About processor first instruction fetched and executed, lots of blogs and articles already talked about, I also got interesting about this topic.

As we know, after hardware reset or cold boot, intel CPU will be start operating in real mode, address ability limited to 1MB. But intel x64/ia32 architechtures software developer manual volume 3 chapter 9 shows that the first instruction is located at physical address 0xFFFFFFF0. Why CPU can access such a high 4G-top memory when in real mode?

Address Translation

Intel x86 architecture CPU translate a logical address into a linear address to arrive at a physical address. as we can see: base address + offset = linear address.

In real-address mode, It shifts the segment selector left by 4 bits to form a 20-bit base address.

Every segment register has a “visible” part and a “hidden” part. CPU will auto load hidden part which including the base address.

Processor Built-in Self-Test(BIST)

After system power-up, reset or INIT, processor BIST and registers set as below default value:

check CS:IP for where to fetch instructions, CS selector is 0xF000, EIP is 0xFFF0, why the first instruction is not at address 0xFFFF0 ?

First Instruction

so we should look for the first instruction by CS hidden Base address and EIP, for IA32 processor:
0xFFFF0000+0xFFF0 = 0xFFFFFFF0
after CS register is loaded with a new value, processor start to follow real address mode address translation rule.

Refer

Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3 Chapter 9
Lightseed CSDN blog about first instruction
BIOS engineer blogspot about first instruciton
programmer-club discussion