[bytefire]

this is interesting! i am not aware of how this logic is implemented, i.e. the logic of initial state where 12 most significant bits but thanks for enlightening

[hyperman1]

I looked it up:

https://software.intel.com/en-us/articles/intel-sdm#nine-vol...

Get volume 3A and read chapter 9.1.4 at pg 315. The text is quite readable:

  The address FFFFFFF0H is beyond the 1-MByte addressable range of the processor while in real-address mode. The
  processor is initialized to this starting address as follows. The CS register has two parts: the visible segment
  selector part and the hidden base address part. In real-address mode, the base address is normally formed by
  shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address. However, during a
  hardware reset, the segment selector in the CS register is loaded with F000H and the base address is loaded with
  FFFF0000H. The starting address is thus formed by adding the base address to the value in the EIP register (that
  is, FFFF0000 + FFF0H = FFFFFFF0H).

Any change to CS reverts this to normal real mode operation. So near jumps are OK, far jumps or interrupts are not.

[Stratoscope]

Speaking of readability, here's a readable copy of that quote:

> The address FFFFFFF0H is beyond the 1-MByte addressable range of the processor while in real-address mode. The processor is initialized to this starting address as follows. The CS register has two parts: the visible segment selector part and the hidden base address part. In real-address mode, the base address is normally formed by shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address. However, during a hardware reset, the segment selector in the CS register is loaded with F000H and the base address is loaded with FFFF0000H. The starting address is thus formed by adding the base address to the value in the EIP register (that is, FFFF0000 + FFF0H = FFFFFFF0H).

(Don't use indentation to format a block quote, only use it for code listings.)

[monocasa]

Practically, nearly all code I've seen pretty much immediately far jumps into 32-bit protected mode.