I would never predict that a simple factual correction would escalate into further pointless arguments! Anyway, even though bzt has said that the conversation is over, I'll try to clear some things up and provide a little more context, given that I have experimented a little bit with BIOS development (didn't get very far though).
bzt wrote:And that's true. Look it's plain simple: BIOS uses real mode. You simply cannot address more than 1M memory in real mode. 0 to 10FFF0 (1M+64k-16) to be exact. In that address space, there's only that much ROM, no more.
Normally, you indeed can access slightly more than 1M in Real Mode, that is 0x00000000-0x0010FFF0 (which is correct if the A20 is enabled, which it should be anyway). Except that, as nullplan said, the reset CS.Base is 0xFFFF0000, so by using the CS segment you can access from 0xFFFF0000 to 0xFFFFFFFF and the reset address is 0xFFFFFFF0. I know this is somewhat confusing given that CS.Base can not be set without loading another GDT, which is not the normal way of setting segments in Real Mode. However, this is done automatically on reset by the processor circuitry, just like setting IP=0xFFF0, and no instruction is needed for either. If you reload the CS segment without loading another GDT first, it will be switched to regular Real Mode operation, else it will be switched to the regular or irregular operation that you specified in the GDT. This is also the reason Unreal Mode works.
Depending on the chipset, there are several megabytes at the end of the 32-bit address space reserved for the ROM. For example, in the Intel 945 Mobile family of chipsets (which the aforementioned ThinkPad T60 uses), there are 2M reserved for the ROM, that is 0xFFE00000-0xFFFFFFFF. See also
the datasheet, section 9.3, figure 13, page 327. Interestingly, the same range is reserved for the ROM in the Intel 440FX chipset, which was released in 1995, and I imagine that BIOSes were much smaller in 1995 than in 2006. But apart from the "real" ROM mapping at the end of the address space ("real" is not to be confused with Real Mode), old chipsets can also map the respective regions of the BIOS to 0x000C0000-0x000FFFFF. However, in newer chipsets that indeed are designed for UEFI, there might not be any ROM mapped to any subregion of 0x000C0000-0x000FFFFF and BIOS "shadowing" is necessary in order to maintain compatibility with legacy requirements.
At the reset vector, the BIOS usually invalidates the caches through the WBINVD instruction, then it jumps to a predetermined at build time address inside the last 64k of the address space. Typically, after the jump, there is some basic processor initialization stuff done, and then a 32-bit GDT is loaded, again from some address inside the upper 64k. All such accesses and references in the upper 64k are done using the CS segment with a regular 16-bit offset. There is however an interesting quirk when loading the GDT. Since the 16-bit LGDT instruction only understands 24-bit addresses (by setting the higher 8 bits to zeroes), a 0x66 operand prefix is required so the GDT base address actually is 0xFFFFxxxx and not 0x00FFxxxx.
Now with the GDT loaded, a switch to protected mode is done in the same way as we do in our bootloaders. The segments are subsequently initialized, and the BIOS goes on to initialize some more things before starting the chipset initialization. Note that there is no main memory accessible before the chipset has been properly initialized, so there isn't much that can be done at this point (though it's standard practice to temporarily use the CPU caches as memory).
During chipset initialization, which is done by tweaking the PCI registers of chipset, the DRAM is initialized. After that, it's typical to "shadow" the BIOS to 0x000C0000-0x000FFFFF, with the reasons being that DRAM access is a lot faster than flash access and that some chipsets don't even support mapping the legacy BIOS range to the actual ROM. For chipsets that support this mapping, the "shadowing" is achieved through using the "Programmable Attribute Map" PCI registers, 13 of them in total, each controlling a different subrange of 0x000C0000-0x000FFFFF. For example, the 0x000F0000-0x000FFFFF address range is controlled through PAM0. The Intel 440FX datasheet also has an example how to "shadow" the BIOS to main memory with the PAMs. However, irrespectively from whether the BIOS is or isn't shadowed, these PAMs still need to be assigned at this point, unless there is evidence that both RE and WE have a defined default state, which I'm not aware of, and that this default state is indeed what we want.
After this point, the BIOS can happily use the main memory and initialize the system further. Finally, when it needs to interact with the bootloader, it switches to Real Mode as this is the mode that the bootloader expects. After such interactions, it returns to Protected Mode so it can execute other parts of itself, presumably implemented with 32-bit code.
Note that I have mostly looked at 32-bit Intel chipsets. Unfortunately, the introduction of 64-bit Intel chipsets (specifically the Intel 965 series) "coincided" with the introduction of the Intel Management Engine (then called the Manageability Engine if you want to search for it in the Intel 965 datasheet). The Intel Management Engine makes it practically impossible to write a custom (non-approved) BIOS without any proprietary blobs and, even then, it might not always work (Coreboot does, in fact, include proprietary blobs and still doesn't work everywhere). Thus, my interest in Intel 965 and later is very minimal.
Irrespectively from all of this, a BIOS can in fact be smaller than UEFI and it usually is. But I still wouldn't say that the BIOS is necessarily better. In my opinion, both are awful, but that's what we have/had on most personal computers, servers, etc. Thus, unless we are going to design a BIOS/UEFI/Coreboot replacement and successfully install it on at least 5% of all existing x86 computers as well as make it one of the de-facto standards, I too think that further discussion in this topic is pointless, unless it consists of actually informative posts (like this one, I hope) and not flaming (like most other posts in this topic).