How does the ‘real mode flat model’ work?

Question

I am interested in old Intel processors. I'll try to be as concise as possible.

I have been studying both Jeff Duntemann's Assembly Language Step-by-Step - Chapter 4 and Modes of Memory Addressing on x86 from Bristol Community College's CIS-77 course - which explictly say about real mode flat model and the difference between this model and real mode segmented model.

I just want to know if - in real mode flat model the 64KB limits also the OS or the os just reserves 64KB for the program? Now I know that in real mode flat model you don't have to mess around with segments because the segment registers remain the same and you only have to worry about the offset

1. In real mode flat model, does the CPU and operating system see all 1MB but only programs see 64KB or the operating system and the CPU is also limited to 64KB (16-bit)?

2. Do 16-bit processors run in both real mode flat model and real mode segmented model but 32-bit processors run in protected mode flat model?

3. What are the examples (Windows) of real mode flat model, real mode segmented model and protected mode flat model (like MS-DOS, Windows 3.1 to Windows XP - or higher)? (Can't find it in the Internet)

Answer 1

I’m assuming you’re asking about x86 processors, not the older 8-bit CPUs.

1. Real mode is always segmented, and everything (CPU, operating system, programs, even peripherals on the CPU bus) has access to all the system’s address space up to just over 1 MiB (1 MiB strictly before the 286). You can write programs without paying attention to segments, and you’ll be limited to 64 KiB per segment register, but nothing enforces that; this is the memory model used by default for COM programs under DOS (with the additional constraint that all segment registers point to the same segment). There’s no practical distinction between “real mode flat model” and “real mode segmented model”.

   In “real mode flat model” as described in the document you’re referring to, all the above remains true: there is no limitation imposed by the architecture. Programs are written voluntarily without ever touching the segment registers, which means that they only have direct access to 64 KiB per segment register; as mentioned above, this is the model used by default in COM programs under DOS, and facilitates porting programs from 8-bit platforms. Programs always end up accessing other segments, indirectly, through operating system or BIOS services; for example when reading or writing files, or reading from the keyboard buffer, or writing to the screen. And nothing prevents programs from changing their segment registers and accessing other segments directly. When the operating system (DOS) starts a program, it gives it its own segments, separate from the operating system’s memory areas (and in systems with small amounts of memory, the program might not really have access to the full 64 KiB).

   Basically, the architecture doesn’t impose any limitations on the use of segments (that’s why protected mode was added, later).

2. The 8086/8088 and 80186/80188 CPUs only run in real, segmented mode. (Even if your program ignores segments, the CPU doesn’t.)

   The 80286 introduced 16-bit protected mode with a 24-bit address space. This protected mode is segmented; segment registers now point to segment descriptions, which specify the location of each segment in memory, and their length, access permissions etc. Segments are necessary to take advantage of the protection provided by protected mode.

   The 80386 introduced 32-bit protected mode, which also relies on segments; however the availability of 32-bit addresses means that segments can be configured to give access to all 4 GiB of address space, so programs can again be written without taking much account of segments (and this is what most people refer to as “flat mode”). The 386 also introduced paging, which allows memory protection to be implemented without relying on segments (once the segments are configured appropriately).

   Newer CPUs support all the modes available in older CPUs.

3. Up to Windows 3.0 included, Windows could run in real mode, using segments. Windows/386, Windows 3.0 and later could also run in protected mode, on 286s (Windows 3.0) and 386s. Windows NT, Windows 95 and all subsequent versions of Windows run in 32-bit protected mode. MS-DOS always ran in real mode; there were several DOS extenders which allowed programs to run in protected mode on top of DOS, such as DOS/4GW.

   16- and 32-bit x86 protected mode still relies heavily on segments; like real mode, protected mode is always segmented. It’s possible to give the appearance of a flat mode in 32-bit protected mode, with segments set to cover all the address space, and that’s how most 32-bit operating systems work; instead of using segments to separate programs from each other, they rely on paging.

There is an “unreal flat mode” on 386s and later, which allows programs to run in real mode while accessing all 4 GiB, but it’s difficult to use and never gained much popularity. Sometimes this is referred to as “flat real mode”, when running 16-bit code with 32-bit registers and 4 GiB segment limits.

Most other 386-based operating systems run in 32-bit protected mode, generally with a flat model where segments cover all of the address space.

The different ways of using segments in real mode were given names, and most compilers offered the choice of different memory models:

• tiny mode, with the same segment used for code, data and the stack (so 64 KiB for everything);
• small mode, with one code segment, and one segment shared for data and the stack (so 64 KiB of code, and 64 KiB of data);
• medium mode, with multiple code segments, and one segment shared for data and the stack (so more than 64 KiB of code, and 64 KiB of data);
• compact mode, with a single code segment, and multiple data segments (so 64 KiB of code, and more than 64 KiB of data);
• large mode, with multiple code and data segments (so more than 64 KiB of code and more than 64 KiB of data);
• huge mode, same as large mode but with the ability to manipulate single objects larger than 64 KiB.

Answer 2

1. All software sees the full 20bit address space, since there is no distinction between kernel and user land.

2. Flat mode is simply all segment descriptors set to maximum length and base offset 0. This is not feasible in 16 bit protected mode (80286), but most 80386 operating systems will use this mode in protected mode. There are other alternatives supported by the hardware, however

3. MS-DOS in real mode was always segmented. There are DOS extenders that allow flat modes beyond 16 bit addressing. 16 bit windows is designed in such way it is mostly transparent whether the cpu is running in real or protected mode.

Answer 3

There's one other legacy mode. On a 286, Windows 3.1 (possibly Windows 3.0), has a 286 protected mode, where GlobalAlloc() and GlobalLock() are used to allocate and lock a large amount of memory returning a far pointer where the upper half is a selector value. This allocates and locks a set of 64KB blocks of memory, and incrementing a selector (segment register) by 8 (the 8 is defined with _AHINCR with Microsoft compiler) advances to the next 64KB block of memory (a selector can not be set to other than the start of 64KB block, increasing the overhead of data or records that span 64KB blocks). Early versions of OS/2 and some other OS can run in 286 protected mode:

https://en.wikipedia.org/wiki/Intel_80286#OS_support

Answer 4

I've not heard the phrase "real mode flat model", but it may be referring to the fact that real mode allows a memory manager to manage memory as a linear sequence of 65,536 16-byte paragraphs (of which 40,960 would be within the first 640K). A memory manager which rounds all allocations to multiples of 16 bytes can avoid the need for any kind of 32-bit computation or address-normalization logic by simply having every allocation start at a fixed offset (perhaps 4) of some segment. Indeed, if the memory manager knows what range of paragraphs it has to work with, and if client code specifies the number of paragraphs (rather than bytes) it needs for each allocation , the memory manager won't need to know or care how big the paragraphs are.

Unfortunately, the people who designed later Intel processors failed to realize the advantages and power of this approach. If segment registers on the 80386 had been implemented as e.g. a 4-bit selector and a 28-bit scaled offset, it would have been practical for frameworks like Java or .NET to use 32-bit object references to access more than a terabyte of storage (e.g. use one of the 16 segment descriptors for a "huge object" segment holding up to a terabyte worth of objects whose sizes would be rounded up to the next multiple of 4096 bytes, one for a "large object" segment holding 64GiB of objects with sizes rounded to 256, and one holding 4GiB of "medium" objects rounded to 16 bytes, and maybe one for 1GiB worth of "tiny" objects whose size would round to 4 bytes; one could have all those areas and still have 12 segments left over for whatever purpose might be needed.

Answer 5

"Flat model" is simply unsegmented linear address space (3.2.1).
https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf
This is processor's definition of flat model. And OS defines flat memory model, "tiny" memory model, as well.
(in my own experience, I never felt flatness in "tiny" model")

If I stand processor's definition - when you particularly say Real-mode flat model, I guess that's unprotected mode (= real mode) with linear widen address space (up to 4GB). Once you entered protected mode, set GDT up, then you return to real mode. That's it.

1. It depends. Today I answer 'NO' for 1st of the questions. Because one segment's extendable up to 32bit (4GB) in 386. If "rela mode flat model" means "tiny"-memory model and it's only on 16bit-processor, this answer was YES.
2. Yes. A x86 16bit processor has linear address space up to 1MB (if A20line is asserted). But an address area where's accessible w/o segmentation is only 64KB because almost such processors don't support a segment descriptor. Note that 286, 16bit processor, can enter to protected mode.
3. If I stand Intel's definition of "flat" model, a samples is memtest86+ https://www.memtest.org/ . freedos may be for real mode segmented model. PC-UNIXs are protected mode segment model. protected mode flat model's sample is ... some RTOS? I don't know.

memtest86+ head.s:

first 4 entries of GDT are 4GB-wide:

GDT, Global Descriptor Table is the table of segment descriptor, {BASE, PAGES, MODE}. The entry's pointed by segment register, and now segment register is NOT a apart of effective address.

gdt:
    .quad 0x0000000000000000    /* NULL descriptor */
    .quad 0x0000000000000000    /* not used */
    .quad 0x00cf9b000000ffff    /* 0x10 main 4gb code at 0x000000 */
    .quad 0x00cf93000000ffff    /* 0x18 main 4gb data at 0x000000 */

returning to real mode. and all segment registers are unified.

    .code16
    /* Disable Paging and protected mode */
    /* clear the PG & PE bits of CR0 */
    movl    %cr0,%eax
    andl    $~((1 << 31)|(1<<0)),%eax
    movl    %eax,%cr0

    /* make intersegment jmp to flush the processor pipeline
     * and reload %cs:%eip (to clear upper 16 bits of %eip).
     */
    ljmp    *(realptr - RSTART)
real:
    /* we are in real mode now
     * set up the real mode segment registers : %ds, %ss, %es, %gs, %fs
     */
    movw    %cs, %ax
    movw    %ax, %ds
    movw    %ax, %es
    movw    %ax, %fs
    movw    %ax, %gs
    movw    %ax, %ss