A20 line


The A20, or addressing line 20, is one of the electrical lines that make up the system bus of an x86-based computer system. The A20 line in particular is used to transmit the 21st bit on the address bus.
A microprocessor typically has a number of addressing lines equal to the base-two logarithm of its physical addressing space. For example, a processor with 4 GB of byte-addressable physical space requires 32 lines, which are named A0 through A31. The lines are named after the zero-based number of the bit in the address that they are transmitting. The least significant bit is first and is therefore numbered bit 0 and signaled on line A0. A20 transmits bit 20 and becomes active once addresses reach 1 MB, or 220.

Overview

The Intel 8086, Intel 8088, and Intel 80186 processors had 20 address lines, numbered A0 to A19; with these, the processor can access 220 bytes, or 1 MB. Internal address registers of such processors only had 16 bits. To access a 20-bit address space, an external memory reference was made up of a 16-bit offset address added to a 16-bit segment number, shifted 4 bits so as to produce a 20-bit physical address. The resulting address is equal to segment × 16 + offset. There are many combinations of segment and offset that produce the same 20-bit physical address. Therefore, there were various ways to address the same byte in memory. For example, here are four of the 4096 different segment:offset combinations, all referencing the byte whose physical address is 0x000FFFFF :
Referenced the last way, an increase of one in the offset yields F800:8000, which is a proper address for the processor, but since it translates to the physical address 0x00100000, the processor would need another address line for actual access to that byte. Since there is no such line on the 8086 line of processors, the 21st bit above, while set, gets dropped, causing the address F800:8000 to "wrap around" and to actually point to the physical address 0x00000000.
When IBM designed the IBM PC AT machine, it decided to use the new higher-performance Intel 80286 microprocessor. The 80286 could address up to 16 MB of system memory in protected mode. However, the CPU was supposed to emulate an 8086's behavior in real mode, its startup mode, so that it could run operating systems and programs that were not written for protected mode. The 80286 did not force the A20 line to zero in real mode, however. Therefore, the combination F800:8000 would no longer point to the physical address 0x00000000, but to the correct address 0x00100000. As a result, programs relying on the address wrap around would no longer work. To remain compatible with such programs, IBM decided to correct the problem on the motherboard.
That was accomplished by inserting a logic gate on the A20 line between the processor and system bus, which got named Gate-A20. Gate-A20 can be enabled or disabled by software to allow or prevent the address bus from receiving a signal from A20. It is set to non-passing for the execution of older programs that rely on the wrap-around. At boot time, the BIOS first enables Gate-A20 when it counts and tests all of the system memory, and then disables it before transferring control to the operating system.
Originally, the logic gate was a gate connected to the Intel 8042 keyboard controller. Controlling it was a relatively slow process. Other methods have since been added to allow more efficient multitasking of programs that require this wrap-around with programs that access all of the system memory. There are multiple methods to control the A20 line.
Disconnecting A20 would not wrap all memory accesses above 1 MB, just those in the 1–2 MB, 3–4 MB, 5–6 MB, etc. ranges. Real-mode software cared only about the area slightly above 1 MB, so the Gate-A20 line was enough.
Enabling the Gate-A20 line is one of the first steps that a protected-mode x86 operating system does in the bootup process, often before control has been passed to the kernel from the bootstrap.
Virtual 8086 mode, introduced with the Intel 80386, allows the A20 wrap-around to be simulated by using the virtual memory facilities of the processor; physical memory may be mapped to multiple virtual addresses. Thus, the memory mapped at the first megabyte of virtual memory may be mapped again in the second megabyte of virtual memory. The operating system may intercept changes to Gate A20 and make corresponding changes to the virtual-memory address space, which also makes irrelevant the efficiency of Gate-A20 line toggling.

A20 gate

Controlling the A20 line was an important feature at one stage in the growth of the IBM PC architecture, as it added access to an additional 65,520 bytes of memory in real mode, without significant software changes.
In what was arguably a "hack", the A20 gate was originally part of the keyboard controller on the motherboard, which could open or close it depending on what behavior was desired.
The A20 gate is still present on many modern PCs, and the gate is initially closed right after boot. Modern protected-mode operating systems typically open the A20 gate early during the boot process and never close it again. Such operating systems do not have the compatibility reasons for keeping it closed, and they gain access to the full range of physical addresses available by opening it.
The Intel 80486 and Pentium added a special pin named A20M#, which when asserted low forces bit 20 of the physical address to be zero for all on-chip cache- or external-memory accesses. It was necessary, since the 80486 introduced an on-chip cache and so masking this bit in external logic was no longer possible. Software still needs to manipulate the gate and must still deal with external peripherals for that.
Support for the A20 gate was changed in the Nehalem microarchitecture. Rather than the CPU having a dedicated A20M# pin that receives the signal whether or not to mask the A20 bit, it has been virtualized so that the information is sent from the peripheral hardware to the CPU using special bus cycles. From a software point of view, the mechanism works exactly as before, and an operating system must still program external hardware to disable the A20 masking.
Intel no longer supports the A20 gate, starting with Haswell. Page 271 of the Intel System Programmers Manual Vol. 3A from June 2013 states: "The functionality of A20M# is used primarily by older operating systems and not used by modern operating systems. On newer Intel 64 processors, A20M# may be absent."

A20 handler

The A20 handler is IBM PC memory manager software that controls access to the high memory area. Extended-memory managers usually provide this functionality. A20 handlers are named after the 21st address line of the microprocessor, the A20 line.
In DOS, HMA managers such as HIMEM.SYS have the "extra task" of managing A20. HIMEM.SYS provided an API for opening/closing A20. DOS itself could use the area for some of its storage needs, thereby freeing up more conventional memory for programs. That functionality was enabled by the DOS=HIGH or HIDOS=ON directives in the CONFIG.SYS configuration file.

Affected programs

Since 1980, the address wrap was internally used by 86-DOS and MS-DOS to implement the CP/M-style CALL 5 entry point in the Program Segment Prefix . This was, in particular, utilized by programs machine-translated from CP/M-80 through assembly language translators like Seattle Computer Products' TRANS86. The CALL 5 handler this entry point refers to resides at physical address 0x000000C0. However, by the design of CP/M-80, the 8080/Z80 16-bit target address stored at offset 6 in the zero page could deliberately also be interpreted as segment memory size. In order to emulate this in DOS with its 8086 segment:offset addressing scheme, the far call entry point's 16-bit offset had to match this segment size, which is stored at offset 6 in the PSP, overlapping parts of the CALL 5. The only way to reconcile these requirements was to choose a segment value that, when added to 0xFEF0, results in an address of 0x001000C0, which, on an 8086, wraps around to 0x000000C0.
A20 had to be disabled for the wraparound to occur and DOS programs using this interface to work. Newer DOS versions which can relocate parts of themselves into the HMA, typically craft a copy of the entry point at FFFF:00D0 in the HMA, so that the interface can work without regard to the state of A20.
One program known to use the CALL 5 interface is the DOS version of the Small-C compiler. Also, the SPELL utility in Microsoft's Word 3.0 is one of the programs depending on the CALL 5 interface to be set up correspondingly. Sun Microsystems' PC-NFS requires the CALL 5 fix-up as well.
Also, to save program space, a trick was used by some BIOS and DOS programmers, for example, to have one segment that has access to program data, as well as the I/O data that was located in the first memory segment.
This trick works for as long as the code isn't executed in low memory, the first 64 KB of RAM, a condition that was always true in older DOS versions without load-high capabilities.
With the DOS kernel relocated into higher memory areas, low memory increasingly became available for programs, causing those depending on the wraparound to fail. The executable loaders in newer versions of DOS attempt to detect some common types of affected programs and either patch them on-the-fly to function also in low memory or load them above the first 64 KB before passing execution on to them. For programs, which are not detected automatically, LOADFIX or MEMMAX -L can be used to force programs to be loaded above the first 64 KB.
The trick was utilized by IBM/Microsoft Pascal itself as well as by programs compiled with it, including Microsoft's MASM. Other commonly used development utilities using this were executable compressors like Realia's Spacemaker and Microsoft's EXEPACK as well as the equivalent /E option in Microsoft's LINK 3.02 and higher. Programs processed with EXEPACK would display a "Packed file is corrupt" error message.
Various third-party utilities exist to modify compressed executables either replacing the problematic uncompression routine or attempting to expand and restore the original file.