How EMM386 Remaps ROM to UMB in MS-DOS 6.22

In MS-DOS 6.22, the memory manager EMM386.EXE frees conventional memory by converting unused addresses in the Upper Memory Area (UMA) into Upper Memory Blocks (UMBs). It achieves this by utilizing the hardware paging capabilities and Virtual 8086 mode of the Intel 80386 processor (and newer), taking physical extended memory (XMS) and mapping it to unused or reclaimed ROM address spaces between 640 KB and 1024 KB. This process allows drivers and terminate-and-stay-resident (TSR) programs to load into upper memory, leaving more of the critical 640 KB conventional memory free for applications.

The Upper Memory Area and the 640 KB Barrier

Under the real-mode architecture of MS-DOS, the CPU can directly address up to 1 MB (1024 KB) of total memory:

  • 0 KB to 640 KB (00000h–9FFFFh): Conventional memory reserved for the DOS kernel, device drivers, TSRs, and user applications.
  • 640 KB to 1024 KB (A0000h–FFFFFh): The Upper Memory Area (UMA), reserved by the IBM PC architecture for hardware devices, including video RAM, video BIOS, adapter card option ROMs (such as SCSI or network cards), and the motherboard System BIOS.

Because not every expansion card occupies its full allocated range, the UMA often contains unmapped address space or "holes." Additionally, certain ROM areas are only used during system boot and sit idle during normal DOS operations.

Virtual 8086 Mode and Paging

MS-DOS is a 16-bit real-mode operating system, meaning it lacks native support for memory protection and translation. However, EMM386.EXE overcomes this limitation by switching the CPU into Virtual 8086 (V86) mode.

In V86 mode:

  1. The CPU emulates an 8086 environment, allowing MS-DOS and DOS programs to run unchanged.
  2. The processor's Memory Management Unit (MMU) and paging mechanism are activated.
  3. The MMU operates with 4 KB memory pages, translating linear (logical) addresses seen by DOS into arbitrary physical addresses in RAM.

The Remapping Process Step-by-Step

When loaded in CONFIG.SYS alongside HIMEM.SYS, EMM386.EXE takes control of the memory map through a defined sequence:

  1. Memory Scanning: During initialization, EMM386.EXE scans the memory space between C0000h and FFFFFh in 4 KB increments to identify active ROM signatures, hardware I/O addresses, and video buffers.
  2. Identifying Reclaimable Spaces:
    • Unused Holes: Any segment with no active hardware mapped to it is marked as available.
    • Discardable ROMs: Certain system BIOS regions (such as parts of the F000h segment) or setup utilities that are only executed at POST are identified as candidates for reclamation.
  3. Allocating Extended Memory: EMM386.EXE requests blocks of extended memory (physical RAM above the 1 MB mark) from HIMEM.SYS.
  4. Page Table Manipulation: The driver modifies the 80386 page tables:
    • The linear addresses of the identified UMA holes (or unused ROM regions) are linked to the physical addresses of the extended RAM located above 1024 KB.
  5. Creating UMBs: The newly mapped regions are exposed to MS-DOS as Upper Memory Blocks. The MS-DOS memory management chain incorporates these segments into its allocation pool.

ROM Shadowing vs. ROM Reclamation

Depending on the configuration switches used in CONFIG.SYS, EMM386.EXE handles ROM spaces in two distinct ways:

  • ROM Shadowing: Read-Only Memory chips are significantly slower than system RAM. EMM386.EXE can copy the code from a physical ROM (such as the Video BIOS at C0000h) into fast extended RAM, mark the page table as write-protected, and remap the linear address to point to that RAM. This improves system execution speed without relocating the address.
  • ROM Overwriting/Reclaiming: When instructed via specific switches (such as ROM or explicit range inclusion I=), EMM386.EXE ignores the physical ROM residing at a particular linear address and completely remaps that address space to physical RAM for use as general-purpose UMB space.

Key EMM386 Switches for UMB Mapping

The behavior of address remapping is controlled directly through CONFIG.SYS:

  • DEVICE=C:\DOS\EMM386.EXE NOEMS: Disables Expanded Memory (EMS) page frames (which typically consume 64 KB at E0000h), freeing that entire region to be remapped as UMB space.
  • DEVICE=C:\DOS\EMM386.EXE RAM: Enables both EMS emulation and UMB provision, reserving a 64 KB frame while remapping remaining gaps to UMBs.
  • I=range (Include): Forces EMM386.EXE to treat a specified address range (e.g., I=E000-EFFF) as free space, overriding hardware detection to map extended RAM into that range.
  • ROM=range: Allocates shadow RAM space for specified ROM areas to speed up access routines.

Once remapped, MS-DOS commands like DEVICEHIGH in CONFIG.SYS and LOADHIGH (or LH) in AUTOEXEC.BAT place resident software directly into these relocated memory pages, leaving conventional memory open for demanding applications.