MS-DOS 6.22 EMS and XMS Memory Transfer Explained

This article explains the technical mechanisms used by MS-DOS 6.22 to execute memory transfers between Expanded Memory (EMS) and Extended Memory (XMS). In MS-DOS 6.22, physical expanded memory hardware is superseded by software emulation, making memory transfers an orchestration between HIMEM.SYS, EMM386.EXE, CPU paging hardware, and the Expanded Memory Specification (EMS 4.0). The following sections detail the memory architecture, driver interaction, and low-level CPU operations involved in shuttling data between these distinct memory pools.

The Underlying Architecture: XMS vs. EMS

MS-DOS natively operates within a 1 MB real-mode address space. To overcome this limitation:

  • Extended Memory (XMS): Represents linear, contiguous physical memory above the 1 MB boundary (handled on 80286+ processors). In MS-DOS 6.22, it is managed primarily by HIMEM.SYS according to the eXtended Memory Specification. Access requires switching the processor to Protected Mode or using specialized BIOS/chipset routines.
  • Expanded Memory (EMS): Represents bank-switched memory accessed through a 64 KB physical window (the "Page Frame," split into four 16 KB pages) residing in the Upper Memory Area (UMA) between 640 KB and 1 MB. Managed under the Lotus-Intel-Microsoft (LIM) EMS 4.0 standard.

In MS-DOS 6.22, EMS is not a separate physical hardware pool; it is simulated out of the XMS pool by EMM386.EXE.

The Role of EMM386.EXE as a Mediator

Because both pools reside in the same physical RAM chips, EMM386.EXE serves as a translation layer. When MS-DOS loads HIMEM.SYS followed by EMM386.EXE, EMM386.EXE requests a large block of Extended Memory from HIMEM.SYS using standard XMS Allocation services (Function 09h via INT 2Fh).

EMM386.EXE takes control of the CPU’s Protected Mode capabilities and switches the system into Virtual 8086 (V86) Mode. In this state, real-mode DOS programs can still run, but the CPU’s hardware Paging Unit (managed via Control Register 0 and Control Register 3) is activated. Physical extended memory pages are dynamically mapped into the 64 KB EMS page frame in the UMA.

Execution of Memory Transfers: INT 67h Function 57h

To transfer data between expanded and extended memory without manually remapping the page frame, applications use EMS 4.0 Function 57h (Move/Exchange Memory Region) via Interrupt 67h.

The calling program populates an EMS Copy Data Structure containing:

  1. Region length in bytes.
  2. Source memory type (Conventional, Expanded, or Extended).
  3. Source handle and offset.
  4. Destination memory type.
  5. Destination handle and offset.

When this interrupt is triggered, EMM386.EXE intercepts the call and executes the transfer via one of two primary pathways depending on the source and destination definitions:

1. Page Table Remapping (Zero-Copy Transfer)

If an application requests that Extended Memory backed by EMM386 be accessed as Expanded Memory, physical copying is bypassed. EMM386.EXE updates the 80386/80486 Page Table Entries (PTEs).

It writes the physical address of the requested XMS page directly into the Page Table corresponding to the linear address of the EMS Page Frame (e.g., segment E000h). The Translation Lookaside Buffer (TLB) is flushed by reloading the CR3 register. The data remains stationary in physical RAM; only the processor's translation layer changes.

2. Direct Physical Block Moves (Copying Data Between Pools)

When moving data between an external XMS handle (managed by HIMEM.SYS) and an EMS handle (managed by EMM386.EXE), a physical memory copy must occur:

  1. Address Resolution: EMM386.EXE resolves the EMS handle and logical page into a 32-bit linear physical address. It then queries HIMEM.SYS to resolve the linear base address of the XMS handle.
  2. Privilege Transition: Since the processor is running in V86 mode, direct access to memory above 1 MB requires supervisor-level instructions. EMM386.EXE executes a transition from V86 mode to Ring 0 Protected Mode.
  3. Execution of the Move: The processor sets up linear descriptors pointing to both source and destination blocks. Using doubleword-aligned string instructions (REP MOVSD on 80386/80486 processors), data is streamed directly across the system bus between the physical address ranges.
  4. Return to V86 Mode: Interrupts are re-enabled, the processor state is restored to Virtual 8086 mode, and control returns to MS-DOS with a success code in the AH register.

Dynamic Pool Sharing (VCPI Standard)

Under MS-DOS 6.22, memory is dynamically converted between XMS and EMS using the Virtual Control Program Interface (VCPI). When an application needs XMS, HIMEM.SYS allocates standard 4 KB pages. When an EMS application requests memory, EMM386.EXE dynamically calls HIMEM.SYS service INT 2Fh, AX=4309h to allocate extended memory blocks, maps them via 80386 paging structures, and assigns them an EMS handle.

When EMS handles are deallocated, EMM386.EXE frees the underlying extended memory back to the common HIMEM.SYS pool, maintaining a singular unified pool where transfer is merely a reallocation of ownership pointers and paging flags.