AOH :: TECHREF.TXT
HUGE file of DOS tech info from IBM
|
CHAPTER 1.
DOS TECHNICAL INFORMATION
Programming Technical Reference - IBM
Copyright 1988, Dave Williams
SOME HISTORY
Development of MSDOS/PCDOS began in October 1980, when IBM began searching
the market for an operating system for the yet-to-be-introduced IBM PC.
Microsoft had no real operating system to sell, but after some research licensed
Seattle Computer Products' 86-DOS, which had been written by a man named Tim
Paterson for use on the company's line of 8086, S100 bus micros. This was
hurriedly polished up and presented to IBM for evaluation. IBM had originally
intended to use Digital Research's CP/M operating system, which was the industry
standard at the time. Folklore reports everything from obscure legal
entanglements to outright snubbing of the IBM representatives by Digital,
irregardless, IBM found itself left with Microsoft's offering of "Microsoft Disk
Operating System 1.0". An agreement was reached between the two, and "IBM PC-DOS
1.0" was ready for the introduction of the IBM PC in October 1981. IBM subjected
the operating system to an extensive quality-assurance program, found well over
300 bugs, and decided to rewrite the programs. This is why PC-DOS is copyrighted
by both IBM and Microsoft.
It is sometimes amusing to reflect on the fact that the IBM PC was not
originally intended to run MSDOS. The target operating system at the end of the
development was for a (not yet in existence) 8086 version of CP/M. On the other
hand, when DOS was originally written the IBM PC did not yet exist! Although
PC-DOS was bundled with the computer, Digital Research's CP/M-86 would probably
have been the main operating system for the PC except for two things - Digital
Research wanted $495 for CP/M-86 (considering PC-DOS was essentially free) and
many software developers found it easier to port existing CP/M software to DOS
than to the new version of CP/M.
MSDOS and PC-DOS have been run on more than just the IBM-PC and clones. There
was an expansion board for the Apple ][ that allowed one to run (some) well -
behaved DOS programs. There are expansion boards for the Commodore Amiga 2000,
the Apple MacIntosh II, and the IBM RT PC allowing them to run DOS, and the IBM
3270 PC, which ran DOS on a 68000 microprocessor. The Atari STs can run an
emulator program and boot MSDOS.
Specific Versions of MS/PC-DOS:
DOS version nomenclature: major.minor.minor. The digit to the left of the
decimal point indicates a major DOS version change. 1.0 was the first version.
2.0 added subdirectories, etc. 3.0 added file handles and network support.
The first minor version indicates customization for a major application. For
example, 2.1 for the PCjr, 3.3 for the PS/2s. The second minor version does not
seem to have any particular meaning.
The main versions of DOS are:
PC-DOS 1.0 October 1981 original release
PC-DOS 1.1 June 1982 bugfix, double sided drive support
MS-DOS 1.25 June 1982 for early compatibles
PC-DOS 2.0 March 1983 for PC/XT, many UNIX-like functions
PC-DOS 2.1 October 1983 for PCjr, bugfixes for 2.0
MS-DOS 2.11 October 1983 compatible equivalent to 2.1
PC-DOS 3.0 August 1984 for PC/AT, network support
PC-DOS 3.1 November 1984 bugfix for 3.0
MS-DOS 2.25 October 1985 compatible; extended foreign language support
PC-DOS 3.2 July 1986 3.5 inch drive support for Convertible
PC-DOS 3.3 April 1987 for PS/2 series
Some versions of MS-DOS varied from PC-DOS in the availible external commands.
Some OEMs only licensed the basic operating system code (the xxxDOS and xxxBIO
programs, and COMMAND.COM) from Microsoft, and either wrote the rest themselves
or contracted them from outside software houses like Phoenix. Most of the
external programs for DOS 3.x are written in "C" while the 1.x and 2.x utilities
were written in assembly language. Other OEMs required customized versions of
DOS for their specific hardware configurations, such as Sanyo 55x and early
Tandy computers, which were unable to exchange their DOS with the IBM version.
At least two versions of DOS have been modified to be run entirely out of ROM.
The Sharp PC5000 had MSDOS 1.25 in ROM, and the Toshiba 1100 and some Tandy
models have MSDOS 2.11 in ROM.
THE OPERATING SYSTEM HIERARCHY
The Disk Operating System (DOS) and the ROM BIOS serve as an insulating layer
between the application program and the machine, and as a source of services
to the application program.
The system heirarchy may be thought of as a tree, with the lowest level being
the actual hardware. The 8088 or V20 processor sees the computer's address
space as a ladder two bytes wide and one million bytes long. Parts of this
ladder are in ROM, parts in RAM, and parts are not assigned. There are also
256 "ports" that the processor can use to control devices.
The hardware is normally addressed by the ROM BIOS, which will always know
where everything is in its particular system. The chips may usually also be
written to directly, by telling the processor to write to a specific address or
port. This sometimes does not work as the chips may not always be at the same
addresses or have the same functions from machine to machine.
DOS STRUCTURE
DOS consists of four components:
* The boot record
* The ROM BIOS interface (IBMBIO.COM or IO.SYS)
* The DOS program file (IBMDOS.COM or MSDOS.SYS)
* The command processor (COMMAND.COM or aftermarket replacement)
* The Boot Record
The boot record begins on track 0, sector 1, side 0 of every diskette formatted
by the DOS FORMAT command. The boot record is placed on diskettes to produce an
error message if you try to start up the system with a nonsystem diskette in
drive A. For hard disks, the boot record resides on the first sector of the DOS
partition. All media supported by DOS use one sector for the boot record.
* Read Only Memory (ROM) BIOS Interface
The file IBMBIO.COM or IO.SYS is the interface module to the ROM BIOS.
This file provides a low-level interface to the ROM BIOS device routines and
may contain extensions or changes to the system board ROMs. Some compatibles do
not have a ROM BIOS to extend, and load the entire BIOS from disk. (Sanyo 55x,
Viasyn)
* The DOS Program File
The actual DOS program is file IBMDOS.COM or MSDOS.SYS. It provides a high-
level interface for user (application) programs. This program consists of file
management routines, data blocking/deblocking for the disk routines, and a
variety of built-in functions easily accessible by user programs.
When a user program calls these function routines, they accept high-level
information by way of register and control block contents. For device
operations, the functions translate the requirement into one or more calls to
IBMBIO.COM or MSDOS.SYS to complete the request.
* The Command Interpreter
The Command interpreter, COMMAND.COM, consists of these parts:
Resident Portion:
The resident portion resides in memory immediately following IBMDOS.COM and its
data area. This portion contains routines to process interrupts 22h (Terminate
Address), 23h (Ctrl-Break Handler), and 24h (Critical Error Handler), as well as
a routine to reload the transient portion if needed. For DOS 3.x, this portion
also contains a routine to load and execute external commands, such as files
with exensions of COM or EXE.
When a program terminates, a checksum is used to determine if the application
program overlaid the transient portion of COMMAND.COM. If so, the resident
portion will reload the transient portion from the area designated by COMSPEC=
in the DOS environment. If COMMAND.COM cannot be found, the system will halt.
NOTE: DOS 3.3 checks for the presence of a hard disk, and will default to
COMSPEC=C:\. Previous versions default to COMSPEC=A:\. Under some DOS
versions, if COMMAND.COM is not immediately availible for reloading
(i.e., swapping to a floppy with COMMAND.COM on it) DOS may crash.
All standard DOS error handling is done within the resident portion of
COMMAND.COM. This includes displaying error messages and interpreting the
replies of Abort, Retry, Ignore, Fail.
An initialization routine is included in the resident portion and assumes
control during startup. This routine contains the AUTOEXEC.BAT file handler and
determines the segment address where user application programs may be loaded.
The initialization routine is then no longer needed and is overlaid by the first
program COMMAND.COM loads.
NOTE: AUTOEXEC.BAT may be a hidden file.
A transient portion is loaded at the high end of memory. This is the command
processor itself, containing all of the internal command processors and the
batch file processor. For DOS 2.x, this portion also contains a routine to load
and execute external commands, such as files with extensions of COM or EXE.
This portion of COMMAND.COM also produces the DOS prompt (such as "A>"), reads
the command from the standard input device (usually the keyboard or a batch
file), and executes the command. For external commands, it builds a command line
and issues an EXEC function call to load and transfer control to the program.
NOTE: COMMAND.COM may be a hidden file.
NOTE: For Dos 2.x, the transient portion of the command processor contains the
EXEC routine that loads and executes external commands. For DOS 3.x, the
resident portion of the command processor contains the EXEC routine.
DOS Initialization
The system is initialized by a software reset (Ctrl-Alt-Del), a hardware reset
(reset button), or by turning the computer on. The Intel 80x8x series processors
always look for their first instruction at the end of their address space
(0FFFF0h) when powered up or reset. This address contains a jump to the first
instruction for the ROM BIOS.
Built-in ROM programs (Power-On Self-Test, or POST, in the IBM) check machine
status and run inspection programs of various sorts. Some machines set up a
reserved RAM area with bytes indicating installed equipment (AT and PCjr).
The ROM routine looks for a disk drive at A: or an option ROM (usually a hard
disk) at absolute address C:800h. If no floppy drive or option ROM is found, the
BIOS calls int 19h (ROM BASIC if it is an IBM) or displays error message.
If a bootable disk is found, the ROM BIOS loads the first sector of information
from the disk and then jumps into the RAM location holding that code. This code
normally is a routine to load the rest of the code off the disk, or to "boot"
the system.
The following actions occur after a system initialization:
1. The boot record is read into memory and given control.
2. The boot record then checks the root directory to assure that the first
two files are IBMBIO.COM and IBMDOS.COM. These two files must be the
first two files, and they must be in that order (IBMBIO.COM first, with
its sectors in contiguous order).
NOTE: IBMDOS.COM need not be contiguous in version 3.x.
3. The boot record loads IBMBIO.COM into memory.
4. The initialization code in IBMBIO.COM loads IBMDOS.COM, determines
equipment status, resets the disk system, initializes the attached
devices, sets the system parameters and loads any installable device
drivers according to the CONFIG.SYS file in the root directory (if
present), sets the low-numbered interrupt vectors, relocates IBMDOS.COM
downward, and calls the first byte of DOS.
NOTE: CONFIG.SYS may be a hidden file.
5. DOS initializes its internal working tables, initializes the interrupt
vectors for interrupts 20h through 27h, and builds a Program Segment
Prefix for COMMAND.COM at the lowest available segment. For DOS versions
3.10 up, DOS initializes interrupt vectors for interrupts 0Fh through 3Fh.
6. IBMBIO.COM uses the EXEC function call to load and start the top-level
command processor. The default command processor is COMMAND.COM.
CHAPTER 10
Programming Technical Reference - IBM
Copyright 1988, Dave Williams
LOTUS-INTEL-MICROSOFT EXPANDED MEMORY SPECIFICATION
The Expanded Memory Manager ............................................ 10-
History ........................................................ 10-
Page Frames .................................................... 10-
Expanded Memory Services ............................................... 10-
AST/Quadram/Ashton-Tate Enhanced EMM ................................... 10-
Calling the Manager ............................................ 10-
Common EMS Functions (hex calls)
1 (40h) Get Manager Status ............................ 10-
2 (41h) Get Page Frame Segment ........................ 10-
3 (42h) Get Number of Pages ........................... 10-
4 (43h) Get Handle and Allocate Memory ................ 10-
5 (44h) Map Memory .................................... 10-
6 (45h) Release Handle and Memory ..................... 10-
7 (46h) Get EMM Version ............................... 10-
8 (47h) Save Mapping Context .......................... 10-
9 (48h) Restore Mapping Context ....................... 10-
10 (49h) Reserved ...................................... 10-
11 (4Ah) Reserved ...................................... 10-
12 (4Bh) Get Number of EMM Handles ..................... 10-
12 (4Ch) Get Pages Owned By Handle ..................... 10-
14 (4Dh) Get Pages for All Handles ..................... 10-
15 (4Eh) Get Or Set Page Map ........................... 10-
new LIM 4.0 specification:
16 (4Fh) Get/Set Partial Page Map ...................... 10-
17 (50h) Map/Unmap Multiple Pages ...................... 10-
18 (51h) Reallocate Pages .............................. 10-
19 (52h) Handle Attribute Functions .................... 10-
20 (53h) Get Handle Name ............................... 10-
21 (54h) Get Handle Directory .......................... 10-
22 (55h) Alter Page Map & Jump ......................... 10-
23 (56h) Alter Page Map & Call ......................... 10-
24 (57h) Move Memory Region ............................ 10-
25 (58h) Get Mappable Physical Address Array ........... 10-
26 (59h) Get Expanded Memory Hardware .................. 10-
27 (5Ah) Allocate Raw Pages ............................ 10-
28 (5Bh) Get Alternate Map Register Set ................ 10-
29 (5Ch) Prepare Expanded Memory Hardware .............. 10-
30 (5Dh) Enable OS/E Function Set ...................... 10-
31 (5Eh) Unknown ....................................... 10-
32 (5Fh) Unknown ....................................... 10-
33 (60h) Unknown ....................................... 10-
34 (61h) AST Generic Accelerator Card Support .......... 10-
Expanded Memory Manager Error Codes .................................... 10-
THE EXPANDED MEMORY MANAGER
History
The Lotus/Intel/Microsoft Expanded Memory Manager was originally a Lotus and
Intel project and was announced as version 3.0 in the second quarter of 1985
primarily as a means of running larger Lotus worksheets by transparently
paging unused sections to bank-switched memory. Shortly afterward Microsoft
announced support of the standard and version 3.2 was subsequently released
with support for Microsoft Windows. LIM 3.2 supported up to 8 megabytes of
paged memory. The LIM 4.0 supports up to 32 megabytes of paged memory.
AST/QUADRAM/ASHTON-TATE ENHANCED EXPANDED MEMORY SPECIFICATION
The AQA EEMS maintains upward compatibility with the LIM, but is a superset
of functions.
The AQA EEMS permits its pages to be scattered throughout the unused portion
of the machine's address space.
On August 19, 1987, the new version of the Expanded Memory Specification (EMS)
was announced by Lotus, Intel and Microsoft. This new version of the
specification includes many features of the Enhanced Expanded Memory
Specification (EEMS) originally developed by AST Reserach, Quadram and Ashton-
Tate, although the three original sponsoring companies elected not to make the
new specification upward compatible with EEMS. AST Research says that they will
endorse EMS 4.0 without reservation.
The definitive document for the LIM-EMS is Intel part number 300275-004,
August, 1987.
32M 旼컴컴컴컴컴컴커
/� �
� �
/ � �
� �
/ � �
� �
/ � �
� Expanded �
/ � Memory �
1024K 旼컴컴컴컴컴컴커 � �
� / / / / / / � / � �
960K 쳐컴컴컴컴컴컴캑 � �
� Page Frame � � �
� � � �
� 12 16K-Byte � � �
� Physical � � �
� Pages � � �
768K 쳐컴컴컴컴컴컴캑 � Divided into �
� / / / / / / � \ � logical �
640K 쳐컴컴컴컴컴컴캑 � pages �
� � \ � �
� � � �
� � \ � �
� � � �
� 24 16K-Byte � \ � �
� Physical � � �
� Pages* � \ � �
� � � �
� � \ � �
� � � �
� � \ � �
256K 쳐컴컴컴컴컴컴캑 � �
� � \ � �
� / / / / / / � � �
� � \ � �
� / / / / / / � � �
� � \ � �
� / / / / / / � � �
� � \ � �
0 읕컴컴컴컴컴컴켸 � �
\ � �
� �
\ � �
0 읕컴컴컴컴컴컴켸
The page frame is located above the 640k system RAM area, anywhere from
0A000h to 0FFFFh. This area is used by the video adapters, network cards, and
add-on ROMs (as in hard disk controllers). The page frames are mapped around
areas that are in use.
WRITING PROGRAMS THAT USE EXPANDED MEMORY
In order to use expanded memory, applications must perform these steps in the
following order:
1. Determine if EMM is installed.
2. Determine if enough expanded memory pages exist for your application.
(Function 3)
3. Allocate expanded memory pages. (Function 4 or 18)
4. Get the page frame base address. (Function 2)
5. Map in expanded memory pages. (Function 5 or 17)
6. Read/write/execute data in expanded memory, just as if it were conventional
memory.
7. Return expanded memory pages to expanded memory pool before exiting. Function
6 or 18)
Programming Guidelines
The following section contains guidelines for programmers writing applications
that use EMM.
A) Do not put a program's stack in expanded memory.
B) Do not replace interrupt 67h. This is the interrupt vector the EMM uses.
Replacing interrupt 67h could result in disabling the Expanded Memory
Manager.
C) Do not map into conventional memory address space your application doesn't
own. Applications that use the EMM to swap into conventional memory space,
must first allocate this space from the operating system. If the operating
system is not aware that a region of memory it manages is in use, it will
think it is available. This could have disastrous results. EMM should not be
used to "allocate" conventional memory. DOS is the proper manager of
conventional memory space. EMM should only be used to swap data in
conventional memory space previously allocated from DOS.
D) Applications that plan on using data aliasing in expanded memory must check
for the presence of expanded memory hardware. Data aliasing occurs when
mapping one logical page into two or more mappable segments. This makes one
16K-byte expanded memory page appear to be in more than one 16K-byte memory
address space. Data aliasing is legal and sometimes useful for applications.
Software-only expanded memory emulators cannot perform data aliasing. A
simple way to distinguish software emulators from actual expanded memory
hardware is to attempt data aliasing and check the results. For example, map
one logical page into four physical pages. Write to physical page 0. Read
physical pages 1-3 to see if the data is there as well. If the data appears
in all four physical pages, then expanded memory hardware is installed in the
system, and data aliasing is supported.
E) Applications should always return expanded memory pages to the expanded
memory manager upon termination. These pages will be made available for other
applications. If unneeded pages are not returned to the expanded memory
manager, the system could run out of expanded memory pages or expanded
memory handles.
F) Terminate and stay resident programs (TSRs) should always save the state of
the map registers before changing them. Since TSRs may interrupt other
programs which may be using expanded memory, they must not change the state
of the page mapping registers without first saving them. Before exiting, TSRs
must restore the state of the map registers.
The following sections describe the three ways to save and restore the state
of the map registers.
1) Save Page Map and Restore Page Map (Functions 8 and 9). This is the
simplest of the three methods. The EMM saves the map register contents in
its own data structures -- the application does not need to provide extra
storage locations for the mapping context. The last mapping context to be
saved, under a particular handle, will be restored when a call to Restore
Page Map is issued with the same handle. This method is limited to one
mapping context for each handle and saves the context for only LIM
standard 64K-byte page frames.
2) Get/Set Page Map (Function 15). This method requires the application to
allocate space for the storage array. The EMM saves the mapping context in
an array whose address is passed to the EMM. When restoring the mapping
context with this method, an application passes the address of an array
which contains a previously stored mapping context. This method is
preferable if an application needs to do more than one save before a
restore. It provides a mechanism for switching between more than one
mapping context.
3) Get/Set Partial Page Map (Function 16). This method provides a way for
saving a partial mapping context. It should be used when the application
does not need to save the context of all mappable memory. This function
also requires that the storage array be part of the application's data.
G) All functions using pointers to data structures must have those data
structures in memory which will not be mapped out. Functions 22 and 23
(Alter Map & Call and Alter Map & Jump) are the only exceptions.
EMS 4.0 SPECIFICATIONS
Page Frames
The bank switched memory chunks are referred to as "page frames". These frame
consist of four 16K memory blocks mapped into some of the normally unused
system ROM address area, 0C0000-0EFFFF. Each 16K page is independent of the
other and they can map to discrete or overlapping areas of the 8 megabyte
expanded memory address area. Most cards allow selection of addresses to prevent
conflict with other cards, such as hard disk controllers and other expanded
memory boards.
Calling the Manager
Applications programs communicate with the EMM device driver directly via user
interrupt 67h. All communication between the application program and the driver
bypasses DOS completely. To call the driver, register AH is loaded with the
number of the EMM service requested; DX is loaded with the file handle; and
interrupt 67h is called. ES:DI is used to pass the address of a buffer or array
if needed.
On return AH contains 0 if the call was successful or an error code from 80h to
8Fh if unsuccessful.
TESTING FOR THE PRESENCE OF THE EXPANDED MEMORY MANAGER
Before an application program can use the Expanded Memory Manager, it must
determine whether the manager is present. The two recommended methods are the
"open handle" technique and the "get interrupt vector" technique.
The majority of application programs can use either the "open handle" or the
"get interrupt vector" method. However, if your program is a device driver or
if it interrupts DOS during file system operations, you must use only the "get
interrupt vector" method.
Device drivers execute from within DOS and can't access the DOS file functions;
programs that interrupt DOS during file operations have a similar restriction.
During their interrupt processing procedures, they can't access the DOS file
functions because another program may be using the system. Since the "get
interrupt vector" method doesn't require the DOS file functions, you must use
it for programs of this type.
The "Open Handle" Method
Most application programs can use the DOS "Open Handle" method to test for
the presence of the EMM. To use this method, follow these steps in order:
1) Issue an "open handle" command (DOS function 3Dh) in "read only" access mode
(register AL = 0). This function requires your program to point to an ASCII
string which contains the path name of the file or device in which you're
interested (register set DS:DX contains the pointer). In this case the file
is actually the reserved name of the expanded memory manager.
you should format the ASCII string as follows:
ASCII_device_name DB 'EMMXXXX0', 0
The ASCII codes for the capital letters EMMXXXX0 are terminated by a byte
containing a value of zero.
2) If DOS returns no error code, skip Steps 3 and 4 and go to Step 5. If DOS
returns a "Too many open files" error code, go to Step 3. If DOS returns a
"File/Path not found" error code, skip Step 3 and go to Step 4.
3) If DOS returns a "Too many open files" (not enough handles) status code, your
program should invoke the "open file" command before it opens any other
files. This will guarantee that at least one file handle will be available to
perform the function without causing this error.
After the program performs the "open file" command, it should perform the
test described in Step 6 and close the "file handle" (DOS function 3Eh).
Don't keep the manager "open" after this status test is performed since
"manager" functions are not available through DOS. Go to Step 6.
4) If DOS returns a "File/Path not found," the memory manager is not installed.
If your application requires the memory manager, the user will have to reboot
the system with a disk containing the memory manager and the appropriate
CONFIG.SYS file before proceeding.
5) If DOS doesn't return an error status code you can assume that either a
device with the name EMMXXXX0 is resident in the system, or a file with this
name is on disk in the current disk drive. Go to Step 6.
6) Issue an "I/O Control for Devices" command (DOS function 44h) with a "get
device information" command (register AL = 0). DOS function 44h determines
whether EMMXXXX0 is a device or a file.
You must use the file handle (register BX) which you obtained in Step 1 to
access the "EMM" device.
This function returns the "device information" in a word (register DX).
Go to Step 7.
7. If DOS returns any error code, you should assume that the memory manager
device driver is not installed. If your application requires the memory
manager, the user will have to reboot the system with a disk containing the
memory manager and the appropriate CONFIG.SYS file before proceeding.
8) If DOS didn't return an error status, test the contents of bit 7 (counting
from 0) of the "device information" word (register DX) the function
returned. Go to Step 9.
9) If bit 7 of the "device information" word contains a zero, then EMMXXXX0 is
a file, and the memory manager device driver is not present. If your
application requires the memory manager, the user will have to reboot the
system with a disk containing the memory manager and the appropriate
CONFIG.SYS file before proceeding.
If bit 7 contains a one, then EMMXXXX0 is a device. Go to Step 10.
10) Issue an "I/O Control for Devices" command (DOS function 44h) with a "get
output status" command (register AL = 7). You must use the file handle you
obtained in Step 1 to access the "EMM" device (register BX). Go to Step 11.
11) If the expanded memory device driver is ready, the memory manager passes
a status value of 0FFh in register AL. The status value is 00h if the device
driver is not ready.
If the memory manager device driver is "not ready" and your application
requires its presence, the user will have to reboot the system with a disk
containing the memory manager and the appropriate CONFIG.SYS file before
proceeding.
If the memory manager device driver is "ready," go to Step 12.
12) Issue a "Close File Handle" command (DOS function 3Eh) to close the expanded
memory device driver. You must use the file handle you obtained in Step 1 to
close the "EMM" device (register BX).
The "Get Interrupt Vector" technique
Any type of program can use this method to test for the presence of the EMM.
Use this method (not the "Open Handle" method) if your program is a device
driver or if it interrupts DOS during file system operations.
Follow these steps in order:
1) Issue a "get vector" command (DOS function 35h) to obtain the contents of
interrupt vector array entry number 67h (addresses 0000:019Ch thru
0000:019Fh).
The memory manager uses this interrupt vector to perform all manager
functions. The offset portion of this interrupt service routine address is
stored in the word located at address 0000:019Ch; the segment portion is
stored in the word located at address 0000:019Eh.
2) Compare the "device name field" with the contents of the ASCII string which
starts at the address specified by the segment portion of the contents of
interrupt vector address 67h and a fixed offset of 000Ah. If DOS loaded the
memory manager at boot time this name field will have the name of the device
in it.
Since the memory manager is implemented as a character device driver, its
program origin is 0000h. Device drivers are required to have a "device
header" located at the program origin. Within the "device header" is an 8
byte "device name field." For a character mode device driver this name field
is always located at offset 000Ah within the device header. The device name
field contains the name of the device which DOS uses when it references the
device.
If the result of the "string compare" in this technique is positive, the
memory manager is present.
Terminate and Stay Resident (TSR) Program Cooperation:
In order for TSR's to cooperate with each other and with other applications,
TSRs must follow this rule: a program may only remap the DOS partition it lives
in. This rule applies at all times, even when no expanded memory is present.
EXPANDED MEMORY SERVICES
FUNCTIONS DEFINED IN EMS 3.2 SPECIFICATION
Interrupt 67h
Function 40h Get Manager Status
LIM Function Call 1
Returns a status code indicating whether the memory manager is
present and the hardware is working correctly.
entry AH 40h
return AH error status: 00h, 80h, 81h, 84h
note 1) upward and downward compatible with both EMS and EEMS 3.2.
this call can be used only after establishing that the EMS driver is in
fact present
2) uses register AX
Function 41h Get Page Frame Segment
LIM Function Call 2
Obtain segment address of the page frame used by the EMM.
entry AH 41h
return AH error status: 00h, 80h, 81h, 84h
BX page frame segment address (error code 0)
note 1) upward and downward compatible with both EMS and EEMS 3.2.
2) uses registers AX & BX
Function 42h Get Unallocated Page Count
LIM Function Call 3
Obtain total number of logical expanded memory pages present in
the system and the number of those pages not already allocated.
entry AH 42h
return AH error status: 00h, 80h, 81h, 84h
BX number of unallocated pages currently availible
DX total number of pages
note 1) upward and downward compatible with both EMS and EEMS 3.2. Note that EMS
and EEMS 3.2 had no mechanism to return the maximum number of handles
that can be allocated by programs. This is handled by the EMS 4.0 new
function 54h/02h.
2) uses registers AX, BX, DX
Function 43h Get Handle and Allocate Memory
LIM Function Call 4
Notifies the EMM that a program will be using extended memory,
obtains a handle, and allocates a certain number of logical pages
of extended memory to be controlled by that handle
entry AH 43h
BX number of 16k logical pages requested (zero OK)
return AH error status: 00h, 80h, 81h, 84h, 85h, 87h, 88h, 89h
DX unique EMM handle (see note 2)
note 1) upward compatible with both EMS and EEMS 3.2; EMS and EEMS 3.2 do not
allow the allocation of zero pages (returns error status 89h). EMS 4.0
does allow zero pages to be requested for a handle, allocating pages
later using function 51h
2) your program must use this EMM handle as a parameter in any function
that requires it. You can use up to 255 handles. The uppermost byte of
the handle will be zero and cannot be used by the application.
3) regs AX & DX are used
Function 44h Map Memory
LIM Function Call 5
Maps one of the logical pages of expanded memory assigned to a
handle onto one of the four physical pages within the EMM's page
frame.
entry AH 44h
AL physical page to be mapped (0-3)
BX the logical page to be mapped (zero through [number of pages
allocated to the EMM handle - 1]). If the logical page number
is 0FFFFh, the physical page specified in AL will be unmapped
(made inaccessible for reading or writing).
DX the EMM handle your program received from Function 4 (Allocate
Pages).
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Bh
note 1) downward compatible with both EMS and EEMS 3.2; EMS and EEMS 3.2 do not
support unmap (logical page 0FFFFh) capability. Also, EEMS 3.2
specified there were precisely four physical pages; EMS 4.0 uses the
subfunctions of function 58h to return the permitted number of physical
pages. This incorporates the functionality of function 69h ("function
42") of EEMS.
2) uses register AX
Function 45h Release Handle and Memory
LIM Function Call 6
Deallocates the logical pages of expanded memory currently
assigned to a handle and then releases the handle itself.
entry AH 45h
DX handle
return AH error status: 00h, 80h, 81h, 83h, 84h, 86h
note 1) upward and downward compatible with both EMS and EEMS 3.2.
2) uses register AX
3) when a handle is deallocated, its name is set to all ASCII nulls
(binary zeros).
4) a program must perform this function before it exits to DOS or no other
programs can use these pages or the EMM handle.
Function 46h Get EMM Version
LIM Function Call 7
Returns the version number of the Expanded Memory Manager software.
entry AH 46h
return AH error status: 00h, 80h, 81h, 84h
AL version number byte (if AL=00h)
binary coded decimal (BCD) format if version byte:
high nibble: integer digit of the version number
low nibble : fractional digit of version number
i.e., version 4.0 is represented like this:
0100 0000
/ \
4 . 0
note 1) upward and downward compatible with both EMS and EEMS 3.2. It appears
that the intended use for this function is to return the version of the
vendor implementation of the expanded memory manager instead of the
specification version.
2) uses register AX
Function 47h Save Mapping Context
LIM Function Call 8
Save the contents of the expanded memory page-mapping registers on
the expanded memory boards, associating those contents with a
specific EMM handle.
entry AH 47h
DX caller's EMM handle (NOT current EMM handle)
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ch, 8Dh
note 1) upward and downward compatible with both EMS and EEMS 3.2.
2) This only saves the context saved in EMS 3.2 specification; if a driver,
interrupt routine or TSR needs to do more, functions 4Eh (Page Map
functions) or 4Fh (Partial Page Map functions) should be used.
3) no mention is made about the number of save contexts to provide. AST
recommends in their Rampage AT manual one save context for each handle
plus one per possible interrupt (5 + <handles>).
4) uses register AX
5) this function saves the state of the map registers for only the 64K page
frame defined in versions 3.x of the LIM. Since all applications written
to LIM versions 3.x require saving the map register state of only this
64K page frame, saving the entire mapping state for a large number of
mappable pages would be inefficient use of memory. Applications that use
a mappable memory region outside the LIM 3.x page frame should use
functions 15 or 16 to save and restore the state of the map registers.
Function 48h Restore Page Map
LIM Function Call 9
Restores the contents of all expanded memory hardwere page-mapping
registers to the values associated with the given handle by a
previous function 08h (Save Mapping Context).
entry AH 48h
DX caller's EMM handle (NOT current EMM handle)
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Eh
note 1) upward and downward compatible with both EMS and EEMS 3.2.
2) This only restores the context saved in EMS 3.2 specification; if a
driver, interrupt routine or TSR needs to do more, functions 4Eh (Page
Map functions) or 4Fh (Partial Page Map functions) should be used.
3) uses register AX
4) this function saves the state of the map registers for only the 64K page
frame defined in versions 3.x of the LIM. Since all applications written
to LIM versions 3.x require saving the map register state of only this
64K page frame, saving the entire mapping state for a large number of
mappable pages would be inefficient use of memory. Applications that use
a mappable memory region outside the LIM 3.x page frame should use
functions 15 or 16 to save and restore the state of the map registers.
Function 49h Reserved
LIM Function Call 10
This function was used in EMS 3.0, but was no longer documented in
EMS 3.2. It formerly returned the page mapping register I/O port
array. Use of this function is discouraged, and in EMS 4.0 may
conflict with the use of the new functions 16 through 30 (4Fh
through 5Dh) and functions 10 and 11. Functions 10 and 11 are
specific to the hardware on Intel expanded memory boards and may
not work correctly on all vendors' expanded memory boards.
Function 4Ah Reserved
LIM Function Call 11
This function was used in EMS 3.0, but was no longer documented in
EMS 3.2. It was formerly Get Page Translation Array. Use of this
function is discouraged, and in EMS 4.0 may conflict with the use
of the new functions (4Fh through 5Dh).
Function 4Bh Get Number of EMM Handles
LIM Function Call 12
The Get Handle Count function returns the number of open EMM
handles (including the operating system handle 0) in the system.
entry AH 4Bh
return AH error status: 00h, 80h, 81h, 84h
BX handle count (AH=00h) (including the operating system handle
[0]). max 255.
note 1) upward and downward compatible with EMS and EEMS 3.2.
2) uses registers AX and BX
Function 4Ch Get Pages Owned by Handle
LIM Function Call 13
Returns number of logical expanded memory pages allocated to a
specific EMM handle.
entry AH 4Ch
DX handle
return AH error status: 00h, 80h, 81h, 83h, 84h
BX pages allocated to handle, max 2048 because the EMM allows a
maximum of 2048 pages (32M bytes) of expanded memory.
note 1) This function is upward compatible with EMS and EEMS 3.2.
2) programmers should compare the number returned in BX with the maximum
number of pages returned by function 42h register DX, total number of
EMM pages. This should be an UNSIGNED comparison, just in case the spec
writers decide to use 16 bit unsigned numbers (for a maximum space of
one gigabyte) instead of signed numbers (for a maximum space of 512
megabytes). Unsigned comparisons will work properly in either case
3) uses registers AX and BX
Function 4Dh Get Pages for All Handles
LIM Function Call 14
Returns an array containing all active handles and the number of
logical expanded memory pages associated with each handle.
entry AH 4Dh
ES:DI pointer to 1020 byte array to receive information on an array of
structures where a copy of all open EMM handles and the number
of pages allocated to each will be stored.
return AH error status: 00h, 80h, 81h, 84h
BX number of active handles (1-255); array filled with 2-word
entries, consisting of a handle and the number of pages
allocated to that handle. (including the operating system handle
[0]). BX cannot be zero because the operating system handle is
always active and cannot be deallocated.
note 1) NOT COMPATIBLE with EMS or EEMS 3.2, since the new special OS handle
0000h is returned as part of the array. Unless benign use of this
information is used (such as displaying the handle and count of pages
associated with the handle) code should be changed to only work with
handles between 01h and FFh and to specifically ignore handle 00h.
2) The array consists of an array of 255 elements. The first word of each
element is the handle number, the second word contains the number of
pages allocated.
3) There are two types of handles, "standard" and "raw". The specification
does not talk about how this function works when both raw and standard
handles exist in a given system. There is no currently known way to
differentiate between a standard handle and a raw handle in EMS 4.0.
4) uses registers AX and BX
Function 4Eh Get or Set Page Map
LIM Function Call 15
Gets or sets the contents of the EMS page-mapping registers on the
expanded memory boards.
This group of four subfunctions is provided for context switching
required by operating environments and systems. These functions are
upward and downward compatible with both EMS and EEMS 3.2; in
addition, these functions now include the functionality of EEMS
function 6Ah ("function 43") involving all pages.
The size and contents of the map register array will vary from
system to system based on hardware vendor, software vendor, number
of boards and the capacity of each board in the system. Note the
array size can be determined by function 4Eh/03h.
Use these functions (except for 03h) instead of Functions 8 and 9
if you need to save or restore the mapping context but don't want
(or have) to use a handle.
00h Get Page Map
This call saves the mapping context for all mappable memory regions
(conventional and expanded) by copying the contents of the mapping
registers from each expanded memory board to a destination array.
The application must pass a pointer to the destination array.
entry AH 4Eh
AL 00h
ES:DI pointer to target array
return AH error status: 00h, 80h, 81h, 84h, 8Fh
note 1) uses register AX
2) does not use an EMM handle
01h Set Page Map
This call the mapping context for all mappable memory regions
(conventional and expanded) by copying the contents of a source
array into the mapping registers on each expanded memory board in
the system. The application must pass a pointer to the source array.
entry AH 4Eh
AL 01h
DS:SI pointer to source array
return AH error status: 00h, 80h, 81h, 84h, 8Fh, 0A3h
note 1) uses register AX
2) does not use an EMM handle
02h Get & Set Page Map
This call simultaneously saves the current mapping context and
restores a previous mapping context for all mappable memory regions
(both conventional and expanded). It first copies the contents of
the mapping registers from each expanded memory board in the system
into a destination array. Then the subfunction copies the contents
of a source array into the mapping registers on each of the
expanded memory boards.
entry AH 4Eh
AL 02h
DS:SI pointer to source array
ES:DI pointer to target array
return AH error status: 00h, 80h, 81h, 84h, 8Fh, 0A3h
note 1) uses register AX
03h Get Size of Page Map Save Array
entry AH 4Eh
AL 03h
return AH error status: 00h, 80h, 81h, 84h, 8Fh
AL size in bytes of array
note 1) this subfunction does not require an EMM handle
2) uses register AX
FUNCTIONS NEW TO EMS 4.0
Function 4Eh Get or Set Page Map
LIM Function Call 16
entry AH 4Eh
AL 00h if getting mapping registers
01h if setting mapping registers
02h if getting and setting mapping registers at once
03h if getting size of page-mapping array
DS:SI pointer to array holding information (AL=01/02)
ES:DI pointer to array to receive information (AL=00/02)
return AH error status: 00h, 80h, 81h, 84h, 8Fh, 0A3h
note 1) this function was designed to be used by multitasking operating systems
and should not ordinarily be used by appplication software.
Function 4Fh Get/Set Partial Page Map
LIM Function Call 16
These four subfunctions are provided for context switching required
by interrupt routines, operating environments and systems. This set
of functions provides extended functionality over the EEMS function
6Ah (function 43) involving subsets of pages. In EEMS, a subset of
pages could be specified by starting position and number of pages;
in this function a list of pages is specified, which need not be
contiguous.
Interrupt routines can use this function in place of functions 47h
and 48h, especially if the interrupt routine wants to use more than
the standard four physical pages.
AH 4Fh
AL subfunction
00h get partial page map
DS:SI pointer to structure containing list of
segments whose mapping contexts are to be saved
ES:DI pointer to array to receive page map
01h set partial page map
DS:SI pointer to structure containing saved partial
page map
02h get size of partial page map
BX number of mappable segments in the partial map
to be saved
return AH error status (00h): 00h, 80h, 81h, 84h, 8Bh, 8Fh, 0A3h
error status (01h): 00h, 80h, 81h, 84h, 8Fh, 0A3h
error status (02h): 00h, 80h, 81h, 84h, 8Bh, 8Fh
AL size of partial page map for subfunction 02h
DS:SI (call 00h) pointer to array containing the partial mapping
context and any additional information necessary to restore this
context to its original state when the program invokes a Set
subfunction.
note uses register AX
Function 50h Map/Unmap Multiple Pages
LIM Function Call 17
entry AH 50h
AL 00h (by physical page)
01h (by segment number)
CX contains the number of entries in the array. For example, if the
array contained four pages to map or unmap, then CX would
contain 4.
DX handle
DS:SI pointer to an array of structures that contains the information
necessary to map the desired pages.
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Bh, 8Fh
note 1) New function permits multiple logical-to-physical assignments to be made
in a single call.(faster than mapping individual pages)
2) The source map array is an array of word pairs. The first word of a
pair contains the logical page to map (0FFFFh if the physical page is
to be totally unmapped) and the second word of a pair contains the
physical page number (subfunction 00h) or the segment selector
(subfunction 01h) of the physical page in which the logical page shall
be mapped.
3) A map of available physical pages (by physical page number and segment
selectors) can be obtained using function 58h/00h, Get Mappable
Physical Address Array.
4) uses register AX
5) Both mapping and unmapping pages can be done simultaneously.
6) If a request to map or unmap zero pages is made, nothing is done and no
error is returned.
7) Pages can be mapped or unmapped using one of two methods. Both methods
produce identical results.
A) A logical page and a physical page at which the logical page is to
be mapped. This method is an extension of Function 5 (Map Handle
Page).
B) Specifys both a logical page and a corresponding segment address at
which the logical page is to be mapped. While functionally the same
as the first method, it may be easier to use the actual segment
address of a physical page than to use a number which only
represents its location. The memory manager verifies whether the
specified segment address falls on the boundary of a mappable
physical page. The manager then translates the segment address
passed to it into the necessary internal representation to map the
pages.
Function 51h Reallocate pages
LIM Function Call 18
This function allows an application to change the number of logical
pages allocated to an EMM handle.
entry AH 51h
BX number of pages desired at return
DX handle
return AH error status: 00h, 80h, 81h, 83h, 84h, 87h, 88h
BX number of pages now associated with handle
note 1) uses registers AX, BX
2) Logical pages which were originally allocated with Function 4 are called
pages and are 16K bytes long. Logical pages which were allocated with
Function 27 are called raw pages and might not be the same size as pages
allocated with Function 4.
3) If the status returned in BX is not zero, the value in BX is equal to
the number of pages allocated to the handle prior to calling this
function. This information can be used to verify that the request
generated the expected results.
Function 52h Get/Set Handle Attributes
LIM Function Call 19
entry AH 52h
AL subfunction
00h get handle attributes
01h set handle attributes
BL new attribute
00h make handle volatile
01h make handle non-volatile
02h get attribute capability
DX handle
return AH error status: (function 00h) 00h, 80h, 81h, 83h, 84h, 8Fh, 91h
error status: (function 01h) 00h, 80h, 81h, 83h, 84h, 8Fh, 90h,
91h
error status: (function 02h) 00h, 80h, 81h, 84h, 8Fh
AL attribute (for subfunction 00h)
00h handle is volatile
01h handle is nonvolatile
AL attribute capability (for subfunction 02h)
00h only volatile handles supported
01h both volatile and non-volatile supported
note 1) uses register AX
2) A volatile handle attribute instructs the memory manager to deallocate
both the handle and the pages allocated to it after a warm boot. If all
handles have the volatile attribute (default) at warm boot the handle
directory will be empty and all expanded memory will be initialized to
zero immediately after a warm boot.
3) If the handle's attribute has been set to non-volatile, the handle, its
name (if it is assigned one), and the contents of the pages allocated to
the handle are all maintained after a warm boot.
4) Most PCs disable RAM refresh signals for a considerable period during a
warm boot. This can corrupt some of the data in memory boards. Non-
volatile handles should not be used unless it is definitely known that
the EMS board will retain proper function through a warm boot.
5) subfunction 02h can be used to determine whether the memory manager can
support the non-volatile attribute.
6) Currently the only attribute supported is non-volatile handles and
pages, indicated by the least significant bit.
Function 53h Handle Name Functions
LIM Function Call 20
EMS handles may be named. Each name may be any eight characters.
At installation, all handles have their name initialized to ASCII
nulls (binary zeros). There is no restriction on the characters
which may be used in the handle name (ASCII chars 00h through
0FFh). A name of eight nulls (zeroes) is special, and indicates a
handle has no name. Nulls have no special significance, and they
can appear in the middle of a name. The handle name is 64 bits of
binary information to the EMM.
Functions 53h and 54h provide a way of setting and reading the
names associated with a particular handle. Function 53h manipulates
names by number.
When a handle is assigned a name, at least one character in the
name must be a non-null character in order to distinguish it from
a handle without a name.
00h Get Handle Name
This subfunction gets the eight character name currently
assigned to a handle.
The handle name is initialized to ASCII nulls (binary zeros)
three times: when the memory manager is installed, when a handle
is allocated, and when a handle is deallocated.
entry AH 53h
AL 00h
DX handle
ES:DI pointer to 8-byte handle name array into which the name
currently assigned to the handle will be copied.
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Fh
note uses register AX
01h Set Handle Name
This subfunction assigns an eight character name to a handle.
A handle can be renamed at any time by setting the handle's
name to a new value. When a handle is deallocated, its name is
removed (set to ASCII nulls).
entry AH 53h
AL 01h
DX handle
DS:SI pointer to 8-byte handle name array that is to be assigned to
the handle. The handle name must be padded with nulls if the
name is less than eight characters long.
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Fh, 0A1h
note uses register AX
Function 54h Handle Directory Functions
LIM Function Call 21
Function 54h manipulates handles by name.
00h Get Handle Directory
Returns an array which contains all active handles and the names
associated with each.
entry AH 54h
AL 00h
ES:DI pointer to 2550 byte target array
return AH error status: 00h, 80h, 81h, 84h, 8Fh
AL number of active handles
note 1) The name array consists of 10 byte entries; each entry has a word
containing the handle number, followed by the eight byte (64 bit) name.
2) uses register AX
3) The number of bytes required by the target array is:
10 bytes * total number of handles
4) The maximum size of this array is:
(10 bytes/entry) * 255 entries = 2550 bytes.
01h Search for Named Handle
Searches the handle name directory for a handle with a particular
name. If the named handle is found, this subfunction returns the
handle number associated with the name.
entry AH 54h
AL 01h
DS:SI pointer to an 8-byte string that contains the name of the
handle being searched for
return AH error status: 00h, 80h, 81h, 84h, 8Fh, A0h, 0A1h
DX handle number
note 1) uses registers AX and DX
02h Get Total Handles
Returns the total number of handles the EMM supports, including
the operating system handle (handle value 0).
entry AH 54h
AL 02h
return AH error status: 00h, 80h, 81h, 84h, 8Fh
BX total number of handles availible
note 1) This is NOT the current number of handles defined, but the maximum
number of handles that can be supported in the current environment.
2) uses registers AX and BX
Function 55h Alter Page Map and Jump (cross page branch)
LIM Function Call 22
Alters the memory mapping context and transfers control to the
specified address. Analogous to the FAR JUMP in the 8086 family
architecture. The memory mapping context which existed before
calling function is lost.
entry AH 55h
AL 00h physical page numbers provided by caller
01h segment addresses provided by caller
DX handle
DS:SI pointer to structure containing map and jump address
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Bh, 8Fh
note 1) Flags and all registers except AX are preserved across the jump.
2) uses register AX
3) Values in registers which don't contain required parameters maintain the
values across the jump. The values in registers (with the exception of
AX) and the flag state at the beginning of the function are still in the
registers and flags when the target address is reached.
4) Mapping no pages and jumping is not considered an error. If a request to
map zero pages and jump is made, control is transferred to the target
address, and this function performs a far jump.
Function 56h Alter Page Map and Call (cross page call)
LIM Function Call 23
00h and 01h
This subfunction saves the current memory mapping context,
alters the specified memory mapping context, and transfers
control to the specified address.
entry AH 56h
AL 00h physical page numbers provided by caller
01h segment addresses provided by caller
DS:SI pointer to structure containing page map and call address
DX handle
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Bh, 8Fh
note 1) Flags and all registers except AX are preserved to the called routine.
On return, flags and all registers except AX are preserved; AL is set to
zero and AX is undefined.
2) uses register AX
3) Values in registers which don't contain required parameters maintain
the values across the call. The values in registers (with the exception
of AX) and the flag state at the beginning of the function are still in
the registers and flags when the target address is reached.
4) Developers using this subfunction must make allowances for the
additional stack space this subfunction will use.
02h Get Page Map Stack Space Size
Since the Alter Page Map & Call function pushes additional
information onto the stack, this subfunction returns the number of
bytes of stack space the function requires.
entry AH 56h
AL 02h
return: BX number of bytes of stack used per call
AH error status: 00h, 80h, 81h, 84h, 8Fh
note 1) if successful, the target address is called. Use a RETF to return and
restore mapping context
2) uses registers AX, BX
Function 57h Move/Exchange Memory Region
LIM Function Call 24
00h Move Memory Region
Moves data between two memory areas. Includes moves between paged
and non-paged areas, or between two different paged areas.
entry AH 57h
AL 00h
SI offset to request block
DS segment selector to request block
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Fh, 92h, 93h, 94h,
95h, 96h, 98h, 0A2h
note 1) uses register AX
01h Exchange Memory Region
Exchanges data between two memory areas. Includes exchanges between
paged and non-paged areas, or between two different paged areas.
entry AH 57h
AL 01h
DS:SI pointer to the data structure which contains the source and
destination information for the exchange.
return AH error status: 00h, 80h, 81h, 83h, 84h, 8Ah, 8Fh, 93h, 94h, 95h,
96h, 97h, 98h, 0A2h
note 1) The request block is a structure with the following format:
dword region length in bytes
byte 0=source in conventional memory
1=source in expanded memory
word source handle
word source offset in page or selector
word source logical page (expanded) or selector (conventional)
byte 0=target in conventional memory
1=target in expanded memory
word target handle
word target offset in page or selector
word target logical page (expanded) or selector (conventional)
2) Expanded memory allocated to a handle is considered to be a linear
array, starting from logical page 0 and progressing through logical page
1, 2, ... n, n+1, ... up to the last logical page in the handle.
3) uses register AX
Function 58h Mappable Physical Address Array
LIM Function Call 25
These functions let you obtain a complete map of the way physical
memory is laid out in a vendor independent manner. This is a
functional equivalent of EEMS function 68h ("function 41"). EEMS
function 60h ("function 33") is a subset call of 68h.
00h Get Array
Returns an array containing the segment address and physical page
number for each mappable physical page in a system. This array
provides a cross reference between physical page numbers and the
actual segment addresses for each mappable page in the system.
entry AH 58h
AL 00h
ES:DI pointer to target array
return AH error status: 00h, 80h, 81h, 84h, 8Fh
CX entries in target array
note 1) The information returned is in an array composed of word pairs. The
first word is the physical page's segment selector, the second word the
physical page number. Note that values are not necessarily returned in a
particular order, either ascending/decending segment selector values or
as ascending/decending physical page number.
2) For compatibility with earlier EMS specifications, physical page zero
contains the segment selector value returned by function 41h, and
physical pages 1, 2 and 3 return segment selector values that corrospond
to the physical 16 KB blocks immediately following physical page zero.
3) uses registers AX and CX
4) The array is sorted in ascending segment order. This does not mean that
the physical page numbers associated with the segment addresses are
also in ascending order.
01h Get Physical Page Address Array Entries.
Returns a word which represents the number of entries in the
array returned by the previous subfunction. This number also
indicates the number of mappable physical pages in a system.
entry AH 58h
AL 01h
return AH error status: 00h, 80h, 81h, 84h, 8Fh
CX number of entries returned by 58h/00h
note 1) multiply CX by 4 for the byte count.
2) uses registers AX and CX
Function 59h Get Expanded Memory Hardware Information
LIM Function Call 26
These functions return information specific to a given hardware
implementation and to use of raw pages as opposed to standard
pages. The intent is that only operating system code ever need use
these functions.
00h Get EMS Hardware Info
Returns an array containing expanded memory hardware configuration
information for use by an operating system.
entry AH 59h
AL 00h
ES:DI pointer to 10 byte target array
The target array has the following format:
word: raw page size in paragraphs (multiples of 16 bytes)
word: number of alternate register sets
word: size of page maps (function 4Eh [15])
word: number of alternate registers sets for DMA
word: DMA operation -- see full specification
return AH error status: 00h, 80h, 81h, 84h, 8Fh, 0A4h
note 1) uses register AX
2) This function is for use by operating systems only.
3) This function can be disabled at any time by the operating system.
01h Get Unallocated Raw Page Count
Returns the number of unallocated non-standard length mappable
pages as well as the total number of non-standard length mappable
pages of expanded memory
entry AH 59h
AL 01h
return AH error status: 00h, 80h, 81h, 84h, 8Fh
BX unallocated raw pages availible for use
DX total raw 16k pages of expanded memory
note 1) uses registers AX, BX, CX
2) An expanded memory page which is a sub-multiple of 16K is termed a raw
page. An operating system may deal with mappable physical page sizes
which are sub-multiples of 16K bytes.
3) If the expanded memory board supplies pages in exact multiples of 16K
bytes, the number of pages this function returns is identical to the
number Function 3 (Get Unallocated Page Count) returns. In this case,
there is no difference between a page and a raw page.
Function 5Ah Allocate Raw Pages
LIM Function Call 27
Allocates the number of nonstandard size pages that the operating
system requests and assigns a unique EMM handle to these pages.
entry AH 5Ah
AL 00h allocate standard pages
01h allocate raw pages
BX number of pages to allocate
return AH error status: 00h, 80h, 81h, 84h, 85h, 87h, 88h
DX unique raw EMM handle (1-255)
note 1) it is intended this call be used only by operating systems
2) uses registers AX and DX
3) For all functions using the raw handle returned in DX, the length of
the physical and logical pages allocated to it are some nonstandard
length (that is, not 16K bytes).
4) this call is primarily for use by operating systems or EMM drivers
supporting hardware with a nonstandard EMS page size.
Function 5Bh Alternate Map Register Set - DMA Registers
LIM Function Call 28
entry AH 00h Get Alternate Map Register Set
01h Set Alternate Map Register Set
BL new alternate map register set number
ES:DI pointer to map register context save area if
BL=0
02h Get Alternate Map Save Array Size
03h Allocate Alternate Map Register Set
04h Deallocate Alternate Map Register Set
BL number of alternate map register set
05h Allocate DMA Register Set
06h Enable DMA on Alternate Map Register Set
BL DMA register set number
DL DMA channel number
07h Disable DMA on Alternate Map Register Set
BL DMA register set number
08h Deallocate DMA Register Set
BL DMA register set number
return AH status: 00h, 02h 00h, 80h, 84h, 81h, 8Fh, 0A4h
01h 00h, 80h, 81h, 84h, 8Fh, 9Ah, 9Ch, 9Dh,
0A3h, 0A4h
03h, 05h 00h 80h 81h 84h, 8Fh, 9Bh, 0A4h
04h 00h, 80h, 81h, 84h, 8Fh, 9Ch, 9Dh, 0A4h
06h, 07h 00h, 80h, 81h, 84h, 8Fh, 9Ah, 9Ch, 9Dh, 9Eh,
9Fh, 0A4h
BL current active alternate map register set number if nonzero
(AL=0)
BL number of alternate map register set; zero if not supported
(AL=3)
DX array size in bytes (subfunction 02h)
ES:DI pointer to a map register context save area if BL=0 (AL=0)
note 1) this call is for use by operating systems only, and can be enabled
or disabled at any time by the operating system
2) This set of functions performs the same functions at EEMS function 6Ah
subfunctions 04h and 05h ("function 43").
3) 00h uses registers AX, BX, ES:DI
01h uses register AX
02h uses registers AX and DX
03h uses registers AX and BX
04h uses register AX
05h uses registers AX, BX
06h uses register AX
07h uses register AX
Function 5Ch Prepare EMS Hardware for Warm Boot
LIM Function Call 29
Prepares the EMM hardware for a warm boot.
entry AH 5Ch
return AH error status: 00h, 80h, 81h, 84h
note 1) uses register AX
2) this function assumes that the next operation that the operating system
performs is a warm boot of the system.
3) in general, this function will affect the current mapping context, the
alternate register set in use, and any other expanded memory hardware
dependencies which need to be initialized at boot time.
4) if an application decides to map memory below 640K, the application must
trap all possible conditions leading to a warm boot and invoke this
function before performing the warm boot itself.
Function 5Dh Enable/Disable OS Function Set Functions
LIM Function Call 30
Lets the OS allow other programs or device drivers to use the OS
specific functions. This capability is provided only for an OS
which manages regions of mappable conventional memory and cannot
permit programs to use any of the functions which affect that
memory, but must be able to use these functions itself.
entry AH 5Dh
AL 00h enable OS function set
01h disable OS function set
02h return access key (resets memory manager, returns access
key at next invocation)
BX,CX access key returned by first invocation
return BX,CX access key, returned only on first invocation of function
AH status 00h, 80h, 81h, 84h, 8Fh, 0A4h
note 1) this function is for use by operating systems only. The operating system
can disable this function at any time.
2) 00h uses registers AX, BX, CX
01h uses registers AX, BX, CX
02h uses register AX
3) 00h, 01h: The OS/E (Operating System/Environment) functions these
subfunctions affect are:
Function 26. Get Expanded Memory Hardware Information.
Function 28. Alternate Map Register Sets.
Function 30. Enable/Disable Operating System Functions.
Function 5Eh Unknown
LIM Function call (not defined under LIM)
Function 5Fh Unknown
LIM Function call (not defined under LIM)
Function 60h EEMS - Get Physical Window Array
LIM Function call (not defined under LIM)
entry AH 60h
ES:DI pointer to buffer
return AH status
AL number of entries
buffer at ES:DI filled
Function 61h Generic Accelerator Card Support
LIM Function Call 34
Contact AST Research for a copy of the Generic Accelerator Card
Driver (GACD) Specification
note Can be used by accelerator card manufacturer to flush RAM cache,
ensuring that the cache accurately reflects what the processor would
see without the cache.
Function 68h EEMS - Get Addresses of All Page Frames in System
LIM Function Call (not defined under LIM)
entry AH 68h
ES:DI pointer to buffer
return AH status
AL number of entries
buffer at ES:DI filled
note Equivalent to LIM 4.0 function 58h
Function 69h EEMS - Map Page Into Frame
LIM Function Call (not defined under LIM)
entry AH 69h
AL frame number
BX page number
DX handle
return AH status
note Similar to EMS function 44h
Function 6Ah EEMS - Page Mapping
LIM Function Call (not defined under LIM)
entry AH 6Ah
AL 00h save partial page map
CH first page frame
CL number of frames
ES:DI pointer to buffer which is to be filled
01h restore partial page map
CH first page frame
CL number of frames
DI:SI pointer to previously saved page map
02h save and restore partial page map
CH first page frame
CL number of frames
ES:DI buffer for current page map
DI:SI new page map
03h get size of save array
CH first page frame
CL number of frames
return AL size of array in bytes
04h switch to standard map register setting
05h switch to alternate map register setting
06h deallocate pages mapped to frames in conventional memory
CH first page frame
CL number of frames
return AH status
note Similar to LIM function 4Eh, except that a subrange of pages can
be specified
EXPANDED MEMORY MANAGER ERROR CODES
EMM error codes are returned in AH after a call to the EMM (int 67h).
code meaning
00h function successful
80h internal error in EMM software (possibly corrupted driver)
81h hardware malfunction
82h EMM busy (dropped in EEMS 3.2)
83h invalid EMM handle
84h function requested not defined - unknown function code in AH.
85h no more EMM handles availible
86h error in save or restore of mapping context
87h more pages requested than exist
88h allocation request specified more logical pages than currently
availible in system (request does not exceed actual physical number of
pages, but some are already allocated to other handles); no pages
allocated
89h zero pages; cannot be allocated (dropped in EMS 4.0)
8Ah logical page requested to be mapped outside range of logical pages
assigned to handle
8Bh illegal page number in mapping request (valid numbers are 0 to 3)
8Ch page-mapping hardware state save area full
8Dh save of mapping context failed; save area already contains context
associated with page handle
8Eh retore of mapping context failed; save area does not contain context
for requested handle
8Fh subfunction parameter not defined (unknown function)
LIM 4.0 extended error codes:
90h attribute type undefined
91h warm boot data save not implemented
92h move overlaps memory
93h move/exchange larger than allocated region
94h conventional/expanded regions overlap
95h logical page offset outside of logical page
96h region larger than 1 MB
97h exchange source/destination overlap
98h source/destination undefined or not supported
99h (no status assigned)
9Ah alternate map register sets supported, specified set is not
9Bh all alternate map & DMA register sets allocated
9Ch alternate map & DMA register sets not supported
9Dh alternate map register or DMA set not defined, allocated or is currently
defined set
9Eh dedicated DMA channels not supported
9Fh dedicated DMA channels supported; specifed channel is not
0A0h named handle could not be found
0A1h handle name already exists
0A2h move/exchange wraps around 1 MB boundry
0A3h data structure contains corrupted data
0A4h access denied
CHAPTER 2
Programming Technical Reference - IBM
Copyright 1988, Dave Williams
CPU Port Assignments, System Memory Map, BIOS Data Area, Interrupts 00h to 09h
SYSTEM MEMORY MAP - OVERALL
The IBM PC handles its address space in 64k segments, divided into 16k
fractions and then further as nescessary.
start start end
addr. addr. addr. usage
(dec) (hex)
00000 **** 640k *************** system data, drivers....
0000:0000 hardware interrupt vectors
0000:0040 BIOS interrupt vectors
0k start of RAM | 0000:0080 DOS interrupt vector table
16k 00000-03FFF | 0000:0300 Stack area during POST and bootstrap routine
32k 04000-07FFF | 0000:0400 BIOS Data Area
48k 08000-0BFFF | 0000:04F0 Intra-Application Communications Area
|
64k 10000-13FFF | 0000:0500 DOS reserved communication area
80k 14000-17FFF | xxxx:0000 IO.SYS - DOS interface to ROM I/O routines
96k 18000-1BFFF | xxxx:0000 MSDOS.SYS - DOS interrupt handlers, service
112k 1C000-1FFFF | routines (int 21 functions)
|
128k 20000-23FFF | xxxx:xxxx DOS buffers, control areas, and installed
144k 24000-27FFF | device drivers.
160k 28000-2BFFF | xxxx:0000 resident portion of COMMAND.COM, interrupt
176k 2C000-2FFFF | handlers for int 22h, 23h,24h, and code to
| reload the transient portion
192k 30000-33FFF | xxxx:0000 master environment block, default 64 bytes
208k 34000-37FFF | xxxx:0000 environment for next program
224k 38000-3BFFF | xxxx:0000 external commands or utilities (COM or EXE
240k 3C000-3FFFF | files)
|
256k 40000-43FFF | ----:---- application programs
272k 44000-47FFF | xxxx:0000 user stack for COM files (256 bytes)
288k 48000-4BFFF | xxxx:0000 transient portion of COMMAND.COM
304k 4C000-4FFFF |
|
320k 50000-53FFF |
336k 54000-57FFF |
352k 58000-5BFFF |
368k 5C000-5FFFF |
|
384k 60000-63FFF |
400k 64000-67FFF |
416k 68000-6BFFF |
432k 6C000-6FFFF |
|
448k 70000-73FFF |
464k 74000-77FFF |
480k 78000-7BFFF |
496k 7C000-7FFFF |
|
512k 80000-83FFF |
528k 84000-87FFF |
544k 88000-8BFFF | original IBM PC-1 BIOS limited memory to 544k
560k 8C000-8FFFF |
|
576k 90000-93FFF |
592k 94000-97FFF |
609k 98000-9BFFF |
624k 9C000-9FFFF | to 640k (top of RAM address space)
A0000 ***** 64k *************** EGA address
640k A0000-A95B0 MCGA 320x200 256 color video buffer
AF8C0 MCGA 640x480 2 color video buffer
-A3FFF
656k A4000-A7FFF
672k A8000-ABFFF
688k AC000-AFFFF
B0000 ***** 64k *************** mono and CGA address
704k B0000-B3FFF mono uses only 4k | The PCjr and early Tandy 1000
720k B4000-B7FFF | BIOSs revector direct writes to
736k B8000-BBFFF CGA uses entire 16k | the B8 area to the Video Gate
756k BC000-BFFFF | Array and reserved system RAM
C0000 ***** 64k *************** expansion ROM
768k C0000-C3FFF 16k EGA BIOS C000:001E EGA BIOS signature (the letters IBM)
784k C4000-C5FFF
C6000-C63FF 256 bytes Professional Graphics Display communication area
C6400-C7FFF
800k C8000-CBFFF 16k hard disk controller BIOS, drive 0 default
816k CC000-CDFFF 8k IBM PC Network NETBIOS
CE000-CFFFF
D0000 ***** 64k *************** expansion ROM | PCjr first ROM cartridge
832k D0000-D7FFF 32k IBM Cluster Adapter | address area.
DA000 voice communications |
848k D4000-D7FFF | Common expanded memory board
864k D8000-DBFFF | paging area.
880k DC000-DFFFF |
E0000 ***** 64k *************** expansion ROM | PCjr second ROM
896k E0000-E3FFF | cartridge address
912k E4000-E7FFF | area
928k E8000-EBFFF |
944k EC000-EFFFF |
F0000 ***** 64k *************** system | PCjr optional ROM
960k F0000-F3FFF reserved by IBM | cartridge address
976k F4000- | area (cartridge
F6000 ROM BASIC Begins | BASIC)
992k F8000-FB000 |
1008k FC000-FFFFF ROM BASIC and original |
BIOS (Compatibility BIOS |
in PS/2) |
1024k FFFFF end of memory (1024k) for 8088 machines
F000:FFF5 BIOS release date
F000:FFFE PC model identification
384k 100000-15FFFF 80286/AT extended memory area, 1Mb motherboard
15Mb 100000-FFFFFF 80286/AT extended memory address space
15Mb 160000-FDFFFF Micro Channel RAM expansion (15Mb extended memory)
128k FE0000-FFFFFF system board ROM (PS/2 Advanced BIOS)
PC Port Assignment, Intel 8088, 80C88, 8086, 80286, 80386 CPUs
hex addr. Function
0000-000F 8237 DMA controller
0010-001F 8237 DMA controller (AT, PS/2)
0020-0027 8259A interrupt controller
0020-003F 8259A interrupt controller (AT)
0040-005F 8253-5 programmable timers
(note: 0041 was memory refresh in PCs. Not used in PS/2)
0060-0067 8255 peripheral interface
0060-006F 8042 keyboard controller (AT)
0200-020F game-control adapter
0210-0217 expansion box (PC, XT)
0278-027F LPT3
02F8-02FF COM2
0300-031F prototype card
0320-032F hard disk controller
0378-037F LPT2
03BC-03BF LPT1
03D0-03DF CGA, MCGA, VGA adapter control
03F0-03F7 floppy disk controller
03F8-03FF COM1
note: These are functions common across the IBM range. The PCjr, PC
Convertible and PS/2 (both buses) have enhancements. In some cases, the
AT and PS/2 series ignore, duplicate, or reassign ports arbitrarily. If
your code incorporates specific port addresses for video or system board
control it would be wise to have your application determine the machine
type and video adapter and address the ports as required.
Reserved Memory Locations in the IBM PC
addr. size description
000h-3FFh DOS interrupt vector table
30:00h- used as a stack area during POST and bootstrap routines. This
3F:FFh stack area may be revectored by an application program.
The BIOS Data Area addr. from 400h to 4FFh
40:00 word COM1 port address | These addresses are zeroed out in the
40:02 word COM2 port address | OS/2 DOS Compatibility Box if any of
40:04 word COM3 port address | the OS/2 COM??.SYS drivers are loaded.
40:06 word COM4 port address |
40:08 word LPT1 port address
40:0A word LPT2 port address
40:0C word LPT3 port address
40:0E word LPT4 port address (not valid in PS/2 machines)
40:0E word PS/2 pointer to 1k extended BIOS Data Area at top of RAM
40:10 word equipment flag (see int 11h)
bits:
0 1 if floppy drive present (see bits 6&7) 0 if not
1 1 if 80x87 installed (not valid in PCjr)
2,3 system board RAM (not used on AT or PS/2)
00 16k
01 32k
10 48k
11 64k
4,5 initial video mode
00 no video adapter
01 40 column color (PCjr)
10 80 column color
11 MDA
6,7 number of diskette drives
00 1 drive
01 2 drives
10 3 drives
11 4 drives
8 0 DMA present
1 DMA not present (PCjr)
9,A,B number of RS232 serial ports
C game adapter (joystick)
0 no game adapter
1 if game adapter
D serial printer (PCjr only)
0 no printer
1 serial printer present
E,F number of parallel printers installed
note 1) The IBM PC and AT store the settings of the system board
switches or CMOS RAM setup information (as obtained by the BIOS
in the Power-On Self Test (POST)) at addresses 40:10h and
40:13h. 00000001b indicates "on", 00000000b is "off".
2) CMOS RAM map, PC/AT:
offset contents
00h Seconds
01h Second Alarm
02h Minutes
03h Minute Alarm
04h Hours
05h Hour Alarm
06h Day of the Week
07h Day of the Month
08h Month
09h Year
0Ah Status Register A
0Bh Status Register B
0Ch Status Register C
0Dh Status Register D
0Eh Diagnostic Status Byte
0Fh Shutdown Status Byte
10h Disk Drive Type for Drives A: and B:
The drive-type bytes use bits 0:3 for the first
drive and 4:7 for the other
Disk drive types:
00h no drive present
01h double sided 360k
02h high capacity (1.2 meg)
03h-0Fh reserved
11h (AT):Reserved (PS/2):drive type for hard disk C:
12h (PS/2):drive type for hard disk D:
(AT, XT/286):hard disk type for drives C: and D:
Format of drive-type entry for AT, XT/286:
0 number of cyls in drive (0-1023 allowed)
2 number of heads per drive (0-15 allowed)
3 starting reduced write compensation (not
used on AT)
5 starting cylinder for write compensation
7 max. ECC data burst length, XT only
8 control byte
Bit
7 disable disk-access retries
6 disable ECC retries
5-4 reserved, set to zero
3 more than 8 heads
2-0 drive option on XT (not used by AT)
9 timeout value for XT (not used by AT)
12 landing zone cylinder number
14 number of sectors per track (default 17,
0-17 allowed)
13h Reserved
14h Equipment Byte (corresponds to sw. 1 on PC and XT)
15h-16h Base Memory Size (low,high)
17h-18h Expansion Memory Size (low,high)
19h-20h Reserved
(PS/2) POS information Model 50 (60 and 80 use a 2k
CMOS RAM that is not accessible through software)
21h-2Dh Reserved (not checksumed)
2Eh-2Fh Checksum of Bytes 10 Through 20 (low,high)
30h-31h Exp. Memory Size as Det. by POST (low,high)
32h Date Century Byte
33h Information Flags (set during power-on)
34h-3Fh Reserved
3) The alarm function is used to drive the BIOS wait function (int
15h function 90h).
4) To access the configuration RAM write the byte address (00-3Fh)
you need to access to I/O port 70h, then access the data via I/O
port 71h.
5) CMOS RAM chip is a Motorola 146818
6) The equipment byte is used to determine the configuration for the
power-on diagnostics.
7) Bytes 00-0Dh are defined by the chip for timing functions, bytes
0Eh-3Fh are defined by IBM.
40:12 byte number of errors detected by infrared keyboard link (PCjr only)
40:13 word availible memory size in Kbytes (less display RAM in PCjr)
this is the value returned by int 12h
40:17 byte keyboard flag byte 0 (see int 9h)
bit 7 insert mode on 3 alt pressed
6 capslock on 2 ctrl pressed
5 numlock on 1 left shift pressed
4 scrollock on 0 right shift pressed
40:18 byte keyboard flag byte 1 (see int 9h)
bit 7 insert pressed 3 ctrl-numlock (pause) toggled
6 capslock pressed 2 PCjr keyboard click active
5 numlock pressed 1 PCjr ctrl-alt-capslock held
4 scrollock pressed 0
40:19 byte storage for alternate keypad entry (not normally used)
40:1A word pointer to keyboard buffer head character
40:1C word pointer to keyboard buffer tail character
40:1E 32bytes 16 2-byte entries for keyboard circular buffer, read by int 16h
40:3E byte drive seek status - if bit=0, next seek will recalibrate by
repositioning to Track 0.
bit 3 drive D bit 2 drive C
1 drive B 0 drive A
40:3F byte diskette motor status
bit 7 1, write in progress 3 1, D: motor on (floppy 3)
6 2 1, C: motor on (floppy 2)
5 1 1, B: motor on
4 0 1, A: motor on
40:40 byte motor off counter
starts at 37 and is decremented 1 by each system clock tick.
motor is shut off when count = 0.
40:41 byte status of last diskette operation where:
bit 7 timeout failure bit 3 DMA overrun
6 seek failure 2 sector not found
5 controller failure 1 address not found
4 CRC failure 0 bad command
40:42 7 bytes NEC status
40:49 byte current CRT mode (hex value)
00h 40x25 BW (CGA) 01h 40x25 color (CGA)
02h 80x25 BW (CGA) 03h 80x25 color (CGA)
04h 320x200 color (CGA) 05h 320x200 BW (CGA)
06h 640x200 BW (CGA) 07h monochrome (MDA)
extended video modes (EGA/MCGA/VGA or other)
08h lores,16 color 09h med res,16 color
0Ah hires,4 color 0Bh n/a
0Ch med res,16 color 0Dh hires,16 color
0Eh hires,4 color 0Fh hires,64 color
40:4A word number of columns on screen, coded as hex number of columns
20 col = 14h (video mode 8, low resolution 160x200 CGA graphics)
40 col = 28h
80 col = 46h
40:4C word screen buffer length in bytes
(number of bytes used per screen page, varies with video mode)
40:4E word current screen buffer starting offset (active page)
40:50 8 words cursor position pages 1-8
the first byte of each word gives the column (0-19, 39, or 79)
the second byte gives the row (0-24)
40:60 byte end line for cursor (normally 1)
40:61 byte start line for cursor (normally 0)
40:62 byte current video page being displayed (0-7)
40:63 word base port address of 6845 CRT controller or equivalent
for active display 3B4h=mono, 3D4h=color
40:65 byte current setting of the CRT mode register
40:66 byte current palette mask setting (CGA)
40:67 5 bytes temporary storage for SS:SP during shutdown (cassette interface)
40:6C word timer counter low word
40:6E word timer counter high word
40:69 byte HD_INSTALL (Columbia PCs) (not valid on most clone computers)
bit 0 = 0 8 inch external floppy drives
1 5-1/4 external floppy drives
1,2 = highest drive address which int 13 will accept
(since the floppy drives are assigned 0-3, subtract
3 to obtain the number of hard disks installed)
4,5 = # of hard disks connected to expansion controller
6,7 = # of hard disks on motherboard controller
(if bit 6 or 7 = 1, no A: floppy is present and
the maximum number of floppies from int 11 is 3)
40:70 byte 24 hour timer overflow 1 if timer went past midnight
it is reset to 0 each time it is read by int 1Ah
40:71 byte BIOS break flag (bit 7 = 1 means break key hit)
40:72 word reset flag (1234 = soft reset, memory check will be bypassed)
PCjr keeps 1234h here for softboot when a cartridge is installed
40:74 byte status of last hard disk operation; PCjr special diskette control
40:75 byte # of hard disks attached (0-2) ; PCjr special diskette control
40:76 byte hd control byte; temporary holding area for 6th param table entry
40:77 byte port offset to current hd adapter ; PCjr special diskette control
40:78 4 bytes timeout value for LPT1,LPT2,LPT3,LPT4
40:7C 4 bytes timeout value for COM1,COM2,COM3,COM4 (0-FFh seconds, default 1)
40:80 word pointer to start of circular keyboard buffer, default 03:1E
40:82 word pointer to end of circular keyboard buffer, default 03:3E
40:84 byte rows on the screen (EGA only)
40:84 byte PCjr interrupt flag; timer channel 0 (used by POST)
40:85 word bytes per character (EGA only)
40:85 2 bytes (PCjr only) typamatic char to repeat
40:86 2 bytes (PCjr only) typamatic initial delay
40:87 byte mode options (EGA only)
Bit 1 0 = EGA is connected to a color display
1 = EGA is monochrome.
Bit 3 0 = EGA is the active display,
1 = "other" display is active.
Mode combinations:
Bit3 Bit1 Meaning
0 0 EGA is active display and is color
0 1 EGA is active display and is monochrome
1 0 EGA is not active, a mono card is active
1 1 EGA is not active, a CGA is active
40:87 byte (PCjr only) current Fn key code
40:88 byte feature bit switches (EGA only) 0=on, 1=off
bit 3 = switch 4
bit 2 = switch 3
bit 1 = switch 2
bit 0 = switch 1
40:88 byte (PCjr only) special keyboard status byte
bit 7 function flag 3 typamatic (0=enable,1=disable)
6 Fn-B break 2 typamatic speed (0=slow,1=fast)
5 Fn pressed 1 extra delay bef.typamatic (0=enable)
4 Fn lock 0 write char, typamatic delay elapsed
40:89 byte PCjr, current value of 6845 reg 2 (horiz.synch) used by
ctrl-alt-cursor screen positioning routine in ROM
40:8A byte PCjrCRT/CPU Page Register Image, default 3Fh
40:8B byte last diskette data rate selected
40:8C byte hard disk status returned by controller
40:8D byte hard disk error returned by controller
40:8E byte hard disk interrupt (bit 7=working int)
40:90 4 bytes media state drive 0, 1, 2, 3
40:94 2 bytes track currently seeked to drive 0, 1
40:96 byte keyboard flag byte 3 (see int 9h)
40:97 byte keyboard flag byte 2 (see int 9h)
40:98 dword pointer to users wait flag
40:9C dword users timeout value in microseconds
40:A0 byte real time clock wait function in use
40:A1 byte LAN A DMA channel flags
40:A2 2 bytes status LAN A 0,1
40:A4 dword saved hard disk interrupt vector
40:A8 dword EGA pointer to parameter table
40:B4 byte keyboard NMI control flags (Convertible)
40:B5 dword keyboard break pending flags (Convertible)
40:B9 byte port 60 single byte queue (Convertible)
40:BA byte scan code of last key (Convertible)
40:BB byte pointer to NMI buffer head (Convertible)
40:BC byte pointer to NMI buffer tail (Convertible)
40:BD 16bytes NMI scan code buffer (Convertible)
40:CE word day counter (Convertible and after)
to -04:8F end of BIOS Data Area
40:90-40:EF reserved by IBM
04:F0 16 bytes Intra-Application Communications Area (for use by applications
04:FF to transfer data or parameters to each other)
05:00 byte DOS print screen status flag
00h not active or successful completion
01h print screen in progress
0FFh error during print screen operation
05:01 Used by BASIC
05:02-03 PCjr POST and diagnostics work area
05:04 byte Single drive mode status byte
00 logical drive A
01 logical drive B
05:05-0E PCjr POST and diagnostics work area
05:0F BASIC: SHELL flag (set to 02h if there is a current SHELL)
05:10 word BASIC: segment address storage (set with DEF SEG)
05:12 4 bytes BASIC: int 1Ch clock interrupt vector segment:offset storage
05:16 4 bytes BASIC: int 23h ctrl-break interrupt segment:offset storage
05:1A 4 bytes BASIC: int 24h disk error interrupt vector segment:offset storage
05:1B-1F Used by BASIC for dynamic storage
05:20-21 Used by DOS for dynamic storage
05:22-2C Used by DOS for diskette parameter table. See int 1Eh for values
05:30-33 Used by MODE command
05:34-FF Unknown - Reserved for DOS
At Absolute Addresses:
0008:0047 IO.SYS or IBMBIO.COM IRET instruction. This is the dummy routine that
interrupts 01h, 03h, and 0Fh are initialized to during POST.
C000:001E EGA BIOS signature (the letters IBM)
F000:FFF5 BIOS release date
F000:FFFE PC model identification
date model byte submodel byte revision
04/24/81 FF = PC-0 (16k) -- --
10/19/81 FF = PC-1 (64k) -- --
08/16/82 FF = PC, XT, XT/370 -- --
(256k motherboard)
10/27/82 FF = PC, XT, XT/370 -- --
(256k motherboard)
11/08/82 FE = XT, Portable PC -- --
XT/370, 3270PC
01/10/86 FB = XT 00 01
01/10/86 FB = XT-2 (early)
05/09/86 FB = XT-2 (640k) 00 02
06/01/83 FD = PCjr -- --
01/10/84 FC = AT -- --
06/10/85 FC = AT 00 01
11/15/85 FC = AT 01 00
04/21/86 FC = XT/286 02 00
09/13/85 F9 = Convertible 00 00
09/02/86 FA = PS/2 Model 30 00 00
11/15/86 FC = AT, Enhanced 8mHz
02/13/87 FC = PS/2 Model 50 04 00
02/13/87 FC = PS/2 Model 60 05 00
1987 F8 = PS/2 Model 80 00 00
2D = Compaq PC (4.77) -- --
9A = Compaq Plus (XT) -- --
00FC 7531/2 Industrial AT
06FC 7552 Gearbox
The IBM PC System Interrupts (Overview)
The interrupt table is stored in the very lowest location in memory, starting
at 0000:0000h. The locations are offset from segment 0, ie location 0000h has
the address for int 0, etc. Each address is four bytes long and its location in
memory can be found by multiplying the interrupt number by 4. For example, int
7 could be found by (7x4=28) or 1Bh (0000:001Bh).
These interrupt vectors normally point to ROM tables or are taken over by DOS
when an application is run. Some applications revector these interrupts to
their own code to change the way the system responds to the user.
Interrupt Address Function
Number (Hex)
0 00-03 CPU Divide by Zero
1 04-07 CPU Single Step
2 08-0B CPU Nonmaskable
3 0C-0F CPU Breakpoint
4 10-13 CPU Overflow
5 14-17 BIOS Print Screen
6 18-1B hdw Reserved
7 1C-1F hdw Reserved
8 20-23 hdw Time of Day
9 24-27 hdw Keyboard
A 28-2B hdw Reserved
B 2C-2F hdw Communications [8259]
C 30-33 hdw Communications
D 34-37 hdw Disk
E 38-3B hdw Diskette
F 3C-3F hdw Printer
10 40-43 BIOS Video
11 44-47 BIOS Equipment Check
12 48-4B BIOS Memory
13 4C-4F BIOS Diskette/Disk
14 50-53 BIOS Serial Communications
15 54-57 BIOS Cassette, System Services
16 58-5B BIOS Keyboard
17 5C-5F BIOS Parallel Printer
18 60-63 BIOS Resident BASIC
19 64-67 BIOS Bootstrap Loader
1A 68-6B BIOS Time of Day
1B 6C-6F BIOS Keyboard Break
1C 70-73 BIOS Timer Tick
1D 74-77 BIOS Video Initialization
1E 78-7B BIOS Diskette Parameters
1F 7C-7F BIOS Video Graphics Characters, second set
20 80-83 DOS General Program Termination
21 84-87 DOS DOS Services Function Request
22 88-8B DOS Called Program Termination Address
23 8C-8F DOS Control Break Termination Address
24 90-93 DOS Critical Error Handler
25 94-97 DOS Absolute Disk Read
26 98-9B DOS Absolute Disk Write
27 9C-9F DOS Terminate and Stay Resident
28-3F A0-FF DOS Reserved for DOS
40-43 100-115 BIOS Reserved for BIOS
44 116-119 BIOS First 128 Graphics Characters
45-47 120-131 BIOS Reserved for BIOS
48 132-135 BIOS PCjr Cordless Keyboard Translation
49 136-139 BIOS PCjr Non-Keyboard Scancode Translation Table
50-5F 140-17F BIOS Reserved for BIOS
60-67 180-19F Reserved for User Software Interrupts
68-7F 1A0-1FF Reserved by IBM
80-85 200-217 ROM BASIC
86-F0 218-3C3 Used by BASIC Interpreter When BASIC is Running
F1-FF 3C4-3FF Reserved by IBM
For consistency in this volume, all locations and offsets are in hexadecimal
unless otherwise specified. All hex numbers are prefaced with a leading zero
if they begin with an alphabetic character, and are terminated with a
lowercase H (h). The formats vary according to common usage.
The IBM-PC System Interrupts (in detail)
Interrupt 00h Divide by Zero (processor error). Automatically called at end
(0:0000h) of DIV or IDIV operation that results in error. Normally set by
DOS to display an error message and abort the program.
Interrupt 01h Single step - Taken after every instruction when CPU Trap Flag
(0:0004h) indicates single-step mode (bit 8 of FLAGS is 1). This is what
makes the T command of DEBUG work for single stepping. Is not
generated after MOV to segment register or POP of segment
register. (unless you have a very early 8088 with the microcode
bug).
Interrupt 02h Non-maskable interrupt - Vector not disabled via CLI. Used by
(0:0008h) parity check routine in POST, 8087 coprocessor, PCjr infrared
keyboard link.
Interrupt 03h Breakpoint - Taken when CPU executes the 1-byte int 3 (0CCh).
(0:000Ch) Generated by opcode 0CCh. Similar to 8080's RST instruction.
Generally used to set breakpoints for DEBUG.
Interrupt 04h Divide overflow - Generated by INTO instruction if OF flag is
(0:0010h) set. If flag is not set, INTO is effectively a NOP. Used to trap
any arithmetic errors when program is ready to handle them rather
than immediately when they occur.
Interrupt 05h Print Screen - service dumps the screen to the printer. Invoked
(0:0014h) by int 9 for shifted key 55 (PrtSc). Automatically called by
keyboard scan when PrtSc key is pressed. Normally executes
routine to print the screen, but may call any routine that can
safely be executed from inside the keyboard scanner. Status and
result byte are at address 0050:0000.
entry AH 05h
return absolute address 50:0
00h print screen has not been called, or upon return from a call
there were no errors.
01h print screen is already in progress.
0FFh error encountered during printing.
note 1) Uses BIOS services to read the screen
2) Output is directed to LPT1
3) Revectored into GRAPHICS.COM if GRAPHICS.COM is loaded
Interrupt 06h Reserved by IBM
(0:0018h)
Interrupt 07h Reserved by IBM
(0:00C0h)
Interrupt 08h Timer - 55ms timer "tick" taken 18.2 times per second. Updates
(0:0020h) (IRQ0) BIOS clock and turns off diskette drive motors after 2
seconds of inactivity.
entry AH 08h
return absolute addresses:
40:6C number of interrupts since power on (4 bytes)
40:70 number of days since power on (1 byte)
40:67 day counter on all products after AT
40:40 motor control count - gets decremented and shuts off diskette
motor if zero
note Int 1Ch invoked as a user interrupt.
Interrupt 09h Keyboard - taken whenever a key is pressed or released.
(0:0024h) (IRQ1) Stores characters/scan-codes in status at [0040:0017,18]
entry AH 09h
return at absolute memory addresses:
40:17 bit
0 right shift key depressed
1 left shift key depressed
2 control key depressed
3 alt key depressed
4 ScrollLock state has been toggled
5 NumLock state has been toggled
6 CapsLock state has been toggled
7 insert state is active
40:18 bit
0 left control key depressed
1 left alt key depressed
2 SysReq key depressed
3 Pause key has been toggled
4 ScrollLock key is depressed
5 NumLock key is depressed
6 CapsLock key is depressed
7 Insert key is depressed
40:96 bit
0 last code was the E1h hidden code
1 last code was the E0h hidden code
2 right control key down
3 right alt key down
4 101 key Enhanced keyboard installed
5 force NumLock if rd ID & kbx
6 last character was first ID character
7 doing a read ID (must be bit 0)
40:97 bit
0 ScrollLock indicator
1 NumLock indicator
2 CapsLock indicator
3 circus system indicator
4 ACK received
5 resend received flag
6 mode indicator update
7 keyboard transmit error flag
40:1E keyboard buffer (20h bytes)
40:1C buffer tail pointer
40:72 1234h if ctrl-alt-del pressed on keyboard
AL scan code
note 1) Int 05h invoked if PrtSc key pressed
2) Int 1Bh invoked if Ctrl-Break key sequence pressed
3) Int 15h, AH=85h invoked on AT and after if SysReq key is pressed
4) Int 15h, AH=4Fh invoked on machines after AT
Interrupt 0Ah EGA Vertical Retrace
(0:0028h) (IRQ2) used by EGA vertical retrace, hard disk
Interrupt 0Bh Communications Controller (serial port) hdw. entry
(0:002Ch) (IRQ3) Serial Port 2 (com2)
note IRQ 3 may be used by SDLC (synchronous data-link control) or
bisynchronous communications cards instead of a serial port.
Interrupt 0Ch Communications Controller (serial port) hdw. entry
(0:0030h) (IRQ4) Serial Port 1 (com1)
note IRQ 4 may be used by SDLC (synchronous data-link control) or
bisynchronous communications cards instead of a serial port.
Interrupt 0Dh Alternate Printer, PC/AT 80287
(0:0034h) (IRQ5) used by hard disk, 60 Hz RAM refresh, LPT2 on AT, XT/286,
and PS/2, dummy CRT vertical retrace on PCjr
Interrupt 0Eh Diskette - indicates that a seek is in progress
(0:0038h) (IRQ6) (sets bit 8 of 40:3E)
Interrupt 0Fh Reserved by IBM
(0:003Ch) (IRQ7) IRQ7 used by PPI interrupt (LPT1, LPT2)
CHAPTER 3 THE PC ROM BIOS
Programming Technical Reference - IBM
Copyright 1988, Dave Williams
Interrupt 10h Video I/O - services to handle video output
(0:0040h) The ROM video routines in the original PC BIOS are designed for
use with the Color Graphics Adapter and incorporate code to test
for the horizontal retrace before writing. The check is
performed no matter what actual display adapter is installed.
The ROM character table for the first 128 characters is located
at 0FA6Eh in the PC. Int 01Fh can be used to point to a second
table of 128 characters.
CS, SS, DS, ES, BX, CX, DX are preserved during call. All
others are destroyed.
Function 00h Determine or Set Video State
entry AH 00h set video mode
AL display mode: CGA|PCjr|MDA|MCGA|EGA|VGA|8514
00h 40x25 B/W text CGA|PCjr| | |EGA| |
16 color 01h 40x25 color text CGA|PCjr| | |EGA| |
02h 80x25 B/W text CGA|PCjr| | |EGA| |
16 color 03h 80x25 color text CGA|PCjr| | |EGA|VGA|
4 color 04h 320x200 color graphics CGA|PCjr| | |EGA| |
4 tone gray 05h 320x200 B/W graphics CGA|PCjr| | |EGA| |
2 color 06h 640x200 B/W graphics CGA|PCjr| | |EGA| |
monochrome 07h 80x25 monochrome text | |MDA| |EGA| |
16 color 08h 160x200 color graphics CGA|PCjr| | | | |
16 color 09h 320x200 color graphics |PCjr| | | |VGA|
4 color 0Ah 640x200 color graphics |PCjr| | | | |
N/A 0Bh BIOS font load | | | |EGA|VGA|
N/A 0Ch BIOS font load | | | |EGA|VGA|
16 color 0Dh 320x200 graphics | | | |EGA|VGA|
16 color 0Eh 640x200 graphics | | | |EGA|VGA|
monochrome 0Fh 640x350 graphics | | | |EGA|VGA|
16 & 64 color 10h 640x350 color hi-res | | | |EGA|VGA|
2 color 11h 640x480 graphics | | |MCGA| |VGA|
16 color 12h 640x480 graphics | | | | |VGA|
256 color 13h 320x200 graphics | | |MCGA| |VGA|8514
14h-20h used by EGA and VGA graphics modes
18h 132x44 8x8 char mono | Tseng Labs EVA
19h 132x25 8x14 char mono | Tseng Labs EVA
1Ah 132x28 8x13 char mono | Tseng Labs EVA
monochrome 21h Hercules Graphics, Graphics Page 1
monochrome 22h Hercules Graphics, Graphics Page 2
22h 132x44 | Tseng, Ahead
23h 132x25 | Tseng Labs EVA
132x25 | Ahead Systems EGA2001
132x25 | ATI EGA Wonder
24h 132x28 | Tseng Labs EVA
25h 80x60 640x480 | Tseng Labs EVA
16 color 640x480 | VEGA VGA
26h 80x60 | Tseng Labs EVA
80x60 640x480 | Ahead Systems EGA2001
16 color 27h 720x512 | VEGA VGA
monochrome 132x25 | ATI EGA Wonder
28h unknown | VEGA VGA
16 color 29h 800x600 | VEGA VGA
256 color 2Dh 640x350 | VEGA VGA
256 color 2Eh 640x480 | VEGA VGA
256 color 2Fh 720x512 | VEGA VGA
256 color 30h 800x600 | VEGA VGA
unknown | AT&T 6300
16 color 36h 960x720 | VEGA VGA
16 color 37h 1024x768 | VEGA VGA
monochrome 132x44 | ATI EGA Wonder
2 color 40h 640x400 | AT&T 6300
80x43 | VEGA VGA
16 color 41h 640x200 | AT&T 6300
132x25 | VEGA VGA
16 color 42h 640x400 | AT&T 6300
132x43 | VEGA VGA
43h unsupported 640x200 of 640x400 viewport AT&T 6300
80x60 | VEGA VGA
44h disable VDC and DEB output | AT&T 6300
100x60 | VEGA VGA
48h 80x50 640x400 | AT&T 6300
4Dh 120x25 | VEGA VGA
4Eh 120x43 | VEGA VGA
4Fh 132x25 | VEGA VGA
monochrome 50h 132x25 | Ahead Systems EGA2001
16 color 640x480 | Paradise EGA-480
monochrome 80x43 | VEGA VGA
640x480 mono? | Taxan 565 EGA
51h 80x30 | Paradise EGA-480
monochrome 132x25 | VEGA VGA
640x480 ? | ATI EGA Wonder
monochrome 52h 132x44 | Ahead Systems EGA2001
monochrome 132x43 | VEGA VGA
752x410 ? | ATI EGA Wonder
53h 800x560 ? | ATI EGA Wonder
54h 132x43 | Paradise EGA-480
16 color 132x43 | Paradise VGA
16 color 132x43 | Paradise VGA on multisync
132x43 | Taxan 565 EGA
55h 132x25 | Paradise EGA-480
16 color 132x25 | Paradise VGA
16 color 132x25 | Paradise VGA on multisync
132x25 | Taxan 565 EGA
56h 132x43 | NSI Smart EGA+
132x43 | Paradise VGA
132x43 | Paradise VGA on multisync
monochrome 132x43 | Taxan 565 EGA
57h 132x25 | NSI Smart EGA+
132x25 | Paradise VGA
132x25 | Paradise VGA on multisync
monochrome 132x25 | Taxan 565 EGA
58h 100x75 800x600 16/256k | Paradise VGA
59h 100x75 800x600 | Paradise VGA
5Eh 640x400 | Paradise VGA,VEGA VGA
5Fh 640x480 | Paradise VGA
60h 80x??? ???x400 | Corona/Cordata BIOS v4.10+
752x410 | VEGA VGA
60h 400 line graphics+80 col text |(Corona/Cordata)
61h 400 line graphics | Corona/Cordata BIOS v4.10+
720x540 | VEGA VGA
62h 800x600 | VEGA VGA
16 color 71h 100x35 800x600 | NSI Smart EGA+
74h 640x400 graphics | Toshiba 3100
82h 80x25 B&W | AT&T VDC overlay mode *
83h 80x25 | AT&T VDC overlay mode *
86h 640x200 B&W | AT&T VDC overlay mode *
C0h 640x400 2/prog pallet | AT&T VDC overlay mode *
C4h disable output | AT&T VDC overlay mode *
D0h 640x400 | DEC VAXmate AT&T mode
unknown 640x225 | Z-100
unknown 640x400 | Z-100
note 1) If the high bit in AL is set, the display buffer is not cleared when a
new mode is selected. This may be used to mix modes on the display;
for example, characters of two difference sizes might be displayed
2) Modes 8-10 are available on the PCjr, Tandy 1000, and PS/2
3) IBM claims 100% software and hardware emulation of the CGA with the
MCGA chipset. All registers may be read and written as CGA. All
characters are double-scanned to give 80x25 with 400 line resolution.
The attributes for setting border color may be set on MCGA, but the
borders will remain the default color (they cannot actually be set)
4) The IBM Color Graphics Adapter (CGA) is too slow for the screen to
be updated before the vertical retrace of the monitor is completed.
If the video RAM is addressed directly, the screen will have "snow"
or interference. IBM's default is to turn the adapter off when it is
being updated, ie "flickering" when the display is scrolled.
5) The vertical retrace signal may be ignored when using the MCGA adapter.
The MCGA will not generate snow when written to. There is no flicker
with the MCGA.
6) The PCjr Video Gate Array uses a user-defined block of main system RAM
from 4 to 32k in size instead of having dedicated memory for the
display. Vertical retrace may be ignored when writing to the PCjr.
There is no flicker with the PCjr display.
7) The Hercules Graphics Card has 750x348 resolution
8) The Hercules Graphics Card takes 32k beginning at B:000 (same as MDA)
9) The CGA, MCGA, and VGA adapters use hardware address B:800
10) The BIOS clears the screen when the mode is set or reset.
11) For AT&T VDC overlay modes, BL contains the DEB mode, which may be 06h,
40h, or 44h
Function 01h Set Cursor Type - set the size of the cursor or turn it off
entry AH 01h
CH bit values:
bits 0-4 top line for cursor in character cell
bits 5-6 blink attribute
00 normal
01 invisible (no cursor)
10 slow (not used on original IBM PC)
11 fast
CL bit values:
bits 0-4 bottom line for cursor in character cell
return none
note 1) The ROM BIOS default cursors are: start end
monochrome mode 07h: 11 12
text modes 00h-03h: 6 7
2) The blinking in text mode is caused by hardware and cannot be turned
off, though some kludges can temporarily fake a nonblinking cursor
3) The cursor is automatically turned off in graphics mode
4) Another method of turning off the cursor in text mode is to position it
to a nondisplayable address, such as (X,Y)=(0,25)
5) Buggy on EGA systems - BIOS remaps cursor shape in 43 line modes, but
returns unmapped cursor shape
Function 02h Set Cursor Position - reposition the cursor to (X,Y)
entry AH 02h
BH video page
00h graphics mode
03h modes 2 and 3
07h modes 0 and 1
DH row (Y=0-24)
DL column (X=0-79 or 0-39)
return none
note 1) (0,0) is upper left corner of the screen
Function 03h Read Cursor Position - return the position of the cursor
entry AH 03h
BH page number
00h in graphics modes
03h in modes 2 & 3
07h in modes 0 & 1
return CH top line for cursor (bits 4-0)
CL bottom line for cursor (bits 4-0)
DH row number (Y=0-24)
DL column number (X=0-79 or 0-39)
Function 04h Read Light Pen - fetch light pen information
entry AH 04h
return AH 00h light pen not triggered
AH 01h light pen is triggered, values in resgisters
BX pixel column (X=0-319 or 0-639) graphics mode
CH raster line (Y=0-199) old graphics modes
CX (EGA) raster line (0-nnn) new graphics modes
DH row of current position (Y=0-24) text mode
DL column of current position (X=0-79 or 0-39) text mode
note Not supported on PS/2
Function 05h Select Active Page - set page number for services 6 and 7
entry AH 05h
AL number of new active page
0-7 modes 00h and 01h (CGA)
0-3 modes 02h and 03h (CGA)
0-7 modes 02h and 03h (EGA)
0-7 mode 0Dh (EGA)
0-3 mode 0Eh (EGA)
0-1 mode 0Fh (EGA)
0-1 mode 10h (EGA)
for PCjr only:
AL 80h to read CRT/CPU page registers
81h to set CPU page register to value in BL
82h to set CRT page register to value in BH
83h to set both CPU and page registers
(and Corona/Cordata BIOS v4.10+)
BH CRT page number for subfunctions 82h and 83h
BL CPU page register for subfunctions 81h and 83h
return standard PC none
PCjr