Hex Availability and use ------------------------------------------------------------------------------ &00 (Acorn MOS 0.10) Reads a line from the currently selected input stream and places it at the 'address'. Characters outside the range 'min' and 'max' will not be entered into the buffer, but WILL appear on the screen. XY+0=address LO XY+1=address HI XY+2=max length XY+3=min chr$ XY+4=max chr$ On exit Y is the line length (inc. CR) C is set if Escape terminated input &01 (Acorn MOS 1.20) Read system clock. The clock increments 100 times a second from hard resets. On exit XY+0 (5 bytes) is the current clock value. &02 (Acorn MOS 1.20) Write system clock. XY+0 (5 bytes) is the new clock value. &03 (Acorn MOS 1.20) Read interval timer. This is the spare timer on the system VIA On exit XY+0 (5 bytes) is the current interval timer value. &04 (Acorn MOS 1.20) Write interval timer. This is the spare timer on the system VIA XY+0 (5 bytes) is the new interval timer value. &05 (Acorn MOS 1.00) Read I/O processor memory. XY+0=32 bit addr LO XY+1=32 bit addr XY+2=32 bit addr XY+3=32 bit addr HI On exit XY+4 contains the byte read. (Acorn MOS 3.20) Setting the address to &FFFExxxx allows reads from the shadow RAM fitted in the Master series at &8000 to &BFFF, and sideways RAM fitted in socket 'n' by reading &FFFnxxxx. (RISC OS 1.00) Not available. &06 (Acorn MOS 1.00) Write I/O processor memory. XY+0=32 bit addr LO XY+1=32 bit addr XY+2=32 bit addr XY+3=32 bit addr HI XY+4=byte to write (Acorn MOS 3.20) Setting the address to &FFFExxxx allows reads from the shadow RAM fitted in the Master series at &8000 to &BFFF, and sideways RAM fitted in socket 'n' by reading &FFFnxxxx. (RISC OS 1.00) Not available. &07 (Acorn MOS 1.20) Generate a sound. XY+0=sound ch LO XY+1=sound ch HI XY+2=amplitude XY+3=amplitude XY+4=pitch LO XY+5=pitch HI XY+6=duration LO XY+7=duration LO (Acorn MOS 3.20) As per definition above, except that the channel number is extended to contain flag bits. XY+0=channel number and flush control b0..2=channel b3 =unused b4 =set=flush any queued sounds on the given channel and play this sound immediately =clear=queue the sound b5..7=unused XY+1=sync and continuation control b0..2=0=no synchronisation 1-3=wait for this many other channels to have non zero sync fields at the head of their sound queue, allowing adjacent asynchronously stuffed sound queues to be realigned 4-7=reserved b3 =unused b4..7=0= play sound when the channel is ready for it 1= wait for the decay phase of its corresponding envelope to complete, if no envelope was specified no sound is made 2-15=passed to sideways ROMs as unknown OSWord (RISC OS 1.00) Translated into a Sound_ControlPacked SWI and passed on. &08 (Acorn MOS 1.20) Define a sound envelope. XY+0 =the envelope number XY+1 =the length of each envelope step (b7=auto repeat pitch envelope) XY+2 =the change of pitch in section 1 XY+3 =the change of pitch in section 2 XY+4 =the change of pitch in section 3 XY+5 =the number of steps in section 1 XY+6 =the number of steps in section 2 XY+7 =the number of steps in section 3 XY+8 =the change of amplitude per step in attack phase XY+9 =the change of amplitude per step in decay phase XY+10=the change of amplitude per step in sustain phase XY+11=the change of amplitude per step in release phase XY+12=the target amplitude at end of attack phase XY+13=the target amplitude at the end of the decay phase. (RISC OS 1.00) Not available. &09 (Acorn MOS 1.20) Read a pixel value from the screen XY+0=X coordinate XY+1=X coordinate XY+2=Y coordinate XY+3=Y coordinate On exit XY+4 contains the pixel value or &FF if the point is off the screen (RISC OS 1.00) On exit XY+4 contains the pixel value or &FF if the point is off the screen or it's a non graphics mode (RISC OS 3.50) On exit XY+4 contains the pixel value or &FF if the point is off the screen or it's a non graphics mode or it's a 256 colour mode (ie. the call makes no sense if in 256 or more colours) &0A (Acorn MOS 1.20) Read character definition XY+0=chr$ number On exit XY+1 contains an 8 byte block of the character raster The results for characters 0..31 and 127 are undefined. (Acorn MOS 3.20) Value 2-5 return the ECF patterns 1-4 respectively Value 6 returns the dot/dash patter in use The results for characters 0, 1, 7..31 and 127 are undefined. &0B (Acorn MOS 1.20) Read palette XY+0=logical colour On exit XY+1=is the physical colour XY+2=contains zero on the BBC or is the =RED component on RISC OS XY+3=contains zero on the BBC or is the =GREEN component on RISC OS XY+4=contains zero on the BBC or is the =BLUE component on RISC OS &0C (Acorn MOS 1.20) Write palette entry. This is faster than doing a VDU19,a,b,R,G,B as it is not queued (ie. acts immediately) XY+0 logical colour On exit XY+1=is the physical colour XY+2=should be zero on the BBC or is the =RED component on RISC OS XY+3=should be zero on the BBC or is the =GREEN component on RISC OS XY+4=should be zero on the BBC or is the =BLUE component on RISC OS &0D (Acorn MOS 1.20) Read last two graphics positions in external coordinates XY+0=previous X LO XY+1=previous X HI XY+2=previous Y LO XY+3=previous Y HI XY+4=current X LO XY+5=current X HI XY+6=current Y LO XY+7=current Y HI &0E (Acorn MOS 3.20) Reads the real time CMOS clock as a string XY+0=0 On exit XY+0 is CR-terminated string of form "Day,DD Mmm YYYY.HH:MM:SS" Reads the real time CMOS clock in BCD XY+0=1 On exit XY+0=the year (0-99) XY+1=the month (1-12) XY+2=the date (1-31) XY+3=the week day (1-7) with 1=Sunday XY+4=the hour (0-23) XY+5=the minute (0-59) XY+6=the second (0-59) Convert XY+1 (7 bytes) from format 1 to format 0 XY+0=2 On exit XY+0 is CR-terminated string of form "Day,DD Mmm YYYY.HH:MM:SS" (RISC OS 1.00) Read soft copy of CMOS clock as 5 byte integer XY+0=3 On exit XY+1=5 byte time offset in centiseconds since 1900 &0F (Acorn MOS 3.20) Sets the time in the CMOS clock XY+0=8 XY+1=8 byte string in format "HH:MM:SS" Sets the date in the CMOS clock XY+0=15 XY+1=15 bytes string in format "Day,DD Mmm YYYY" Set time and date XY+0=24 XY+1=24 byte string in format "Day,DD Mmm YYYY.HH:MM:SS" &10 (NFS) Network transmit XY+0 =control byte with b7 set XY+1 =destination port XY+2..3 =destination station XY+4..7 =buffer start address XY+8..11=buffer end address On exit XY+0=zero if transmission failed to start Transmission must be polled with OSByte &32. If the destination station is &FFFF, a broadcast will be sent, the eight bytes of data are in the control block at XY+4 to XY+11 If the port number is zero, an immediate operation is transmitted. &11 (NFS) Open or read network receive block XY+0 =0 - Open receive block XY+1 =must contain &7F XY+2 =port to receive on XY+3..4 =station to receive from XY+5..8 =address of reception buffer XY+9..12=address of buffer end On exit XY+0=0 if no more space to open blocks or handle number of opened reception block Receive blocks can be 'wild' ie. will receive from anyone if port or station values are set to &00. XY+0 <>0 - Read receive block XY+0 =receive block number to read XY+5..8 =buffer start address XY+9..12=buffer end address On exit XY+1=flag from transmission block XY+2=port received XY+3..4=station received from XY+9..12=updated to new address of buffer end Unread receive blocks must be deleted with OSByte &34. &12 (NFS) Read argument block and restore NFS protection mask On exit XY+0..1=station number XY+2.. =supplied arguments &13 (NFS) Read/Write station information XY+0=function XY+1=start of read data or written data Functions are: 0 - Read file server number to XY+1..2 1 - Write file server number from XY+1..2 2 - Read printer server number to XY+1..2 3 - Write printer server number from XY+1 4 - Read protection mask to XY+1 5 - Write protection mask from XY+1 6 - Read user environment: XY+1=URD XY+2=CSD XY+3=LIB 7 - Write user environment: XY+1=URD XY+2=CSD XY+3=LIB 8 - Read local station number to XY+1 9 - Read number of arguments to XY+1 and size of argument block to XY+2 for OSWord &12 above 10 - Read extended error number to XY+1 11 - ? 12 - ? 13 - ? 14 - ? 15 - Read ANFS timeouts in seconds, XY+1=not listening XY+2=no reply XY+3=machine peek 16 - Write ANFS timeouts in seconds, as above &14 (NFS) Various NFS/Network functions XY+0 =0 - Communicate with fileserver XY+1 =size of rest of block XY+2 =0 XY+3 =function XY+4 =0 XY+5 =0 XY+6 =0 XY+7... contains rest of information On exit XY+1=updated size of block XY+2=command code 0 for ok <>0 to continue with another function XY+3=error code 0 for ok <>0 for error CR-terminated error string following XY+4..contains returned data. XY+0 =1 - Send text string to remote station. XY+1..2=destination station XY+3... string to send, terminated by CR or &00. The CR also gets sent. XY+0 =2 - Generate error on remote machine. XY+1..2=destination machine. &15 (RISC OS 1.00) Read/Write mouse and pointer information XY+0 =0 - Set pointer size, shape and active point XY+1 =shape number (1-4) XY+2 =width in bytes (0-8) XY+3 =height in pixels (0-32) XY+4 =ActiveX in pixels from left XY+5 =ActiveY in pixels from top XY+6..9=pointer shape data. XY+0 =1 - Define mouse bounding box XY+1..2=left coordinate XY+3..4=bottom coordinate XY+5..6=right coordinate XY+7..8=top coordinate XY+0=2 - Set mouse multipliers XY+1=signed 8-bit X multiplier XY+2=signed 8-bit Y multiplier XY+0 =3 - Set mouse position XY+1..2=X position XY+3..4=Y position. XY+0 =4 - Read unbuffer mouse position XY+1..2=X position XY+3..4=Y position. XY+0 =5 - Set pointer position XY+1..2=X position XY+3..4=Y position. XY+0 =6 - Read pointer position XY+1..2=X position XY+3..4=Y position. &16 (RISC OS 1.00) Write screen base address R0=&16 R1=pointer to 5 byte buffer R1+0 Type b0 set if setting screen base used by VDU b1 set if setting screen base used by hardware R1+1 New screen offset LO R1+2 New screen offset R1+3 New screen offset R1+4 New screen offset HI The screen offset MUST be divisible by 16 &28-&31 (Prisma 2) Allocated to Millipede Prisma 2 Graphics Processor. Block format unknown &36 (AMX Stop Press routines) Function unknown. Block format unknown &40 (AMX Super Art) Read mouse pointer and button state. XY+0=X cood LO XY+1=X ccod HI XY+2=Y cood LO XY+3=Y ccod HI XY+4=X text coodinate XY+5=Y text coodinate XY+6=button state &80=cancel &40=move &20=execute &41 (AMX Super Art) Miscellaneous graphics commands XY+0=command # XY+1=rest of the block Commands are: 0 = Draw patterned block. XY+1 is pattern number XY+2 (2 bytes) is the left X coordinate XY+4 (2 bytes) is the bottom Y coordinate XY+6 (2 bytes) is the right X coordinate XY+8 (2 bytes) is the top Y coordinate. 1 = Store area of screen. XY+1 (4 bytes) is the destination address XY+5 is the left X text coordinate XY+6 is the bottom Y text coordinate XY+7 is the width in characters XY+8 is the height in characters. 2 = Restore area of screen. XY+1 (4 bytes) is the source address XY+5 is the left X text coordinate XY+6 is the bottom Y text coordinate XY+7 is the width in characters XY+8 is the height in characters. 3 = Store area then draw window on screen. XY+1 (4 bytes) is the destination address XY+5 is the left X text coordinate XY+6 is the bottom Y text coordinate XY+7 is the width in characters XY+8 is the height in characters. 4 = Pull down a menu. XY+1 (4 bytes) is the data store address XY+5 is the left X text coordinate XY+6 is the bottom Y text coordinate XY+7 is the width in characters XY+8 is the height in characters XY+9 (4 bytes) is the text address XY+13 (3 bytes) are the tick and options flags. Text is stored as CR-separated strings, terminated by a zero byte. Tick and options flags are split into 12 low-order bits (legal selections) and 12 high order bits (ticks). 5 = Select option from pull down menu. XY+1 is the left X coordinate XY+2 is the bottom Y coordinate XY+3 is the right X coordinate XY+4 is the top Y coordinate XY+5 (2 bytes) are illegal options flags. On exit, XY+0 is the selection number, or 0 if no item was selected 6 = Shift AMX Art screen. XY+1 is the X shift XY+2 is the Y shift. 7 = Set Mouse coordinates. XY+1 (2 bytes) is the X coordinate XY+3 (2 bytes) is the Y coordinate. 8 = Read AMX ROM details. On exit, XY+1 is the ROM number XY+2 is the workspace address XY+4 is the mouse flag (0=off, &80=on) XY+5 is the pointer flag (0=off, &40=on) XY+6 is the RAM pattern address XY+8 is the status flag b0-b3 keys generated by buttons b4-b6 button status b7 mouse movement generates cursor key motion XY+9 is the pointer X coordinate XY+11 is the pointer Y coordinate XY+13 is the mouse sensitivity flag b0-b2 X sensitivity b3-b5 Y sensitivity b6-b7 device type flag XY+14 is the ROM version number. &42 (SWRAM utils) Perform *SRREAD and *SRWRITE. XY+0=call type b7 clear if reading from SWRAM set for writing to SWRAM b6 clear for absolute addressing set for pseudo addressing b5 : reserved b0 XY+1=start addr LO XY+2=start addr XY+3=start addr XY+4=start addr HI XY+5=block length LO XY+6=block length HI XY+7=rom id (only applies if in absolute addressing mode) range: 0-15 decimal W,X,Y,Z are mapped onto ids: 16-19 respectively XY+8=SWRAM address LO XY+9=SWRAM address HI On exit the call block is unaltered &43 (SWRAM utils) Perform *SRLOAD and *SRSAVE XY+0 =call type b7 clear if reading from SWRAM b6 clear for absolute addressing b5 : reserved b0 XY+1 =filename pointer LO XY+2 =filename pointer LO XY+3 =rom id (only applies if in absolute addressing mode) range: 0-15 decimal W,X,Y,Z are mapped onto ids: 16-19 respectively XY+4 =start addr LO XY+5 =start addr HI XY+6 =filelength LO XY+7 =filelength HI (for save operations only) XY+8 =pointer to buffer in the IO processor LO XY+9 =pointer to buffer in the IO processor HI XY+10=buffer length LO XY+11=buffer length HI If the length of the buffer is zero then the default buffer will be used and so XY+8 and XY+9 will be ignored. If the length of the buffer is less than 32768 then that buffer will be used, if greater than 32768 then ALL the available space from OSHWM to the bottom of screen RAM will be used (this is how the 'Q' option is implemented if the command had been entered at the CLI) On exit the call block is unaltered unless overwritten by the buffer &44 (AMX Super Art) Access ROM commands, but without using the command line interpreter. XY+0=manufacturer 0=AMS others=??? XY+1=command# XY+2=number of arguments to the command, n. XY+3=the 'n' arguments Commands are: 0 = *buttons off 1 = *buttons XY+3 2 = *sensitivity XY+3 [XY+4] 3 = *update 4 = *icon XY+3 [XY+4, XY+5] 5 = *desk [XY+3, XY+4] 6 = *window XY+3, XY+4, XY+5, XY+6 7 = *pointer XY+3, XY+4 8 = *loop XY+3 9 = *movepointer 10 = *showpointer 11 = *hidepointer 12 = *mcursor XY+3 (1=on, 0=off) 13 = *header 14 = *mwindow XY+3, XY+4, XY+5, XY+6 15 = *pattern XY+3 16 = *spray 17 = *device &45 (Aries B32) Aries B32 move/swap XY+0=function 0=move 1=Swap XY+1=source start address XY+3=bank specifier &00 to &0F for sideways roms/rams and program RAM &80 to &8F for sideways rom/rams and video RAM XY+4=source end plus 1 XY+6=destination address XY+8=destination bank specifier (as above) XY+9 returns the return code 0=ok 1=overlapping areas for swap 2=end before start 3=destination end >&FFFF 4=no RAM in bank 13 or 14. &46 (BBC Soft) Allocated but probably unused. &47-&5E (3rd party use) These calls are passed to the paged ROMs &5F (BBC Soft) Monitor reads across the Tube. Block format unknown &60 (VFS) Read Videodisk master sequence number and status byte On exit XY+0=Master Sequence Number XY+1=status byte: b7=Tube present b6=Tube claimed by VFS b5=LVROM controller present b4=n/u b3=n/u b2=*OPT1 flag b1=Bad b0=IRQ pending &61 (VFS LASERDISK ROM) Read free space on VFS disc. This is unused/unimplemented as VFS is read-only media. &62 (VFS LASERDISK ROM) Access LVROM controller Same format as ADFS call &72 Commands are &00=Test drive ready &01=Seek track 0 &03=Request status &08=Read sectors &1B=Stop/Start drive - stop if XY+9=0 start if XY+9=1 &C8=Read F-code result from LVDOS &CA=Transmit F-code to LVDOS Results are &02=Drive door open &03=Media error, eg. disc dirty &05=Bad SCSI command &63 (VFS LASERDISK ROM) Read last VFS error number Same format as ADFS call &73 &64 (VFS LASERDISK ROM) Read current F-code On exit XY+0...contains current F-code command string terminated by CR. &6E (Watford 32K shadow RAM) Read byte from shadow RAM board XY+0..1=address within RAM board XY+2=bank flag, b0=0 - &0000-&2FFF is main memory b0=1 - &0000-&2FFF is shadow memory b1=0 - &3000-&7FFF is main memory b1=1 - &3000-&7FFF is shadow memory On exit XY+3=byte read. &6F (Watford 32K shadow RAM) Write byte to shadow RAM board XY+0..1=address within RAM board XY+2 =bank flag, as per OSWord &6E XY+3 =byte to be written On exit XY+3=former contents of memory location. &70 (ADFS) Read master sequence number and status byte. On exit XY+0=master sequence number, in BCD XY+1=b0 file ensuring in progress (IRQ pending) b1 bad free space map b2 *OPT1 setting b3 undefined b4 undefined b5 Winchester disc controller present b6 Tube in use by ADFS b7 Tube present &71 (ADFS) Read free space on disc. Gives the free space as the command *FREE does XY+0=32 bit LO XY+1=32 bit XY+2=32 bit XY+3=32 bit HI &72 (ADFS) Write to disc controller chip. This call allows communication with the disc controller chip without having to worry about writing an NMI handler. This is for 1770 use (see OSWord &7F) XY+0 =zero XY+1 =ptr to data LO XY+2 =ptr to data XY+3 =ptr to data XY+4 =ptr to data HI XY+5 =&8 to read or &A to write XY+6 =b0 : top 5 bits of sector number b4 b5 : drive number to be ORed with currently selected drive b7 XY+7 =sector number middle 8 bits XY+8 =sector number LO 8 bits XY+9 =sector count (for read operations) XY+10=unused XY+11=number of bytes to write LO XY+12=number of bytes to write XY+13=number of bytes to write XY+14=number of bytes to write HI On exit XY+0=zero if successful, otherwise returns an error code &48-CRC error &50-sector not found &60-bad command &61-bad address &63-volume error &65-bad drive &73 (ADFS) Read last ADFS error information. This provides a means of reading the details that appears in the error message for fatal ADFS errors. XY+0=sector num LO XY+1=sector num XY+2=b0 : sector num HI b4 b5 : drive # b7 XY+3=disc error number &0C-CRC error (ID) &0E-CRC error (data) &14-track 0 missing &16-write fault &18-sector not found XY+4=channel number of file that caused the error &7A (Teletext ROM) XY+0=&80 Reload the last page fetched XY+0=&86 Fetch the next page in the chain of the current chain (if loading a telesoftware file) or the next rolling page if not a file XY+0=&88 Goto start of chain/rolling sequence XY+0=&89 See if the last page requested has arrived yet XY+1=result Result is &FF for succeed or 0 for fail If the test was successful, the page is then locked and no further refreshes will be attempted XY+0=&8A Unlock page XY+0=&8B Select TV channel XY+1=channel number XY+0=&8D Reads the 'television data service data packet' XY+1=16 bit addr LO and writes the 16 bit value to the block XY+2=16 bit addr HI XY+0=&8E Checks the hamming code of the 8 bit byte and XY+1=byte to decode returns &FF for a bit error, otherwise OK XY+0=&8F Transfer the current page to the 32 bit address XY+1=32 bit addr LO which takes into account 2nd processors XY+2=32 bit addr XY+3=32 bit addr XY+4=32 bit addr HI XY+0=&92 Future readable headers received will be written to XY+1=16 bit addr LO the 16 bit address given, which could be used to XY+2=16 bit addr HI show the clock (etc...) on a MODE 7 display XY+0=&93 Reads the channel number currently selected XY+1=channel number &7B (COMMAND ROM) Modem commands On entry XY+0=command as follows: 1 - Read status byte to XY+0: b0=offline/online b1=XOFF sent b2=XOFF received b3=carrier present 2 - Put byte to modem. XY+1=byte to send. 3 - Get byte from modem. On exit XY+0=byte XY+1=255 if valid, 0 if invalid. 4 - Put string to modem. XY+1=length XY+2.. contains string. No exit parameters. 5 - Get string from modem. On exit XY+0=length read XY+1..contains string. 6 - Read from remote computer. XY+1=maximum length XY+2..3=maximum time in centiseconds On exit XY+0=length of string XY+1..contains string. If RETURN not receieved within the time a Timout error (103) is generated. &7D (DFS) Read master sequence number in BCD. The master sequence number is incremented by 1 for each disc write operation. XY+0=number &7E (DFS) Read disc size in bytes XY+0=disc size LO XY+1=disc size XY+2=disc size HI Typically a 40 track disc is &190000 and 80 track returns &320000 &7F (DFS) Write to disc controller chip. This call allows communication with the disc controller chip without having to worry about writing an NMI handler. This is for 8271 use (see OSWord &72) XY+0 =drive number XY+1 =ptr to data LO XY+2 =ptr to data XY+3 =ptr to data XY+4 =ptr to data HI XY+5 =number of parameters for this 'command', usually 3 XY+6 =command, &53 to read or &4B to write XY+7 =track # XY+8 =sector # XY+9 =b0 : number of sectors to read or write b4 b5 : encoded number of bytes per sector 000=128 bytes per sector b7 001=256 bytes per sector 010=512 bytes per sector 100=1024 bytes per sector XY+10=result, zero for success otherwise returns an error code as detailed in OSWord &73 &80 (IEEEFS) This call allows the issue of IEEEFS commands without using the command line interpreter. Block format unknown (ARM Springboard) Makes a DOS INT call from the ARM and returns the updated register results in the block at XY+4 onwards. XY+0 =24 XY+1 =24 XY+2 =INT number to call LO XY+3 =INT number to call HI XY+4..6 =AX (16 bit) XY+6..7 =BX (16 bit) XY+8..9 =CX (16 bit) XY+10..11=DX (16 bit) XY+12..13=SI (16 bit) XY+14..15=DI (16 bit) XY+16..17=DP (16 bit) XY+18..19=ES (16 bit) XY+20..21=Flags (16 bit) &81 (SWI emulation) Performs the equivalent of a RISC OS SWI on systems which may be later ported to and from a BBC micro, or which are running under emulation on a more capable host. XY+0 =42 XY+1 =42 XY+2 =SWI number LO XY+3 =SWI number XY+4 =SWI number HI XY+5 =status register XY+6 =bit set of registers 0-7 to pass to SWI XY+7 =bit set of registers 0-7 to return to 6502 caller XY+8 =unused XY+9 =unused XY+10=unused XY+11=register 0 XY+15 : XY+39=register 7 If on exit from the SWI an error occurred then the error message pointed to by R0 will be translated into a 6502 style error message, if at this point the SWI called had bit 17 clear a BRK error will be executed, otherwise control is returned to the caller to take appropriate action. (ARM Springboard) Purpose unknown, only the send/receive lengths for Tube purposes are filled in as follows XY+0=0 XY+1=10 &82 (Cambridge ring) Read/Write parameters. Block format unknown &83 (Cambridge ring) Data transmission. Block format unknown &84 (Cambridge ring) Ring polling. Block format unknown &90 (???) Service interface - Network. Block format unknown &A0 (???) Isolated word recogniser. Block format unknown &E0-&FF (User) Passed through USERV on an unexpanded machine &FA (80186 second processor) Read or write a block from i/o processor memory. The 80186 uses DS and BX instead of the 6502's X and Y DS:BX +&0 = 13 (or 14 if the memory access control byte is specified) +&1 = 1 +&2 = 4 byte i/o processor address +&6 = 2 byte offset address in the 80186 processor address +&8 = 2 byte segment address in the 80186 processor address +&A = number of bytes to transfer +&C = operation 0 = write at 24us/byte 1 = read at 24us/byte 2 = write at 26us/pair of bytes 3 = read at 26us/pair of bytes 6 = write at 10us/byte in 256 byte blocks 7 = read at 10us/byte in 256 byte blocks +&D = 65C12 memory access control b0..3=paged ROM number b4=if i/o address given is between &8000 and &C000 use set - currently selected ROM clear - ROM number given in bits 0..3 b5=if i/o address given is between &3000 and &8000 use set - shadow screen memory clear - main screen memory b6=if i/o address given is between &3000 and &8000 use set - screen memory regardless of *SHADOW state this bit overrides b5 if a conflict occurs b7=unused &FF (Z80 second processor) Read or write a block from i/o processor memory. The Z80 uses H and L instead of the 6502's X and Y HL +&0 = 13 +&1 = 1 +&2 = 4 byte i/o processor address +&6 = 4 byte Z80 processor address +&A = number of bytes to transfer +&C = operation (1=read, 0=write)