HomeBIOSHooking into the reset vectorThe system vectors

3.4 The system variables

As the system variables and vectors represent the lowest level of the operating system, application programs should access these only when absolutely necessary. Explicitly:

The following list contains all the TOS system variables:

Variable     Address Description
_autopath    LONG 0x4ca Pointer to the access path for the AUTO-folder (unused and not officially documented).
_bootdev     WORD 0x446 Normally contains the number of the drive that was used for booting. In addition, this variable is also used during booting to select the boot-drive (but usually this only works when no hard disk driver is booted). So if one sets the variable to 1, has no boot-capable hard drive connected and executes a reset, booting will be from drive B!
_bufl        LONG 0x4b2 Two pointers to GEMDOS buffer lists.
_cmdload     WORD 0x482 If this register is non-0, an attempt is made to start the program COMMAND.PRG instead of GEM. The register may be set by a program in an executable bootsector.
_dskbufp     LONG 0x4c6 Pointer to a 1024-byte buffer for reading and writing to floppy disks or hard drives (e.g. at boot-attempts). The pointer is also used by the VDI.
_drvbits     LONG 0x4c2 Bit-table for the mounted drives of the BIOS. Valid are:

Bit-0 = Drive A
Bit-1 = Drive B
Bit-2 = Drive C (etc.)

In TOS 1.00 the variable is not cleared at a reset. Therefore custom drivers should clear the bits they have entered at a reset; otherwise it could happen that drive identifiers suddenly "disappear".
_frclock     LONG 0x466 Similar to _vbclock, with the difference that the count is not halted by vblsem.
_fverify     WORD 0x444 Determines whether the BIOS should perform a Verify via Rwabs when writing to floppy disks, or not. Valid are:

0 = No Verify

Normally the Verify is switched on.
_hz_200      LONG 0x4ba Number of 200-Hz interrupts till now.
_longframe   WORD 0x59e If this flag is not null, then a CPU with long stackframes (i.e. not a 68000 type) is installed. This value is of interest, for instance, if a routine is to be hooked into an exception vector, and the values to be examined are passed on the stack. If this variable has the value 0 than one will find the parameters at offset 6, otherwise at offset 8.
_md          LONG 0x49e Not officially documented, and probably also unused.
_membot      LONG 0x432 Lower end of the free ST-compatible memory region under GEMDOS (i.e. the start of the original TPA). The variable is used by the BIOS function Getmpb.
_memtop      LONG 0x436 Similar to _membot the end of the free ST-compatible memory region.
_nflops      WORD 0x4a6 Number of mounted floppy disk drives.
_p_cookies   LONG 0x5a0 Pointer to the cookie jar.
_prtabt      WORD 0x4f0 Flag for aborting the printing process due to a timeout. It is unused, however.
_shell_p     LONG 0x4f6 This pointer is not used by the ROM, i.e. programs that use it themselves have to clear it in the case of a reset and at a program termination. Normally _shell_p is set by UNIX-like shells, and points to a routine that handles a command line. The address of the character string is passed on the stack (4(sp)), the return of the operation will lie in register D0.
_sysbase     LONG 0x4f2 Points to a OSHEADER structure.
_timr_ms     WORD 0x442 Time in milliseconds that normally passes between two ticks of the system timer. This value is also returned by the BIOS function Tickcal.
_v_bas_ad    LONG 0x44e Pointer to the starting address of the logical screen, which on an ST has to be aligned at a 256-byte boundary. With an STE and TT this is a 2- or 8-byte boundary respectively.
_vbl_list    LONG 0x4ce List of the initial vertical blank routines. One should always access only via _vqlqueue.
_vbclock     LONG 0x462 Number of vertical blanks processed since the last reset.
_vblqueue    LONG 0x456 Pointer to the list of pointers to the deferred vertical blank handlers.
bell_hook    LONG 0x5ac Pointer to a routine for the output of the ping-sound (system bell). The BIOS looks after the querying of the flag automatically in con_term and calls this routine only when the bell should really be sounded. The routine is called in supervisor-mode and terminated via RTS; it may alter the registers D0-D2 and A0-A2. BIOS calls from "within" the routine are permitted (from TOS 1.06 on, from KAOS 1.4.2 on).
colorptr     LONG 0x45a Pointer to a colour palette, which is loaded into the ST hardware colour registers (from address 0xffff8240 onwards) at the next vertical blank. This prevens an unattractive flickering on the screen. If there is a null in colorptr, then nothing happns. After the transfer of the colour values the pointer is cleared.
con_state    LONG 0x4a8 Internal pointer for screen output routines (not officially documented).
conterm      BYTE 0x484 Attribute bits for the BIOS device "CON:". Valid are:
Bit-0 = Key-click on/off
Bit-1 = Key-repeat on/off
Bit-2 = Bell at ouput of CTRL-G
Bit-3 = Cause Bconin to return the current value of Kbshift in the bits 24..31.
criticret    LONG 0x48a oOfficially undocumented, and probably also unused.
defshiftmd   BYTE 0x44a Default colour graphic resolution. Switches the computer to colour operation (after a reset, by changing of the plugs or by switching on) into the specified resolution.
end_os       LONG 0x4fa Pointer to the first byte not used by TOS-internal variables (i.e. the first byte of free memory).
etv_critic   LONG 0x404 Logical GEMDOS vector 257. Should always be set only via Setexc.
etv_term     LONG 0x408 Logical GEMDOS vector 258. Should always be set via Setexc. Programs that hook into any system vectors should also hook into this vector. If the program is terminated in an abnormal manner, the operating system jumps first via this vector, so that one can withdraw cleanly from all changed vectors. As MagiC uses its own etv_term vector for each application, collisions can not arise there.
etv_timer    LONG 0x400 Logical GEMDOS vector 256. Should always be set via Setexc.
etv_xtra     LONG 0x40c Reserved for the logical vectors 259-263 of GEMDOS, and presently unused.
exec_os      LONG 0x4fe Pointer to the first byte of the text segment of the shell-program.
flock        WORD 0x43e If there is a non-zero value here, then you must not access the DMA chip. So DMA device drivers must first inquire whether the DMA chip has been blocked and set flock themselves when they start work.
hdv_boot     LONG 0x47a Vector to the routine for loading the boot sector. This routine is used by the BIOS to establish whether a boot-sector is present and establish whether there is a boot sector and if so, whether it is executable.
hdv_bpb      LONG 0x472 Vector to routine that establishes the BPB of a BIOS drive. The device number is passed on the stack (4(sp)).
hdv_init     LONG 0x46a Vector to the initialisation routines for the floppy disk drives. It is read out before reading the boot sectors, and hence can be altered only by reset-resident programs or ROM-modules. The tasks include:
  • Initialisation of the diskette drives (_nflops is set accordingly).
  • Transfer of seekrate to the internal variables of the BIOS.
hdv_mediach  LONG 0x47e Vector to routine for establishing the media-change status of a BIOS drive. The BIOS device number is passed on the stack (4(sp)).
hdv_rw       LONG 0x476 Vector to the routine for reading and writing of blocks to BIOS drives. The same parameters are passed on the stack as for Rwabs (starting with 4(sp); rwflag).
kcl_hook     LONG 0x5b0 Pointer to a routine for the output of the key-click sound. The BIOS itself serves for the inquiry of the flag in con_term and calls this routine only when the sound is to be issued. The routine is called in supervisor mode, terminated via RTS, and may alter the registers D0-D2 and A0-A2; it should not take up too much time. (From TOS 1.06 on, from KAOS 1.4.2 on)
memcntrl     BYTE 0x424 Contains the lowest four bits of the memory control register (0xffff8001)
Some known values are:

Memory size Value
128 K 0
512 K 4
256 K (2 banks) 0
1 MB 5
memval2      LONG 0x43a Should hold the magical value 0x237698aa after a successful cold start. If both memval2 as well as memvalid have the required value and from TOS 1.02 on memval3 as well), then at the next reset only a warm start will be initiated.
memval3      LONG 0x51a See also memval and memval2. In this case the magical value is 0x5555aaaa. (From TOS 1.02 on)
memvalid     LONG 0x420 Should contain the magical value 0x752019f3.
nvbls        WORD 0x454 Number of entries that _vblqueue points to. Identical with the maximum number of coresidentally installable vertical blank routines (default value: 8).
palmode      WORD 0x448 Tells the Atari the television mode. The following apply:

0 = NTSC mode (60 Hz)
1 = PAL mode  (50 Hz)

In practice this system variable is ignored. A change of the picture repetition frequency is only possible via the corresponding hardware registers.
phystop      LONG 0x42e Pointer to the first byte above the physical end of the ST-compatible RAM region (physical top of ST-compatible RAM)
prt_cnt      WORD 0x4ee Counter for the Alternate-Help key-presses. Valid are:
-1 = Normal status
 0 = Start hardcopy
>0 = Cancel hardcopy and reset value to -1


This variable also has to be set before a call of Prtblk.
prv_aux      LONG 0x512 Pointer to a routine for output to the serial port (likewise for hardcopy routine). The characer to be output lies in 6(sp).
prv_auxo     LONG 0x50e Pointer to a routine for establishing the status of the serial ports (likewise for hardcopy function).
prv_lst      LONG 0x50a Pointer to a routine for output to the parallel port (likewise for hardcopy routine). The character to be output lies in 6(sp).
prv_lsto     LONG 0x506 Pointer to a routine for establishing the status of the parallel port (likewise for hardcopy routine).
pun_ptr      LONG 0x516 After successful installation of an AHDI- compatible hard disk driver this points to a PUN_INFO structure.
ramtop       LONG 0x5a4 Pointer to the end of the Fast-RAM in Atari TT (not officially documented).
ramvalid     LONG 0x5a8 Magic value that shows whether ramtop holds a sensible value. Must be 0x1357bd13. Not officially documented.
resvalid     LONG 0x426 If this address at a reset contains the magic value 0x31415926, then the system will jump through resvector.
resvector    LONG 0x42a This is used during system initialisation. Contains the vector for a reset, provided resvalid contains the correct value. At the time of the call the hardware registers are not yet set, and the stack-pointer too has not been initialised yet.
sav_context  LONG 0x4ae Should actually be a pointer to the memory region into which parts of the stack are saved during exceptions. Actually however it is not used by TOS, and one therefore has to access the variables directly at the address 0x380.
sav_row      WORD 0x4ac Internal buffer for temporary saving the cursor row position when using an Esc-Y VT-52 sequence (not officially documented).
savptr       LONG 0x4a2 Pointer to temporary buffer to which internal registers of BIOS and XBIOS are saved.
scr_dump     LONG 0x502 Pointer to the hardcopy routine. Is used by the XBIOS function Scrdmp. Zeiger auf die Hardcopy-Routine. Wird von der XBIOS-Funktion Scrdmp benutzt.
screenpt     LONG 0x45e Pointer to the top of the physical screen. Is transferred at the next vertical blank after _v_bas_ad to the relevant hardware registers, bu not cleared subsequently. Therefore one should always work with Setscreen.
seekrate     WORD 0x440 Seek rate for the two floppy drives. Valid are:

0 =  6 ms
1 = 12 ms
2 =  2 ms
3 =  3 ms


The variable is read out straight after system start by the BIOS, and ignored afterwards. For altering the seek rate that is used actually, one has to use the XBIOS function Floprate.
sshiftmd     BYTE 0x44c Copy of the mode register of the shifter. Valid are:

0 =  320 * 200 (four planes)
1 =  640 * 200 (two planes)
2 =  640 * 400 (one planes)
3 =  640 * 480 (four planes, TT only)
4 = 1280 * 960 (one planes, TT only)
5 =  320 * 480 (eight planes, TT only)

All other values are reserved for future extensions.
swv_vec      LONG 0x46e Pointer to the routine that reacts to the connection of a black and white or colour monitor (at the start it points to the normal reset routine).
the_env      LONG 0x4be Pointer to the default environment strings (unused).
themd        MD   0x48e Pointer to the MD structure of the GEMDOS. This is set once only during initialisation of the system, and must not be altered (and it would be if using Getmpb!).
trp14ret     LONG 0x486 Officially not documented, and probably also unused.
vblsem       WORD 0x452 A value of 1 here means that the vertical blank handler is active.
xconin       LONG 0x53e Eight vectors for Bconin routines. (From TOS 1.02 on)
xconout      LONG 0x57e Eight vectors for Bconout routines. (From TOS 1.02 on)
xconstat     LONG 0x51e Eight vectors for Bconstat routines. (From TOS 1.02 on)
xcostat      LONG 0x55e Eight vectors for Bcostat routines. (From TOS 1.02 on)

See also:
Reset vector   The System Vectors   Program launch and TPA
System variables, sorted numerically

3.4.1 System variables, sorted numerically

Variable Size Address
0x400 LONG etv_timer
0x404 LONG etv_critic
0x408 LONG etv_term
0x40c LONG etv_xtra
0x420 LONG memvalid
0x424 BYTE memcntrl
0x426 LONG resvalid
0x42a LONG resvector
0x42e LONG phystop
0x432 LONG _membot
0x436 LONG _memtop
0x43a LONG memval2
0x43e WORD flock
0x440 WORD seekrate
0x442 WORD _timr_ms
0x444 WORD _fverify
0x446 WORD _bootdev
0x448 WORD palmode
0x44a BYTE defshiftmd
0x44c BYTE sshiftmd
0x44e LONG _v_bas_ad
0x452 WORD vblsem
0x454 WORD nvbls
0x456 LONG _vblqueue
0x45a LONG colorptr
0x45e LONG screenpt
0x462 LONG _vbclock
0x466 LONG _frclock
0x46a LONG hdv_init
0x46e LONG swv_vec
0x472 LONG hdv_bpb
0x476 LONG hdv_rw
0x47a LONG hdv_boot
0x47e LONG hdv_mediach
0x482 WORD _cmdload
0x484 BYTE conterm
0x486 LONG trp14ret
0x48a LONG criticret
0x48e MD themd
0x49e LONG _md
0x4a2 LONG savptr
0x4a6 WORD _nflops
0x4a8 LONG con_state
0x4ac WORD sav_row
0x4ae LONG sav_context
0x4b2 LONG _bufl
0x4ba LONG _hz_200
0x4be LONG the_env
0x4c2 LONG _drvbits
0x4c6 LONG _dskbufp
0x4ca LONG _autopath
0x4ce LONG _vbl_list
0x4ee WORD prt_cnt
0x4f0 WORD _prtabt
0x4f2 LONG _sysbase
0x4f6 LONG _shell_p
0x4fa LONG end_os
0x4fe LONG exec_os
0x502 LONG scr_dump
0x506 LONG prv_lsto
0x50a LONG prv_lst
0x50e LONG prv_auxo
0x512 LONG prv_aux
0x516 LONG pun_ptr
0x51a LONG memval3
0x51e LONG xconstat
0x53e LONG xconin
0x55e LONG xcostat
0x57e LONG xconout
0x59e WORD _longframe
0x5a0 LONG _p_cookies
0x5a4 LONG ramtop
0x5a8 LONG ramvalid
0x5ac LONG bell_hook
0x5b0 LONG kcl_hook

See also: System variables


HomeBIOSHooking into the reset vectorThe system vectors