System variables and low RAM
===========#==#=======#===============================================#=====
----------------------|TT MFP Vectors |-----
===========#==#=======#===============================================#=====
$00000140.L|RW|TTMFP00|GPI 0 |TT
$00000144.L|RW|TTMFP01|GPI 1 |TT
$00000148.L|RW|TTMFP02|SCC-DMA Controller |TT
$0000014C.L|RW|TTMFP03|Ring Indicator SCC B |TT
$00000150.L|RW|TTMFP04|Timer D (RS232 baud rate generator) |TT
$00000154.L|RW|TTMFP05|Timer C (SCC TRxCB) |TT
$00000158.L|RW|TTMFP06|Reserved, GPI 4 |TT
$0000015C.L|RW|TTMFP07|SCSI DMA Controller |TT
$00000160.L|RW|TTMFP08|Timer B |TT
$00000164.L|RW|TTMFP09|Send Error |TT
$00000168.L|RW|TTMFP10|Send buffer empty |TT
$0000016C.L|RW|TTMFP11|Receive error |TT
$00000170.L|RW|TTMFP12|Receive buffer full |TT
$00000174.L|RW|TTMFP13|Timer A |TT
$00000178.L|RW|TTMFP14|TT Clock (MC146818A) |TT
$0000017C.L|RW|TTMFP15|TT-SCSI Drive Controller NCR 5380 |TT
===========#==#=======#===============================================#=====
----------------------|SCC Interrupt Vectors |-----
===========#==#=======#===============================================#=====
$00000180.L|RW| - |SCC Port B Transmit Buffer Empty |SCC
$00000184.L|RW| - |Unused |SCC
$00000188.L|RW| - |SCC Port B External Status Change |SCC
$0000018C.L|RW| - |Unused |SCC
$00000190.L|RW| - |SCC Port B Receive Character Available |SCC
$00000194.L|RW| - |Unused |SCC
$00000198.L|RW| - |SCC Port B Special Receive Condition |SCC
$0000019C.L|RW| - |Unused |SCC
$000001A0.L|RW| - |SCC Port A Transmit Buffer Empty |SCC
$000001A4.L|RW| - |Unused |SCC
$000001A8.L|RW| - |SCC Port A External Status Change |SCC
$000001AC.L|RW| - |Unused |SCC
$000001B0.L|RW| - |SCC Port A Receive Character Available |SCC
$000001B4.L|RW| - |Unused |SCC
$000001B8.L|RW| - |SCC Port A Special Receive Condition |SCC
$000001BC.L|RW| - |Unused |SCC
| | | CORRECTED: this table was previously built |SCC
| | | densely (4 consecutive different meanings per |SCC
| | | channel). The real layout is sparse, every |SCC
| | | other slot unused, confirmed by the Atari |SCC
| | | Compendium AND Atari's own TOS 2.06/3.06 |SCC
| | | source (tos3x bios/chardev.S, sccvect: table).|SCC
===========#==#=======#===============================================#=====
----------------------|Exception Crash Save Area |-----
===========#==#=======#===============================================#=====
$00000380.L|RW|PRCLIVE|Validates crash page, if $12345678 |
$00000384. |RW|PRCDREG|Saved registers D0-D7 (32 bytes) |
$000003A4. |RW|PRCAREG|Saved registers A0-A7 (32 bytes) |
$000003C4.L|RW|PRCENUM|Vector number of crash exception |
$000003C8.L|RW|PRC_USP|Saved user stack pointer |
$000003CC. |RW|PRC_STK|16 words from exception stack (32 bytes) |
===========#==#=======#===============================================#=====
----------------------|GEM Vectors |-----
===========#==#=======#===============================================#=====
$00000400.L|RW|ETVTIMR|etv_timer - GEM event timer vector |
$00000404.L|RW|ETVCRIT|etv_critic - GEM critical error handler |
$00000408.L|RW|ETVTERM|etv_term - GEM program termination vector |
$0000040C.L|RW|ETVXTRA|etv_xtra - 5 additional vectors, unused |
===========#==#=======#===============================================#=====
----------------------|System Variables |-----
===========#==#=======#===============================================#=====
$00000420.L|RW|MEMVALD|memvalid - memory conf valid if $752019F3 |
$00000424.B|RW|MEMCTRL|memcntlr - copy of $FFFF8001 %____xxxx |
| | | Bank 0 size 00:128k,01:512k,10:2Mb-------+||| |
| | | Bank 1 size 00:128k,01:512k,10:2Mb---------+| |
$00000426.L|RW|RESVALD|resvalid - resvector valid if $31415926 |
$0000042A.L|RW|RESVECT|resvector - system reset bailout vector |
$0000042E.L|RW|PHYSTOP|phystop - physical top of ST RAM |
$00000432.L|RW|_MEMBOT|_membot - bottom of TPA (user memory) |
$00000436.L|RW|_MEMTOP|_memtop - top of TPA (user memory) |
$0000043A.L|RW|MEMVAL2|memval2 - validates memcntlr if $237698AA |
$0000043E.W|RW|_FLOCK |flock - if <>0, VBL floppy routine is off |
$00000440.W|RW|SEEKRAT|seekrate - floppy step rate %______xx | | | | 0:6ms 1:12ms 2:2ms 3:3ms (WD1772)----------+| |
$00000440 seekrate Floppy drive step rate
Word. Sets the step rate for BOTH floppy drives.
0 = 6 ms
1 = 12 ms
2 = 2 ms
3 = 3 ms (default)
These values are written straight into the low two bits of a
WD1772 Type I command, so they are the chip's own encoding.
IMPORTANT: these are WD1772 values. The WD1770 uses 6, 12, 20
and 30 ms for the same four encodings, so values must never be
carried between the two chips.
On the Atari 3 ms is the normal setting. 2 ms works but gives
less reliable seeks in practice.
TOS declares this as _seekrate at $440 in common/tosvars.inc.
Values from the Atari Compendium, cross-checked against the
WD1772 command encoding.
$00000442.W|RW|TIMR_MS|_timr_ms - system timer calibration, ms |
$00000444.W|RW|FVERIFY|_fverify - if <>0, verify floppy writes |
$00000446.W|RW|BOOTDEV|_bootdev - default boot drive |
$00000446 _bootdev Boot device
Word. The device the system was booted from.
0 = A: 1 = B: 2 = C: and so on
Hatari writes this directly during machine setup
(src/stMemory.c: STMemory_WriteWord(0x446, nBootDrive)),
commented "Boot up on A(0) or C(2)".
TOS declares it as _bootdev at $446 in common/tosvars.inc.
Meaning from the Atari Compendium.
$00000448.W|RW|PALMODE|palmode - 0:NTSC(60Hz), else PAL(50Hz) |
$0000044A.B|RW|DEFSHFT|defshiftmd - default video resolution |
$0000044C.B|RW|SSHIFTM|sshiftmd - copy of $FFFF8260 %_____xxx | | | | 0:low 1:medium 2:high resolution----------+|| |
$0000044C sshiftmd Shifter mode shadow
Byte. A copy of the hardware shift mode register at
$FFFF8260, kept so software can read the current resolution
without touching the hardware.
0 = low 320x200, 4 planes
1 = medium 640x200, 2 planes
2 = high 640x400, 1 plane
The related variable defshiftmd at $0000044A holds the
resolution to use at the next reset.
From the Atari Compendium and Atari TOS common/tosvars.inc.
$0000044E.L|RW|V_BAS_A|_v_bas_ad - screen base address |
$00000452.W|RW|_VBLSEM|vblsem - if >0, VBL routine is executed |
$00000454.W|RW|_NVBLS |nvbls - number of VBL routines |
$00000456.L|RW|VBLQUEU|_vblqueue - pointer to list of VBL routines |
$0000045A.L|RW|COLORPT|colorptr - palette to load at next VBL |
$0000045E.L|RW|SCREENP|screenpt - video RAM base for next VBL |
$00000462.L|RW|VBCLOCK|_vbclock - count of VBL interrupts |
$00000466.L|RW|FRCLOCK|frclock - count of unblocked VBL interrupts |
$0000046A.L|RW|HDVINIT|hdv_init - hard disk initialisation vector |
$0000046E.L|RW|SWV_VEC|swv_vec - resolution change vector |
$00000472.L|RW|HDV_BPB|hdv_bpb - hard disk Getbpb vector |
$00000476.L|RW|HDV_RW |hdv_rw - hard disk read/write vector |
$0000047A.L|RW|HDVBOOT|hdv_boot - hard disk boot vector |
$0000047E.L|RW|HDVMEDC|hdv_mediach- hard disk media change vector |
$00000482.W|RW|CMDLOAD|_cmdload - if <>0, load COMMAND.PRG at boot |
$00000484.B|RW|CONTERM|conterm - console attributes %____SBRK | | | | Bconin returns shift status--------------+||| | | | | System bell 0:off,1:on--------------------+|| | | | | Key repeat 0:off,1:on----------------------+| | | | | Key click 0:off,1:on------------------------+ |
$00000484 conterm Console attribute bits
Byte. A bit array controlling several console behaviours:
Bit 3 Cause Bconin() to return the shift status in the
high word of its return value
Bit 2 Enable system bell
Bit 1 Enable key repeat
Bit 0 Enable key click
Bit 3 is the useful one for anything reading the keyboard
directly: with it set, Bconin() returns the state of the
shift, control and alternate keys alongside the character.
The byte at $00000485 immediately after is reserved.
TOS declares this as _conterm at $484 in common/tosvars.inc,
described there as the attribute vector for console output.
Bit meanings from the Atari Compendium.
$00000485.B|RW| - |Reserved |
$00000486.L|RW|TRP14RT|trp14ret - trap #14 return address, unused |
$0000048A.L|RW|CRITRET|criticret - critical error handler return |
$0000048E. |RW|_THEMD |themd - first memory descriptor (16 bytes)|
$0000049E.L|RW|___MD |_md - space for additional descriptor |
$000004A2.L|RW|SAVPTR |savptr - pointer to BIOS register save area|
$000004A6.W|RW|_NFLOPS|nflops - number of floppy drives attached |
$000004A8.L|RW|CONSTAT|con_state - vector for screen output |
$000004AC.W|RW|SAVEROW|save_row - temporary cursor line storage |
$000004AE.L|RW|SAVCTXT|sav_context- exception processing save area |
$000004B2. |RW|_BUFL |bufl - 2 GEMDOS buffer list heads(8bytes)|
$000004BA.L|RW|_HZ_200|hz_200 - 200 Hz system clock counter |
$000004BE.L|RW|THE_ENV|the_env - default environment string |
$000004C2.L|RW|DRVBITS|_drvbits - bit map of mounted drives |
$000004C2 _drvbits Connected drive bitmap
Longword. One bit per drive letter:
Bit 0 = A:, bit 1 = B:, through to bit 25 = Z:
A set bit means that drive exists.
Note: if at least ONE floppy drive is connected, BOTH the A
and B bits are always set. This is because of virtual drive
swapping, where a single physical drive answers as both A and
B with a disk change prompt. Testing bit 1 does not tell you
whether a second physical drive is fitted; use nflops at
$000004A6 for that.
From the Atari Compendium and Atari TOS common/tosvars.inc.
$000004C6.L|RW|DSKBUFP|_dskbufp - pointer to 1K disk buffer |
$000004CA.L|RW|AUTOPAT|_autopath - pointer to autoexec path |
$000004CE. |RW|VBLLIST|_vbl_list - 8 VBL routine pointers (32 bytes) |
$000004EE.W|RW|DUMPFLG|_dumpflg - screen dump flag |
$000004F0.W|RW|_PRTABT|prtabt - printer abort flag |
$000004F2.L|R-|SYSBASE|_sysbase - pointer to start of OS |
$000004F2 _sysbase Pointer to the operating system
Longword. Points to the start of TOS in memory, which begins
with the OS header structure:
Offset Size Field Meaning
$00 word os_entry BRA.S to the reset handler
$02 word os_version TOS version number
$04 long reseth pointer to the reset handler
$08 long os_beg base address of the OS
$0C long os_end end of ST-RAM used by the OS
$10 long os_rsv1 reserved, default UI entry point
$14 long os_magic GEM memory usage parameter block
$18 long os_date TOS date
$1C word os_conf PAL flag and country code
$1E word os_dosdate TOS date in GEMDOS format
$20 long os_root BDOS quick pool pointer (1.2+)
$24 long os_kbshift pointer to the shift state (1.2+)
$28 long os_run pointer to current basepage(1.2+)
$2C long reserved (1.2+)
The last four fields only exist from TOS 1.2 onward. Check
os_version before reading them.
os_version is BCD: $0102 is TOS 1.02, $0404 is TOS 4.04.
CONFLICT on os_date format: the Atari Compendium gives it as
$YYYYMMDD. EmuTOS include/biosdefs.h comments it as BCD
MMDDYYYY. Not resolved here.
EmuTOS note: EmuTOS puts the ASCII signature 'ETOS' in the
final longword at offset $2C, where real TOS leaves it
reserved. That is a reliable way to detect EmuTOS.
Structure from the Atari Compendium and EmuTOS
include/biosdefs.h. Hatari reads this variable at
src/gemdos.c to locate the OS.
$000004F6.L|RW|SHELL_P|_shell_p - pointer to shell |
$000004FA.L|R-|_END_OS|end_os - pointer to end of OS in RAM |
$000004FE.L|R-|EXEC_OS|exec_os - pointer to OS entry point |
$00000502.L|RW|SCR_DMP|scr_dump - pointer to screen dump routine |
$00000506.L|RW|PRTSTAT|prt_stat - pointer to prv_lsto |
$0000050A.L|RW|PRT_VEC|prt_vec - pointer to prv_lst |
$0000050E.L|RW|AUXSTAT|aux_stat - pointer to prv_auxo |
$00000512.L|RW|AUX_VEC|aux_vec - pointer to prv_aux |
$00000516.L|RW|PUN_PTR|pun_ptr - pointer to pun_info if AHDI |
$00000516 pun_ptr AHDI partition information
Longword. Points to a PUN_INFO structure maintained by AHDI,
Atari's hard disk driver, describing the mounted partitions.
The structure begins:
word puns number of drives supported, including
floppies (maximum 16)
then pun[16] one byte per drive:
bits 0-2 physical ACSI unit
bit 7 set if the drive is not
present
then start[16] longword starting sector of each
partition
A null pointer means AHDI is not loaded.
This is a driver structure rather than hardware, so its exact
layout depends on the AHDI version in use. Treat the above as
indicative.
TOS declares it as _pun_ptr at $516 in common/tosvars.inc with
the comment "if AHDI, pointer to pun_info". Structure from the
Atari Compendium.
$0000051A.L|RW|MEMVAL3|memval3 - memory conf valid if $5555AAAA |
$0000051E. |RW|BCONSTA|bconstat_vec - 8 input status vectors(32 bytes)|
$0000053E. |RW|BCONIN |bconin_vec - 8 input vectors (32 bytes) |
$0000055E. |RW|BCOSTAT|bcostat_vec - 8 output status vectors(32bytes)|
$0000057E. |RW|BCONOUT|bconout_vec - 8 output vectors (32 bytes) |
$0000059E.W|R-|LNGFRAM|_longframe - if <>0, CPU uses long stack frames|
$000005A0.L|R-|P_COOKI|_p_cookie - pointer to cookie jar |1.06+
$000005A4.L|RW|_RAMTOP|ramtop - top of alternative (Fast) RAM |TT,F
$000005A8.L|RW|RAMVALD|ramvalid - validates ramtop if $1357BD13 |TT,F
$000005AC.L|RW|BELHOOK|bell_hook - vector for system bell |1.06+
$000005B0.L|RW|KCLHOOK|kcl_hook - vector for keyclick |1.06+
===========#==#=======#===============================================#=====
----------------------|STBook |-----
===========#==#=======#===============================================#=====
$00000889.B|RW|LCDPSHD|Shadow of LcdPowerControl ($FFFF827F) |STB
===========#==#=======#===============================================#=====
Magic validation values, collected for reference:
memvalid $420 = $752019F3
resvalid $426 = $31415926
memval2 $43A = $237698AA
memval3 $51A = $5555AAAA
ramvalid $5A8 = $1357BD13
proc_lives $380 = $12345678
flock ($43E) must be non-zero before any direct FDC or DMA access, so
the VBL floppy routine does not deselect the drive or disturb the DMA
mid-transfer. Clear it again afterwards.
Sources: addresses and labels from Atari's own TOS source
(th-otto/tos1x, common/tosvars.inc), cross-checked against EmuTOS
(bios/tosvars.S), Hatari and The Atari Compendium Appendix B. Sizes are
inferred from address spacing and the Compendium; the byte-versus-word
calls on memcntlr, defshiftmd and sshiftmd are judgement rather than
documented. Read-only marks reflect convention, not hardware
enforcement.