INTERRUP.

Interrupt List Release 61 Last change 16jul00
Copyright (c) 1989-1999,2000 Ralf Brown

Index for category m - memory management,

02----SI0714 - INT 02 U - STB RAPIDMAP.SYS - ???

INT 02 U - STB RAPIDMAP.SYS - ???
	SI = 0714h
	ES:DI -> ???
Return: ???
SeeAlso: INT 67/AX=6100h"STB",PORT 00E1h"STB"

Top

1511DE - INT 15 - DESQview - QEXT.SYS - INSTALLATION CHECK

INT 15 - DESQview - QEXT.SYS - INSTALLATION CHECK
	AX = 11DEh
Return: CF clear if installed
	    AX = segment at which QEXT.SYS is located
Desc:	QEXT.SYS is Quarterdeck's HMA manager for DESQview; more recent
	  versions also implement the XMS standard
Note:	a private entry point (see #00434) may be found by searching the
	  beginning of the returned segment for the signature string
	  "QUARTERDECK EXTENDED MEMORY MANAGER 286"; the word immediately
	  prior to the signature contains the QEXT version number in BCD,
	  and the word prior to that contains the offset within the QEXT
	  code segment of the private entry point
SeeAlso: INT 2F/AX=4310h"XMS",INT 67/AH=3Fh

(Table 00434)
Call QEXT.SYS private entry point with:
	AH = 00h ???
	AH = nonzero ???

Top

15F200CX454D - INT 15 - Tandon memory mapper - Tandon MAPPER HARDWARE INITIALIZATION CHECK ???

INT 15 - Tandon memory mapper - Tandon MAPPER HARDWARE INITIALIZATION CHECK ???
	AX = F200h
	CX = 454Dh
Return: CF clear if hardware already initialised
	    BX = upper RAM areas in use
		bit 0: C000-C3FF
		bit 1: C400-C7FF
		...
		bit 11: EC00-EFFF
	CF set if hardware not initialised yet

Top

165758BX5754 - INT 16 U - Netroom ??? - ???

INT 16 U - Netroom ??? - ???
	AX = 5758h
	BX = 5754h
	???
Return: ???

Top

165758BX5755 - INT 16 U - Netroom ??? - ???

INT 16 U - Netroom ??? - ???
	AX = 5758h
	BX = 5755h
	DS:SI -> ???
Return: ???

Top

165758BX5756 - INT 16 U - Netroom ??? - INSTALLATION CHECK

INT 16 U - Netroom ??? - INSTALLATION CHECK
	AX = 5758h
	BX = 5756h
Return: BX <> 5756h if installed

Top

165758BX5858 - INT 16 U - Netroom PRENET - GET OLD INTERRUPT VECTORS

INT 16 U - Netroom PRENET - GET OLD INTERRUPT VECTORS
	AX = 5758h
	BX = 5858h
Return: CF clear
	DX:BX -> saved copy of interrupt vector table
InstallCheck:	call this function and compare BX against 5858h on return; if
	  it has changed, PRENET is installed
SeeAlso: AX=5758h/BX=5859h
Index:	installation check;Netroom PRENET

Top

165758BX5859 - INT 16 U - Netroom POSTNET - GET OLD INTERRUPT VECTORS

INT 16 U - Netroom POSTNET - GET OLD INTERRUPT VECTORS
	AX = 5758h
	BX = 5859h
Return: CF clear
	DX:BX -> saved copy of interrupt vector table
InstallCheck:	call this function and compare BX against 5859h on return; if
	  it has changed, POSTNET is installed
SeeAlso: AX=5758h/BX=5858h
Index:	installation check;Netroom POSTNET

Top

16B0B1 - INT 16 - VGARAM v1.00 - INSTALLATION CHECK

INT 16 - VGARAM v1.00 - INSTALLATION CHECK
	AX = B0B1h
	ES:DI -> 6 byte signature "VGARAM"
Return: AX = B1B0h if installed,
	DS:BX -> VGARAM Status byte: 0 = OFF, 1 = ON
Program: VGARAM is a utility by Brett Warthen which makes VGA memory which is
	  not used in text modes available for DOS

Top

212B01CX444D - INT 21 - Quarterdeck DOS-UP.SYS v2.00 - INSTALLATION CHECK

INT 21 - Quarterdeck DOS-UP.SYS v2.00 - INSTALLATION CHECK
	AX = 2B01h
	CX = 444Dh ('DM')
	DX = 4158h ('AX')
Return: AX = 0000h if installed
	    BX = DOS-UP version (BH = minor, BL = major)
	    CX = 4845h ('HE')
	    DX = 5245h ('RE')
	    ES = DOS-UP driver segment

Top

214402 - INT 21 U - LASTBYTE.SYS v1.19 - IOCTL - GET ??? TABLE

INT 21 U - LASTBYTE.SYS v1.19 - IOCTL - GET ??? TABLE
	AX = 4402h
	BX = handle for device "LA$TBYTE"
	CX = 0004h
	DS:DX -> DWORD to hold address of 39-byte table of ???
Return: CF set on error
	    AX = error code (see #01680 at AH=59h/BX=0000h)
	CF clear if successful
	    AX = number of bytes read
Program: LASTBYTE.SYS is part of the shareware "The Last Byte" memory
	  management package by Key Software Products
SeeAlso: AX=4402h"HIGHUMM"

Top

214402 - INT 21 - HIGHUMM.SYS v1.17+ - IOCTL - GET API ADDRESS

INT 21 - HIGHUMM.SYS v1.17+ - IOCTL - GET API ADDRESS
	AX = 4402h
	BX = handle for device "KSP$UMM"
	CX = 0004h
	DS:DX -> DWORD to hold entry point (see #01446)
Return: CF set on error
	    AX = error code (see #01680 at AH=59h/BX=0000h)
	CF clear if successful
	    AX = number of bytes read
Program: HIGHUMM.SYS is part of the shareware "The Last Byte" memory
	  management package by Key Software Products
SeeAlso: AX=4402h"LASTBYTE"

(Table 01446)
Call HIGHUMM.SYS entry point with:
	AH = 00h allocate UMB (same as XMS function 10h) (see INT 2F/AX=4310h)
	    DX = size in paragraphs
	    Return: BX = segment number (if successful)
		    DX = size of requested block/size of largest block
	AH = 01h deallocate UMB (same as XMS func 11h) (see INT 2F/AX=4310h)
	    DX = segment number of UMB
	AH = 02h request a bank-switched memory block
	    DX = size in paragraphs
	    Return: BX = segment number (if successful)
		    DX = size of requested block/size of largest block
	AH = 03h release a bank-switched memory block
	    DX = segment number
	AH = 04h transfer data to/from high memory
	    DS:SI -> source
	    ES:DI -> destination
	    CX = length in bytes
	    Note: enables bank-switched memory, does the copy, then disables
		bank-switched memory
	AH = 05h get a word from bank-switched memory
	    ES:DI -> word to read
	    Return: DX = word
	AH = 06h put a word to bank-switched memory
	    ES:DI -> word to write
	    DX = word
	AH = 07h put a byte to bank-switched memory
	    ES:DI -> byte to write
	    DL = byte
	AH = 08h enable bank-switched memory
	    DS:SI -> 6-byte status save area
	AH = 09h disable bank-switched memory
	    DS:SI -> 6-byte save area from enable call (AH=08h)
	AH = 0Ah assign name to UMB or high bank-switched block
	    DX = segment number
	    DS:SI -> 8-byte blank-padded name
	AH = 0Bh locate UMB block by name
	    DS:SI -> 8-byte blank-padded name
	    Return: BX = segment number (if successful)
		    DX = size of block
	AH = 0Ch locate bank-switched block by name
	    DS:SI -> 8-byte blank-padded name
	    Return: BX = segment number (if successful)
		    DX = size of block
Return: AX = status code
	    0001h successful
	    0000h failed
		BL = error code
		    80h not implemented
		    B0h insufficient memory, smaller block available
		    B1h insufficient memory, no blocks available
		    B2h invalid segment number
Note:	only functions 00h and 01h are always available; the remaining
	  functions are only enabled if the proper commandline switch is given

Top

214402 - INT 21 - Quarterdeck - QEMM-386 v5+ - GET API ENTRY POINT

INT 21 - Quarterdeck - QEMM-386 v5+ - GET API ENTRY POINT
	AX = 4402h
	BX = file handle for device "QEMM386$"
	CX = 0004h
	DS:DX -> DWORD buffer for API entry point
Return: CF clear if successful
	    buffer filled (refer to INT 67/AH=3Fh for entry point parameters)
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Note:	Quarterdeck recently (June 1993) documented this function, but the
	  documentation incorrectly states that it is only available for
	  QEMM 6+
SeeAlso: AX=4402h"HOOKROM",INT 2F/AX=D201h/BX=5145h,INT 67/AH=3Fh

Top

214402 - INT 21 U - Qualitas 386MAX v6.00+ - IOCTL INPUT - GET STATE

INT 21 U - Qualitas 386MAX v6.00+ - IOCTL INPUT - GET STATE
	AX = 4402h
	BX = file handle for device "386MAX$$"
	CX = number of bytes to read
	DS:DX -> BYTE 03h followed by 386MAX state buffer (see #01467)
Return: CF clear if successful
	    buffer at DS:DX+1 filled
	    AX = number of bytes actually copied
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Notes:	if the value given in CX is less than the size of the state record
	  (5Ah for v6.01, 66h for v7.00), only a partial state record will be
	  returned
	the state is 40h bytes for 386MAX (actually ASTEMM) v2.20 ("386MAX$$"
	  did not exist yet, use "QMMXXXX0" and then "EMMXXXX0" instead) and
	  56h bytes for v5.11.
	to invoke 386MAX API functions, push DX onto the stack, load DX with
	  the word at offset 25h in the returned state, load all other
	  registers as needed for the desired function, and execute an
	  OUT DX,AL or OUT DX,AX; DX will be set to the pushed value on return
	  if it is not otherwise modified by the API function.	For safety,
	  in case a function is not supported or 386MAX is not present, SP
	  should be saved and restored around the API call.
	Windows 3.1 Standard mode, LAN Manager, and Windows for Workgroups all
	  use the 386MAX API; LAN Manager and Windows for Workgroups reportedly
	  make some calls incorrectly
SeeAlso: AX=4403h/SF=03h"386MAX",INT 67/AH=3Fh

Format of 386MAX v6.01+ state:
Offset	Size	Description	(Table 01467)
 -1	BYTE	(call) 03h
 00h  6 BYTEs	signature "386MAX"
 06h  4 BYTEs	version string "N;NN" or "N.NN" (i.e. "6;01" for v6.01)
		(';' by default; apparently changed to a period when 386MAX
		has linked high RAM into DOS's memory chain)
 0Ah	WORD	segment of low-memory portion of 386MAX.SYS
 0Ch  2 BYTEs	???
 0Eh	WORD	segment of ??? memory block or 0000h
 10h	WORD	bit flags 1 (see #01468)
 12h	WORD	starting address of video memory in KB
 14h  2 BYTEs	???
 16h	WORD	total high DOS memory in KB
 18h  2 BYTEs	???
 1Ah	WORD	available shared memory in KB
 1Ch	WORD	KBytes extended memory used by 386MAX
 1Eh  2 BYTEs	???
 20h	WORD	total extended memory in KB
 22h	WORD	IO port to write (OUT DX,AL) to invoke 386MAX INT 15 functions
 24h	WORD	IO port to write (OUT DX,AL) to invoke 386MAX API functions
		  (see #01481)
 26h	WORD	??? (depends on DOS version)
 28h	WORD	size of ??? in paragraphs
 2Ah	DWORD	machine type (see #01476)
 2Eh	DWORD	-> first DOS memory control block
 32h	WORD	system configuration flags (see #01469)
 34h	WORD	debugging flags 1 (see #01470)
 36h	WORD	debugging flags 2 (see #01471)
 38h  2 BYTEs	???
 3Ah	WORD	segment of first MCB in high memory chain
 3Ch	WORD	feature flags 1 (see #01473)
 3Eh	WORD	feature flags 2 (see #01474)
 40h	WORD	feature flags 3 (see #01475)
 42h	WORD	segment of first 386MAX control block??? (see #01477)
 44h	WORD	amount of memory to report available on INT 15/AH=88h
 46h  4 BYTEs	???
 4Ah	WORD	number of K at start of address space swapped with fast
		  extended memory (SWAP= parameter)
 4Ch  2 BYTEs	???
 4Eh	WORD	segment address of ???
 50h	WORD	debugging flags 3 (see #01472)
 52h	DWORD	old INT 21h
 56h	DWORD	pointer to 386MAX's EMS (INT 67h) handler
---386MAX v7.00---
 5Ah	DWORD	KB of extended memory managed by 386MAX
 5Eh	DWORD	bytes of extended memory (EXT= parameter)
 62h  4 BYTEs	???

Bitfields for 386MAX bit flags 1:
Bit(s)	Description	(Table 01468)
 1	???
 2	allow A20 to be enabled/disabled???
 3	??? (cleared by calling INT 67 functions or starting MSWindows)
 4	high RAM present???
 5	386MAX in AUTO mode
 6	386MAX enabled
 7	386MAX is providing EMS services
 8	??? (affects API function 08h)
 9	A20 gate closed (A20 disabled) (see INT 15/AX=2402h)
 10	Weitek support enabled
 11	???
 12	ROMs not shadowed???
 13	QPMS has been used
 14	???
 15	???

Bitfields for 386MAX system configuration flags:
Bit(s)	Description	(Table 01469)
 1	ROM compressed???
 3	???
 5	386MAX loaded into high memory
 6	Microchannel bus
 7	Weitek math coprocessor detected
 9	??? (also generates INT 01 on ??? and INT 03 on ???)
 11	PC/XT (thus only single 8259 interrupt controller present, DMA only
		in 1st megabyte, etc)
 13	LMLTOP= specified
 14	enable A20 control???
 15	???

Bitfields for 386MAX debugging flags 1:
Bit(s)	Description	(Table 01470)
 0	DEBUG=LED
 1	DEBUG=X67
 2	DEBUG=INV
 3	DEBUG=EMSPTED
 4	DEBUG=JMP
 5	DEBUG=CALL
 6	DEBUG=HLT
 7	DEBUG=PMR
 8	DEBUG=CR3
 9	DEBUG=CAPS or DEBUG=INT
 10	DEBUG=RC
 11	DEBUG=ROM
 12	DEBUG=XM
 13	DEBUG=SOR
 14	DEBUG=XR
 15	DEBUG=EMSERR (generate INT 01 on returning error from EMS call)

Bitfields for 386MAX debugging flags 2:
Bit(s)	Description	(Table 01471)
 0	DEBUG=ROMSWAP
 1	DEBUG=UNSHADOWROM
 2	DEBUG=COMPROM
 3	DEBUG=DPMIPHYS
 4	DEBUG=ALLROM
 5	DEBUG=VMS
 6	DEBUG=XMS (generate INT 01 on XMS calls)
 7	DEBUG=I06
 8	DEBUG=VCPI
 9	DEBUG=XDMA
 10	DEBUG=X09
 13	DEBUG=I67 (generate INT 01 on every INT 67 call)
 14	DEBUG=EVM (generate INT 01 on entering V86 mode)
 15	DEBUG=EMSSAVE or DEBUG=VDS

Bitfields for 386MAX debugging flags 3:
Bit(s)	Description	(Table 01472)
 10	DEBUG=EPM
 12	DEBUG=ABIOS
 13	DEBUG=XMSPTED
 14	DEBUG=TIME
 15	DEBUG=SCRUB

Bitfields for 386MAX feature flags 1:
Bit(s)	Description	(Table 01473)
 1	Weitek present
 2	no DPMI services
 3	NODMA
 4	TERSE
 5	NOROM
 6	NOPARITY
 8	NOFLEX (IGNOREFLEXFRAME)
 11	don't create UMBs
 12	don't backfill below video memory (NOLOW)
 13	FRAME= specified
 14	EXT= specified
 15	NOEMS, allow prior expanded memory manager to provide EMS

Bitfields for 386MAX feature flags 2:
Bit(s)	Description	(Table 01474)
 0	UNSHIFT specified (FORCEA20 disabled)
 1	NOXRAM
 2	NOSCSI specified
 3	SCREEN specified
 4	enabled EISADMA
 5	slow DMA
 6	RESETKEYB specified
 7	???
 9	TOP384
 10	???
 11	NOWARMBOOT
 12	USE= specified
 13	ROM= specified

Bitfields for 386MAX feature flags 3:
Bit(s)	Description	(Table 01475)
 0	Windows3 support enabled
 1	SHADOWROM
 2	don't compress ROM (NOCOMPROM)
 3	??? (related to PRGREG=)
 4	??? (related to PRGREG=)
 5	SHADOWRAM
 6	DOS4 specified
 7	NOLOADHIGH
 8	NOPULSE
 11	FORCEA20
 12	DMA buffer enabled
 13	NOSCRUB
 15	NOFRAME

Bitfields for 386MAX machine type:
Bit(s)	Description	(Table 01476)
 12	Amstrad
 13	Epson
 14	Zenith Data Systems
 15	"ASEM"
 16	NEC
 17	"HPRS" model codes 69h and 6Ah
 18	Dell
 19	"CA"
 20	ITT (Xtra Business Systems/Alcatel)
 21	Toshiba 5100
 22	Olivetti
 23	Quadram Quad386 (BIOS model FEh, submodel A6h)
 24	Tandy???
 25	AST 386
 26	INBOARD, ??? version
 27	INBOARD, ??? version
 28	INBOARD, ??? version
 29	"HPRS"
 30	Compaq 386
 31	JET386

Format of 386MAX control block:
Offset	Size	Description	(Table 01477)
 00h	WORD	segment of next block (FFFFh if last)
 02h	WORD	segment of previous block (FFFFh if first)
 04h 12 BYTEs	filename
 10h	WORD	resident size in paragraphs
 12h	WORD	environment size???
 14h	WORD	real prsent environment size + 1 (0000h if ENVSAVE used)
 16h  2 BYTEs	???
 18h	DWORD	initial size or SIZE=n in 386LOAD commandline
 1Ch	DWORD	SIZE=-1 ???
 20h	DWORD	SIZE= ???
 24h	BYTE	PRGREG= if specified, else FFh
 25h	BYTE	ENVREG= if specified, else FFh
 26h	BYTE	FlexFrame (00h not present, 01h present)
 27h  3 BYTEs	???
 2Ah	BYTE	GROUP= or 00h if not present
 2Bh	BYTE	???
 2Ch	WORD	PSP

Format of 386MAX high memory info record:
Offset	Size	Description	(Table 01478)
 00h	WORD	segment address of memory region
 02h	WORD	size of memory region in paragraphs
 04h	BYTE	type or flags???
		00h if locked out
		02h if EMS page frame
		04h if high RAM
		42h if ROM
 05h	BYTE	???

Format of 386MAX ROM shadowing record:
Offset	Size	Description	(Table 01479)
 00h	WORD	logical start segment of ROM??? (may be used by BlueMAX when it
		  squeezes together the ROMs to make room)
 02h	WORD	physical start segment of ROM
 04h  2 BYTEs	???
 06h	WORD	size of shadowed ROM in paragraphs
 08h  2 BYTEs	???
 0Ah	WORD	flags
		bit 15: shadowing enabled for this ROM???
		bit 14: ???
		bit 13: ???
		bit 12: ???
		bit 10: ???

(Table 01480)
Values for 386MAX memory type:
 00h	unused by EMS
 01h	DOS
 04h	page frame overlapping ROM???
 80h	high memory
 84h	page frame???
 87h	video ROM???
Note:	the type may be 00h (unused) if the 16K page is split among different
	  uses (such as ROM and high RAM)

(Table 01481)
Call 386MAX API (via OUT DX,AL) with:
	STACK: WORD value for DX
	AH = 00h unused
		Return: AH = 84h (unsupported function)
	AH = 01h get high memory information
		ES:DI -> buffer for array of high memory info records
			(see #01478)
		Return: CX = number of records placed in buffer
	AH = 02h get shadowed ROM info
		ES:DI -> buffer for array of ROM shadowing records (see #01479)
		Return: CX = number of records placed in buffer
	AH = 03h get 386MAX state
		ES:DI -> 90-byte buffer for state (see #01467)
		Return: AH = 00h (successful)
			buffer filled
	AH = 04h get memory types???
		ES:DI -> buffer for memory type info (array of bytes, one per
			16K page) (see #01480)
		Return:	CX = number of bytes placed in buffer
	AH = 05h get page table entries
		AL = A20 control (00h enable A20 first, 01h leave unchanged)
		CX = buffer size in bytes (0000h = enough for all memory from
			given start to end of memory managed by 386MAX)
		SI = first K to report (rounded down to 4K page)
		ES:DI -> buffer for returned page table entries
		Return: CX = number of bytes returned (four per 4K page)
			ES:DI buffer filled
	AH = 06h get memory speed info
		ES:DI -> buffer for memory speed records (see #01482)
		Return: AH = 00h (successful)
			CX = number of bytes placed in buffer
		Note:	this function can take over a second to execute
	AH = 07h map/unmap multiple handle pages
		DX = EMS handle (on stack)
		STACK: DWORD -> EMS mapping record
		Return:	AH = status (00h,80h,83h,8Ah,8Bh)
		Format of EMS mapping record:
		Offset	Size	Description
		 00h	WORD	function
				0000h use physical page numbers
				0001h use segment addresses
		 02h	WORD	EMS handle
		 04h	WORD	number of mapping entries following
		 06h 2N WORDs	logical page number and physical page/segment
				logical page FFFFh means unmap physical page
		SeeAlso: INT 67/AH=50h
	AH = 08h "EMM2_GOREAL" check whether possible to disable 386MAX
		AL = ??? (00h or nonzero)
		Return: AH = status (00h OK, A4h not possible at this time)
		Note:	if AL=00h, this function always returns success
	AH = 09h toggle Bit Flags 1 flags
		BX = bitmask of bit flags 1's flags to toggle (see #01468)
		Return: AH = 00h (successful)
		Note:	enables A20 first
	AH = 0Ah toggle Debugging Flags 1 flags
		BX = bitmask of Debugging Flags 1's bits to toggle (see #01470)
		Return: AH = 00h (successful)
		Notes:	enables A20 first
			does ??? if bit 3 on after specified bits are toggled
	AH = 0Bh toggle Debugging Flags 2 flags
		BX = bitmask of Debugging Flags 2's bits to toggle (see #01471)
		Return: AH = 00h (successful)
		Note:	enables A20 first
	AH = 0Ch toggle feature flags 3
		BX = bitmask of feature flags 3's bits to toggle (see #01475)
		Return: AH = 00h (successful)
		Note:	enables A20 first
	AH = 0Dh specify 386MAX high-memory location
		BX = segment address of high-memory real-mode portion of 386MAX
		CX = current segment of real-mode stub???
		Return: AH = status (00h successful)
			???
	AH = 0Eh CRT controller register virtualization
		AL = subfunction
		    00h allow access to CRTC I/O ports 03B4h/03B5h, 03D4h/03D5h
		    01h trap accesses to CRTC I/O ports
	AH = 0Fh reboot system
		Return: never
	AH = 10h unused
		Return: AH = 84h (unsupported function)
	AH = 11h get high memory information
		ES:DI -> 96-byte buffer for high memory info
		Return: AH = 00h (successful)
			ES:DI buffer filled
		Notes:	each byte in buffer contains bit flags for a 4K page in
			  the A000h-FFFFh region
				bit 0: page is writeable
				bit 1: physical address same as linear address
				bit 2: EMS page frame
				bit 6: page is part of the QPMS window
			this function can take over a second to execute,
			  because it does a 128K read for each page in an
			  attempt to flush any RAM cache the system may have
	AH = 12h shadow RAM mapping
		AL = subfunction
		    00h unshadow ROMs (except page FFh if NOWARMBOOT set)
		    01h map shadow RAM into ROM regions???
		Return: AH = 00h (successful) if AL=00h or 01h
			AH = 8Fh otherwise
	AH = 13h shadow RAM page protection
		AL = subfunction
		    00h set all shadowed ROM 4K pages to read-only
		    01h set all shadowed ROM 4K pages to read-write
		Return: AH = 00h (successful) if AL=00h or 01h
			AH = 8Fh otherwise
	AH = 14h get Programmable Option Select info???
		ES:DI -> 54-byte buffer for POS data???
		Return: AH = 00h if successful
			AH = A4h on error
		Note:	the buffer consists of nine 6-byte fields; the first
			  eight for slots 1-8, the last for the system board
	AH = 15h ???
		???
		Return: ???
	AH = 16h get 386MAX memory usage screen
		ES:DI -> buffer for memory info display
		CX = size of buffer in bytes
		Return:	ES:DI buffer filled with '$'-terminated string (if
				large enough to hold entire usage screen)
		Note:	the screen is 0303h bytes in v7.00
	AH = 17h Windows 3 startup/termination
		AL = subfunction
		    00h Windows3 initializing
			DX (on stack) = Windows startup flags
			DI = Windows version number (major in upper byte)
			ES:BX = 0000h:0000h
			DS:SI = 0000h:0000h
			Return: CX = 0000h if OK for Windows to load
				   <> 0 if Windows should not load
				ES:BX -> startup info structure
				DS:SI -> Virtual86 mode enable/disable callback
		    01h Windows3 terminating
			ES:BX -> ???
			DX (on stack) = Windows exit flags
			Return: ???
	AH = 18h QPMS (Qualitas Protected Memory Services)
		AL = subfunction
		    00h get QPMS configuration
			Return: BX = starting segment of QPMS memory window
				CX = number of 4K pages reserved for QPMS???
				DX = number of 4K pages in QPMS window???
		    01h map QPMS memory page???
			BX = 4K page number within memory reserved for QPMS???
			CL = 4K page number within QPMS memory window???
		    02h mark all QPMS memory read-only
		    03h mark all QPMS memory read-write
		Return: AH = status (00h,8Ah,8Bh,8Fh)
	AH = 19h get linear address for physical address
		EDX = physical address (low word on stack)
		Return: AH = status
			    00h successful
				EDX = linear address at which physical address
					may be accessed
			    8Bh physical address currently not addressable
		Note:	enables A20 first
	AH = 1Ah set page table entry
		EDX = new page table entry (low word on stack)
		ESI = linear address of page to map (bits 0-11 clear)
		Return: AH = status (00h,8Bh)
		Note:	enables A20 first
	AH = 1Bh get ???
		Return: AH = status
			BX = ???
			CX = number of ???
			EDX = physical address of ???
	AH = 1Ch get original interrupt vector
		AL = interrupt vector (00h-7Fh)
		Return: AH = 00h (successful)
			EDX = original vector before 386MAX loaded (segment in
				high word, offset in low word)
		Note:	no range checking is performed; requests for INTs 80h-
			  FFh will return random values
	AH = 1Dh display string???
		SI = ???
		Return: AH = 00h (successful)
			???
		Note:	this function appears to be broken in v7.00
	AH = 1Eh get memory info
		ES:DI -> memory info (see #01483)
		Return: ???
	AH = 1Fh get DPMI host information
		Return: AX = 0000h if successful
			BX = DPMI flags (see #03152 at INT 31/AX=0400h)
			CL = CPU type (02h = 80286, 03h = 80386, etc.)
			DX = DPMI ver supported (DH=major, DL=2-digit minor)
			SI = ???
			ES???:DI -> ???
		Note:	NOP if NODPMI switch specified
	AH = 20h (v7.00) get ???
	    AL = index of ???
	    Return: EDX = ??? for specified ???
	AH = 21h (v7.00) STACKS support
	    AL = 00h get STACKS parameters
		Return: BX = ??? (0060h for v7.00)
			CX = number of stacks for hardware interrupts
			DX = size of each stack in bytes
			SI = ??? (low and high bytes are separate values)
			DI = ??? (low and high bytes are separate values)
			    low byte = logical page number set by subfn 02h
			ES = ???
	    AL = 01h set ??? "EMM2_DSTKS"
		EBX = ???
		ECX = ???
	    AL = 02h set ???
		BL = logical page number for ??? (00h-03h)
		Return: AH = status (00h,8Ah)
	AH = 22h (v7.00) call ??? for every load module
	    AL = which function to call
		00h call ???
		else call ????
	    Return: AH = 00h
	    Note: if AL=00h, calls the protected-mode function pointed at by
		the DWORD at offset 22h from the start of each module installed
		by a LOAD= directive; if AL<>00h, it calls the function
		pointed at by the DWORD at offset 28h of the load module
	AH = 23h (v7.00) ???
	    AL = 00h set ???
		BL = ???
		Return:	AH = 00h or unchanged (depending on ???)
	    AL = 01h set ???
		BL = ???
		BH = ???
		CX = ???
		DX = ??? (on top of stack)
		Return: AH = status (00h if successful, 8Fh once table full)
		Note:	this call adds one entry to an internal table on each
			  call, until the table is full
	    AL = 02h get ???
		CX = size of buffer
		ES:DI -> buffer for ??? (60 bytes total data)
		Return: CX = number of bytes actually returned
		Note:	returns the array storing the values set with AX=2301h
		Format of one entry in array:
		Offset	Size	Description
		 00h	BYTE	??? (BL from subfn 01h)
		 01h	WORD	??? (CX from subfn 01h)
		 03h	BYTE	??? (BH from subfn 01h)
		 04h	WORD	??? (DX from subfn 01h)
	    AL = 03h set ??? name/path
		ES:DI -> buffer containing ASCIZ ???
	    AL = 04h get ???
		ES:DI -> buffer for ASCIZ ???
	    Note: the ASCIZ string for subfunctions 03h and 04h does not appear
		to be used by 386MAX, and may serve merely for communication
		between two other Qualitas programs
	AH = 24h (v7.00) high memory control
	    AL = 00h get high memory state
		Return: BX = current state
			    00h high memory removed from DOS memory chain
			    01h high memory included in DOS memory chain
	    AL = 01h set high memory state
		BX = new state
		    00h high memory removed from DOS memory chain
		    01h high memory included in DOS memory chain
		    else
			Return: ??? (error, but return varies according to ???)
	AH = 25h (v7.00) remove high RAM from DOS memory chain
	AH = 26h (v7.00) ???
	    BX = ???
	    CX = ???
	    SI = ???
	    DI = ???
	    Return: AH = status
		    BX = ???
		    CX = ???
	AH = 27h (v7.00) ???
	    AL = 00h get ???
		Return: BX = number of paragraphs for ???
	    AL = 01h ???
		BX = ???
		ES??? = ???
	    AL = 02h ???
		???
	    AL = 03h ???
		CX = ???
		DX = ???
		ES??? = ???
		Return: ???
	AH = 28h (v7.00) get ???
		Return: AH = status (00h,8Fh) (see #03648 at INT 67/AH=40h)
			if AH=00h,
			    CX = ???
			    DX = ???
	AH = 29h (v7.00) get ???
		Return: AX = ???
	AH = 40h-5Dh EMS services (see INT 67/AH=40h, etc.)
	AH = DEh VCPI services (see INT 67/AX=DE00h, etc.)
Return: AH = status (as for EMS INT 67 calls)
	    00h successful
	    80h internal error
	    81h hardware malfunction
	    83h invalid handle
	    84h	undefined function
	    8Ah invalid logical page nuber
	    8Bh illegal physical page number
	    8Fh undefined subfunction
	    A4h access denied
	    etc.
	STACK popped (value placed in DX if no specific return value for DX)

Format of 386MAX memory speed record:
Offset	Size	Description	(Table 01482)
 00h	DWORD	page table entry for 4K page
 04h	WORD	number of microticks (840ns units) required for REP LODSD of
		  entire 4K page

Format of 386MAX memory info [array]:
Offset	Size	Description	(Table 01483)
 00h	DWORD	linear start address
 04h	DWORD	size in bytes
 08h	WORD	XMS handle (if next byte = 04h)
		??? (if next byte = 05h)
		??? (if next byte = 06h)
		??? (if next byte = 13h)
		??? (if next byte = 14h)
		??? (if next byte = 15h)
		??? (if next byte = 23h)
		??? (if next byte = 24h)
		??? (if next byte = 26h)
		else unused
 0Ah	BYTE	type
		00h = ???, 01h = VDISK,
		02h = INT 15h extended memory, 03h = ??? extended,
		04h = XMS handle's memory, 05h = ???, 06h = ???, 07h = ???,
		08h = ???, 09h = ???, 0Ah = ???, 0Bh = ???,
		11h = ???, 12h = ???, 14h = ???, 15h = ???,
		19h = ???, 1Ah = ???, 1Bh = ???,
		1Ch = ???, 1Dh = ???, 1Eh = ???, 1Fh = ???,
		20h = ???, 21h = ???, 23h = ???, 24h = ???,
		26h = ???
 0Bh	BYTE	??? (00h for types 00h-03h, 07h-0Bh, 19h-21h;
		     80h for types 04h/13h-15h/23h-26h;
			??? for type 05h)

Top

214402 - INT 21 U - Novell DOS 7+ EMM386.EXE - GET STATE RECORD

INT 21 U - Novell DOS 7+ EMM386.EXE - GET STATE RECORD
	AX = 4402h
	BX = file handle for device "EMMXXXX0" or "EMMQXXX0"
	CX = 003Eh (size of state record)
	DS:DX -> buffer for state record (see #01511)
Return: CF clear if successful
	    buffer filled (see #03603 at INT 67/AH=3Fh)
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Note:	This function is called by the Novell DOS 7+ MEM utility.

Format of Novell DOS 7 - DR-DOS 7.03 EMM386.EXE state record:
Offset	Size	Description	(Table 01511)
 00h	WORD	signature EDC0h
 02h 12 BYTEs	(ret) bitmap for include range
 0Eh 12 BYTEs	(ret) bitmap for auto range
 1Ah 12 BYTEs	(ret) bitmap for BIOS range
 26h 12 BYTEs	(ret) bitmap for ROM range
 32h 12 BYTEs	(ret) bitmap for map range
Note:	each bitmap covers the upper-memory address range A000h-FFFFh, where
	  offset X bit B within the bitmap indicates the state of the 4K page
	  starting at segment A000h + (8X + B) * 100h

Top

214402SF00 - INT 21 U - Memory Managers - GET API ENTRY POINT

INT 21 U - Memory Managers - GET API ENTRY POINT
	AX = 4402h subfn 00h
	BX = file handle for device "EMMXXXX0"
	CX = 0006h (size of buffer in bytes)
	DS:DX -> buffer for API entry point record (see #01512)
		first byte must be 00h on entry
Return: CF clear if successful
	    buffer filled (see #03603 at INT 67/AH=3Fh)
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Notes:	this function is supported by Microsoft EMM386.EXE v4.45+ and
	  CEMM v5.10+, and is intended for use by MS Windows as it starts up
	if no other program has hooked INT 67, an alternate installation
	  check for CEMM is testing for the string
	  "COMPAQ EXPANDED MEMORY MANAGER 386" at offset 14h in the INT 67
	  handler's segment; if present, the word at offset 12h contains the
	  offset of the API entry point
SeeAlso: AX=4402h/SF=01h,AX=4402h/SF=02h,AX=4402h"EMM386",INT 67/AH=3Fh

Format of memory manager API entry point record:
Offset	Size	Description	(Table 01512)
 00h	WORD	??? (0022h for CEMM 5.11, 0025h for MS EMM386 v4.45)
 02h	DWORD	manager's private API entry point
		(see #01513,#03666 at INT 67/AX=FFA5h)

(Table 01513)
Call CEMM v5.10+ entry point with:
	AH = 00h get memory manager's state
	    Return: AH = state
			bit 0: turned OFF
			bit 1: AUTO mode enabled
	AH = 01h set memory manager's state
	    AL = new state (00h ON, 01h OFF, 02h AUTO)
	    Return: CF clear if successful
		    CF set on error
	AH = 02h Weitek coprocessor support
	    AL = subfunction
		00h get Weitek support state
		    Return: AL = status
				bit 0: Weitek coprocessor is present
				bit 1: Weitek support is enabled
		01h turn on Weitek support
		02h turn off Weitek support
	    Return: CF clear if successful
		    CF set on error
			AH = error code (01h invalid subfunc, 02h no Weitek)
	AH = 05h get statistics
	    ???
	AH > 06h
	    Return: CF set
		    AH = 01h (invalid function)
Notes:	AH=03h,04h,06h are NOPs which return CF clear, presumably for backwards
	  compatibility with earlier versions of CEMM
	in v5.11, AH=05h merely prints an error message (using INT 21/AH=09h)
	  stating that a different version of CEMM is installed and it is
	  therefore not possible to display the statistics

Top

214402SF01 - INT 21 U - Memory Managers - GET EMM IMPORT STRUCTURE ADDRESS

INT 21 U - Memory Managers - GET EMM IMPORT STRUCTURE ADDRESS
	AX = 4402h subfn 01h
	BX = file handle for device "EMMXXXX0"
	CX = 0006h (size of buffer in bytes)
	DS:DX -> buffer for EMM import structure record (see #01514)
		first byte must be 01h on entry
Return: CF clear if successful
	    buffer filled (see also #03603 at INT 67/AH=3Fh)
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Notes:	this function is supported by Microsoft EMM386.EXE v4.45+,
	  QEMM-386 v6+, and CEMM v5.10+, and is intended for use by MS Windows
	  as it starts up
	for QEMM-386, this call always returns an error if Windows3 support
	  has been disabled with the NW3 switch
SeeAlso: AX=4402h/SF=00h,AX=4402h"EMM386",INT 2F/AX=D201h/BX=5145h
SeeAlso: INT 67/AH=3Fh

Format of EMM import structure record:
Offset	Size	Description	(Table 01514)
 00h	DWORD	physical address of EMM import structure (see #01515)
 04h	BYTE	EMM import structure major version
 05h	BYTE	EMM import structure minor version
Note:	vession 1.00 contains only EMS information (Windows 3.0+)
	version 1.10 contains UMB/XMS/HMA/EMS information (Windows 3.1)
	version 1.11 is version 1.10 plus memory manager maker/product name
SeeAlso: #03643

Format of Global EMM Import record:
Offset	Size	Description	(Table 01515)
 00h	BYTE	bit flags
		bit 2: ???
		bit 3: free EMM386 virtual HMA only if hma_page_table_paddr!=0
		bit 4: no UMB???
 01h	BYTE	reserved (0)
 02h	WORD	size of structure in bytes
 04h	WORD	structure version
 06h	DWORD	reserved
 0Ah 384 BYTEs	64 EMS frame status records (see #01516), one per 16K of
		  real-mode 1M address space
18Ah	BYTE	??? (must be at least 3*number_of_EMS_frames+4)
18Bh	BYTE	number of UMB frame descriptors following
18Ch 4N DWORDs	UMB frame descriptors
		each is 4 DWORDs giving physical page numbers for the four
		  4K pages of a 16K EMS frame (00000000h if non-UMB page)
var	BYTE	number of EMS handle info records following
    16N BYTEs	EMS handle info records (see #01518)
---version 1.10+ ---
	DWORD	realmode INT 67 vector (used by Windows to set breakpoints)
	DWORD	physical address of HMA page table values
	BYTE	number of free page entries following
     2N DWORDs	free page entries
		each is:
		    DWORD	physical page number
		    DWORD	number of consecutive physical pages
	BYTE	number of XMS handle info records following
		00h if memory manager does not emulate XMS or has real mode
		  XMS code which can execute in the Windows environment
    12N BYTEs	XMS handle info records (see #01519)
	BYTE	number of free UMB info records following
     2N WORDs	free UMB info records
		each is:
		    WORD	real mode start segment
		    WORD	size in paragraphs
---version 1.11---
     20 BYTEs	blank-padded maker name
     20 BYTEs	blank-padded product name

Format of EMS frame status record:
Offset	Size	Description	(Table 01516)
 00h	BYTE	frame type (see #01517)
 01h	BYTE	owner handle (00h/FFh = none) from frame including UMB
		index to UMB frame descriptors
 02h	WORD	logical page for frame, 7FFFh if none, FFFFh if non-EMS frame
 04h	BYTE	EMS physical page number (FFh for non-EMS = don't care???)
 05h	BYTE	flags for non-EMS frames (00h for EMS frame)
		bits 0,1 for first 4K, bits 2,3 for second 4K, etc:
		  10: direct mapping (linear address = physical address)
		  01: UMB mapping

Bitfields for EMS frame type:
Bit(s)	Description	(Table 01517)
 0	EMS frame
 1	(if EMS frame) in standard 64K page frame
 2	first 4K of frame is UMB
 3	second 4K of frame is UMB
 4	third 4K of frame is UMB
 5	last 4K of frame is UMB

Format of EMS handle info record:
Offset	Size	Description	(Table 01518)
 00h	BYTE	handle number (00h = system handle)
 01h	BYTE	flags
		bit 0: normal handle rather than system handle
		bit 2: ??? (set by some EMS managers)
 02h  8 BYTEs	EMS handle's name
 0Ah	WORD	number of 16K pages for handle
 0Ch	DWORD	physical address of page table entries forming page map
Note:	all values should be zero for the system handle if no large frame
	  support is present

Format of XMS handle info record:
Offset	Size	Description	(Table 01519)
 00h	WORD	handle
 02h	WORD	flags
		bit 0: handle usable by Windows
			(already in use when Windows started if clear)
		bit 1: reserved (0)
 04h	DWORD	size in KB (may be zero, used only if flags bit 0 set)
 08h	DWORD	physical address (only if flags bit 0 set)

Top

214402SF02 - INT 21 U - Memory Managers - GET MEMORY MANAGER VERSION

INT 21 U - Memory Managers - GET MEMORY MANAGER VERSION
	AX = 4402h subfn 02h
	BX = file handle for device "EMMXXXX0"
	CX = 0002h (size of buffer in bytes)
	DS:DX -> buffer for memory manager version (see #01520)
		first byte must be 02h on entry
Return: CF clear if successful
	    buffer filled
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Note:	this function is supported by Microsoft EMM386.EXE v4.45+ and
	  CEMM v5.10+, and is intended for use by MS Windows as it starts up
SeeAlso: AX=4402h/SF=00h,AX=4402h"EMM386",INT 67/AH=3Fh

Format of memory manager version:
Offset	Size	Description	(Table 01520)
 00h	BYTE	major version
 01h	BYTE	minor version (binary)

Top

214402 - INT 21 U - Microsoft EMM386.EXE v4.45 - GET MEMORY MANAGER INFORMATION

INT 21 U - Microsoft EMM386.EXE v4.45 - GET MEMORY MANAGER INFORMATION
	AX = 4402h
	BX = file handle for device "EMMXXXX0"
	CX = size of buffer in bytes (varies, see #01521)
	DS:DX -> buffer for returned data (see #01521)
		first byte must be set on entry to indicate desired data
Return: CF clear if successful
	    buffer filled
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Notes:	an error is returned if the number of bytes to be read does not match
	  the number of bytes returned for the specified data item
	this function is part of the interface which allows MS Windows to
	  cooperate with memory managers
SeeAlso: AX=4402h/SF=00h,AX=4402h/SF=01h,AX=4402h/SF=02h,INT 67/AX=FFA5h

Format of EMM386.EXE data buffer:
Offset	Size	Description	(Table 01521)
 00h	BYTE	(call) function
		03h get ???
		04h get ???
---function 03h---
 00h	WORD	???
 02h	WORD	???
---function 04h---
 00h	WORD	segment of UMB containing EMM386 code/data
 02h	WORD	number of paragraphs of EMM386 code/data in UMB
 04h	WORD	???

Top

214403SF01 - INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX OFF

INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX OFF
	AX = 4403h subfn 01h
	BX = handle for device "386MAX$$"
	DS:DX -> BYTE 01h
	CX ignored
Return: DS:DX -> BYTE status (00h = successful)
	CF clear if successful
	    AX destroyed
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Note:	this function will fail if any EMS or UMBs are in use
SeeAlso: AX=4403h/SF=02h,AX=4403h/SF=03h,AX=4403h/SF=05h

Top

214403SF02 - INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX ON

INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX ON
	AX = 4403h subfn 02h
	BX = handle for device "386MAX$$"
	DS:DX -> BYTE 02h
	CX ignored
Return: DS:DX -> BYTE status (00h = successful)
	CF clear if successful
	    AX destroyed
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
SeeAlso: AX=4403h/SF=01h,AX=4403h/SF=03h,AX=4403h/SF=05h

Top

214403SF03 - INT 21 U - Qualitas 386MAX v6.01+ - SET STATE

INT 21 U - Qualitas 386MAX v6.01+ - SET STATE
	AX = 4403h subfn 03h
	BX = handle for device "386MAX$$"
	CX = number of bytes to copy (up to size of state buffer)
	DS:DX -> BYTE 03h followed by state buffer
		  (see #01467 at AX=4402h"386MAX")
Return: CF clear if successful
	    AX = number of bytes actually written
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Note:	the first byte of the buffer must be either 01h, 02h, or 03h
	  (specifying the version of the state record) and the buffer must
	  contain CX bytes AFTER the initial byte
SeeAlso: AX=4402h"386MAX"

Top

214403SF05 - INT 21 U - Qualitas 386MAX v7.00+ - LIMIT AUTOMATIC ACTIVATION TO STD EMS CALLS

INT 21 U - Qualitas 386MAX v7.00+ - LIMIT AUTOMATIC ACTIVATION TO STD EMS CALLS
	AX = 4403h subfn 05h
	BX = handle for device "386MAX$$"
	DS:DX -> BYTE 05h
	CX ignored
Return: CF clear if successful
	    AX destroyed
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Desc:	specifies that 386MAX will only shift from AUTO to ON mode on standard
	  EMS calls INT 67/AH=40h-5Dh
SeeAlso: AX=4403h/SF=02h,AX=4403h/SF=03h,AX=4403h/SF=06h

Top

214403SF06 - INT 21 U - Qualitas 386MAX v7.00+ - ALLOW AUTOMATIC ACTIVATION ON ANY INT 67

INT 21 U - Qualitas 386MAX v7.00+ - ALLOW AUTOMATIC ACTIVATION ON ANY INT 67
	AX = 4403h subfn 06h
	BX = handle for device "386MAX$$"
	DS:DX -> BYTE 06h
	CX ignored
Return: CF clear if successful
	    AX destroyed
	CF set on error
	    AX = error code (01h,05h,06h,0Dh) (see #01680 at AH=59h/BX=0000h)
Desc:	specified that 386MAX should shift from AUTO to ON mode on any INT 67
	  call other than INT 67/AH=3Fh
SeeAlso: AX=4403h/SF=01h,AX=4403h/SF=03h,AX=4403h/SF=05h

Top

214C57 - INT 21 - Headroom - ???

INT 21 - Headroom - ???
	AX = 4C57h
	DS:DX -> target address
Note:	jumps to target address instead of terminating program
SeeAlso: AX=5758h

Top

2C - INT 2C R - Cloaking - CALL PROTECTED-MODE PASSALONG CHAIN

INT 2C R - Cloaking - CALL PROTECTED-MODE PASSALONG CHAIN
Notes:	when this interrupt is invoked in V86 mode, RM386 will invoke the first
	  in a chain of protected-mode handlers, and will only pass execution
	  to the V86-mode INT 2C handler if none of the handlers in the
	  passalong chain handle the call instead.  This is the method by which
	  the real-mode stub of a cloaked application communicates with the
	  protected-mode portion.
	the cloaking host calls the passalong chain with EAX=58494E33h ('WIN3')
	  when MS Windows starts up and with EAX=334E4958h ('3NIW') when
	  Windows shuts down; between these two broadcasts, the additional
	  Windows-only Cloaking services are available
	this function was first introduced with RM386 (RAM-MAN/386) v6.00, the
	  memory manager included in Helix Software's Netroom
SeeAlso: INT 2C/AX=0009h,INT 2F/AX=4310h"Cloaking"

Top

2C0000 - INT 2C P - Cloaking - ALLOCATE GDT SELECTOR

INT 2C P - Cloaking - ALLOCATE GDT SELECTOR
	AX = 0000h
	EBX = base address
	CL = access mode byte
	CH = extended access mode byte (omit limit field)
	EDX = segment limit
Return: CF clear if successful
	    AX = selector
	CF set on error
	    AX = error code (see #02556)
Notes:	this INT 2C interface is used by Netroom's DPMI.EXE v3.00
	to access extended memory, set the base address to the desired
	  physical address plus 400000h (4M)
	this function was first introduced with RM386 (RAM-MAN/386) v6.00, the
	  memory manager included in Helix Software's Netroom
SeeAlso: AX=0001h,AX=0002h,AX=0003h,AX=0004h,AX=0005h,INT 31/AH=57h,#00501

(Table 02556)
Values for Cloaking error code:
 0001h	no more selectors
 0002h	not a GDT ring 0 selector
 0003h	invalid selector (out of range, not user selector)
 0004h	selector not allocated

Top

2C0001 - INT 2C P - Cloaking - FREE GDT SELECTOR

INT 2C P - Cloaking - FREE GDT SELECTOR
	AX = 0001h
	SI = selector
Return: CF clear if successful
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0000h,INT 2F/AX=4310h"Cloaking"

Top

2C0002 - INT 2C P - Cloaking - SET SEGMENT BASE ADDRESS

INT 2C P - Cloaking - SET SEGMENT BASE ADDRESS
	AX = 0002h
	SI = selector
	EBX = new physical base addres
Return: CF clear if successful
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0000h,AX=0003h,AX=0004h,INT 31/AX=0007h,#00501

Top

2C0003 - INT 2C P - Cloaking - SET SEGMENT LIMIT

INT 2C P - Cloaking - SET SEGMENT LIMIT
	AX = 0003h
	SI = selector
	EBX = new limit
Return: CF clear if successful
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0000h,AX=0002h,AX=0004h,INT 31/AX=0008h

Top

2C0004 - INT 2C P - Cloaking - SET SEGMENT ACCESS MODE

INT 2C P - Cloaking - SET SEGMENT ACCESS MODE
	AX = 0004h
	SI = selector
	CL = new access mode byte (see #00502)
Return: CF clear if successful
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0000h,AX=0002h,AX=0003h,AX=0005h,INT 31/AX=0009h

Top

2C0005 - INT 2C P - Cloaking - SET SEGMENT EXTENDED ACCESS MODE

INT 2C P - Cloaking - SET SEGMENT EXTENDED ACCESS MODE
	AX = 0005h
	SI = selector
	CL = new extended access mode byte (limit field ignored) (see #02557)
Return: CF clear if successful
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0000h,AX=0002h,AX=0003h,AX=0004h,INT 31/AX=0009h

Bitfields for extended access mode byte:
Bit(s)	Description	(Table 02557)
 7	4K granularity instead of byte granularity
 6	32-bit code segment
 5	reserved (0)
 4	segment available to system
SeeAlso: #00505

Top

2C0006 - INT 2C P - Cloaking - GET PROTECTED-MODE INTERRUPT VECTOR

INT 2C P - Cloaking - GET PROTECTED-MODE INTERRUPT VECTOR
	AX = 0006h
	CL = vector (00h-7Fh)
Return: CF clear
	DX:EBX -> current interrupt handler
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0007h,INT 31/AX=0204h

Top

2C0007 - INT 2C P - Cloaking - SET PROTECTED-MODE INTERRUPT VECTOR

INT 2C P - Cloaking - SET PROTECTED-MODE INTERRUPT VECTOR
	AX = 0007h
	CL = vector (00h-7Fh)
	DX:EBX -> interrupt handler
Return: CF clear
Notes:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
	the IDT entry's type remains unchanged
SeeAlso: AX=0006h,INT 31/AX=0205h

Top

2C0008 - INT 2C P - Cloaking - GET PASSALONG ADDRESS

INT 2C P - Cloaking - GET PASSALONG ADDRESS
	AX = 0008h
Return: CF clear
	DX:EBX = current passalong address
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0009h,AX=002Ch,INT 2F/AX=4310h"Cloaking"

Top

2C0009 - INT 2C P - Cloaking - SET PASSALONG ADDRESS

INT 2C P - Cloaking - SET PASSALONG ADDRESS
	AX = 0009h
	DX:EBX = new value for passalong address (see #02558)
Return: CF clear
Notes:	when an INT 2C instruction is executed in V86 mode, the Cloaking host
	  calls the passalong address.	The handler should check whether the
	  upcall is of interest to it, and if not it should jump to the old
	  passalong address (retrieved with AX=0008h before the handler was
	  installed).  The final handler should return with CF clear to cause
	  the interrupt to be reflected back to V86 mode if none of the
	  passalong handlers is triggered
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0008h,AX=002Dh,INT 2C"PASSALONG CHAIN"

(Table 02558)
Values Cloaking passalong address is called with:
	EAX = CS:IP of byte following INT 2C instruction invoking passalong
	SS:EBX -> caller registers (see #02559)
	CF clear
	others undefined
Return: CF clear: pass along to V86-mode INT 2C handler
	CF set: return immediately to V86 mode

Format of Cloaking caller registers:
Offset	Size	Description	(Table 02559)
 00h	DWORD	EDI
 04h	DWORD	ESI
 08h	DWORD	EBP
 0Ch	DWORD	reserved (ESP from PUSHAD instruction)
 10h	DWORD	EBX
 14h	DWORD	EDX
 18h	DWORD	ECX
 1Ch	DWORD	EAX
 20h	DWORD	error code
 24h	DWORD	EIP
 28h	WORD	CS
 2Ah	WORD	padding
 2Ch	DWORD	EFLAGS
 30h	DWORD	ESP
 34h	WORD	SS
 36h	WORD	padding
--remainder not available if protected-mode ring3 trap---
 38h	WORD	ES
 3Ah	WORD	padding
 3Ch	WORD	DS
 3Eh	WORD	padding
 40h	WORD	FS
 42h	WORD	padding
 44h	WORD	GS
 46h	WORD	padding

Top

2C000A - INT 2C P - Cloaking - GET BASE ADDRESS OF GDT SELECTOR

INT 2C P - Cloaking - GET BASE ADDRESS OF GDT SELECTOR
	AX = 000Ah
	SI = selector
Return: CF clear if successful
	    EBX = segment base address
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00, the
	  memory manager included in Helix Software's Netroom
SeeAlso: AX=0000h,AX=0002h,AX=000Bh

Top

2C000B - INT 2C P - Cloaking - GET SELECTOR LIMIT

INT 2C P - Cloaking - GET SELECTOR LIMIT
	AX = 000Bh
	SI = selector
Return: CF clear if successful
	    EBX = segment base address
	CF set on error
	    AX = error code (see #02556)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=000Ah,INT 2F/AX=4310h"Cloaking"

Top

2C - INT 2C P - RM386 v6.00 - CLOAKING - RESERVED FOR CLOAKED BIOS USE UNDER WINDOWS

INT 2C P - RM386 v6.00 - CLOAKING - RESERVED FOR CLOAKED BIOS USE UNDER WINDOWS
	AX = function (000Ch-001Fh)

Top

2C000F - INT 2C P - Cloaking v1.01 - "Simulate_Shell_Event"

INT 2C P - Cloaking v1.01 - "Simulate_Shell_Event"
	AX = 000Fh
	ECX = event code (see #02560)
	DX = subfunction for event
	EDX high word = boost value (see #02561)
	SI:EDI -> completion procedure
Return: CF clear if successful (event scheduled)
	CF set on error
Note:	this function is only available while MS Windows is running
SeeAlso: AX=0011h,AX=0012h,INT 2F/AX=1605h,INT 2F/AX=4310h"Cloaking"

(Table 02560)
Values for Cloaking shell event code:
 0414h	Hot key event
	subevent 0000h: Alt-Space
	subevent 0001h: Alt-Enter
	subevent 0002h: Dir-VM
 0415h	Switch context
	subevent 0000h for DOS VM context, nonzero for System VM context
 0416h	Clipboard event
 0417h	Termination event
	subevent 0000h for normal termination, nonzero for error
 0418h	Display message
	subevent 0000h for normal message, nonzero for system model ASAP
 0419h	Crash
 041Ah	Paste complete
	subevent 0000h: normal
	subevent 0001h: cancelled by user
	subevent 0002h: cancelled
 041Bh	Contention event
 041Ch	Screen switch
	subevent 0000h: forward
	subevent 0001h: back
 041Dh	Filesystem change
 041Eh	Check Focus
 041Fh	Panic

Bitfields for boost value:
Bit(s)	Description	(Table 02561)
 0	boost system VM until focus changes
 1	boost system VM on Switcher screen
 2	boost system VM until response
 3	boost system VM during clipboard activity
 4	boost system VM during print screen
 5	boost system VM during update

Top

2C0011 - INT 2C P - Cloaking v1.01 - "Switch_VMs_and_Call_back"

INT 2C P - Cloaking v1.01 - "Switch_VMs_and_Call_back"
	AX = 0011h
	EBX = handle of VM to be made active
	SI:EDI -> 32-bit FAR completion procedure
Return: CF clear if successful (scheduled)
	CF set on error
Notes:	this function is only available while MS Windows is running
	the completion procedure is called with CF clear if the specified
	  VM has been made active, or with CF set on error
SeeAlso: AX=000Fh,AX=0012h

Top

2C0012 - INT 2C P - Cloaking v1.01 - "Query_Current_VM"

INT 2C P - Cloaking v1.01 - "Query_Current_VM"
	AX = 0012h
Return: CF clear
	EBX = handle of active VM
	ESI = handle of system VM
	ECX = VM status flags (see #02562)
	EDX = shell flags (see #02563)
Note:	this function is only available while MS Windows is running in enhanced
	  mode
SeeAlso: AX=000Fh,AX=0011h,AX=0013h

Bitfields for VM status flags:
Bit(s)	Description	(Table 02562)
 0	in exclusive mode
 1	runs in background
 2	being created
 3	suspended
 4	not executable
 5	executing in protected mode
 6	contains PM application
 7	32-bit PM application
 8	called from VxD
 9	high priority background
 10	blocked on semaphore
 11	awakening
 12	has pageable V86
 13	has locked V86
 14	is scheduled
 15	idle
 16	closing

Bitfields for shell flags:
Bit(s)	Description	(Table 02563)
 2	windowed
 5	Alt-Tab reserved
 6	Alt-Esc reserved
 7	Alt-Space reserved
 8	Alt-PrtSc reserved
 9	Alt-Enter reserved
 10	Alt-PrtSc reserved
 11	PrtSc reserved
 12	polling enabled
 13	no HMA
 14	has shortcut key
 15	locked EMS handles
 16	locked XMS handles
 17	fast paste enabled
 18	locked V86 memory
 30	close-on-exit enabled

Top

2C0013 - INT 2C P - Cloaking v1.01 - "Issue_System_Modal_Message"

INT 2C P - Cloaking v1.01 - "Issue_System_Modal_Message"
	AX = 0013h
	EDX = message box flags (see #02564)
	DS:ECX -> ASCIZ message text
	DS:EDI -> ASCIZ caption
Return: CF clear
	EAX = response code
Note:	this function is only available while MS Windows is running in enhanced
	  mode
SeeAlso: AX=000Fh,AX=0012h

Bitfields for message box flags:
Bit(s)	Description	(Table 02564)
 3-0	response codes (see #02565)
 7-4	icon codes
	1 = Warning hand
	2 = exclamation mark
	4 = asterisk
 9-8	default response (0 = first button, 1 = second, 2 = third)
 12	message is system model
 15	don't change focus
 29	hang with interrupts enabled
 30	do not window
 31	execute ASAP

(Table 02565)
Values for response codes:
 00h	OK
 01h	OK, Cancel
 02h	Abort, Retry, Ignore
 03h	Yes, No, Cancel
 04h	Yes, No
 05h	Retry, Cancel

Top

2C001D - INT 2C P - Cloaking v1.01 - GET INT 2C API HANDLER ENTRY POINT

INT 2C P - Cloaking v1.01 - GET INT 2C API HANDLER ENTRY POINT
	AX = 001Dh
Return: CF clear
	DX:EBX = selector:offset of Cloaking host INT 2C handler
Desc:	get the Cloaking host's entry point to bypass any other programs
	  which may have hooked INT 2C in protected mode
Note:	the returned entry point must be called with a simulated INT, i.e.
	  a PUSHD must precede the far call to the handler
SeeAlso: INT 2F/AX=4310h"Cloaking"

Top

2C001E - INT 2C P - Cloaking v1.01 - CLEAR CRITICAL SECTION

INT 2C P - Cloaking v1.01 - CLEAR CRITICAL SECTION
	AX = 001Eh
Return: CF clear
Desc:	allow MS Windows to switch to another VM after having prevented it
	  by invoking a critical section
SeeAlso: AX=001Fh,INT 15/AX=101Ch,INT 2F/AX=1682h

Top

2C001F - INT 2C P - Cloaking v1.01 - SET CRITICAL SECTION

INT 2C P - Cloaking v1.01 - SET CRITICAL SECTION
	AX = 001Fh
Return: CF clear
Desc:	prevent MS Windows from switching to another VM
SeeAlso: AX=001Eh,INT 15/AX=101Bh,INT 2F/AX=1681h

Top

2C0020 - INT 2C P - Cloaking - GET SIZE OF PROTECTED-MODE STATE

INT 2C P - Cloaking - GET SIZE OF PROTECTED-MODE STATE
	AX = 0020h
Return: EAX = number of bytes required for storing state
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0021h,AX=0022h

Top

2C0021 - INT 2C P - Cloaking - SAVE PROTECTED-MODE STATE

INT 2C P - Cloaking - SAVE PROTECTED-MODE STATE
	AX = 0021h
	ES:EDI -> buffer for protected-mode state
Return: CF clear
	buffer filled
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0020h,AX=0022h

Top

2C0022 - INT 2C P - Cloaking - RESTORE PROTECTED-MODE STATE

INT 2C P - Cloaking - RESTORE PROTECTED-MODE STATE
	AX = 0022h
	DS:ESI -> buffer containing previously-saved protected-mode state
Return: CF clear if successful
	    state restored
	CF set on error (invalid buffer contents)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0020h,AX=0021h

Top

2C0023 - INT 2C P - Cloaking - ISSUE PROTECTED-MODE XMS CALL

INT 2C P - Cloaking - ISSUE PROTECTED-MODE XMS CALL
	AX = 0023h
Notes:	not currently implemented--NOP in RM386 v6.00
	this function was first introduced with RM386 (RAM-MAN/386) v6.00

Top

2C0024 - INT 2C P - Cloaking - SET V86-MODE STACK

INT 2C P - Cloaking - SET V86-MODE STACK
	AX = 0024h
	DX:EBX = new value for V86-mode SS:ESP
Return: nothing
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00

Top

2C0025 - INT 2C P - Cloaking - CALL V86-MODE PROCEDURE

INT 2C P - Cloaking - CALL V86-MODE PROCEDURE
	AX = 0025h
	DS:EBX -> client register structure (see #02559)
Return: CF clear if successful
	    client register structure updated
	CF set if no more nested procedure call space available
Notes:	this call uses the V86-mode stack supplied in the client structure, and
	  calls the routine specified by CS:IP in the client structure
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0026h,AX=0027h,INT 31/AX=0301h

Top

2C0026 - INT 2C P - Cloaking - CALL V86-MODE INTERRUPT HANDLER

INT 2C P - Cloaking - CALL V86-MODE INTERRUPT HANDLER
	AX = 0026h
	DS:EBX -> client register structure (see #02559)
	CX = interrupt number
Return: CF clear if successful
	    client register structure updated
	CF set if no more nested procedure call space available
Notes:	this call uses the V86-mode stack supplied in the client structure
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0025h,AX=0027h,INT 31/AX=0300h

Top

2C0027 - INT 2C P - Cloaking - CHAIN TO V86-MODE INTERRUPT HANDLER

INT 2C P - Cloaking - CHAIN TO V86-MODE INTERRUPT HANDLER
	AX = 0027h
	DS:EBX -> client register structure (see #02559)
Return: CF clear if successful
	    client register structure updated
	CF set if no more nested procedure call space available
Notes:	this call uses the V86-mode stack supplied in the client structure,
	  and jumps to the address specified by CS:IP in the client structure
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0025h,AX=0026h

Top

2C0028 - INT 2C P - Cloaking - GET ESP0 FROM TSS

INT 2C P - Cloaking - GET ESP0 FROM TSS
	AX = 0028h
Return: CF clear
	EAX = TSS's ESP0
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00, the
	  memory manager included in Helix Software's Netroom

Top

2C0029 - INT 2C P - Cloaking - SET SECONDARY STACK

INT 2C P - Cloaking - SET SECONDARY STACK
	AX = 0029h
	DX:EBX = new value for SS:ESP of ring 3 secondary stack
Return: CF clear
Desc:	inform RM386 of the ring 3 interrupt stack location
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00

Top

2C002A - INT 2C P - Cloaking - SET 8259 IRQ BASE VECTORS

INT 2C P - Cloaking - SET 8259 IRQ BASE VECTORS
	AX = 002Ah
	BL = base vector of master interrupt controller
	CL = base vector of slave interrupt controller
Notes:	this call merely informs RM386 that the caller has changed the
	  interrupt mappings
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: INT 67/AX=DE0Bh

Top

2C002BCH81 - INT 2C P - Cloaking - PROTECTED-MODE VIRTUAL DMA SERVICES

INT 2C P - Cloaking - PROTECTED-MODE VIRTUAL DMA SERVICES
	AX = 002Bh
	CH = 81h
	CL = subfunction (02h-0Ch)
	other registers as appropriate for subfunction
Return: varies by function
	CF set on error
Notes:	these functions are equivalent to the INT 4B/AX=81xxh subfunctions
	  with the same numbers
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: INT 4B/AX=8102h,INT 4B/AX=810Ch

Top

2C002C - INT 2C P - Cloaking - GET PORT-TRAPPING PASSALONG

INT 2C P - Cloaking - GET PORT-TRAPPING PASSALONG
	AX = 002Ch
Return: CF clear
	DX:EBX = current I/O trapping passalong address
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0008h,AX=002Dh

Top

2C002D - INT 2C P - Cloaking - SET PORT-TRAPPING PASSALONG

INT 2C P - Cloaking - SET PORT-TRAPPING PASSALONG
	AX = 002Dh
	DX:EBX = new I/O trapping passalong address (see #02566)
Return: CF clear
Notes:	RM386 calls the passalong address whenever an access to a monitored
	  I/O port is attempted; the handler should check whether it is a port
	  that it is interested in, and if not call the previous passalong
	  address (which was retrieved with AX=002Ch before installing the
	  new handler)
	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=0009h,AX=002Ch,INT 67/AX=5DEAh

(Table 02566)
Values Cloaking port-trapping passalong address is called with:
	EAX = CS:IP of faulting instruction (unless executing in protected-mode
		ring 3)
	SS:EBX -> caller register structure (see #02559)
		check EFLAGS V86-mode bit for type
	CX = first two bytes of I/O instruction which was trapped
	DX = port to which I/O is being performed
	CF clear
Return: CF clear if RM386 should perform I/O operation
	CF set if I/O should be skipped
Note:	RM386 skips the trapped I/O instruction, so the passalong handler
	  should not modify the client CS:EIP

Top

2C002E - INT 2C P - Cloaking - TRAP I/O PORT

INT 2C P - Cloaking - TRAP I/O PORT
	AX = 002Eh
	DX = port number to trap
Return: CF clear if successful
	CF set on error (port out of range or reserved)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=002Fh,AX=0030h

Top

2C002F - INT 2C PU - Cloaking - UNTRAP I/O PORT

INT 2C PU - Cloaking - UNTRAP I/O PORT
	AX = 002Fh
	DX = port number for which to cancel trapping
Return: CF clear if successful
	CF set on error (port out of range or reserved)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=002Eh,AX=0030h

Top

2C0030 - INT 2C PU - Cloaking - GET TRAPPING STATE OF SPECIFIED PORT

INT 2C PU - Cloaking - GET TRAPPING STATE OF SPECIFIED PORT
	AX = 0030h
	DX = port number
Return: CF clear if successful
	   BX = current state (0000h not trapped, 0001h trapped)
	CF set on error (port out of range or reserved)
Note:	this function was first introduced with RM386 (RAM-MAN/386) v6.00
SeeAlso: AX=002Eh,AX=002Fh

Top

2C0031 - INT 2C PU - RM386 v6.00 - BUG

INT 2C PU - RM386 v6.00 - BUG
	AX = 0031h
Program: RM386 (RAM-MAN/386) is the memory manager included in Helix
	  Software's Netroom
Note:	due to a fencepost error, RM386 v6.00 will branch unpredictably if
	  invoked with this function

Top

2C0031 - INT 2C P - Cloaking v1.01 - ALLOCATE V86 CALLBACK

INT 2C P - Cloaking v1.01 - ALLOCATE V86 CALLBACK
	AX = 0031h
	DX:EBX = CS:EIP of protected-mode routine to be invoked by callback
Return: CF clear if successful
	    EBX = CS:IP of V86-mode callback handler
	CF set on error
SeeAlso: AX=0032h

Top

2C0032 - INT 2C P - Cloaking v1.01 - FREE V86 CALLBACK

INT 2C P - Cloaking v1.01 - FREE V86 CALLBACK
	AX = 0032h
	EBX = CS:IP of V86-mode callback handler
Return: CF clear if successful
	CF set on error
	    AX = error code
		0005h invalid callback address
		0006h callback already free
SeeAlso: AX=0032h

Top

2C0033 - INT 2C P - Cloaking v1.01 - REGISTER CLOAKING CLIENT

INT 2C P - Cloaking v1.01 - REGISTER CLOAKING CLIENT
	AX = 0033h
	DS:EDX -> client registration structure (see #02567)
Return: CF clear if successful
	CF set on error (linked list corrupt)
SeeAlso: AX=0034h,#02778 at INT 2F/AX=4310h"Cloaking"

Format of client registration structure:
Offset	Size	Description	(Table 02567)
 00h	PWORD	link to next structure
 06h	PWORD	link to previous structure
 0Ch  2 BYTEs	client version (major, minor)
 0Eh 20 BYTEs	client name
 22h	DWORD	physical address of client start
 26h	DWORD	client's total size in bytes
Note:	the link area should not be modified once the structure has been
	  used for the registration call

Top

2C0034 - INT 2C P - Cloaking v1.01 - UNREGISTER CLOAKING CLIENT

INT 2C P - Cloaking v1.01 - UNREGISTER CLOAKING CLIENT
	AX = 0034h
	DS:EDX -> client registration structure (see #02567)
Return: CF clear if successful
	CF set on error (linked list corrupt)
Note:	the client must unregister before freeing the XMS block containing
	  its registration structure(s)
SeeAlso: AX=0033h,#02778 at INT 2F/AX=4310h"Cloaking"

Top

2F12FFBX0006 - INT 2F U - DR DOS 6+, Novell DOS 7+ - EMM386.EXE - VIDEO MEMORY SPACE CONTROL

INT 2F U - DR DOS 6+, Novell DOS 7+ - EMM386.EXE - VIDEO MEMORY SPACE CONTROL
	AX = 12FFh
	BX = 0006h
	DX = 0000h
	CX = function
	    0000h get status of video memory space (MEMMAX /V)
	    0001h map memory into video memory space (MEMMAX +V)
	    0002h unmap memory from video memory space (MEMMAX -V)
Return: CF clear if successful
	    AX = 0000h (successful)
	    BX = segment of reserved video RAM
	    CX = segment of used video RAM
	    DX = segment of first upper MCB
Notes:	this functionality is provided by EMM386, and partially supported by
	  HIDOS.SYS
	BL specifies which program handles the call, BH is the function number
BUG:	4DOS 5.51(a) often hangs the system (reported to be reproducable), if
	  MEMMAX +V is issued from the 4DOS prompt.  To avoid this, one should
	  temporary load COMMAND.COM followed by MEMMAX +v , starting the
	  application, MEMMAX -v and EXIT.  4DOS 5.5c does not show this
	  phenomena on the same systems where 5.51a hangs.
SeeAlso: AX=D201h/BX=4849h

(Table 04105)
Values for DR DOS memory space control error code:
 00h	successful
 80h	video memory already unmapped
 81h	video memory already mapped
 82h	no video memory reserved (/VIDEO not specified)
 83h	video memory in use (graphics mode or non-standard text mode)
 84h	mapped video memory contains allocated arena(s)
 85h	hardware error
 86h	driver requires protected mode but is permanently in real mode
	  ("EMM386 OFF")

Top

2F12FFBX0106 - INT 2F U - Novell DOS 7+ - MEMORYMAX INSTALLATION CHECK

INT 2F U - Novell DOS 7+ - MEMORYMAX INSTALLATION CHECK
	AX = 12FFh
	BX = 0106h
Return: CF clear if successful
	    AX = 0000h (successful)
	    BX = EDC0h (signature "European Development Centre")
	    CL = memory manager variant
		00h if HIMEM.SYS present
		01h if EMMXMA.SYS present
		02h if EMM386.EXE present (DPMI/VCPI disabled)
		03h if multitasking EMM386.EXE present (DPMI/VCPI loaded)
	    CH = ??? (00h)
	    DX = binary driver version, DH is major, DL is minor
	    ES = segment of EMM386 device driver header (low-memory stub)
	CF set on error
	    AX = 0001h
Notes:	BL specifies which program handles the call, BH is the function number
	if the word at ES:0012h is nonzero, if contains the offset within
	  segment ES of the CEMM-compatible entry point (see #02617)
	if no other program has hooked INT 67, an alternate installation
	  check is to test for the string
	  "NOVELL EXPANDED MEMORY MANAGER 386" at offset 14h in the INT 67
	  handler's segment; the word immediately preceding this string
	  contains the offset of the API entry point if it is nonzero
Index:	entry point;Novell EMM386

(Table 02617)
Call Novell EMM386.EXE entry point with:
	AH = 00h get memory manager's status???
	    ???
	AH = 01h set memory manager's status???
	    ???
	AH = 02h Weitek coprocessor support???
	    AL = subfunction???
	more functions???
SeeAlso: #01513 at INT 21/AX=4402h/SF=02h,#03666 at INT 67/AX=FFA5h

Top

2F12FFBX0206 - INT 2F - Novell DOS 7+ - MEMORYMAX GET PAGE TABLE ENTRY

INT 2F - Novell DOS 7+ - MEMORYMAX GET PAGE TABLE ENTRY
	AX = 12FFh
	BX = 0206h
	ESI = linear address
Return: CF clear if successful
	    AX = 0000h (successful)
	    CX = 0000h
	    EDI = page table entry
	CF set on error
	    AX = function status
		0000h function supported
		    CX error code
		       80h if linear address has no mapping
	        0001h (AX > 0) function not supported
		    CX undefined
Note:	This function is supported by Novell DOS 7+ EMM386.EXE 3.0+ and
	  possibly by HIMEM.SYS 2.3+.
SeeAlso: AX=12FFh/BX=0306h

Top

2F12FFBX0306 - INT 2F - Novell DOS 7+ - MEMORYMAX SET PAGE TABLE ENTRY

INT 2F - Novell DOS 7+ - MEMORYMAX SET PAGE TABLE ENTRY
	AX = 12FFh
	BX = 0306h
	ESI = linear address
	EDI = page table entry
Return: CF clear if successful
	    AX = 0000h (successful)
	    CX = 0000h
	CF set on error
	    AX = function status
		0000h function supported
		    CX error code
		       80h if linear address has no mapping
	        0001h (AX > 0) function not supported
		    CX undefined
Note:	This function is supported by Novell DOS 7+ EMM386.EXE 3.0+ and
	  possibly by HIMEM.SYS 2.3+.
SeeAlso: AX=12FFh/BX=0206h

Top

2F12FFBX0406 - INT 2F - Novell DOS 7+ - MEMORYMAX CREATE ACCESS KEY

INT 2F - Novell DOS 7+ - MEMORYMAX CREATE ACCESS KEY
	AX = 12FFh
	BX = 0406h
Return: CF clear if successful
	    AX = 0000h (successful)
	    CX = 0000h
	    SI:DI = access key
	CF set on error
	    AX = function status
		0000h function supported
		    CX error code
		       80h if access key already exists
	        0001h (AX > 0) function not supported
		    CX undefined
Note:	This function is supported by Novell DOS 7+ EMM386.EXE 3.0+ and
	  possibly by HIMEM.SYS 2.3+.
SeeAlso: AX=12FFh/BX=0506h

Top

2F12FFBX0506 - INT 2F - Novell DOS 7+ - MEMORYMAX DESTROY ACCESS KEY

INT 2F - Novell DOS 7+ - MEMORYMAX DESTROY ACCESS KEY
	AX = 12FFh
	BX = 0506h
	SI:DI = access key
Return: CF clear if successful
	    AX = 0000h (successful)
	    CX = 0000h
	CF set on error
	    AX = function status
		0000h function supported
		    CX error code
		       80h if invalid access key
		       81h if no access key exists
	        0001h (AX > 0) function not supported
		    CX undefined
Note:	This function is supported by Novell DOS 7+ EMM386.EXE 3.0+ and
	  possibly by HIMEM.SYS 2.3+.
SeeAlso: AX=12FFh/BX=0406h

Top

2F12FFBL06 - INT 2F U - Novell DOS 7 - EMM386.EXE - ???

INT 2F U - Novell DOS 7 - EMM386.EXE - ???
	AX = 12FFh
	BL = 06h
	BH = function (06h-09h)
	???
Return: CF clear if successful
	CF set on error
	    AX = function status
		0000h function supported
		    CX error code
	        0001h (AX > 0) function not supported
		    CX undefined

Top

2F1610 - INT 2F - XMS v1.x only - GET DRIVER ADDRESS

INT 2F - XMS v1.x only - GET DRIVER ADDRESS
	AX = 1610h
	details unavailable
Note:	this function and AX=1600h were only used in XMS version 1 and are now
	  obsolete.  Use AX=4300h and AX=4310h instead
SeeAlso: AX=1600h,AX=4310h

Top

2F1B00 - INT 2F U - DOS 4+ XMA2EMS.SYS extension internal - INSTALLATION CHECK

INT 2F U - DOS 4+ XMA2EMS.SYS extension internal - INSTALLATION CHECK
	AX = 1B00h
Return: AL = FFh if installed
Note:	XMA2EMS.SYS extension is only installed if DOS has page frames to hide.
	This extension hooks onto INT 67/AH=58h and returns from that call data
	  which excludes the physical pages being used by DOS.
SeeAlso: AH=1Bh"FRAME INFO"

Top

2F1B - INT 2F U - DOS 4+ XMA2EMS.SYS extension internal - GET HIDDEN FRAME INFORMATION

INT 2F U - DOS 4+ XMA2EMS.SYS extension internal - GET HIDDEN FRAME INFORMATION
	AH = 1Bh
	AL <> 00h
	DI = hidden physical page number
Return: AX = FFFFh if failed (no such hidden page)
	AX = 0000h if OK, then
	    ES = segment of page frame
	    DI = physical page number
Notes:	this corresponds to the data edited out of the INT 67/AH=58h call
	FASTOPEN makes this call with AL = FFh
SeeAlso: AX=1B00h

Top

2F2780CL01 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - SUPERVISOR MODULE

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - SUPERVISOR MODULE
	AX = 2780h
	CL = 01h (module: Supervisor)
	CH = subfunction
	    00h unused
		Return: CX = status (0002h) (see #02739)
	    01h unused
		Return: CX = status (0002h) (see #02739)
	    02h "Z_ModuleReg" register an OS module
		EBX = module number (0005h-000Fh)
		DS:EDX -> module descriptor (see #02741)
		Return: CX = status (0000h,0030h) (see #02739)
	    03h allocate SYSDAT memory
		DX = number of ??? to allocate
		Return: CX = status (0000h,0003h) (see #02739)
	    04h get selector to SYSDAT
		Return: CX = 0000h (successful)
			BX = selector for EMM386 data segment
			EBX high word cleared
	    05h "Z_MoveReal" relocate segment into extended memory
		DS:EDX -> descriptor parameter block
		Return: ECX = status (00h,03h,31h,32h) (see #02739)
			---if successful---
			parameter block filled
	    06h "Z_Reboot" return to real mode via triple fault
	    07h debugger break
		Note:	calls INT 03, then INT 21/AH=02h to output a question
			  mark
	    08h "X_ForeCheck" check if domain is in foreground
		Return: CX = 0000h (successful)
			EBX = ??? (0 or 2)
	    09h register VxD with system
	    0Ah unload VxD hook
	    0Bh indicate end of initialization phase
		Return: CX = status (0002h) (see #02739)
	    0Ch "F_AllocWindow" allocate 4K mapping window
	    0Dh "F_RegisterBoot" register reboot addresses
		EBX = ???
		EDX = ???
		Return: ???
	    0Eh "F_EnquireBoot" check if reboot active
		Return: CX = 0000h (successful)
			BL = ???     \ or BX = 0000h
			BH = ???     /
	    0Fh get debugging level
		Return: CX = 0000h (successful)
			EBX = new value for debugging level
	    10h set debugging level
		EDX = ???
		Return: CX = 0000h (successful)
			EBX = old value of debugging level
	    11h installation check (documented)
		Return: CX = status
			    0000h if multitasker is installed
				EBX = version (0100h for v1.00)
			    1101h if multitasker is not present
	    12h "F_V86BPInstall" install V86 breakpoint
		DX = ???
		Return: CX = 0000h (successful)
			AX = old value of ???
	    13h "F_V86BPRemove" remove V86 breakpoint
		Return: CX = status (0000h,003Fh) (see #02739)
			AX = ???
	    14h "F_V86BPOffer" indicate INT 03 to be used as V86 breakpoint
		EDX = linear address ??? of INT 03 instruction for breakpoint
		Return: CX = status (0000h,003Fh) (see #02739)
	    15h "F_LoaderCleanup" offer opportunity to clean up
		BX = segment of ???
		Return: CX = 0000h (successful)
			BX = segment of ???
	    16h "F_RegisterVxDWindow" register VxD mapping window
	    17h "F_RegisterPNW" register Personal NetWare information
		EBX = subfunction (0-2)
		Return: CX = status (0002h if EBX>2) (see #02739)
			???
	    18h unused
		Return: CX = status (0002h) (see #02739)
Return: CX = status (most subfunctions)
	(E)AX and/or (E)BX contain return values, depending on function
Notes:	called by DPMS.EXE and EMM386.EXE
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=02h,AX=2780h/CL=03h,AX=2780h/CL=04h

(Table 02739)
Values for Novell DOS 7 EMM386 function status:
 0000h	successful
 0001h	not implemented
 0002h	invalid subfunction
 0003h	unable to find memory
 0004h	invalid flag (semaphore) number
 0005h	flag (semaphore) overrun
 0006h	flag (semaphore) underrun
 0007h	no queue handles available
 0009h	no queue buffers available
 000Ah	queue is in use
 000Bh	invalid process handle
 000Ch	no process handles available
 000Dh	queue access not permitted
 000Eh	queue is empty
 000Fh	queue is full
 0012h	no memory handles available
 0014h	can't find process in process list
 001Bh	invalid memory handle
 0023h	unable to terminate process
 002Ah	flag set ignored
 002Dh	no more system flags
 002Eh	flag (semaphore) not in idle state
 002Fh	flag (semaphore) wait timed out
 0030h	bad module number in CL
 0031h	bad descriptor
	invalid value for DESC_PB_SINFO in a descriptor parameter block
 0032h	no free descriptors
 0033h	error while locking/unlocking a page
 0034h	error getting or setting a page
 0035h	no pages available
 0036h	invalid domain
 0037h	process already frozen
 0038h	process not frozen
 0039h	fork failure (no registered swaplist)
 003Ah	page already free
 003Bh	page already allocated
 003Ch	unable to switch tasks
 003Dh	attempted to free critical section which is not active
 003Eh	too many active critical sections
 003Fh	???
 41FFh	current domain is invalid, or no domain in context
 42FFh	domain ID is not a valid descriptor
 43FFh	domain creation still in progress
 44FFh	domain currently being deleted
 45FFh	task manager is busy, cannot unload it
 46FFh	task manager already loaded
 47FFh	task manager not yet loaded
 48FFh	cannot save/restore because prior switch not complete
 49FFh	console already has owner
 4BFFh	unsupported opcode
 4CFFh	32-bit address prefix not supported
 4FFFh	timeout, but not on timer queue
 50FFh	unable to lock timer queue
 53FFh	unable to switch while in Global Message Mode
 54FFh	error while setting Global Message Mode
 55FFh	not in Global Message Mode
 56FFh	system already in Domain Message Mode
 57FFh	not in Domain Message Mode
 58FFh	unable to allocate timeout structure
 59FFh	unsupported video type
 5AFFh	function not handled by any VM
 5BFFh	error in Serial..Set call
 5CFFh	error in Parallel..Set call
 5DFFh	domain list overflowed
 5FFFh	unable to free domain while in nobuffers mode

Format of Novell DOS/OpenDOS EMM386 descriptor parameter block:
Offset	Size	Description	(Table 02740)
 00h	DWORD	"DESC_PB_BASE"
 04h	DWORD	"DESC_PB_LIMIT"
 08h	WORD	"DESC_PB_SEL"
 0Ah	BYTE	"DESC_PB_MINFO"
 0Bh	BYTE	"DESC_PB_SINFO"
SeeAlso: #02741

Format of Novell DOS/OpenDOS EMM386 module descriptor:
Offset	Size	Description	(Table 02741)
 00h 12 BYTEs	descriptor parameter block (see #02740)
 0Ch	DWORD	-> module entry point
Note:	for function "Z_ModuleReg", only DESC_PB_SEL and the module entry point
	  need to be initialized before calling EMM386
SeeAlso: #02740

Top

2F2780CL02 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - REAL-TIME MONITOR

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - REAL-TIME MONITOR
	AX = 2780h
	CL = 02h (module: Real-Time Monitor)
	CH = subfunction
	    00h ???
		???
		Return: CX = status (0000h,0023h, others???) (see #02739)
			BX = ??? (0000h if CX=0000h, FFFFh if CX=0023h)
		Note:	calls func 04h/sf 03h, func 04h/sf 1Eh,func 02h/sf 43h,
			  func 02h/sf 0Bh, and func 04h/sf 01h
	    01h "Z_PCountGet" get and clear count of dispatches
		DX = ??? handle or 0000h for default
		Return: CX = status (0000h,000Bh) (see #02739)
			EBX = old value of ??? if successful
			EDX destroyed
	    02h "Z_FlagWait" wait on semaphore
		DX = index of semaphore???
		Return: CX = status (0000h,0004h,0005h) (see #02739)
			EBX = 0000FFFFh on error, 00000000h if successful
	    03h "Z_FlagSet" set a semaphore flag
		DX = index of semaphore???
		Return: CX = status (0000h,0004h,0006h) (see #02739)
			BX = FFFFh on error, 0000h if successful
	    04h "X_QCreate" create a new queue
		Return: CX = status (0000h,0007h,000Ah) (see #02739)
	    05h "X_QOpen" open queue for reading/writing
		EDX -> ??? data (first 8 bytes seem to be name)
		Return: CX = status (0000h,0009h,000Dh) (see #02739)
	    06h "X_QDelete" delete a queue
		Note:	calls fn 02h/subfn 05h, then fn 02h/subfn 40h
	    07h "X_QRead" read message from queue
		EDX = ???
		Return: CX = status (0000h,0009h,000Eh) (see #02739)
	    08h "X_QReadC" read message from queue, if any
		EDX = ???
		Return: CX = status (0000h,0009h,000Eh) (see #02739)
	    09h "X_QWrite" write message to queue
		EDX = ???
		Return: CX = status (0000h,0009h,000Fh) (see #02739)
	    0Ah "X_QWriteC" write message to queue, if space available
		EDX = ???
		Return: CX = status (0000h,0009h,000Fh) (see #02739)
	    0Bh "X_PDelay" put process to sleep for specified period
		DX = number of clock ticks to sleep???
		Return: CX = 0000h (successful)
	    0Ch "X_PDispatch" force a dispatch (run scheduler)
		Return: CX = 0000h (successful)
	    0Dh "F_PTerm" terminate process???
		Return: CX = status (0000h,0023h) (see #02739)
			BX = FFFFh on error, 0000h if successful
		Note:	calls fn 04h/subfn 03h, fn 04h/subfn 1Eh,
			  fn 02h/subfn 43h, fn 02h/subfn 0Bh, fn 04h/sub 01h
	    0Eh "X_PCreate" create new process
		???
		Return: CX = status (0000h,000Ch) (see #02739)
			EBX = ??? if successful
	    0Fh "Z_PPriorSet" set process priority
		BX = ???
		DX = ??? handle or 0000h for default
		Return: CX = status (0000h,000Bh) (see #02739)
	    10h "X_PHandleGet" get current process handle
		Return: CX = 0000h (successful)
			BX = handle of default ???
			EBX high word cleared
	    11h "X_PTerm" terminate process
		DX = process handle or 0000h for current
		BX = ??? (handle???)
		Return:	CX = status (0000h,000Bh,0014h) (see #02739)
	    12h "F_Sleep" ???
		BX = ???
		DX = ???
		Return: CX = 0000h (successful)
	    13h "F_Wakeup" ???
		DX = ???
		Return: CX = status (see #02739)
	    14h "F_FindPDName" find process by name???
		BX = ???
		DX = ???
		Return: CX = status (0000h,0014h) (see #02739)
			BX = FFFFh on error, ??? if successful
	    15h "F_SetFlags" set ??? flags
		BX = ??? (low two bits only)
		DX = ??? handle or 0000h for default
		Return: CX = status (0000h,000Bh) (see #02739)
			BX = new value of ??? flags (entire word)
			EBX high register cleared
	    16h "F_EndOfInterrupt" issue EOI to PIC
		Return: CX = 0000h (successful)
	    17h "X_PTermOff" disable process termination
	    18h "X_PTermOK" enable process termination
	    19h "Z_FlagStatusGet" get semahprore's status
	    1Ah "F_QRdMX" ???
	    1Bh "F_QWrMX" ???
	    1Ch "Z_FlagAlloc" allocate a new semaphore
	    1Dh "Z_FlagFree" free semaphore
	    1Eh "X_FlagsMaxGet" get number of semaphores supported
	    1Fh "X_QReadNDC" non-destructive read from queue (peek)
	    20h "Z_FlagWWTO" wait on semaphore, with timeout
	    21h "F_UdaAlloc" ???
	    22h "F_UdaFree" ???
	    23h "X_PSuspend" suspend process
	    24h "X_PUnsuspend" restart process after suspension
	    25h "X_CritEnter" enter critical region
	    26h "X_CritExit" leave critical region
	    27h "F_PCreate" ???
	    28h "Z_PHandleListGet" get list of process handles
	    29h "Z_PNameGet" get process name
	    2Ah "Z_PStatusGet" get process status
	    2Bh "F_PDToDomain" get process' domain???
	    2Ch "Z_PPriorGet" get process priority
	    2Dh "F_QDList" get list of queues???
	    2Eh "Z_QNameGet" get queue's name
	    2Fh "X_QMsgLenGet" get message length of queue
	    30h "X_QMsgMaxGet" get message capacity of queue
	    31h "Z_QWriterGet" get handle of process waiting to write queue
	    32h "Z_QReaderGet" get handle of process waiting to read queue
	    33h "X_QMsgNumGet" get number of messages in queue
	    34h "Z_QFlagsGet" get queue's flags
	    35h "F_NameToQD" get queue by name???
	    36h "F_NameToPD" get process by name???
	    37h "X_MXCreate" create a mutex
	    38h "X_MXDelete" delete a mutex
	    39h "X_MXEnter" enter mutual-exclusion zone
	    3Ah "X_MXEnterC" enter mutual-exclusion zone if it is free
	    3Bh "X_MXExit" leave mutual-exclusion zone
	    3Ch "Z_TicksSet" set length of foreground time slices
	    3Dh "X_TickGet" get clock tick period
	    3Eh "F_ProcessID" ???
	    3Fh "X_QClose" close a queue
	    40h "F_QDispose" delete queue???
	    41h "F_PDToFlags" get process flags???
	    42h "F_PDToDParam" ???
	    43h "F_ReleaseMX" release mutex???
	    44h "F_SimulateInt" ???
	    45h "Z_QFlagsSet" set queue's flags
	    46h "F_TickRate" ???
	    47h ???
Return: CX = status (most subfunctions)
	(E)AX and/or (E)BX contain return values, depending on function
Notes:	called by DPMS.EXE and EMM386.EXE
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=03h,AX=2780h/CL=04h

Top

2F2780CL03 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - MEMORY

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - MEMORY
	AX = 2780h
	CL = 03h (module: Memory)
	CH = subfunction
	    00h ???
	    01h "F_PdirGet" ???
	    02h "F_PdirSet" ???
	    03h "Z_PageAlloc" allocate a given page of memory
	    04h "F_PageAllocG" allocate global page???
	    05h "F_PageAllocI" allocate instance page???
	    06h "F_PtblRead" get page table???
	    07h "F_PtrlWrite" select page table???
	    08h "Z_PtblGet" read page table
	    09h "Z_PtblSet" change page table
	    0Ah "Z_PagesAlloc" allocate pages of memory
	    0Bh "Z_PageFree" free a given page of memory
	    0Ch "Z_MemAlloc" allocate a memory block
	    0Dh "Z_MemFree" release memory block
	    0Eh "Z_MemSizeGet" get size of memory block
	    0Fh "Z_MemResize" resize a memory block
	    10h "Z_DescAlloc" allocate a memory descriptor
	    11h "Z_DescFree" release a memory descriptor
	    12h "Z_DescGet" get details on memory descriptor
	    13h "Z_DescSet" set a memory descriptor
	    14h "Z_MemDescAlloc" allocate a memory block and its descriptor
	    15h "Z_MemDescFree" release a memory block and its descriptor
	    16h "Z_MemDescSizeGet" get size of memory block
	    17h "Z_MemDescResize" resize a memory block
	    18h "Z_PageLock" lock a page, with existing contents
	    19h "Z_PageUnlock" unlock a page
	    1Ah "Z_PageLockAny" lock a page, contents undefined
	    1Bh "Z_PageUnlockReuse" unlock page, reuse phsyical memory
	    1Ch "Z_PageLockNone" lock a page, no physical memory assigned
	    1Dh "Z_PageUnlockNone" unlock a page, don't reuse physical memory
	    1Eh "F_CallRealRaw" call real mode (SS:ESP supplied)
	    1Fh "F_IntRealRaw" perform real-mode interrupt (SS:ESP supplied)
	    20h "F_CallReal" call real mode with RETF frame
	    21h "F_IntReal" perform real-mode interrupt
	    22h "F_PagedCallReal" paged real-mode call
	    23h "F_PagedIntReal" paged real-mode interrupt
	    24h "F_CallIretReal" call real mode with IRET frame
	    25h "F_CallIretRealRaw" call real mode with IRET (SS:ESP supplied)
	    26h "F_CallProt16" call 16-bit protected-mode code
	    27h "F_CallProt32" call 32-bit protected-mode code
	    28h "F_IAddPage" add kernel instance data
	    29h "Z_PageDomLock" lock page in specific domain, preserve contents
	    2Ah "Z_PatgeDomUnlock" unlock page in specific domain
	    2Bh "Z_PageDomLockAny" lock page in specific domain, undef contents
	    2Ch "Z_PageDomUnlockReuse" unlock page in spec. domain,reuse ph.mem
	    2Dh "Z_PageDomLockNone" lock page in spec. domain, no phys memory
	    2Eh "Z_PageDomUnlockNone" unlock page in spec. domain, no phys. mem
	    2Fh "Z_GateAlloc" allocate a gate
	    30h "Z_GateFree" release a gate
	    31h "X_MemFreeGet" get total free memory
	    32h "X_MemTopGet" get highest memory address
	    33h "X_MemTotalGet" get total memory size
	    34h "F_DescRead" ???
	    35h "F_DescWrite" ???
	    36h "F_GetStack" ???
	    37h "F_SetStack" ???
Return: CX = status (most subfunctions)
	(E)AX and/or (E)BX contain return values, depending on function
Notes:	called by DPMS.EXE and EMM386.EXE
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=02h,AX=2780h/CL=04h

Top

2F2780CL04 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - DOMAINS

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - DOMAINS
	AX = 2780h
	CL = 04h (module: Domains)
	CH = subfunction
	    00h "F_DAlloc" create new domain
	    01h "F_DFree" delete a domain
	    02h "X_DomHandleGetMy" get current domain handle
	    03h "F_DSet" switch to another domain
	    04h "Z_HandlerSWInt" install software-interrupt handler
	    05h "Z_HandlerPageFault" install page-fault handler
	    06h "Z_HandlerIOEx" install I/O exception handler
	    07h "Z_HandlerGenEx" install general exception handler
	    08h "Z_HandlerHWInt" install hardware interrupt handler
	    09h "Z_IOBitmapGet" get current domain's I/O bitmap entry
	    0Ah "Z_IOBitmapSet" set current domain's I/O bitmap entry
	    0Bh "Z_IOBitmapDomGet" get domain's I/O bitmap entry
	    0Ch "Z_IOBitmapDomSet" set domain's I/O bitmap entry
	    0Dh "Z_DomMemRead" read memory in another domain
	    0Eh "Z_DomMemWrite" write memory in another domain
	    0Fh "Z_PtblDomGet" read domain's page table
	    10h "Z_PtblDomSet" write domain's page table
	    11h "Z_InstanceSet" register instanced memory
	    12h "X_DomNProcessesGet" get number of processes in domain
	    13h "X_DomSuspend" suspend a domain
	    14h "Z_DomUnsuspend" resume execution of a domain
	    15h "Z_DomFork" make a copy of the current domain
	    16h "Z_DomTerm" terminate domain and all processes in it
	    17h "Z_HandlerUnlink" remove a handler
	    18h "Z_HandlerHWIntDflt" install default hardware interrupt handler
	    19h "Z_HandlerVHWInt" install virtual hardware interrupt handler
	    1Ah "Z_HandlerVHWIntDflt" install default virtual hware int handler
	    1Bh "Z_HandlerSwapIn" install swap-in handler
	    1Ch "Z_HandlerSwapOut" install swap-out handler
	    1Dh "Z_EndOfInterrupt" signal EOI
	    1Eh ???
	    1Fh "Z_HandlerPCreate" install process-creation handler
	    20h "Z_HandlerPTerm" install process-termination handler
	    21h "Z_DomRootProcessGet" get domain's root process' handle
	    22h "F_DForeground" domain has just switched to foreground
	    23h "F_DBackground" domain has just switched to background
	    24h "F_MapHMA" map domain's HMA
	    25h "F_AddInstData" add DOS instance data
	    26h "X_DomMemFreeGet" get free memory in a domain
	    27h "X_DomMemUsedGet" get memory used by current domain
	    28h "Z_DomMemMaxGet" get per-domain memory limit
	    29h "Z_DomMemMaxSet" set per-domain memory limit
	    2Ah "F_ReflectInt21" protected-mode INT 21 support
	    2Bh "Z_DomHandleGet" get domain for a process
	    2Ch ???
	    2Dh ???
	    2Eh ???
	    2Fh ???
	    30h ???
	    31h ???
	    32h ???
Return: CX = status (most subfunctions)
	(E)AX and/or (E)BX contain return values, depending on function
Notes:	called by DPMS.EXE and EMM386.EXE
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=02h,AX=2780h/CL=03h

Top

2F2780CL05 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - VIRTUAL MACHINES

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - VIRTUAL MACHINES
	AX = 2780h
	CL = 05h (module: VM)
	CH = function
	    00h "F_VMProtInit" internal protected-mode initialization
	    01h "Z_TMLoad" load task manager
	    02h "Z_TMUnload" unload task manager
	    03h	"Z_VMBackSet" send virtual machine to background
	    04h "Z_VMForeSet" send virtual machine to foreground
	    05h "Z_VMSaveEnable" enable saving virtual machine
	    06h "Z-VMSaveDisable" disable saving virtual machine
	    07h "Z_TMInit" intialize task manager
	    08h "Z_TMHotKeyGet" get task manager hotkey
	    09h "Z_TMHitKeyEnable" restart scanning for task manager key
	    0Ah "Z_TMHotKeyDisable" stop scanning for task manager key
	    0Bh "X_ForeGet" get current foreground domain
	    0Ch "F_DMAHandlerEnable" (re)enable DMA address translation
	    0Dh "F_DMAHandlerDisable" disable DMA address translation
	    0Eh "Z_SerialTimeoutGet" set serial port timeout
	    0Fh "Z_ParallelTimeoutSet" set parallel port timeout
	    10h "F_VCPIEntry" domain is entering VCPI mode
	    11h "F_VCPIExit" domain is leaving VCPI mode
	    12h "X_MsgGlobalEnter" enter Global Message Mode
	    13h "X_MsgGlobalDisplay" display global message
	    14h "X_MsgGlobalExit" leave Global Message Mode
	    15h "X_MsgDomEnter" enter Domain Message Mode
	    16h "X_MsgDomDisplay" display domain-specific message
	    17h "X_MsgDomExit" leave Domain Message Mode
	    18h "X_MsgFatalDisplay" display fatal error message
	    19h "Z_SerialBaseSet" set serial port address
	    1Ah "Z_ParallelBaseSet" set parallel port address
	    1Bh "Z_SerialIRQSet" set serial port IRQ
	    1Ch "Z_ParallelIRQSet" set parallel port IRQ
	    1Dh "F_ResetVideo" emergency video system reset
	    1Eh "F_SetMouseIRQ" set which IRQ is used by mouse
	    1Fh "F_CheckNotIdle" check whether system is idle
	    20h "F_GetMouseInfo"
	    21h "Z_SerialOwnerGet" get serial port owner
	    22h "Z_SerialTimeoutGet" get serial port timeout
	    23h "Z_ParallelOwnerGet" get parallel port owner
	    24h "Z_ParallelTimeoutGet" get parallel port timeout
	???
Return: ???
Notes:	called by DPMS.EXE and EMM386.EXE
	the handler for this function may be set by one of the subfunctions
	  of AX=2780h/CL=01h; the default handler returns AX=BX=FFFFh and
	  CX=0001h (see #02739)
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=02h,AX=2780h/CL=03h

Top

2F2780CL06 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - DPMI SERVICES

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - DPMI SERVICES
	AX = 2780h
	CL = 06h
	CH = function
	    00h "F_InitDPMI" used for internal initialization
	    01h "F_DescAllocLDT" allocate LDT descriptor
	    02h "F_DescFreeLDT" free LDT descriptor
	    03h "F_DescGetLDT" get details on LDT descriptor
	    04h "F_DescSetLDT" set up LDT descriptor
	    05h "F_DescAllocInt21" allocate descriptor for PM INT 21
	    06h "F_WhereIsDPMI" get address of DPMI global data
Return: ???
Notes:	called by DPMS.EXE and EMM386.EXE
	the handler for this function may be set by one of the subfunctions
	  of AX=2780h/CL=01h; the default handler returns AX=BX=FFFFh and
	  CX=0001h (see #02739)
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=02h,AX=2780h/CL=03h

Top

2F2780 - INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - AVAILABLE FOR APPS

INT 2F U - Novell DOS 7 - EMM386.EXE - MULTITASKING API - AVAILABLE FOR APPS
	AX = 2780h
	CL = function (07h-0Fh)
	???
Return: ???
Notes:	called by DPMS.EXE and EMM386.EXE
	the handlers for each of these functions may be set individually by
	  one of the subfunctions of AX=2780h/CL=01h; the default handlers
	  return with all registers unchanged
	this API is only available if AX=12FFh/BX=0EDCh returns successfully;
	  because the request is handled on the initial trap to the memory
	  manager caused by INT instructions, this API must be invoked with
	  an actual INT 2F instruction instead of some simulation such as a
	  far call to the address in the interrupt vector table
SeeAlso: AX=12FFh/BX=0EDCh,AX=2780h/CL=01h,AX=2780h/CL=02h,AX=2780h/CL=03h

Top

2F2783 - INT 2F U - Novell DOS 7 - EMM386.EXE - GET ???

INT 2F U - Novell DOS 7 - EMM386.EXE - GET ???
	AX = 2783h
Return: AX = ???
	BX = ???

Top

2F4300 - INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ - INSTALLATION CHECK

INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ - INSTALLATION CHECK
	AX = 4300h
Return: AL = 80h XMS driver installed
	AL <> 80h no driver
Notes:	XMS gives access to extended memory and noncontiguous/nonEMS memory
	  above 640K
	this installation check DOES NOT follow the format used by other
	  software
SeeAlso: AX=4310h,AX=1687h,INT 67/AH=40h,@xxxxh:xxxxh"PMM"
Index:	installation check;XMS version 2+

Top

2F4308 - INT 2F U - HIMEM.SYS v2.77+ - GET A20 HANDLER NUMBER

INT 2F U - HIMEM.SYS v2.77+ - GET A20 HANDLER NUMBER
	AX = 4308h
Return: AL = 43h if supported
	    BL = A20 handler number (value of /MACHINE:nn switch)
	    BH = AT A20 switch time (00h medium, 01h fast, 02h slow)
Note:	if the A20 handler number returned in BL is 00h, an external handler
	  is being used (see AX=4330h)
SeeAlso: AX=4309h,AX=4330h

Top

2F4309 - INT 2F U - HIMEM.SYS v3.09+ - GET XMS HANDLE TABLE

INT 2F U - HIMEM.SYS v3.09+ - GET XMS HANDLE TABLE
	AX = 4309h
Return: AL = 43h if function supported
	    ES:BX -> XMS handle table (see #02747)
Note:	HIMEM.SYS v3.09 is part of MS-DOS 6.0.
SeeAlso: AX=4308h

Format of XMS handle table:
Offset	Size	Description	(Table 02747)
 00h	BYTE	??? (01h in HIMEM.SYS v3.09)
 01h	BYTE	size of one handle descriptor
 02h	WORD	number of handles (default = 20h)
 04h	DWORD	pointer to XMS handle array (see #02748)
SeeAlso: #02777

Format of XMS handle descriptor [array]:
Offset	Size	Description	(Table 02748)
 00h	BYTE	flag
		01h=free, 02h=used, 04h=in pool but not associated with any EMB
 01h	BYTE	lock count (00h=unlocked)
 02h	DWORD	address of XMS block in KB (shift left by 10 for abs. address)
 06h	DWORD	size of XMS block in KB

Top

2F4310 - INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ - GET DRIVER ADDRESS

INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ - GET DRIVER ADDRESS
	AX = 4310h
Return: ES:BX -> driver entry point (see #02749,#02750,#02753,#02760,#02769,#02774)
Notes:	HIMEM.SYS v2.77 chains to previous handler if AH is not 00h or 10h
	HIMEM.SYS requires at least 256 bytes free stack space when calling
	  the driver entry point
SeeAlso: AX=4300h,AX=4310h"Cloaking",AX=4310h"Netroom",AX=4310h"XMZ"

Format of XMS driver entry point:
Offset	Size	Description	(Table 02749)
 00h  5 BYTEs	jump to actual handler
		either short jump (EBh XXh) followed by three NOPs or
		  far jump (EAh XXXX:XXXX) to a program which has hooked itself
		  into the XMS driver chain
Note:	to hook into the XMS driver chain, a program should follow the chain of
	  far jumps until it reaches the short jump of the driver at the end
	  of the chain; this short jump is to be replaced with a far jump to
	  the new handler's entry point, which should contain a short jump
	  followed by three NOPs.  The new handler must return to the address
	  pointed at by the short jump which was overwritten.  Using this
	  method, the new handler becomes the first to see every XMS request.

(Table 02750)
Call the XMS driver "Get XMS version number" function with:
	AH = 00h
Return: AX = XMS version (in BCD, AH=major, AL=minor)
	BX = internal revision number (in BCD for HIMEM.SYS)
	DX = High Memory Area (HMA) state
	    0001h HMA (1M to 1M + 64K) exists
	    0000h HMA does not exist
SeeAlso: #02751,#02752,#02757,#02758,#02764

(Table 02751)
Call the XMS driver "Request High Memory Area" function with:
	AH = 01h
	DX = memory in bytes (for TSR or device drivers)
	    FFFFh if application program
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,90h,91h,92h) (see #02775)
Note:	HIMEM.SYS will fail function 01h with error code 91h if AL=40h and
	  DX=KB free extended memory returned by last call of function 08h
SeeAlso: #02752,#02784

(Table 02752)
Call the XMS driver "Release High Memory Area" function with:
	AH = 02h
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,90h,93h) (see #02775)
SeeAlso: #02751

(Table 02753)
Call the XMS driver "Global enable A20, for using the HMA" function with:
	AH = 03h
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,82h) (see #02775)
SeeAlso: #02754,#02755,MSR 00001000h

(Table 02754)
Call the XMS driver "Global disable A20" function with:
	AH = 04h
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,82h,94h) (see #02775)
SeeAlso: #02753,#02756,MSR 00001000h

(Table 02755)
Call the XMS driver "Local enable A20" function with:
	AH = 05h
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,82h) (see #02775)
Note:	this function is used for direct access to extended memory
SeeAlso: #02753,#02756

(Table 02756)
Call the XMS driver "Local disable A20" function with:
	AH = 06h
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,82h,94h) (see #02775)
SeeAlso: #02754,#02755

(Table 02757)
Call the XMS driver "Query A20 state" function with:
	AH = 07h
Return: AX = status
	    0001h enabled
	    0000h disabled
		BL = error code (00h,80h,81h) (see #02775)
SeeAlso: #02750,#02758

(Table 02758)
Call the XMS driver "Query free extended memory" function with:
	AH = 08h
	BL = 00h (some implementations leave BL unchanged on success)
Return: AX = size of largest extended memory block in KB
	DX = total extended memory in KB
	BL = error code (00h,80h,81h,A0h) (see #02775)
Note:	this function does not include the HMA in the returned memory sizes
SeeAlso: #02750,#02757,#02759,#02771

(Table 02759)
Call the XMS driver "Allocate extended memory block" function with:
	AH = 09h
	DX = Kbytes needed
Return: AX = status
	    0001h success
		DX = handle for memory block
	    0000h failure
		BL = error code (80h,81h,A0h) (see #02775)
SeeAlso: #02758,#02761,#02764,#02765,#02766,#02772

(Table 02760)
Call the XMS driver "Free extended memory block" function with:
	AH = 0Ah
	DX = handle of block to free
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,A2h,ABh) (see #02775)
SeeAlso: #02759,#02772

(Table 02761)
Call the XMS driver "Move extended memory block" function with:
	AH = 0Bh
	DS:SI -> EMM structure (see #02776)
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h-82h,A3h-A9h) (see #02775)
Note:	if either handle in the EMM structure is 0000h, the corresponding
	  offset is considered to be an absolute segment:offset address in
	  directly addressable memory
SeeAlso: #02759,#02762

(Table 02762)
Call the XMS driver "Lock extended memory block" function with:
	AH = 0Ch
	DX = handle of block to lock
Return: AX = status
	    0001h success
		DX:BX = 32-bit physical address of locked block
	    0000h failure
		BL = error code (80h,81h,A2h,ACh,ADh) (see #02775)
Note:	MS Windows 3.x rejects this function for handles allocated after
	  Windows started
SeeAlso: #02759,#02761,#02763,#02777

(Table 02763)
Call the XMS driver "Unlock extended memory block" function with:
	AH = 0Dh
	DX = handle of block to unlock
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,A2h,AAh) (see #02775)
SeeAlso: #02762

(Table 02764)
Call the XMS driver "Get handle information" function with:
	AH = 0Eh
	DX = handle for which to get info
Return: AX = status
	    0001h success
		BH = block's lock count
		BL = number of free handles left
		DX = block size in KB
	    0000h failure
		BL = error code (80h,81h,A2h) (see #02775)
BUG:	MS Windows 3.10 acts as though unallocated handles are in use
Note:	MS Windows 3.00 has problems with this call
SeeAlso: #02750,#02759,#02773

(Table 02765)
Call the XMS driver "Reallocate extended memory block" function with:
	AH = 0Fh
	DX = handle of block
	BX = new size of block in KB
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,81h,A0h-A2h,ABh) (see #02775)
SeeAlso: #02759,#02768

(Table 02766)
Call the XMS driver "Request upper memory block" function with:
	AH = 10h
	DX = size of block in paragraphs
Return: AX = status
	    0001h success
		BX = segment address of UMB
		DX = actual size of block
	    0000h failure
		BL = error code (80h,B0h,B1h) (see #02775)
		DX = largest available block
Notes:	Upper Memory consists of non-EMS memory between 640K and 1024K
	the XMS driver need not implement functions 10h through 12h to be
	  considered compliant with the standard
	under DOS 5+, if CONFIG.SYS contains the line DOS=UMB, then no upper
	  memory blocks will be available for allocation because all blocks
	  have been grabbed by MS-DOS while booting
SeeAlso: #02759,#02767,#02785,INT 21/AH=58h"UMB"

(Table 02767)
Call the XMS driver "Release upper memory block" function with:
	AH = 11h
	DX = segment address of UMB to release
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,B2h) (see #02775)
Note:	the XMS driver need not implement functions 10h through 12h to be
	  considered compliant with the standard
SeeAlso: #02760,#02766,#02768

(Table 02768)
Call the XMS v3.0+ driver "Reallocate upper memory block" function with:
	AH = 12h
	DX = segment address of UMB to resize
	BX = new size of block in paragraphs
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,B0h,B2h) (see #02775)
		DX = maximum available size (RM386)
Note:	the XMS driver need not implement functions 10h through 12h to be
	  considered compliant with the standard
SeeAlso: #02765,#02766,#02767,#02783

(Table 02769)
Call the QEMM v5.11 "???" function with:
	AH = 34h  (QEMM 5.11 only, undocumented)
	???
Return: ???
SeeAlso: #02770

(Table 02770)
Call the QEMM v5.11 "???" function with:
	AH = 44h  (QEMM 5.11 only, undocumented)
	???
Return: ???
SeeAlso: #02769,#02783

(Table 02771)
Call the XMS v3.0 driver "Query free extended memory" function with:
	AH = 88h
Return: EAX = largest block of extended memory, in KB
	BL = status (00h,80h,81h,A0h) (see #02775)
	ECX = physical address of highest byte of memory
	    (valid even on error codes 81h and A0h)
	EDX = total Kbytes of extended memory (0 if status A0h)
BUG:	HIMEM v3.03-3.07 crash on an 80286 machine if any of the 8Xh functions
	  are called
SeeAlso: #02758,#02772

(Table 02772)
Call the XMS v3.0 driver "Allocate any extended memory" function with:
	AH = 89h
	EDX = Kbytes needed
Return: AX = status
	    0001h success
		DX = handle for allocated block (free with AH=0Ah) (see #02760)
	    0000h failure
		BL = status (80h,81h,A0h,A1h,A2h) (see #02775)
SeeAlso: #02759,#02771

(Table 02773)
Call the XMS v3.0 driver "Get extended EMB handle information" function with:
	AH = 8Eh
	DX = handle
Return: AX = status
	    0001h success
		BH = block's lock count
		CX = number of free handles left
		EDX = block size in KB
	    0000h failure
		BL = status (80h,81h,A2h) (see #02775)
BUG:	MS-DOS 6.0 HIMEM.SYS leaves CX unchanged
SeeAlso: #02764,#02772,#02774

(Table 02774)
Call the XMS v3.0 driver "Reallocate any extended memory block" function with:
	AH = 8Fh
	DX = unlocked memory block handle
	EBX = new size in KB
Return: AX = status
	    0001h success
	    0000h failure
		BL = status (80h,81h,A0h-A2h,ABh) (see #02775)
BUG:	HIMEM v3.03-3.07 crash on an 80286 machine if any of the 8Xh functions
	  are called
SeeAlso: #02765,#02773

(Table 02775)
Values for XMS error code returned in BL:
 00h	successful
 80h	function not implemented
 81h	Vdisk was detected
 82h	an A20 error occurred
 8Eh	a general driver error
 8Fh	unrecoverable driver error
 90h	HMA does not exist or is not managed by XMS provider
 91h	HMA is already in use
 92h	DX is less than the /HMAMIN= parameter
 93h	HMA is not allocated
 94h	A20 line still enabled
 A0h	all extended memory is allocated
 A1h	all available extended memory handles are allocated
 A2h	invalid handle
 A3h	source handle is invalid
 A4h	source offset is invalid
 A5h	destination handle is invalid
 A6h	destination offset is invalid
 A7h	length is invalid
 A8h	move has an invalid overlap
 A9h	parity error occurred
 AAh	block is not locked
 ABh	block is locked
 ACh	block lock count overflowed
 ADh	lock failed
 B0h	only a smaller UMB is available
 B1h	no UMB's are available
 B2h	UMB segment number is invalid

Format of EMM structure:
Offset	Size	Description	(Table 02776)
 00h	DWORD	number of bytes to move (must be even)
 04h	WORD	source handle
 06h	DWORD	offset into source block
 0Ah	WORD	destination handle
 0Ch	DWORD	offset into destination block
Notes:	if source and destination overlap, only forward moves (source base
	  less than destination base) are guaranteed to work properly
	if either handle is zero, the corresponding offset is interpreted
	  as a real-mode address referring to memory directly addressable
	  by the processor

Format of XMS handle info [array]:
Offset	Size	Description	(Table 02777)
 00h	BYTE	handle
 01h	BYTE	lock count
 02h	DWORD	handle size
 06h	DWORD	handle physical address (only valid if lock count nonzero)
SeeAlso: #02747,#02762

Top

2F4310 - INT 2F - Cloaking - REAL-MODE API

INT 2F - Cloaking - REAL-MODE API
	AX = 4310h
Return: ES:BX -> driver entry point (see #02749,#02778,#02779,#02780,#02781)
SeeAlso: AX=4310h"XMS"

(Table 02778)
Call the Cloaking v1.01 "Client Registration" function with:
	AH = 7Eh
	BX = subfunction
	    0000h get client registration count
	    0001h get client registration structures
		ES:DI -> buffer for registration structures
Return: AX = status
	    0000h failed
	    0001h successful
		---subfunction 00h---
		BX = size of client structure in bytes
		CX = number of clients installed
		---subfunction 01h---
		ES:DI buffer filled
SeeAlso: #02779,#02781,INT 2C/AX=0033h

(Table 02779)
Call the Cloaking v1.01 "Verify Cloaking Host" function with:
	AH = 7Fh
Return: AX = status
	    0000h failed
	    0001h (successful) if installed
		BX = version (0101h for v1.01)
		CX = flags
		    bit 0: host is VCPI-based
		DS:DX -> ASCIZ Cloaking host signature
		    "CLOAKING.EXE"0, followed by a far-call entry point to
		      uninstall host (see #02780) in Helix's CLOAKING.EXE
SeeAlso: #02778,#02781
Index:	installation check;Cloaking host|installation check;CLOAKING.EXE

(Table 02780)
Call the CLOAKING.EXE "Uninstall Host" function with:
Return: AX = 4F4Bh ('OK') if successfully uninstalled protected-mode code

(Table 02781)
Call the Cloaking "Start Protected-Mode Client" function with:
	AH = 82h
	DX = XMS handle of locked block containing protected-mode code
	CL = code size (00h 16-bit, else 32-bit)
	ESI, EDI = parameters to pass to protected-mode code
Return: AX = status
	    nonzero success
	    0000h failed
		BL = error code (A2h,B0h) (see #02775)
Notes:	this function calls a user initialization function at offset 0 in
	  the XMS memory block (see #02782)
	supported by Helix's RM386 v6.00 and Helix's CLOAKING.EXE
SeeAlso: #02778,#02779

(Table 02782)
Values user initialization function is called with:
	EBX = physical address of block's start
	ESI = user data from function 82h call
	EDI = user data from function 82h call
	CS = code selector for XMS block at EBX (16-bit or 32-bit)
	DS = data selector for XMS block, starting at EBX
	ES = selector for V86 memory access to full real-mode 1088K
	GS = selector for full 4G flat address space
	SS:ESP -> stack provided by host
Return: via 32-bit FAR return
Note:	the initialization function may call any protected-mode Cloaking
	  service; it should store the values of DS, ES, and GS for future
	  reference

Top

2F4310 - INT 2F - Helix Netroom RM386 v6.00 - XMS EXTENSIONS

INT 2F - Helix Netroom RM386 v6.00 - XMS EXTENSIONS
	AX = 4310h
Return: ES:BX -> driver entry point (see #02783,#02784,#02785,#02786)
Notes:	HIMEM.SYS v2.77 chains to previous handler if AH is not 00h or 10h
	HIMEM.SYS requires at least 256 bytes free stack space when calling
	  the driver entry point
SeeAlso: AX=4300h,AX=4310h"XMS",AX=4310h"Cloaking"

(Table 02783)
Call the Netroom RM386 v6.00 "Reallocate upper memory block" function with:
	AH = 80h
	DX = segment address of UMB to resize
	BX = new size of block in paragraphs
Return: AX = status
	    0001h success
	    0000h failure
		BL = error code (80h,B0h,B2h) (see #02775)
		DX = maximum available size
Note:	this function is identical to function 12h
SeeAlso: #02768,#02784

(Table 02784)
Call the Netroom RM386 v6.00 "re-enable HMA allocation" function with:
	AH = 81h
Return: AX = 0001h (success)
SeeAlso: #02751,#02783,#02785

(Table 02785)
Call the Netroom RM386 v6.00 "Create new UMB entry" function with:
	AH = 83h
	BX = segment of high-memory block
	DX = first page of start of block
	CX = number of consecutive pages in block
	DI = start of UMB in block
Return: AX = 0001h (success)
	DI = segment of first high-DOS block
Note:	the new UMB is not linked into the high-memory chain
SeeAlso: #02766,#02784,#02786

(Table 02786)
Call the Netroom RM386 v6.00 "Get all XMS handles info" function with:
	AH = 84h
	CX = size of buffer for handle info
	ES:DI -> buffer for handle info (see #02777)
Return: AX = 0001h (success)
	DX = current number of allocated XMS handles
SeeAlso: #02785,#02771

Top

2F4310 - INT 2F - NEC PC-9800 - XMZ - PRIVATE API

INT 2F - NEC PC-9800 - XMZ - PRIVATE API
	AX = 4310h
Return: ES:BX -> driver entry point (see #02787,#02788)
Program: XMZ is an XMS 2.x-compatible driver for the NEC PC-98 series written
	  by ZOBplus Hayami and available at
	  ftp:/ftp.tohoku.ac.jp/pub/msdos/Memory/xmz/
SeeAlso: AX=4300h,AX=4310h"XMS"

(Table 02787)
Call XMZ v1.02 "Get HMA Information" function with:
	AH = FFh  (XMZ only)
	AL = 01h
Return: AX = 1 on success
	DX = minimum HMA allocation size (/HMAMIN=)
	BX = actual size of HMA allocation, if in use (i.e. the value in DX
	      when XMS function 1 was called)
SeeAlso: #02788

(Table 02788)
Call XMZ v1.02 "Get EMB Handle Information" function with:
	AH = FFh  (XMZ only)
	AL = 02h
Return: AX = 1 on success
	DX = number of EMB handles configured (/NUMHANDLES=)
	BX = offset in XMZ's segment of the handle table (use segment of
	      entry point) (see #02789)
SeeAlso: #02787

Format of XMZ v1.02 EMB Handle structure:
Offset	Size	Description	(Table 02789)
 00h	BYTE	flag byte
		04h unused handle slot
		02h in-use handle slot
		01h handle slot that represents a free block
 01h	BYTE	lock count
 02h	WORD	block start address (1K increments)
 04h	WORD	block length (1K increments)
SeeAlso: #02788

Top

2F4320 - INT 2F U - HIMEM.SYS - Mach 20 SUPPORT

INT 2F U - HIMEM.SYS - Mach 20 SUPPORT
	AX = 4320h
	???
Return: ???

Top

2F4330 - INT 2F CU - HIMEM.SYS v2.77+ - GET EXTERNAL A20 HANDLER ADDRESS

INT 2F CU - HIMEM.SYS v2.77+ - GET EXTERNAL A20 HANDLER ADDRESS
	AX = 4330h
Return: AL = 80h if external A20 handler provided
	    ES:BX -> external A20 handler (see #02790)
	    CL = A20 detection support
		00h handler is unable to report A20 state
		01h handler supports function 0002h to report A20 state
Note:	HIMEM.SYS calls this function to allow an external program to provide
	  an A20 handler (i.e. to support a machine not supported by HIMEM
	  itself)
SeeAlso: AX=4308h,AX=4310h

(Table 02790)
Call parameters for external A20 handler are:
	AX = function
	    0000h disable A20
	    0001h enable A20
	    0002h get A20 state
Return: AX = status (functions 0000h and 0001h)
	    0000h failure
	    0001h successful
	AX = A20 state (function 0002h)
	    0000h disabled
	    0001h enabled
Note:	HIMEM.SYS only calls function 0002h if the returned CL indicated that
	  the handler supports the call

Top

2F43E1 - INT 2F - DOS Protected Mode Services (DPMS) v1.0 - REGISTER CLIENT

INT 2F - DOS Protected Mode Services (DPMS) v1.0 - REGISTER CLIENT
	AX = 43E1h
	CX = required protected-mode stack size in bytes
	ES:DI -> DPMS client interface structure (see #02794)
Return: AX = 0000h if supported
	   CF clear
	   ES:DI buffer filled with API entry point code from offset 0Ah
Note:	the client is allowed to copy the returned API code to any location in
	  memory, and need not keep the three code fields together
SeeAlso: AX=43E0h,AX=43E2h,AX=43E3h

Format of DPMS client interface structure:
Offset	Size	Description	(Table 02794)
 00h	WORD	0000h (structure version / flags)
 02h  8 BYTEs	blank-padded client name
 0Ah  7 BYTEs	real/virtual-86 mode API code (see #02795)
 11h	BYTE	space for return instruction
		set to C3h for near return, CBh for far return
 12h  7 BYTEs	16-bit protected-mode API code (see #02795)
 19h	BYTE	space for return instruction
		set to C3h for near return, CBh for far return
 1Ah  9 BYTEs	32-bit protected-mode API code (see #02795)
 23h	BYTE	space for return instruction
		set to C3h for near return, CBh for far return
Note:	the DPMS server fills the return opcode bytes with zeros and DPMS
	  requests will thus crash the system unless the application
	  explicitly sets them (some early versions set them to C3h by
	  default, but one should not rely on that)

(Table 02795)
Call DPMS entry point with:
	AX = 0000h unregister client from server
 ---control transfer functions---
	AX = 0100h call protected-mode procedure
		CX = number of words of stack to copy
		ES:(E)DI -> callup/down register structure (see #02797)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0101h call real-mode procedure (RETF return)
		CX = number of words of stack to copy
		ES:(E)DI -> callup/down register structure (see #02797)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0102h call real-mode procedure (IRET return)
		CX = number of words of stack to copy
		ES:(E)DI -> callup/down register structure (see #02797)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0103h call real-mode interrupt handler
		BL = interrupt number
		CX = number of words of stack to copy
		ES:(E)DI -> callup/down register structure (see #02797)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0104h register default protected mode procedure
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0105h register default real-mode procedure (RETF return)
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the procedure will be called from 16-bit prot. mode
	AX = 0106h register default real-mode procedure (IRET return)
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the procedure will be called from 16-bit prot. mode
	AX = 0107h register default real-mode interrupt handler
		BL = interrupt number
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the handler will be called from 16-bit protected mode
	AX = 0108h register default real-mode procedure (RETF return)
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the procedure will be called from 32-bit prot. mode
	AX = 0109h register default real-mode procedure (IRET return)
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the procedure will be called from 32-bit prot. mode
	AX = 010Ah register default real-mode interrupt handler
		BL = interrupt number
		ES:(E)DI -> default register structure (see #02798)
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
		Note:	the handler will be called from 32-bit protected mode
 ---descriptor management---
	AX = 0200h allocate descriptors
		CX = number of descriptors to allocate
		Return: CF clear if successful
			    AX = selector for first descriptor allocated
			CF set on error
			    AX = error code (see #02796)
	AX = 0201h free a descriptor
		BX = selector for descriptor
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0202h create alias descriptor
		BX = selector for descriptor to be aliased
		Return: CF clear if successful
			    AX = alias descriptor
			CF set on error
			    AX = error code (see #02796)
	AX = 0203h build alias to real-mode segment
		BX = descriptor
		CX = real-mode segment
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0204h set descriptor base
		BX = descriptor
		CX:DX = base address
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0205h set descriptor limit
		BX = descriptor
		CX = limit
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0206h set descriptor type/attribute
		BX = descriptor
		CL = type
		CH = attribute
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0207h get descriptor base
		BX = descriptor
		Return: CF clear if successful
			    CX:DX = base address
			CF set on error
			    AX = error code (see #02796)
 ---linear memory functions---
	AX = 0300h get size of largest free block of memory
		Return: CF clear if successful
			    BX:CX = size
			CF set on error
			    AX = error code (see #02796)
	AX = 0301h allocate block of extended memory
		BX:CX = required size
		Return: CF clear if successful
			    BX:CX = base address
			    SI:DI = handle
			CF set on error
			    AX = error code (see #02796)
	AX = 0302h free block of extended memory
		SI:DI = handle
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0303h map linear memory
		ES:(E)DI -> DDS (see #02799)
		Return: CF clear if successful
			    BX:CX = base address
			    SI:DI = handle
			CF set on error
			    AX = error code (see #02796)
	AX = 0304h unmap linear memory
		SI:DI = handle
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0305h get page table entries
		ESI = linear address
		(E)CX = count
		ES:(E)DI -> buffer for page table entries
		Return: CF clear if successful
			    ES:(E)DI buffer filled
			CF set on error
			    AX = error code (see #02796)
	AX = 0306h set page table entries
		EBX = linear memory handle
		ESI = linear address
		(E)CX = count
		ES:(E)DI -> buffer containing page table entries
		Return: CF clear if successful
			CF set on error
			    AX = error code (see #02796)
	AX = 0307h get largest mappable block size
		Return: CF clear if successful
			    BX:CX = size
			CF set on error
			    AX = error code (see #02796)
 ---miscellaneous---
	AX = 0400h relocate segment to extended memory
		ES:SI = base address
		CX = limit
		BL = type
		BH = attribute
		DX = selector or 0000h
		Return: CF clear if successful
			    AX = selector
			    BX:CX = new base address
			    SI:DI = handle
			CF set on error
			    AX = error code (see #02796)
Note:	the beta DPMS specification, which is still supported by the Novell
	  DOS 7.0 DPMS host, only supported functions 0100h-0103h, 0200h-0207h,
	  0300h-0304h, and 0400h

(Table 02796)
Values for DPMS error code:
 8000h	general error
 8001h	unsupported function
 8002h	unable to switch to protected mode
 8004h	no default stack defined
 8005h	unknown client
 8010h	resource unavailable
 8011h	descriptor unavailable
 8012h	linear memory unavailable
 8013h	physical memory unavailable
 8021h	invalid value
 8022h	invalid selector
 8023h	invalid handle
 8025h	invalid linear address

Format of DPMS callup/down register structure:
Offset	Size	Description	(Table 02797)
 00h	DWORD	EDI
 04h	DWORD	ESI
 08h	DWORD	EBP
 0Ch  4 BYTEs	reserved (0) (ESP, may be used by DPMS server)
 10h	DWORD	EBX
 14h	DWORD	EDX
 18h	DWORD	ECX
 20h	DWORD	EAX
 24h	DWORD	EIP
 28h	WORD	CS
 2Ah  2 BYTEs	reserved (0)
 2Ch	DWORD	EFLAGS
 30h	DWORD	ESP
 34h	WORD	SS
 36h  2 BYTEs	reserved (0)
 38h	WORD	ES
 3Ah  2 BYTEs	reserved (0)
 3Ch	WORD	DS
 3Eh  2 BYTEs	reserved (0)
 40h	WORD	FS
 42h  2 BYTEs	reserved (0)
 44h	WORD	GS
 46h  2 BYTEs	reserved (0)

Format of DPMS default register structure:
Offset	Size	Description	(Table 02798)
 00h	DWORD	EIP
 04h	WORD	CS
 06h  2 BYTEs	reserved (0)
 08h	WORD	number of words to copy from stack to stack
 0Ah	BYTE	(call) 00h
		(ret) nonzero if call could not be made
 0Bh	BYTE	reserved (may be used by some servers)
 0Ch	DWORD	ESP
 10h	WORD	SS
 12h  2 BYTEs	reserved (0)
 14h	WORD	ES
 16h  2 BYTEs	reserved (0)
 18h	WORD	DS
 1Ah  2 BYTEs	reserved (0)
 1Ch	WORD	FS
 1Eh  2 BYTEs	reserved (0)
 20h	WORD	GS
 22h  2 BYTEs	reserved (0)
 24h  9 BYTEs	API entry code (filled in by server)

Format of DPMS lock DDS:
Offset	Size	Description	(Table 02799)
 00h	DWORD	total size in bytes
 04h	DWORD	offset
 08h	WORD	segment or selector
 0Ah	WORD	reserved
 0Ch	WORD	maximum number of physical blocks structure has space for
 0Eh	WORD	number of physical blocks listed
 10h	DWORD	physical address of first block
 14h	DWORD	size in bytes of first block
	...

Top

2F43E2 - INT 2F - DOS Protected Mode Services (DPMS) v1.0 - ENABLE/DISABLE DPMS

INT 2F - DOS Protected Mode Services (DPMS) v1.0 - ENABLE/DISABLE DPMS
	AX = 43E2h
	BX = new state (0000h disable, 0001h enable)
Return: AX = 0000h if supported
Note:	this function should normally be called only by system software
SeeAlso: AX=43E0h,AX=43E1h,AX=43E3h

Top

2F43E3BX0000 - INT 2F C - DOS Protected Mode Services (DPMS) v1.0 - DPMS STARTUP BROADCAST

INT 2F C - DOS Protected Mode Services (DPMS) v1.0 - DPMS STARTUP BROADCAST
	AX = 43E3h
	BX = 0000h
	CX = 4450h ('DP')
	DX = 4D53h ('MS')
	ES:DI -> DPMS server structure (see #02791)
Return: BX = status
	    bit 0 set if server is not allowed to load (e.g. some resident
		  program is incompatible)
Note:	this callout is made while the potential server is running as a normal
	  real-mode DOS program, so there are no BIOS/DOS re-entrancy issues
SeeAlso: AX=43E0h,AX=43E4h

Top

2F43E4BX0000 - INT 2F C - DOS Protected Mode Services (DPMS) v1.0 - DPMS EXIT BROADCAST

INT 2F C - DOS Protected Mode Services (DPMS) v1.0 - DPMS EXIT BROADCAST
	AX = 43E4h
	BX = 0000h
	CX = 4450h ('DP')
	DX = 4D53h ('MS')
Return: BX = status
	    bit 0 set if server is not allowed to unload
Note:	servers never unload until all clients unregister
SeeAlso: AX=43E0h,AX=43E3h

Top

2FA189 - INT 2F U - Biologic HRAMDEV.SYS - API

INT 2F U - Biologic HRAMDEV.SYS - API
	AX = A189h
	BX = subfunction
	    0000h set ???
	    0001h remove ???
	    0002h get status ???
	    0003h enable ???
	    0004h disable ???
	    0005h set ??? flag
	    0006h clear ??? flag
	    0007h set ??? flag
	    0008h clear ??? flag
	    0009h set ???
	ES:DI -> function-specific arguments
		if func 0000h: 20-byte buffer containing ???
		if func 0001h: 20-byte buffer for returned ???
		if func 0002h: 16-byte buffer for returned ???
		if func 0009h: WORD containing ???
Return: BX = A189h if installed
	AH = status
	    00h successful
	    FFh failed or invalid function number
Program: HRAMDEV.SYS is a part of the shareware package HRAM by Biologic which
	  provides improved high memory access under MS-DOS 5.0
Note:	functions 00h and 01h use a stack of four entries; function 01h always
	  removes the values stored with the most recent function 00h call
	  which has not yet been matched with a function 01h call.

Top

2FD201BX4849 - INT 2F - Quarterdeck RPCI - GET QD HIMEM PRESENCE

INT 2F - Quarterdeck RPCI - GET QD HIMEM PRESENCE
	AX = D201h
	BX = 4849h ("HI")
	CX = 4D45h ("ME")
	DX = 4D51h ("MQ")
Return: BX = 4F4Bh ("OK")
	ES:DI -> HIMEM entry point
Range:	AH=C0h to AH=FFh, selected by scanning AH=D2h-FFh, then AH=C0h-D1h
SeeAlso: AX=D200h,AX=D201h/BX=5145h

Top

2FD201BX4849 - INT 2F - Quarterdeck RPCI - QEMM/QRAM v5.0+ - GET HIRAM MEMORY CHAIN

INT 2F - Quarterdeck RPCI - QEMM/QRAM v5.0+ - GET HIRAM MEMORY CHAIN
	AX = D201h
	BX = 4849h ("HI")
	CX = 5241h ("RA")
	DX = 4D30h ("M0")
Return: BX = 4F4Bh ("OK")
	CX = segment of start of HIRAM chain
	DX = reserved block owner (QEMM/QRAM code segment)
Range:	AH=C0h to AH=FFh, selected by scanning AH=D2h-FFh, then AH=C0h-D1h
Note:	the HIRAM memory chain has the same format as the regular DOS 4.0
	  memory chain (see #01628 at INT 21/AH=52h), except that XMS Upper
	  Memory Blocks have the block header program name field set to
	  "UMB"; blocks whose "owner" field is set to the reserved segment
	  returned in DX are locked-out regions such as video memory and ROMs.
SeeAlso: AX=12FFh/BX=0006h,AX=D200h

Top

2FD201BX5145 - INT 2F - Quarterdeck RPCI - QEMM v5.0+ - INSTALLATION CHECK

INT 2F - Quarterdeck RPCI - QEMM v5.0+ - INSTALLATION CHECK
	AX = D201h
	BX = 5145h ("QE")
	CX = 4D4Dh ("MM")
	DX = 3432h ("42")
Return: BX = 4F4Bh ("OK")
	ES:DI -> QEMM API entry point (see INT 67/AH=3Fh)
Range:	AH=C0h to AH=FFh, selected by scanning AH=D2h-FFh, then AH=C0h-D1h
Note:	this call is not available under QEMM v6.00 unless Windows3 support
	  has been disabled with the NW3 switch to QEMM386.SYS
SeeAlso: AX=D200h,AX=D201h/BX=4849h,INT 67/AH=3Fh

Top

2FF1 - INT 2F U - MIN-MEM v2.11 - INSTALLATION CHECK

INT 2F U - MIN-MEM v2.11 - INSTALLATION CHECK
	AH = F1h
	AL <> F1h
Return: AL = F1h if installed
Program: MIN-MEM is a shareware TSR manager by Biologic which permits up to 24
	  popup TSRs to be loaded but swapped out to disk, EMS, or XMS.	 One
	  TSR at a time is brought back into memory at the user's request.

Top

671E - INT 67 U - Qualitas 386MAX v7.00 - MEMLIMIT - INSTALLATION CHECK

INT 67 U - Qualitas 386MAX v7.00 - MEMLIMIT - INSTALLATION CHECK
	AH = 1Eh
Return: AH = 00h if installed
	    AL destroyed
	    ES:DI -> ASCII signature "MemLimit"
SeeAlso: AH=1Fh,INT 21/AX=4402h"386MAX"

Top

671F - INT 67 U - Qualitas 386MAX v7.00 - MEMLIMIT - API

INT 67 U - Qualitas 386MAX v7.00 - MEMLIMIT - API
	AH = 1Fh
	DS:SI -> request packet (see #03523)
Return: AH = status (00h successful, 84h invalid function code, etc.)
SeeAlso: AH=1Eh

Format of 386MAX MEMLIMIT request packet:
Offset	Size	Description	(Table 03523)
 00h	WORD	function code (00h-0Fh)
 02h	WORD	return code (see #03524)
 04h  4 BYTEs	???
 08h	WORD	???
	???

(Table 03524)
Values for 386MAX MEMLIMIT return code:
 00h	unknown request
 01h	invalid parameter for VCPI limit
 02h	VCPI limit set
 03h	invalid parameter for EMS limit
 04h	EMS limit set
 05h	DPMI disabled
 06h	XMS disabled
 07h	XMS limit set
 08h	unable to uninstall
 09h	unloaded

Top

672763CL01 - INT 67 - VIDEMS.SYS v1.31+ - INSTALLATION CHECK

INT 67 - VIDEMS.SYS v1.31+ - INSTALLATION CHECK
	AX = 2763h
	CL = 01h
	BX = signature AAFFh
Return: AH = 00h if VIDEMS is installed
	    CH = 00h if optimization for 80286 is used, 01h otherwise
	    CL = internal revision number (typically 00h to 03h)
	    DX = driver version (DH=major, DL=minor; not a BCD!)
	AH = 84h if not installed but EMS manager is present
Program: VIDEMS is an expanded memory manager from Conea Software Corp. It
	 converts video adapter RAM to LIM 3.2 EMS.
SeeAlso: AX=2763h/CL=02h,AX=2763h/CL=03h

Top

672763CL02 - INT 67 - VIDEMS.SYS v1.31+ - FLUSH EMS TO VIDEO RAM

INT 67 - VIDEMS.SYS v1.31+ - FLUSH EMS TO VIDEO RAM
	AX = 2763h
	CL = 02h
	BX = signature AAFFh
Return: AH = 00h if successful
Notes:	This call is normally used by Conea products only.
SeeAlso: AX=2763h/CL=01h,AX=2763h/CL=03h

Top

672763CL03 - INT 67 - VIDEMS.SYS v1.31+ - RELOAD EMS FROM VIDEO RAM

INT 67 - VIDEMS.SYS v1.31+ - RELOAD EMS FROM VIDEO RAM
	AX = 2763h
	CL = 03h
	BX = signature AAFFh
Return: AH = 00h if successful
Notes:	This call is normally used by Conea products only.
SeeAlso: AX=2763h/CL=01h,AX=2763h/CL=03h

Top

672763CL04 - INT 67 - VIDEMS.SYS v1.31+ - RETURN HIDDEN BLOCK SIZE

INT 67 - VIDEMS.SYS v1.31+ - RETURN HIDDEN BLOCK SIZE
	AX = 2763h
	CL = 04h
	BX = signature AAFFh
Return: AH = 00h if successful
	    DX = block size in kilobytes
Desc:	Returns the amount of EMS which can be safely used at any time, and
	  can't be destroyed by writing anything to the B800:0000 buffer.
Note:	this function normally returns 184K, while the driver provides up to
	  240K of EMS.
SeeAlso: AX=2763h/CL=01h,AX=2763h/CL=02h

Top

672763CL05 - INT 67 - VIDEMS.SYS v1.31+ - RETURN PHYSICAL PAGE SIZE

INT 67 - VIDEMS.SYS v1.31+ - RETURN PHYSICAL PAGE SIZE
	AX = 2763h
	CL = 05h
	BX = signature AAFFh
Return: AH = 00h
	DX = size in bytes
Desc:	Used by Conea products to determine if addressing mode has changed.
	  Normally, all VIDEMS versions beginning from 1.15 use 4K "physical"
	  pages.
Notes:	this function will probably become raw page size in future releases of
	  VIDEMS, which	will support the LIM 4.0 standard.
SeeAlso: AX=2763h/CL=01h,AX=2763h/CL=02h

Top

672763CL06 - INT 67 - VIDEMS.SYS v1.50+ - RETURN VIDEO RAM SIZE

INT 67 - VIDEMS.SYS v1.50+ - RETURN VIDEO RAM SIZE
	AX = 2763h
	CL = 06h
	BX = signature AAFFh
Return: AH = 00h
	DX = total amount of video RAM
Desc:	beginning with version 1.50, VIDEMS can use more adapter memory on
	  some chipsets, and is no longer limited to the first 240K.
Notes:	this call is not officially documented, and Conea programmers use it
	  mainly for debugging purposes.

Top

673F--CX5145 - INT 67 U - QEMM-386 v4.23+ - INSTALLATION CHECK

INT 67 U - QEMM-386 v4.23+ - INSTALLATION CHECK
	AH = 3Fh
	CX = 5145h ("QE")
	DX = 4D4Dh ("MM")
Return: AH = 00h if installed
	    ES:DI -> QEMM API entry point (see #03525,#03528,#03640)
Notes:	if no other program has hooked INT 67, an alternate installation
	  check is to test for the string
	  "QUARTERDECK EXPANDED MEMORY MANAGER 386" at offset 14h in the INT 67
	  handler's segment; the word at offset 12h contains the offset in
	  the handler's segment of the API entry point
	although this function is still undocumented, Quarterdeck has recently
	  documented two alternate methods for determining the QEMM API entry
	  point, as well as several of the API functions
	MICEMM (Micronics Expanded Memory Manager) versions 2.0C and 4D support
	  the alternate QEMM installation check and entry point functions 00h,
	  02h, and 03h; version 4D only provides the signature string if the
	  commandline argument "DV" is provided
	386MAX v6.01 responds to this call, but DESQview 2.42 does not
	  recognize the returned entry point as providing QEMM's capabilities
	  because a) only functions 0Ch (different from QEMM 0Ch) and
			1000h-1009h are supported,
		  b) status is returned as for EMS functions, not QEMM funcs
		  c) the protected-mode entry point returned by function 1000h
			only supports functions 0Ch, 1004h, 1005h, and 100Ah
	the string check mentioned above is not supported by 386MAX
SeeAlso: AX=5BF0h,AH=DDh,AX=FFA5h,INT 15/AX=11DEh,INT 21/AX=4402h/SF=01h
SeeAlso: INT 21/AX=4402h"QEMM",INT 21/AX=4402h"386MAX",INT 2F/AX=D201h/BX=5145h

(Table 03525)
Values for calling QEMM "QPI_GetStatus" function:
	AH = 00h get QEMM state
Return: CF clear
	AL = QEMM state
	    bit 0 set if QEMM turned OFF
	    bit 1 set if in "Auto" mode
Note:	this function is officially documented
SeeAlso: #03526,#03527,#03528,#03640

(Table 03526)
Values for calling QEMM "QPI_SetStatus" function:
	AH = 01h set QEMM state
	AL = new state
	    bit 0 set: place QEMM in OFF state
Return: CF clear if successful
	CF set on error
Note:	this function is officially documented
SeeAlso: #03525

(Table 03527)
Values for calling QEMM QPI function 02h:
	AH = 02h get ???
Return: CF clear
	AX = segment of ??? data structure
	Data Structure
	Offset	Size	Description
	 00h	DWORD	page table entry for ???
		???
SeeAlso: #03528

(Table 03528)
Values for calling QEMM "QPI_GetVersion" function:
	AH = 03h get QEMM version
Return: CF clear
	AX = BX = version in BCD
Notes:	this function is officially documented.	 The most recent official docs
	  state that the version is returned in both AX and BX; older
	  documentation only mentions BX
	MICEMM returns AX=0001h, BX unchanged
SeeAlso: #03525,#03529

(Table 03529)
Values for calling QEMM QPI function 04h:
	AH = 04h allocate 4K page and set AUTO/ON mode
Return: CF clear if successful
	    DX = page number of a 4K page
	CF set if unable to allocate page
Note:	QEMM mode unchanged if not AUTO/OFF
SeeAlso: #03530

(Table 03530)
Values for calling QEMM QPI function 05h:
	AH = 05h free 4K page and turn QEMM off
	DX = page number returned by function 04h
Return: CF clear
Note:	QEMM mode unchanged if not AUTO/ON
SeeAlso: #03529,#03531

(Table 03531)
Values for calling QEMM QPI function 06h:
	AH = 06h make new mapping context???
	DX = page number of 4K page to hold page table
Return: CF clear
Note:	copies page table into given page and then sets ??? page table entry
	  to point at copy
SeeAlso: #03532,#03533

(Table 03532)
Values for calling QEMM QPI function 07h:
	AH = 07h get mapping context
Return: CF clear
	DX = page number of page table for current mapping context
SeeAlso: #03528,#03531,#03533

(Table 03533)
Values for calling QEMM QPI function 08h:
	AH = 08h set mapping context???
	DX = linear page number of page table
Return: CF clear
SeeAlso: #03528,#03531,#03532,#03534,#03536

(Table 03534)
Values for calling QEMM QPI function 09h:
	AH = 09h get linear page number for page table entry
	CX = page table index
Return: CF clear
	DX = linear page number
SeeAlso: #03535

(Table 03535)
Values for calling QEMM QPI function 0Ah:
	AH = 0Ah set linear page number for page table entry
	CX = page table index
	DX = linear page number
Return: CF clear
SeeAlso: #03534

(Table 03536)
Values for calling QEMM QPI function 0Bh:
	AH = 0Bh map 4K pages
	BX = number of pages
	CX = first page number (must be 0100h to allocate HMA)
	DX = EMS handle (memory belonging to EMS handle will be mapped
	      into the address space beginning with the first page
	      allocated to the handle)
Return: AH = 00h
SeeAlso: #03533,#03537

(Table 03537)
Values for calling QEMM QPI function 0Ch:
	AH = 0Ch get available memory
Return: CF clear
	BX = 0001h
	CX = total 4K pages???
	DX = number of 4K pages free
SeeAlso: #03536,#03538

(Table 03538)
Values for calling QEMM QPI function 0Dh:
	AH = 0Dh CRT controller I/O port trapping
	AL = mode
	    00h only trap on I/O ports 03C0h-03C5h, 03C7h, 03CAh-03CFh
	    01h trap on ports 03B4h, 03B5h, 03B8h, 03C6h, 03C8h, 03C9h,
		  03D4h, and 03D5h
	    02h only trap on I/O ports 03C6h, 03C8h, and 03C9h
Return: CF clear

(Table 03539)
Values for calling QEMM QPI function 0Eh:
	AH = 0Eh set cursor virtualization callbacks
	DS:BX -> FAR routine for getting hardware cursor address
	ES:DX -> FAR routine for setting hardware cursor address
Return: CF clear
Note:	both callbacks are invoked with CL indicating which
	  CRT controller register to access (0Eh for high
	  byte of cursor address, 0Fh for low byte)
	the DS:BX callback should return BX=cursor address;
	  ES:DX is called with BL or BH (depending on CL)
	  set to the appropriate half of the cursor's address

(Table 03540)
Values for calling QEMM QPI function 0Fh:
	AH = 0Fh unmap 4K pages
	CX = first page number
	DX = number of pages
Return: CF clear
	AL = 00h/01h if ???
Note:	if CX=0100h and DX=0010h, the HMA is remapped to
	  simulate a disabled A20

(Table 03541)
Values for calling QEMM QPI function 1000h:
	AX = 1000h get protected-mode interface
	DS:SI -> 16-byte buffer for two GDT entries
	ES:DI -> buffer for 4K page table
Return: CF clear
	EAX = offset of protected-mode API entry point
	DS:SI buffer filled with two GDT descriptors
		first is QEMM code segment, second is data???
	ES:DI buffer filled with 4K page table
	DI points to first unused page table entry
SeeAlso: INT 67/AX=DE01h

(Table 03542)
Values for calling QEMM QPI function 1001h:
	AX = 1001h get CPU debug registers
	ES:DI -> buffer for debug registers (8 DWORDs)
Return: CF clear
	BL = INT01 handling (see #03543)
	ES:DI buffer filled

(Table 03543)
Values for calling QEMM QPI function 1002h:
	AX = 1002h set CPU debug registers
	BL = INT01 handling
	    00h	 reflect all debugging exceptions as V86-mode INT 01's
	    else convert debugging exceptions other than single-step
		  into V86-mode INT 03's, single-step to INT 01's
	ES:DI -> buffer containing debug registers (8 DWORDs)
Return: CF clear
Notes:	identical to INT 67/AX=DE09h if BL=01h
	the INT01 handling flag is set to 01h by the general-protection
	  violation handler for certain privileged instructions
SeeAlso: #03542

(Table 03544)
Values for calling QEMM QPI function 1003h:
	AX = 1003h get machine status word CR0
Return: CF clear
	EAX = contents of CR0
SeeAlso: INT 67/AX=DE07h

(Table 03545)
Values for calling QEMM QPI function 1004h:
	AX = 1004h allocate a 4K page
Return: CF clear if successful
	    EDX = linear address of allocated page
	CF set on error
SeeAlso: INT 67/AX=DE04h

(Table 03546)
Values for calling QEMM QPI function 1005h:
	AX = 1005h free 4K page
	EDX = linear address of page to free
Return: CF clear
SeeAlso: INT 67/AX=DE05h

(Table 03547)
Values for calling QEMM QPI function 1006h:
	AX = 1006h NOP
Return: CF set

(Table 03548)
Values for calling QEMM QPI function 1007h:
	AX = 1007h get maximum physical memory address
Return: CF clear
	EDX = physical address of highest 4K memory page
SeeAlso: INT 67/AX=DE02h

(Table 03549)
Values for calling QEMM QPI function 1008h:
	AX = 1008h get physical address of page in first megabyte
	CX = page number (linear address shifted right 12 bits)
Return: CF clear
	EDX = linear address of page
SeeAlso: #03548,#03624,#03625

(Table 03550)
Values for calling QEMM QPI function 1009h:
	AX = 1009h switch to protected mode
	ESI = linear address in first megabyte of system reg values
	      (see INT 67/AX=DE0Ch)
	interrupts disabled
Return: interrupts disabled
	GDTR, IDTR, LDTR, TR loaded
	SS:ESP must have at least 16 bytes space, and the
	      entry point is required to set up a new stack
	      before enabling interrupts
	EAX, ESI, DS, ES, FS, GS destroyed

(Table 03551)
Values for calling QEMM QPI function 100Ah:
	AX = 100Ah switch back to virtual-86 mode
	DS = selector for data segment from function 1000h
	SS:ESP in first megabyte of linear memory
	interrupts disabled
	STACK:	QWORD  return address from FAR call to 32-bit segment
		DWORD  EIP
		DWORD  CS
		DWORD  reserved for EFLAGS
		DWORD  ESP
		DWORD  SS
		DWORD  ES
		DWORD  DS
		DWORD  FS
		DWORD  GS
	will switch to virtual86 mode with interrupts disabled, all
	  segment registers loaded, and EAX destroyed.

(Table 03552)
Values for calling QEMM QPI function 11h:
	AH = 11h get memory type map
	AL = zero/nonzero ??? (set by QEMM.COM but apparently ignored
	      by QEMM 6.00)
	ES:DI -> 256-byte buffer for memory types
Return: CF clear
	BL = ???
	ES:DI buffer filled
Note:	each byte of the buffer corresponds to a 4K page, and
	  contains the type of that page: 00h = mappable,
	  02h = mapped ROM, 03h = high RAM, 04h = excluded,
	  05h = video, 06h = ROM, 07h = adapter ROM,
	  08h = split ROM, 09h = page frame, 0Ah = RAMmable,
	  0Bh = conventional, 83h = high RAM under MS Windows

(Table 03553)
Values for calling QEMM QPI function 12h:
	AH = 12h get HIRAM chain
Return: CF clear
	BX = segment of first MCB in high memory
	    0000h if no high memory

(Table 03554)
Values for calling QEMM QPI function 1300h:
	AX = 1300h VIDRAMEGA???
	BL = 00h copy ???
	     nonzero copy ??? (reverse)
Return: CF clear
	AL = status
	    00h if all pages clean
	    01h if any page dirty

(Table 03555)
Values for calling QEMM QPI function 1301h:
	AX = 1301h check if pages modified
	DX:DI = start address of range to check
	CX = length of range in paragraphs
Return: CF clear
	CX = status
	    0000h none of the indicated pages is dirty
		DI destroyed
	    1000h one or more pages is dirty
		DI = low word of first dirty page's linear addr

(Table 03556)
Values for calling QEMM QPI function 1302h:
	AX = 1302h ???
	BL = ???
	BH = ???
	CX = ???
	SI = offset of ???
	DI = offset of ???
	???
Return: CF clear
	???
Note:	disables certain interrupts at the two 8259 PICs during
	  execution; also modifies CRT controller during
	  execution under certain circumstances

(Table 03557)
Values for calling QEMM QPI function 1303h:
	AX = 1303h initialize EGA graphics virtualization
	BX = number of pages (less 1) of EMS to allocate
Return: CF clear if successful
	    DX = EMS handle
	CF set on error

(Table 03558)
Values for calling QEMM QPI function 1304h:
	AX = 1304h shutdown EGA graphics virtualization
	DX = EMS handle being used for virtualization
Return: CF clear

(Table 03559)
Values for calling QEMM QPI function 1305h:
	AX = 1305h select portion of EGA graphics to virtualize???
	(related to graphics virtualization, changes memory mappings)
	CX = start offset within A000h segment of virtualized mem???
Return: CF clear
Note:	disables certain interrupts at the two 8259 PICs during
	  execution (see #03566) and runs inside a QEMM
	  critical section

(Table 03560)
Values for calling QEMM QPI function 1306h:
	AX = 1306h set DESQview critical section counter address
	ES:BX -> WORD DESQview critical section counter or 0000h:0000h
Return: CF clear
Note:	also sets a pointer in the low-memory part of QEMM to
	  the current value of INT 15 if ES:BX not 0000h:0000h

(Table 03561)
Values for calling QEMM QPI function 1307h:
	AX = 1307h ??? (changes memory mappings for entire A000h segment)
Return: CF clear
Note:	disables certain interrupts at the two 8259 PICs during
	  execution (see #03566) and runs inside a QEMM
	  critical section

(Table 03562)
Values for calling QEMM QPI function 1308h:
	AX = 1308h start/reset CRT controller I/O trapping
	BL = subfunction
	    00h restore CRTC I/O port trapping to previous state
	    else start trapping all accesses to I/O ports 03B0-03DF
Return: CF clear
Note:	if called more than once in a row with BL nonzero, the
	  original state of the I/O port trapping will be lost

(Table 03563)
Values for calling QEMM QPI function 1309h:
	AX = 1309h Hercules mode-change support
	ES:BX -> new address for Hercules mode-change callback
Return: CF clear
Note:	the callback function is called whenever the CRTC mode
	  register is written, with AL set to the value written

(Table 03564)
Values for calling QEMM QPI function 130Ah:
	AX = 130Ah virtualize EGA/VGA DAC registers (I/O ports 03C8h/03C9h)
	CX:DX -> DAC register virtualization buffer (see #03647)
		or 0000h:0000h to disable
Return: CF clear

(Table 03565)
Values for calling QEMM QPI function 130Bh:
	AX = 130Bh ???
	BL = ??? (??? or 00h)
Return: CF clear
	???
Note:	calls AX=130Eh in some cases

(Table 03566)
Values for calling QEMM QPI function 130Ch:
	AX = 130Ch set interrupts to mask
	BX = interrupts to mask out during AX=1302h,AX=1307h,AX=1308h,
	      AX=130Dh,AX=1310h (BL = master PIC, BH = slave PIC)
Return: CF clear

(Table 03567)
Values for calling QEMM QPI function 130Dh:
	AX = 130Dh map EGA memory at A0000h
	???
Return: CF clear
Note:	disables certain interrupts at the two 8259 PICs during execution
	  (see #03566) and runs inside a QEMM critical section
	calls AX=1307h (see #03561)

(Table 03568)
Values for calling QEMM QPI function 130Eh:
	AX = 130Eh ??? (modifies CRT controller setup)
	???
Return: CF clear

(Table 03569)
Values for calling QEMM QPI function 130Fh:
	AX = 130Fh reset ???
Return: CF clear

(Table 03570)
Values for calling QEMM QPI function 1310h:
	AX = 1310h copy modified pages to physical video RAM???
	???
Return: CF clear
Note:	disables certain interrupts at the two 8259 PICs during execution
	  (see #03566) and runs inside a QEMM critical section
	also calls AX=130Dh (see #03567)

(Table 03571)
Values for calling QEMM QPI function 1311h:
	AX = 1311h set ???
	BL = zero/nonzero???
Return: CF clear
Note:	certain operations will be performed with interrupts
	  (as set by AX=130Ch) enabled rather than disabled if
	  called with BL nonzero

(Table 03572)
Values for calling QEMM QPI function 1312h:
	AX = 1312h (v6.02) NOP???
Note:	called by DV 2.42, but appears to be a NOP in QEMM 6.02

(Table 03573)
Values for calling QEMM QPI function 1400h:
	AX = 1400h initialize DESQview "protection level" support
	ES:DI -> protection level configuration (at least 24 bytes)
		(see #03641)
	BL = highest ??? to return (one less than number of words)
Return: CF clear
	AX = ??? (4204h for v6.00)
Note:	QEMM also sets the protected mode INT 02 and INT 06
	  vectors to alternate handlers in certain cases

(Table 03574)
Values for calling QEMM QPI function 1401h:
	AX = 1401h turn off DESQview protection level support
		Return: CF clear
			???
		Notes:	clears the DV critical-section flag address set with
			  function 1306h
			QEMM also sets the protected mode INT 02 and INT 06
			  vectors to the default handlers if they had been
			  revectored by function 1400h

(Table 03575)
Values for calling QEMM QPI function 1402h:
	AX = 1402h set protection level???
		BL = protection level???
		    00h NOP
		    01h ???
		    02h ???
		    other (03h) ???
		ES:DI -> ???
		Return: CF clear
			???
		Format of Data structure:
		Offset	Size	Description
		 00h	WORD	segment of ??? (X, word at X:0136h set to X)
		 02h	WORD	segment of ??? (word at X:0124h set to this)
		 04h	WORD	number of paragraphs of ???
		 06h  3 WORDs	??? (copied to X:0000h)
		 0Ch	WORD	???

(Table 03576)
Values for calling QEMM QPI function 1403h:
	AX = 1403h add ??? to end of list and ??? (execute func 1406h)
		ES:DI -> ??? structure added to end of ??? list
			(at least 31 bytes, DWORD at offset 06h used for
			 storing pointer to next struc, WORD at offset 00h
			 seems to be a key or index)
		Return: CF clear

(Table 03577)
Values for calling QEMM QPI function 1404h:
	AX = 1404h NOP
		Return: CF clear

(Table 03578)
Values for calling QEMM QPI function 1405h:
	AX = 1405h remove ??? from ??? list
		BX = key???
		Return: CF clear

(Table 03579)
Values for calling QEMM QPI function 1406h:
	AX = 1406h ???
		???
		Return: CF clear
			???
		Notes:	this function is a NOP unless protection level 2 or 3
			  is active
			when not a NOP, one of the actions is to write-protect
			  certain memory pages

(Table 03580)
Values for calling QEMM QPI function 1407h:
	AX = 1407h ???
		???
		Return: CF clear
			???
		Note:	same as function 1406h, but only does anything if
			  protection level 2 is active

(Table 03581)
Values for calling QEMM QPI function 1408h:
	AX = 1408h unprotect???
		???
		Return: CF clear
			???

(Table 03582)
Values for calling QEMM QPI function 1409h:
	AX = 1409h abort program causing protection violation???
		???
		Return: CF clear
			???

(Table 03583)
Values for calling QEMM QPI function 140Ah:
	AX = 140Ah set ???
		BX = index of ???
		Return: CF clear
			???
		Notes:	no range checking is performed on BX
			this function is a NOP unless protection level 3 active

(Table 03584)
Values for calling QEMM QPI function 140Bh:
	AX = 140Bh get ???
		BX = index of ???
		SI = 0000h
		Return: CF clear
			SI = segment of 256-byte buffer??? or 0000h
		Notes:	no range checking is performed on BX
			this function is a NOP unless protection level 3 active

(Table 03585)
Values for calling QEMM QPI function 15h:
	AH = 15h set timer channel 0 virtualization buffer
		ES:BX -> WORD buffer for timer channel 0 divisor
			0000h:0000h to disable virtualization
		Return: CF clear

(Table 03586)
Values for calling QEMM v5.00+ QPI function 1600h:
	AX = 1600h get memory access status
		ES:DI -> 256-byte buffer
		Return: ES:DI buffer filled
		Note:	each byte of the buffer indicates the status of a 4K
			  page (bit 0 set if read, bit 1 set if written)

(Table 03587)
Values for calling QEMM v5.00+ QPI function 1601h:
	AX = 1601h set memory access status
		ES:DI -> 256-byte buffer containing access statuses (see #03586)

(Table 03588)
Values for calling QEMM v5.00+ QPI function 17h:
	AH = 17h get memory usage statistics
		ES:DI -> 81-byte buffer for memory statistics (see #03645)
		Return: CF clear

(Table 03589)
Values for calling QEMM v5.11+ QPI function 18h:
	AH = 18h check whether conventional memory mapped into address range
		ES:BX = starting address
		CX = number of 4K pages
		Return: CF clear
			AL = 00h one or more pages is remapped
			     01h all pages in range are conventional memory
				(physical address == virtual address)

(Table 03590)
Values for calling QEMM v5.11+ QPI function 19h:
	AH = 19h NOP
		Return: CF set

(Table 03591)
Values for calling QEMM v5.11+ "QPI_UntrappedIORead" function:
	AX = 1A00h get byte from I/O port
	DX = port number
Return: CF clear
	BL = port value
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03592)
Values for calling QEMM v5.11+ "QPI_UntrappedIOWrite" function:
	AX = 1A01h send byte to I/O port
	BL = value to send
	DX = port number
Return: CF clear
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03593)
Values for calling QEMM v5.11+ "QPI_UntrappedIOReadIndexed" function:
	AX = 1A02h
	BH = index value to send
	DX = base port number
Return: CF clear
	BL = value read from I/O port (DX+1)
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03594)
Values for calling QEMM v5.11+ "QPI_UntrappedIOWriteIndexed" function:
	AX = 1A03h send bytes to two consecutive I/O ports
	BH = value for first I/O port (DX)
	BL = value for second I/O port (DX+1)
	DX = base port number
Return: CF clear
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03595)
Values for calling QEMM v7.03+ "QPI_UntrappedIO" function:
	AX = 1A04h
	BX = value to write to port
	CX = direction and size
	    bit 2: output instead of input
	    bit 3: word instead of byte
	DX = I/O port to be accessed
Return: CF clear
	BX = value read (if CX indicates read)
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03596)
Values for calling QEMM v7.03+ function 1A05h
	AX = 1A05h
	???
Return: ???

(Table 03597)
Values for calling QEMM v7.03+ "QPI_GetIOCallback" function:
	AX = 1A06h
Return: CF clear
	ES:DI -> current I/O callback function (see #03599)
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03598)
Values for calling QEMM v7.03+ "QPI_SetIOCallback" function:
	AX = 1A07h
	ES:DI -> new I/O callback function (see #03599)
Return: CF clear
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03599)
Values QEMM v7.03+ I/O callback function is called with:
	AL/AX = data to/from trapped port
	CL = I/O direction (00h = IN instruction, else OUT instruction)
	DX = I/O port address
Return: CF clear if port handled by callback function
	CF set if not handled
	all other registers returned to application executing the IN or OUT
	  instruction (allowing arbitrary changes to port address, data value,
	  etc.)
SeeAlso: #03597,#03598

(Table 03600)
Values for calling QEMM v7.03+ "QPI_GetPortTrap" function:
	AX = 1A08h
	DX = I/O port number
Return: CF clear
	BL = trapping state (00h not being trapped, 01h trap installed)
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03601)
Values for calling QEMM v7.03+ "QPI_SetPortTrap" function:
	AX = 1A09h
	DX = I/O port number
Return: CF clear
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03602)
Values for calling QEMM v7.03+ "QPI_ClearPortTrap" function:
	AX = 1A0Ah
	DX = I/O port number
Return: CF clear
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03603)
Values for calling QEMM v5.11+ QPI function 1B00h:
	AX = 1B00h get EMM Import Structure address
	ES:DI -> buffer for EMM import data structure (see #03643)
Return: CF set on error
	CF clear if successful
SeeAlso: INT 21/AX=4402h/SF=01h

(Table 03604)
Values for calling QEMM v5.11+ QPI function 1B01h:
	AX = 1B01h disable V86 mode
Return: CF set on error
	    (i.e. no Global EMM Import rec. allocated)
	CF clear if successful
Note:	shuts down EMS and initializes Global EMM Import record; this function
	  is invoked from the callback supplied by INT 2F/AX=1605h

(Table 03605)
Values for calling QEMM v5.11+ QPI function 1B02h:
	AX = 1B02h enable V86 mode
Return: CF set on error
	CF clear if successful
Note:	restarts EMS and frees Global EMM Import record; this function is
	  invoked from the callback supplied by INT 2F/AX=1605h

(Table 03606)
Values for calling QEMM v5.11+ QPI function 1B03h:
	AX = 1B03h MS Windows initializing
	CX = segment from which Windows init broadcast made???
	DX = Windows startup flags
	DI = Windows version number (major in upper byte)
Return: CF clear if successful
	    DS:SI -> V86 mode enable/disable callback
		  (see #02634 at INT 2F/AX=1605h)
	    ES:BX -> startup info structure (see #02631 at INT 2F/AX=1605h)
	CF set on error (unable to start Windows)
SeeAlso: INT 2F/AX=1605h

(Table 03607)
Values for calling QEMM v5.11+ QPI function 1B04h:
	AX = 1B04h MS Windows terminating
Return: CF clear

(Table 03608)
Values for calling QEMM v5.11+ QPI function 1B05h:
	AX = 1B05h determine whether program is driver
	DS:DX -> ASCIZ filename
Return: CF clear
	AL = status
	    01h if string ends in ".DRV"
	    FFh if string ends in "GDI.EXE"
	    00h otherwise
Note:	when MS Windows 3.0 standard mode starts, QEMM patches all drivers
	  until GDI.EXE is loaded

(Table 03609)
Values for calling QEMM v5.11+ QPI function 1B06h:
	AX = 1B06h patch protected-mode check in Windows driver
	CX = length of data pointed at by DS:DX
	DS:DX -> buffer containing Windows driver code
Return: CF clear
Note:	patches all SMSW x/TEST x,1 instruction sequences into MOV x,CS/VERW x
	  sequences, which has the effect that the protected-mode check will
	  only indicate protected mode in native protected mode and not in V86
	  mode

(Table 03610)
Values for calling QEMM v5.11+ QPI function 1B07h:
	AX = 1B07h
BUG: QEMM 6.00-7.01 accept this and branch randomly

(Table 03611)
Values for calling QEMM v5.11+ QPI function 1Bxxh:
	AX = 1B08h to 1BFFh
Return: CF set

(Table 03612)
Values for calling QEMM v5.11+ QPI function 1C00h:
	AX = 1C00h disable IRQ0-7 calldowns
Return: CF clear

(Table 03613)
Values for calling QEMM v5.11+ QPI function 1C01h:
	AX = 1C01h set V86-mode IRQ0-7 handlers
	ES:DI -> 8 DWORDs containing V86-mode handler addresses
Return: CF clear

(Table 03614)
Values for calling QEMM v5.11+ QPI function 1C02h:
	AX = 1C02h disable IRQ8-15 handlers
Return: CF clear

(Table 03615)
Values for calling QEMM v5.11+ QPI function 1C03h:
	AX = 1C03h set V86-mode IRQ8-15 handlers
	ES:DI -> 8 DWORDs containing V86-mode handler addresses
BUG:	although the jump table only contains four entries, QEMM 6.00 will
	  attempt to use it for any value of AL between 00h and 2Ah, thus
	  branching unpredictably for AL=04h-2Ah; QEMM v7.01 behaves
	  similarly for AL=04h-1Bh
Note:	when enabled, the appropriate IRQs are reflected back to the specified
	  handlers in virtual-86 mode after the CPU automatically invokes the
	  protected-mode handler inside QEMM

(Table 03616)
Values for calling QEMM v7.03+ "QPI_SimulateHWInt" function:
	AX = 1C04h
	BX = number of interrupt to simulate
Return: ???
Notes:	this function will allow proper simulation of a hardware interrupt
	  under DESQview and DESQview/X, where the correct interrupt handler
	  may be in a different process with a completely different address
	  space
	this function was officially documented with the release of QEMM v7.50

(Table 03617)
Values for calling QEMM v6.0x only QPI function 1D00h:
	AX = 1D00h switch to pre-Stealth interrupt vector table
Return: CF clear if supported (QEMM v6.x)
	CF set if not supported (QEMM v7+)
Notes:	also switches VGA Save table pointer (0040h:00A8h) and overwrites the
	  vectors currently assigned for use by the two interrupt controllers
	  (see INT 67/AX=DE0Ah) with the vectors for INT 08-0F and 70-77 (to
	  avoid crashing the system).
	functions 1Dxxh are not supported by QEMM v7.01, and always return CF
	  set

(Table 03618)
Values for calling QEMM v6.0x only QPI function 1D01h:
	AX = 1D01h restore user interrupt vector table
Return: CF clear if supported (QEMM v6.x)
	CF set if not supported (QEMM v7+)
Notes:	interrupts should be disabled around the AX=1D00h and AX=1D01h calls
	  because QEMM does not modify the memory maps to map in ROM, so
	  an interrupt could be disastrous
	clears any pending IRQ7 at end of function
	functions 1Dxxh are not supported by QEMM v7.01, and always return CF
	  set

(Table 03619)
Values for calling QEMM v6.00+ QPI function 1Dxxh:
	AX = 1D02h to 1DFFh
Return: CF set

(Table 03620)
Values for calling QEMM v6.00+ "QEMM_GET_INFO"/"QPI_GetInfo" function:
	AX = 1E00h get Stealth configuration
Return: CF clear
	BL = memory configuration flags (documented as "reserved") (see #03644)
	BH = (v7.00+) disk buffer flags
	    bit 0: DISKBUFFRAME buffer instead of DISKBUF buffer
	    bit 1: buffer has already been used
	CL = stealth type (00h none, 46h Frame, 4Dh Map, 50h Protect)
	CH = suspend/resume interrupt (00h none)
	DL = (v7.00+) size of QEMM disk buffer in KB (00h none)
	DH = reserved (always 00h for v6.00)
	SI = reserved (always 0000h for v6.00)
	DI = reserved (always 0000h for v6.00)
Note:	this function is officially documented

(Table 03621)
Values for calling QEMM v6.00+ "QPI_GetStealthCount" function:
	AX = 1E01h get number of Stealth'ed ROMs
Return: CF clear
	BX = number of Stealth'ed ROMs
Note:	this function is officially documented

(Table 03622)
Values for calling QEMM v6.00+ "QPI_GetStealthList" function:
	AX = 1E02h
	ES:DI -> buffer for Stealth ROM info (see #03646)
Return: CF clear
	BX = number of Stealth'ed ROMs
	ES:DI buffer filled
Note:	this function is officially documented

(Table 03623)
Values for unimplemented Stealth information functions:
	AX = 1E03h to 1EFFh
Return: CF set


(Table 03624)
Values for calling QEMM v6.00+ "QEMM_GET_PTE"/"QPI_GetPTE" function:
	AX = 1F00h get page table entry
	CX = page number (0000h-010Fh)
Return: CF clear
	EDX = page table entry
Note:	this function is officially documented

(Table 03625)
Values for calling QEMM v6.00+ "QEMM_SET_PTE"/"QPI_SetPTE" function:
	AX = 1F01h set page table entry
	CX = page number (0000h-010Fh)
	EDX = new page table entry
Return: CF clear
Note:	this function is officially documented
SeeAlso: #03549

(Table 03626)
Values for calling QEMM v6.00+ QPI function 1Fxxh:
	AX = 1F02h to 1FFFh
Return: CF set

(Table 03627)
Values for calling QEMM v6.00+ "QEMM_GET_VHI_INFO"/"QPI_GetVHIInfo" function:
	AX = 2000h "QEMM_GET_VHI_INFO" get VirtualHDIRQ information
Return: CF clear
	BL = flags
	    bit 7: VirtualHDIRQ setting respected
		  (set if Stealth active)
	    bits 6-1 reserved
	    bit 0: VirtualHDIRQ currently enabled
		(INT 15/AH=90h suppressed when enabled)
Note:	this function is officially documented
SeeAlso: #03628

(Table 03628)
Values for calling QEMM v6.00+ "QEMM_SET_VHI_INFO"/"QPI_SetVHIInfo" function:
	AX = 2001h set VirtualHDIRQ state
	BL bit 0 = new VirtualHDIRQ state
Return: CF clear
	BL = old VHI setting (bits 0 and 7, see #03627)
Note:	this function is officially documented
SeeAlso: #03627

(Table 03629)
Values for calling QEMM v6.00+ QPI function 20xxh:
	AX = 2002h to 20FFh
Return: CF set

(Table 03630)
Values for calling QEMM v6.00+ "QEMM_COPY_STEALTH_ROMS"/"QPI_CopyStealthRoms":
	AX = 2100h copy data from Stealthed address space
	DS:SI -> start address of hidden memory to copy
	ES:DI -> buffer for copied data
	ECX = number of bytes to copy
Return: CF clear if successful
	CF set on error (no Stealth or DS:SI < C000h:0000h or DS:SI + ECX > 1M)
Note:	this function was officially documented with the release of QEMM 7.50

(Table 03631)
Values for calling QEMM v6.00+ QPI function 21xxh:
	AX = 2101h to 21FFh
Return: CF set

(Table 03632)
Values for calling QEMM v6.03+ QPI function 2200h:
	AX = 2200h DESQview/X support -- get ???
Return: CF clear
	ES:DI -> ???

(Table 03633)
Values for calling QEMM v6.03+ QPI function 2201h:
	AX = 2201h DESQview/X support -- set ???
	ES:DI -> ??? or 0000h:0000h
Return: CF clear if successful
	CF set on error

(Table 03634)
Values for calling QEMM v6.04+ QPI function 2300h:
	AX = 2300h get ???
	BX = which ??? to get (must be 0000h for v6.04)
Return: CF clear if successful
	    ES:DI -> ???
	CF set on error

(Table 03635)
Values for calling QEMM v6.04+ QPI function 2301h:
	AX = 2301h set ???
	BX = which ??? to set (must be 0000h for v6.04)
	ES:DI -> ???
Return: CF clear if successful
	CF set on error

(Table 03636)
Values for calling QEMM v6.04+ QPI function 2302h:
	AX = 2302h clear specified ???
	BX = which ??? to clear (must be 0000h for v6.04)
Return: CF clear if successful
	CF set on error

(Table 03637)
Values for calling QEMM v6.04+ QPI function 23FFh:
	AX = 23FFh clear all ???
Return: CF clear if successful
	CF set on error

(Table 03638)
Values for calling QEMM v6.04+ QPI function 23xxh:
	AX = 2303h to 23FEh
Return: CF set

(Table 03639)
Values for calling QEMM v7.01+ QPI function 24h:
	AH = 24h ST-DBL support
	AL = subfunction
	    00h set ???
		EDX -> information table (EDX = segment SHL 16 + offset)
	    01h ???
Return: CF clear if successful
	CF set on error

(Table 03640)
Values for calling QEMM unimplemented QPI functions:
	AH = 25h to FFh
Return: CF set

Format of QEMM protection level configuration:
Offset	Size	Description	(Table 03641)
 00h	WORD	segment of 128 breakpoint (INT 3) instructions for use in
		  DESQview protection level 3 interrupt vector checking, or
		  0000h to disable; in pl3, INTs 00-7F are pointed at these
		  breakpoints
 02h	DWORD	-> array of actual interrupt handler addresses for INT 00-7F
		  when interrupt vectors are pointed at protection level 3
		  breakpoints
 06h	DWORD	far pointer to ??? region list (see #03642)
 0Ah	DWORD	far pointer to buffer for returned ???
 0Eh	DWORD	seg:ofs of function to call on protection violation???
 12h	WORD	segment of ???
 14h	DWORD	far pointer to DWORD containing number of paragraphs of
		  ??? for segment at offset 12h
	???

Format of protection level Region List:
Offset	Size	Description	(Table 03642)
 00h	WORD	number of PAIRS of pointers to follow
 02h 2N DWORDs	start/end seg:ofs addresses of ??? regions
Note:	QEMM converts the segmented addresses into linear addresses in place

Format of EMM Import structure:
Offset	Size	Description	(Table 03643)
 00h	DWORD	physical address of EMM import struct
 04h	BYTE	major version (v6.00 sets to 01h)
 05h	BYTE	minor version (v6.00 sets to 00h/0Bh)
SeeAlso: INT 21/AX=4402h/SF=01h

Bitfields for memory configuration flags:
Bit(s)	Description	(Table 03644)
 0	conventional memory sorted
 1	conventional memory filled
 2	???
 3	???
 4	expanded memory is in use
 5	???

Format of QEMM 6.0 memory statistics:
Offset	Size	Description	(Table 03645)
 00h	BYTE	01h if Shadow RAM found, 00h otherwise
 01h	DWORD	initial conventional memory in bytes
 05h	DWORD	initial extended memory in bytes
 09h	DWORD	initial expanded memory in bytes
 0Dh	DWORD	initial "top" or "shadow" memory in bytes
 11h	DWORD	Unavailable conventional memory in bytes
 15h	DWORD	Unavailable extended memory in bytes
 19h	DWORD	Unavailable expanded memory in bytes
 1Dh	DWORD	Unavailable "top" or "shadow" memory in bytes
		Add to offset 49h for Total unavailable top/shadow.
 21h	DWORD	QEMM code size in bytes
 25h	DWORD	QEMM data size in bytes
 29h	DWORD	bytes used for TASKS=
 2Dh	DWORD	DMA buffer size
 31h	DWORD	bytes used for MAPS=
 35h	DWORD	bytes of high RAM
 39h	DWORD	bytes used by mapped ROMs
 3Dh	DWORD	bytes of conventional memory provided by QEMM
 41h	DWORD	bytes of extended memory NOT converted by QEMM (EXT=xxx)
 45h	DWORD	bytes of EMS/XMS pool memory provided by QEMM
 49h	DWORD	Unavailable "top" or "shadow" memory in bytes
		Add to offset 1Dh for Total unavailable top/shadow.
 4Dh	DWORD	conventional memory overhead in bytes
		(set to 0 by QEMM.COM prior to call)

Format of Stealth ROM info [array]:
Offset	Size	Description	(Table 03646)
 00h	WORD	starting segment of ROM
 02h	WORD	length of ROM in paragraphs

Format of QEMM EGA/VGA DAC register virtualization buffer:
Offset	Size	Description	(Table 03647)
 00h	BYTE	(temp) current color register number
 01h	BYTE	(temp) number of bytes written so far for current color reg
 02h 768 BYTEs	three bytes per color register

Top

6740 - INT 67 - LIM EMS - GET MANAGER STATUS

INT 67 - LIM EMS - GET MANAGER STATUS
	AH = 40h
Return: AH = status (00h,80h,81h,84h) (see #03648)
Note:	this call can be used only after establishing that the EMS driver is in
	  fact present
SeeAlso: AH=3Fh,AX=FFA5h,@xxxxh:xxxxh"PMM"

(Table 03648)
Values for EMS function status:
 00h	successful
 80h	internal error
 81h	hardware malfunction
 82h	busy -- retry later
 83h	invalid handle
 84h	undefined function requested by application
 85h	no more handles available
 86h	error in save or restore of mapping context
 87h	insufficient memory pages in system
 88h	insufficient memory pages available
 89h	zero pages requested
 8Ah	invalid logical page number encountered
 8Bh	invalid physical page number encountered
 8Ch	page-mapping hardware state save area is full
 8Dh	save of mapping context failed
 8Eh	restore of mapping context failed
 8Fh	undefined subfunction
 90h	undefined attribute type
 91h	feature not supported
 92h	successful, but a portion of the source region has been overwritten
 93h	length of source or destination region exceeds length of region
	  allocated to either source or destination handle
 94h	conventional and expanded memory regions overlap
 95h	offset within logical page exceeds size of logical page
 96h	region length exceeds 1M
 97h	source and destination EMS regions have same handle and overlap
 98h	memory source or destination type undefined
 9Ah	specified alternate map register or DMA register set not supported
 9Bh	all alternate map register or DMA register sets currently allocated
 9Ch	alternate map register or DMA register sets not supported
 9Dh	undefined or unallocated alternate map register or DMA register set
 9Eh	dedicated DMA channels not supported
 9Fh	specified dedicated DMA channel not supported
 A0h	no such handle name
 A1h	a handle found had no name, or duplicate handle name
 A2h	attempted to wrap around 1M conventional address space
 A3h	source array corrupted
 A4h	operating system denied access

Top

6741 - INT 67 - LIM EMS - GET PAGE FRAME SEGMENT

INT 67 - LIM EMS - GET PAGE FRAME SEGMENT
	AH = 41h
Return: AH = status (see also AH=40h)
	    00h function successful
		BX = segment of page frame
SeeAlso: AH=58h,AH=68h

Top

6742 - INT 67 - LIM EMS - GET NUMBER OF PAGES

INT 67 - LIM EMS - GET NUMBER OF PAGES
	AH = 42h
Return: AH = status (see also AH=40h)
	    00h function successful
		BX = number of unallocated pages
		DX = total number of pages
BUG:	DOS 6.0 EMM386.EXE causes a system lock-up or reboot if in AUTO mode
	  when this call is made; use AH=46h to ensure that EMM386 is ON
	  before making this call
SeeAlso: INT 2F/AX=2702h

Top

6743 - INT 67 - LIM EMS - GET HANDLE AND ALLOCATE MEMORY

INT 67 - LIM EMS - GET HANDLE AND ALLOCATE MEMORY
	AH = 43h
	BX = number of logical pages to allocate
Return: AH = status (00h,80h,81h,84h,85h,87h,88h,89h) (see #03648)
	DX = handle if AH=00h
SeeAlso: AH=45h

Top

6744 - INT 67 - LIM EMS - MAP MEMORY

INT 67 - LIM EMS - MAP MEMORY
	AH = 44h
	AL = physical page number (0-3)
	BX = logical page number
	    or FFFFh to unmap (QEMM)
	DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Ah,8Bh) (see #03648)
SeeAlso: AH=69h

Top

6745 - INT 67 - LIM EMS - RELEASE HANDLE AND MEMORY

INT 67 - LIM EMS - RELEASE HANDLE AND MEMORY
	AH = 45h
	DX = EMM handle
Return: AH = status (00h,80h,81h,83h,84h,86h) (see #03648)
SeeAlso: AH=43h

Top

6746 - INT 67 - LIM EMS - GET EMM VERSION

INT 67 - LIM EMS - GET EMM VERSION
	AH = 46h
Return: AH = status (00h,80h,81h,84h) (see #03648)
	AL = EMM version number if AH=00h

Top

6747 - INT 67 - LIM EMS - SAVE MAPPING CONTEXT

INT 67 - LIM EMS - SAVE MAPPING CONTEXT
	AH = 47h
	DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Ch-8Eh) (see #03648)
SeeAlso: AH=48h

Top

6748 - INT 67 - LIM EMS - RESTORE MAPPING CONTEXT

INT 67 - LIM EMS - RESTORE MAPPING CONTEXT
	AH = 48h
	DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Eh) (see #03648)
SeeAlso: AH=47h

Top

6749 - INT 67 - LIM EMS - reserved - GET I/O PORT ADDRESSES

INT 67 - LIM EMS - reserved - GET I/O PORT ADDRESSES
	AH = 49h
Note:	defined in EMS 3.0, but undocumented in EMS 3.2

Top

674A - INT 67 - LIM EMS - reserved - GET TRANSLATION ARRAY

INT 67 - LIM EMS - reserved - GET TRANSLATION ARRAY
	AH = 4Ah
Note:	defined in EMS 3.0, but undocumented in EMS 3.2

Top

674B - INT 67 - LIM EMS - GET NUMBER OF EMM HANDLES

INT 67 - LIM EMS - GET NUMBER OF EMM HANDLES
	AH = 4Bh
Return: AH = status (00h,80h,81h,83h,84h) (see #03648)
	BX = number of EMM handles if AH=00h

Top

674C - INT 67 - LIM EMS - GET PAGES OWNED BY HANDLE

INT 67 - LIM EMS - GET PAGES OWNED BY HANDLE
	AH = 4Ch
	DX = EMM handle
Return: AH = status (see #02785)
	BX = number of logical pages if AH=00h
SeeAlso: AH=4Dh

Top

674D - INT 67 - LIM EMS - GET PAGES FOR ALL HANDLES

INT 67 - LIM EMS - GET PAGES FOR ALL HANDLES
	AH = 4Dh
	ES:DI -> array to receive information
Return: AH = status (00h,80h,81h,84h) (see #03648)
	---if AH=00h---
	BX = number of active EMM handles
	array filled with 2-word entries, consisting of a handle and the
	  number of pages allocated to that handle
SeeAlso: AH=4Ch

Top

674E - INT 67 - LIM EMS - GET OR SET PAGE MAP

INT 67 - LIM EMS - GET OR SET PAGE MAP
	AH = 4Eh
	AL = subfunction
	    00h get mapping registers
	    01h set mapping registers
	    02h get and set mapping registers at once
	    03h get size of page-mapping array
	DS:SI -> array holding information (AL=01h/02h)
	ES:DI -> array to receive information (AL=00h/02h)
Return: AH = status (00h,80h,81h,84h,8Fh,A3h) (see also AH=40h)
	    00h successful
		AL = bytes in page-mapping array (AL=03h only)
		array pointed to by ES:DI receives mapping info (AL=00h/02h)
Notes:	this function was designed to be used by multitasking operating systems
	  and should not ordinarily be used by appplication software.
	MD386 returns the size of the page-mapping array in AX instead of AL
SeeAlso: AH=4Fh

Top

674F - INT 67 - LIM EMS 4.0 - GET/SET PARTIAL PAGE MAP

INT 67 - LIM EMS 4.0 - GET/SET PARTIAL PAGE MAP
	AH = 4Fh
	AL = subfunction
	    00h get partial page map
	       DS:SI -> structure containing list of segments whose mapping
			contexts are to be saved
	       ES:DI -> array to receive page map
	    01h set partial page map
	       DS:SI -> structure containing saved partial page map
	    02h get size of partial page map
	       BX = number of mappable segments in the partial map to be saved
Return: AH = status (00h,80h,81h,84h,8Bh,8Fh,A3h) (see also AH=40h)
	    8Bh one of the specified segments is not mappable
	    A3h contents of partial page map corrupted or count of mappable
		segments exceeds total number of mappable segments in system
	AL = size of partial page map for subfunction 02h
SeeAlso: AH=4Eh

Top

6750 - INT 67 - LIM EMS 4.0 - MAP/UNMAP MULTIPLE HANDLE PAGES

INT 67 - LIM EMS 4.0 - MAP/UNMAP MULTIPLE HANDLE PAGES
	AH = 50h
	AL = subfunction
	    00h use physical page numbers
	    01h use segment addresses
	DX = handle
	CX = number of entries in array
	DS:SI -> mapping array (see #03649)
Return: AH = status (00h,80h,81h,83h,84h,8Ah,8Bh,8Fh) (see #03648)
SeeAlso: AH=40h

Format of EMS mapping array entry:
Offset	Size	Description	(Table 03649)
 00h	WORD	logical page number or FFFFh to unmap physical page
 02h	WORD	physical page number or segment address

Top

6751 - INT 67 - LIM EMS 4.0 - REALLOCATE PAGES

INT 67 - LIM EMS 4.0 - REALLOCATE PAGES
	AH = 51h
	DX = handle
	BX = number of pages to be allocated to handle
Return: AH = status (00h,80h,81h,83h,84h,87h,88h) (see #03650)
	BX = actual number of pages allocated to handle

(Table 03650)
Values for EMS function status:
 00h	successful
 80h	internal error
 81h	hardware malfunction
 83h	invalid handle
 84h	undefined function requested
 87h	more pages requested than present in system
 88h	more pages requested than currently available
 8Ah	invalid logical page number encountered
 8Bh	invalid physical page number encountered
 8Fh	undefined subfunction
 90h	undefined attribute type
 91h	feature not supported
 A0h	no such handle name
 A1h	duplicate handle name

Top

6752 - INT 67 - LIM EMS 4.0 - GET/SET HANDLE ATTRIBUTES

INT 67 - LIM EMS 4.0 - GET/SET HANDLE ATTRIBUTES
	AH = 52h
	AL = subfunction
	    00h get handle attributes
		Return: AL = attribute
			    00h handle is volatile
			    01h handle is nonvolatile
	    01h set handle attributes
		BL = new attribute
		   00h handle is volatile
		   01h handle is nonvolatile
	    02h get attribute capability
		Return: AL = attribute capability
			    00h only volatile handles supported
			    01h both volatile and non-volatile supported
	DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Fh-91h) (see #03648)
SeeAlso: AH=53h

Top

6753 - INT 67 - LIM EMS 4.0 - GET/SET HANDLE NAME

INT 67 - LIM EMS 4.0 - GET/SET HANDLE NAME
	AH = 53h
	AL = subfunction
	    00h get handle name
	       ES:DI -> 8-byte buffer for handle name
	    01h set handle name
	       DS:SI -> 8-byte handle name
	DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Fh,A1h) (see #03648)
SeeAlso: AH=52h

Top

6754 - INT 67 - LIM EMS 4.0 - GET HANDLE DIRECTORY

INT 67 - LIM EMS 4.0 - GET HANDLE DIRECTORY
	AH = 54h
	AL = subfunction
	    00h get handle directory
	       ES:DI -> buffer for handle directory (see #03651)
	    01h search for named handle
	       DS:SI -> 8-byte name
	    02h get total number of handles
Return: AL = number of entries in handle directory (subfunction 00h)
	DX = value of named handle (subfunction 01h)
	BX = total number of handles (subfunction 02h)
	AH = status (00h,80h,81h,84h,8Fh,A0h,A1h) (see also #03650)
	    A1h a handle found had no name

Format of EMS handle directory entry:
Offset	Size	Description	(Table 03651)
 00h	WORD	handle
 02h  8 BYTEs	handle's name

Top

6755 - INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND JUMP

INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND JUMP
	AH = 55h
	AL = subfunction
	    00h physical page numbers provided by caller
	    01h segment addresses provided by caller
	DX = handle
	DS:SI -> structure containing map and jump address
Return: (at target address unless error)
	AH = status (00h,80h,81h,83h,84h,8Ah,8Bh,8Fh) (see #03648)
SeeAlso: AH=56h

Top

6756 - INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND CALL

INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND CALL
	AH = 56h
	AL = subfunction
	    00h physical page numbers provided by caller
		DX = handle
		DS:SI -> structure containing page map and call address
	    01h segment addresses provided by caller
		DX = handle
		DS:SI -> structure containing page map and call address
	    02h get page map stack space required
		Return: BX = stack space required
Return: (if successful, the target address is called.  Use a RETF to return
	 and restore mapping context)
	AH = status (00h,80h,81h,83h,84h,8Ah,8Bh,8Fh) (see #03648)
SeeAlso: AH=55h

Top

6756FF - INT 67 - RM386 v6.00 - ???

INT 67 - RM386 v6.00 - ???
	AX = 56FFh
	DS:SI -> ???
	???
Return: ???

Top

6757 - INT 67 - LIM EMS 4.0 - MOVE/EXCHANGE MEMORY REGION

INT 67 - LIM EMS 4.0 - MOVE/EXCHANGE MEMORY REGION
	AH = 57h
	AL = subfunction
	    00h move memory region
	    01h exchange memory region
	DS:SI -> structure describing source and destination (see #03653)
Return: AH = status (see #03652)
Note:	source and destination may overlap for a move, in which case the copy
	  direction is chosen such that the destination receives an intact copy
	  of the source region

(Table 03652)
Values for EMS function status:
 00h	successful
 80h	internal error
 81h	hardware failure
 83h	invalid handle
 84h	undefined function requested
 8Ah	invalid logical page number encountered
 8Fh	undefined subfunction
 92h	successful, but a portion of the source region has been overwritten
 93h	length of source or destination region exceeds length of region
	  allocated to either source or destination handle
 94h	conventional and expanded memory regions overlap
 95h	offset within logical page exceeds size of logical page
 96h	region length exceeds 1M
 97h	source and destination EMS regions have same handle and overlap
 98h	memory source or destination type undefined
 A2h	attempted to wrap around 1M conventional address space

Format of EMS copy data:
Offset	Size	Description	(Table 03653)
 00h	DWORD	region length in bytes
 04h	BYTE	source memory type
		00h conventional
		01h expanded
 05h	WORD	source handle (0000h if conventional memory)
 07h	WORD	source initial offset (within page if EMS, segment if convent)
 09h	WORD	source initial segment (conv mem) or logical page (EMS)
 0Bh	BYTE	destination memory type
		00h conventional
		01h expanded
 0Ch	WORD	destination handle
 0Eh	WORD	destination initial offset
 10h	WORD	destination initial segment or page

Top

6758 - INT 67 - LIM EMS 4.0 - GET MAPPABLE PHYSICAL ADDRESS ARRAY

INT 67 - LIM EMS 4.0 - GET MAPPABLE PHYSICAL ADDRESS ARRAY
	AH = 58h
	AL = subfunction
	    00h get mappable physical address array
		ES:DI -> buffer to be filled with array (see #03654)
	    01h get number of entries in m.p.a. array
Return: CX = number of entries in array
	AH = status (00h,80h,81h,84h,8Fh) (see #03652)
Note:	the returned array for subfunction 00h is filled in physical segment
	  address order

Format of EMS mappable physical address entry:
Offset	Size	Description	(Table 03654)
 00h	WORD	physical page segment
 02h	WORD	physical page number

Top

675857 - INT 67 U - NETROOM??? - ???

INT 67 U - NETROOM??? - ???
	AX = 5857h
	BX = function??? (0057h,0059h,0159h seen)
	???
Return: ???
Note:	BX=0059h appears to be analogous to AX=5800h and BX=0159h appears to
	  be analogous to AX=5801h; BX=0057h appears to indicate whether
	  AX=580xh or AX=5857h/BX=0x59h should be used
SeeAlso: AX=5BF0h

Top

6759 - INT 67 - LIM EMS 4.0 - GET EXPANDED MEMORY HARDWARE INFORMATION

INT 67 - LIM EMS 4.0 - GET EXPANDED MEMORY HARDWARE INFORMATION
	AH = 59h
	AL = subfunction
	    00h get hardware configuration array
		ES:DI -> buffer to be filled with array (see #03655)
	    01h get unallocated raw page count
		Return: BX = unallocated raw pages
			DX = total raw pages
Return: AH = status (see also AH=58h"EMS 4.0")
	    A4h access denied by operating system
Note:	subfunction 00h is for use by operating systems only, and can be
	  enabled or disabled at any time by the operating system

Format of EMS hardware configuration array:
Offset	Size	Description	(Table 03655)
 00h	WORD	size of raw EMM pages in paragraphs
 02h	WORD	number of alternate register sets
 04h	WORD	size of mapping-context save area in bytes
 06h	WORD	number of register sets assignable to DMA
 08h	WORD	DMA operation type
		0000h DMA with alternate register sets
		0001h only one DMA register set

Top

675A - INT 67 - LIM EMS 4.0 - ALLOCATE STANDARD/RAW PAGES

INT 67 - LIM EMS 4.0 - ALLOCATE STANDARD/RAW PAGES
	AH = 5Ah
	AL = subfunction
	    00h allocate standard pages
	    01h allocate raw pages
	BX = number of pages to allocate
Return: DX = handle
	AH = status (00h,80h,81h,84h,85h,87h,88h,8Fh) (see #03648)

Top

675B - INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET

INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET
	AH = 5Bh
	AL = subfunction
	    00h get alternate map register set
		Return: BL = current active alternate map register set number
			ES:DI -> map register context save area if BL=00h
	    01h set alternate map register set
		BL = new alternate map register set number
		ES:DI -> map register context save area if BL=0
	    02h get alternate map save array size
		Return: DX = array size in bytes
	    03h allocate alternate map register set
		Return: BL = number of map register set; 00h = not supported
	    04h deallocate alternate map register set
		BL = number of alternate map register set
Return: AH = status (00h,80h,81h,84h,8Fh,9Ah-9Dh,A3h,A4h) (see #03656)
Note:	this function is for use by operating systems only, and can be
	  enabled or disabled at any time by the operating system

(Table 03656)
Values for EMS function status:
 00h	successful
 80h	internal error
 81h	hardware malfunction
 84h	undefined function requested
 8Fh	undefined subfunction
 9Ah	specified alternate map register or DMA register set not supported
 9Bh	all alternate map register or DMA register sets currently allocated
 9Ch	alternate map register or DMA register sets not supported
 9Dh	undefined or unallocated alternate map register/DMA register set
 9Eh	dedicated DMA channels not supported
 9Fh	specified dedicated DMA channel not supported
 A3h	source array corrupted
 A4h	operating system denied access

Top

675B - INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET - DMA REGISTERS

INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET - DMA REGISTERS
	AH = 5Bh
	AL = subfunction
	    05h allocate DMA register set
		Return: BL = DMA register set number, 00h if not supported
	    06h enable DMA on alternate map register set
	       BL = DMA register set number
	       DL = DMA channel number
	    07h disable DMA on alternate map register set
	       BL = DMA register set number
	    08h deallocate DMA register set
	       BL = DMA register set number
Return: AH = status (00h,80h,81h,84h,8Fh,9Ah-9Fh,A3h,A4h) (see #03656)
Note:	this function is for use by operating systems only, and can be
	  enabled or disabled at any time by the operating system

Top

675BE0 - INT 67 - MICEMM v4D, RM386 - GET LINEAR ADDRESS OF MEMORY

INT 67 - MICEMM v4D, RM386 - GET LINEAR ADDRESS OF MEMORY
	AX = 5BE0h
	ES:BX -> memory for which to get linear address
Return: AH = 00h
	CX:DX = linear address of physical memory corresponding to ES:BX
Program: RAM-MAN/386 is the memory manager included with Helix's Netroom;
	  MICEMM is a memory manager for some Micronics motherboards
Note:	this has been superceded by AX=DE06h, which should be used instead
SeeAlso: AX=5BF0h,AX=5BF1h,AX=DE06h

Top

675BE1 - INT 67 - RM386 v6.00+ - GET MEMORY MANAGER SIZE

INT 67 - RM386 v6.00+ - GET MEMORY MANAGER SIZE
	AX = 5BE1h
Return: AH = 00h
	CX = code and data size in bytes
	DX:BX = physical address of RM386 code
	DI:SI = total size of RM386 area including handle tables
	BP = number of additional pages (high DOS, etc.)
SeeAlso: AX=5BE0h,AX=5BE2h

Top

675BE2 - INT 67 - RM386 v6.00+ - GET INTERRUPT VECTORS

INT 67 - RM386 v6.00+ - GET INTERRUPT VECTORS
	AX = 5BE2h
Return: DS:SI -> V86-mode table (see #03657)
	ES:BX -> ??? (undoc, middle of device driver interrupt routine!)
SeeAlso: AX=5BE0h,AX=5BE1h

Format of RM386 V86-mode table:
Offset	Size	Description	(Table 03657)
 00h	DWORD	original INT 13 vector
 04h	DWORD	original INT 15 vector
 08h	DWORD	original INT 19 vector
 0Ch	DWORD	original INT 21 vector
 10h	DWORD	original INT 4B vector
 14h	DWORD	original INT 67 vector

Top

675BF0 - INT 67 - MICEMM v4D, RM386 - INSTALLATION CHECK

INT 67 - MICEMM v4D, RM386 - INSTALLATION CHECK
	AX = 5BF0h
Return: AH = 00h if MICEMM or RM386 present
	    BX = code segment of driver
Program: MICEMM is the Micronics Expanded Memory Manager; RM386 is the memory
	  manager included in Helix Software's Netroom
SeeAlso: AH=3Fh,AX=5BE0h,AX=5BF1h

Top

675BF1 - INT 67 - MICEMM v4D, RM386 - GET ADDRESS MAP

INT 67 - MICEMM v4D, RM386 - GET ADDRESS MAP
	AX = 5BF1h
	ES:BX -> 256-byte (MICEMM) or 512-byte (RM386) buffer for memory types
Return: AH = 00h
	ES:BX buffer filled (see #03658)
Note:	each byte in the buffer specifies the type of a 4K page of memory
SeeAlso: AX=5BE0h,AX=5BF0h

(Table 03658)
Values for MICEMM/RM386 memory type:
 00h	unused (MICEMM), RAM/available (RM386)
 02h	DOS extension (XMS UMB)
 04h	shadowed ROM
 08h	mappable EMS
 10h	page frame
 20h	ROM
 40h	reserved (video memory, etc)
 80h	RAM (MICEMM), Windows UMB (RM386)

Top

675BF2 - INT 67 - RM386 - GET RM386 INTERNAL DATA

INT 67 - RM386 - GET RM386 INTERNAL DATA
	AX = 5BF2h
	CX = size of buffer
	DS:SI -> buffer for internal data
	(documentation says ES:BX -> buffer, SI = offset within RM386)
Return: buffer filled
Note:	the data returned by this function is release-specific
SeeAlso: AX=5BF0h

Top

675BF3 - INT 67 - RM386 - RETURN TO REAL MODE

INT 67 - RM386 - RETURN TO REAL MODE
	AX = 5BF3h
Return: nothing
Note:	use AX=5DE0h instead of this functin
SeeAlso: AX=5BF0h,AX=5DE0h

Top

675BF4 - INT 67 - RM386 v6.00 - GET RM386 GLOBAL FLAGS

INT 67 - RM386 v6.00 - GET RM386 GLOBAL FLAGS
	AX = 5BF4h
Return: AH = 00h
	BX = global flags 1 (see #03659)
	CX = global flags 2 (see #03660)
	DX = global flags 3 (see #03661)
	SI = global flags 4 (see #03662)
SeeAlso: AX=5BF0h

Bitfields for RM386 global flags 1:
Bit(s)	Description	(Table 03659)
 0-3	reserved
 4	V86 mode
 5	reserved
 6	80386 or higher CPU
 7,8	reserved
 9	A20 enabled at startup
 10	"HIGH_IO"
 11	ROM
 12	large frame
 13,14	reserved
 15	PS/2-style A20 control

Bitfields for RM386 global flags 2:
Bit(s)	Description	(Table 03660)
 0	HMA in use
 1	XMS present
 2	using XMS driver memory
 3	HIGH (NEAT only)
 4-7	reserved
 8	NOBKTRAP
 9	NORESET
 10	ALTMAP
 11	NOFRAME
 12-15	reserved

Bitfields for RM386 global flags 3:
Bit(s)	Description	(Table 03661)
 0	NOTEST
 1	NOEBDA
 2	Windows3 support
 3	system board mouse
 4	DISKBUF
 5	EBDALOW
 6	A20 global enable flag
 7	A20 flag
 8	EBDA moved to stub
 9	VXD file was found
 10	reserved
 11	NOBOOTMAP
 12	AUTO
 13	PS/2 machine
 14	Compaq ROM merge active
 15	NOHMA set

Bitfields for RM386 global flags 4:
Bit(s)	Description	(Table 03662)
 0	"NOV8259" don't virtualize interrupt controller
 1	NOSCSI
 2	NOSCAN
 3	NOTR
 4	ALTBOOT
 5	NOCOMPQ
 6	KB2TRAP
 7	DESHADOW
 8	Video 7 VGA detected
 9	reserved
 10	NOVGA
 11	NOPS2
 12	DEBUG
 13	NOVKB
 14,15	reserved

Top

675BF5 - INT 67 - RM386 v6.00 - GET RM386 EMS HANDLE COUNT

INT 67 - RM386 v6.00 - GET RM386 EMS HANDLE COUNT
	AX = 5BF5h
Return: AH = status
	    00h successful
		BX = current number of allocated EMS handles
	    84h function not available
SeeAlso: AX=5BF0h

Top

675C - INT 67 - LIM EMS 4.0 - PREPARE EXPANDED MEMORY HARDWARE FOR WARM BOOT

INT 67 - LIM EMS 4.0 - PREPARE EXPANDED MEMORY HARDWARE FOR WARM BOOT
	AH = 5Ch
Return: AH = status (see #03663)
Note:	when MS-DOS v6.xx EMM386 is loaded and the keyboard driver supports
	  INT 15/AH=4Fh (keyboard intercept) calls, the system may hang
	  instead of booting if this function is called just prior to a jump
	  to F000h:FFF0h

(Table 03663)
Values for EMS function status:
 00h	successful
 80h	internal error
 81h	hardware malfunction
 84h	undefined function requested

Top

675D - INT 67 - LIM EMS 4.0 - ENABLE/DISABLE OS FUNCTION SET FUNCTIONS

INT 67 - LIM EMS 4.0 - ENABLE/DISABLE OS FUNCTION SET FUNCTIONS
	AH = 5Dh
	AL = subfunction
	    00h enable OS Function Set
	    01h disable OS Function Set
	    02h return access key (resets memory manager, returns access key at
		next invocation)
	BX,CX = access key returned by first invocation
Return: BX,CX = access key, returned only on first invocation of function
	AH = status (see also AH=5Ch)
	    8Fh undefined subfunction
	    A4h operating system denied access

Top

675D03 - INT 67 u - Nanosoft MD386 - INTERNAL INITIALIZATION

INT 67 u - Nanosoft MD386 - INTERNAL INITIALIZATION
	AX = 5D03h
	???
Return: ???
Program: MD386 is a subset EMS memory manager by Nanosoft specifically
	  designed for use with the MultiDOS Plus multitasker
SeeAlso: AX=5D04h,AX=5E00h

Top

675D04 - INT 67 - Nanosoft MD386 - GET ALTERNATE MAP STRUCTURE

INT 67 - Nanosoft MD386 - GET ALTERNATE MAP STRUCTURE
	AX = 5D04h
	BX = alternate register set number
	ES:DI -> 1024-byte buffer for map structure
Return: AH = status (see #03648)
	buffer filled if AH=00h
Note:	used for debugging purposes
SeeAlso: AX=5D05h

Top

675D05 - INT 67 - Nanosoft MD386 - GET INTERNAL HANDLE TABLE

INT 67 - Nanosoft MD386 - GET INTERNAL HANDLE TABLE
	AX = 5D05h
	BX = handle number
	ES:DI -> 1024-byte buffer for handle table
Return: AH = status (see #03648)
	buffer filled if AH=00h
Note:	used for debugging purposes
SeeAlso: AX=5D04h

Top

675DE0 - INT 67 - RM386 - DISABLE RM386

INT 67 - RM386 - DISABLE RM386
	AX = 5DE0h
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE1h

Top

675DE1 - INT 67 - RM386 - ENABLE RM386

INT 67 - RM386 - ENABLE RM386
	AX = 5DE1h
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE0h

Top

675DE2 - INT 67 - RM386 - GET PAGE TABLE

INT 67 - RM386 - GET PAGE TABLE
	AX = 5DE2h
	ES:DI -> 1088-byte buffer for page table
Return: ES:DI buffer filled
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE3h

Top

675DE3 - INT 67 - RM386 - SET PAGE TABLE

INT 67 - RM386 - SET PAGE TABLE
	AX = 5DE3h
	ES:DI -> 1088-byte buffer containing page table
Notes:	only the access bits of the page table are used, the remainder is
	  ignored
	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE2h

Top

675DE4 - INT 67 - RM386 - SET WRITE-PROTECTION FOR PAGE IN FIRST MEGABYTE

INT 67 - RM386 - SET WRITE-PROTECTION FOR PAGE IN FIRST MEGABYTE
	AX = 5DE4h
	BL = page number
	BH = access (00h read-only, 01h read-write)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt

Top

675DE5 - INT 67 - RM386 - MAP PHYSICAL PAGE TO PHYSICAL SEGMENT

INT 67 - RM386 - MAP PHYSICAL PAGE TO PHYSICAL SEGMENT
	AX = 5DE5h
	EBX = physical page number
	DX = page number in first megabyte to be remapped (linear-addr SHR 12)
Return: AH = status
	    00h successful
	    8Bh invalid destination page (not in first megabyte)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE6h

Top

675DE6 - INT 67 - RM386 - MAP LOGICAL 4K PAGE TO PHYSICAL SEGMENT

INT 67 - RM386 - MAP LOGICAL 4K PAGE TO PHYSICAL SEGMENT
	AX = 5DE6h
	BX = logical page number in 4K pages from beginning of memory for EMS
	      handle
	CX = segment in first megabyte to be remapped
	DX = previously-allocated EMS handle
Return: AH = status
	    00h successful
	    83h invalid handle
	    8Ah invalid logical page (out of handle's range)
	    8Bh invalid destination page (not in first megabyte)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE5h

Top

675DE7 - INT 67 - RM386 - SET PAGE TABLE BITS FOR RANGE OF PAGES

INT 67 - RM386 - SET PAGE TABLE BITS FOR RANGE OF PAGES
	AX = 5DE7h
	BL = page table bits to be set (bits 2-0 = U/S, R/W, P)
	CX = number of pages to set
	DX = first page number to set (in first megabyte)
Return: AH = status
	    00h successful
	    8Bh invalid destination page (not in first megabyte)
	    A5h invalid page bits
	    A6h invalid page count (overflows first megabyte)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt

Top

675DE8 - INT 67 - RM386 - GET PARTIAL PAGE TABLE

INT 67 - RM386 - GET PARTIAL PAGE TABLE
	AX = 5DE8h
	BX = starting page number in first megabyte+HMA (0000h-010Fh)
	CX = number of page table entries to get
	ES:DI -> buffer for DWORD page table entries
Return: AH = status (00h successful, 8Bh invalid page)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE9h

Top

675DE9 - INT 67 - RM386 - SET PARTIAL PAGE TABLE

INT 67 - RM386 - SET PARTIAL PAGE TABLE
	AX = 5DE9h
	BX = starting page number in first megabyte+HMA (0000h-010Fh)
	CX = number of page table entries to get
	DS:SI -> buffer of DWORD page table entries
Return: AH = status (00h successful, 8Bh invalid destination page)
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DE8h

Top

675DEA - INT 67 - RM386 - V86-MODE I/O PORT TRAPPING CONTROL

INT 67 - RM386 - V86-MODE I/O PORT TRAPPING CONTROL
	AX = 5DEAh
	BX = function
	    00h globally disable V86-mode trapping
	    01h globally enable V86-mode trapping
		CL = interrupt to use for trapping
	    02h get I/O trapping state
Return: AH = status
	    00h successful
		BX = current trapping state (function 02h)
		    0000h disabled, 0001h enabled
		CX = interrupt used as trap interrupt (functions 00h and 02h)
Notes:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
	when I/O trapping is enabled and I/O port access occurs, RM386
	  simulates an INT instruction for the specified interrupt; the
	  interrupt handler is responsible for decoding the trapped instruction
	  and performing the appropriate action.  INT 2C/AX=002Dh provides a
	  similar but more-easily used interface.
SeeAlso: AX=5DEBh,AH=EFh"RM386",INT 2C/AX=002Dh

Top

675DEB - INT 67 - RM386 - V86-MODE I/O TRAPPING PORT CONTROL

INT 67 - RM386 - V86-MODE I/O TRAPPING PORT CONTROL
	AX = 5DEBh
	BX = function
	    00h disable V86-mode trapping for specified port
	    01h enable V86-mode trapping for specified port
	    02h get V86-mode trapping state for specified port
	DX = port for which to enable/disable/query trapping
Return: AH = status
	    00h successful
		BX = current trapping state (00h off, 01h on) (function 02)
	    A7h invalid port ID
	    A8h reserved port--cannot trap/untrap (DMA/INT/KBD controllers)
Notes:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DEAh

Top

675DFD - INT 67 U - RM386 v6.00 - ???

INT 67 U - RM386 v6.00 - ???
	AX = 5DFDh
	???
Return: ???
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DFEh

Top

675DFE - INT 67 U - RM386 v6.00 - ???

INT 67 U - RM386 v6.00 - ???
	AX = 5DFEh
	???
Return: ???
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DFDh

Top

675DFF - INT 67 U - RM386 v6.00 - ???

INT 67 U - RM386 v6.00 - ???
	AX = 5DFFh
	???
Return: ???
Note:	RM386 traps this function on the initial transition to protected
	  mode caused by the INT instruction, which means it can not be
	  overridden simply by hooking the interrupt
SeeAlso: AX=5DFDh,AX=5DFEh

Top

675E00 - INT 67 - Nanosoft MD386 - SET HARDWARE BREAKPOINT

INT 67 - Nanosoft MD386 - SET HARDWARE BREAKPOINT
	AX = 5E00h
	DH = breakpoint number (0-3)
	DL = breakpoint attributes (used to set DR7)
	CX:BX = linear address of breakpoint
SeeAlso: AX=5D03h,AX=5E01h

Top

675E01 - INT 67 - Nanosoft MD386 - GET HARDWARE DEBUG REGISTER

INT 67 - Nanosoft MD386 - GET HARDWARE DEBUG REGISTER
	AX = 5E01h
	BL = register number (0-3,7)
Return: CX:BX = value of specified DRx register
SeeAlso: AX=5E00h

Top

675E02 - INT 67 - Nanosoft MD386 - SET DEBUG EXCEPTION HANDLER

INT 67 - Nanosoft MD386 - SET DEBUG EXCEPTION HANDLER
	AX = 5E02h
	CX:BX -> exception handler
Note:	the specified exception handler is called with a simulated interrupt
	  whenever a debug exception occurs which was caused by a hardware
	  breakpoint set with the debug registers
SeeAlso: AX=5E04h,AX=5E05h

Top

675E03 - INT 67 - Nanosoft MD386 - ENABLE/DISABLE MEMORY WRITE PROTECTION

INT 67 - Nanosoft MD386 - ENABLE/DISABLE MEMORY WRITE PROTECTION
	AX = 5E03h
	BL = register map set number
	BH = new state (00h read-only, else read-write)
	CX = linear page number (linear address SHR 12)
Note:	setting write protection in map set 0 will cause the setting to become
	  the default for newly-allocated map sets

Top

675E04 - INT 67 - Nanosoft MD386 - GET DEBUG EXCEPTION

INT 67 - Nanosoft MD386 - GET DEBUG EXCEPTION
	AX = 5E04h
Return: BL = debug exception (low byte of DR6 register)
SeeAlso: AX=5E02h,AX=5E05h

Top

675E05 - INT 67 - Nanosoft MD386 - IGNORE NEXT DEBUG EXCEPTION

INT 67 - Nanosoft MD386 - IGNORE NEXT DEBUG EXCEPTION
	AX = 5E05h
Note:	may be required when using AX=5E02h for handling instruction
	  breakpoints
SeeAlso: AX=5E02h,AX=5E04h

Top

6760 - INT 67 - EEMS - GET PHYSICAL WINDOW ARRAY

INT 67 - EEMS - GET PHYSICAL WINDOW ARRAY
	AH = 60h
	ES:DI -> buffer
Return: AH = status (see also AH=40h)
	AL = number of entries
	buffer at ES:DI filled

Top

6761 - INT 67 - EEMS - GENERIC ACCELERATOR CARD SUPPORT

INT 67 - EEMS - GENERIC ACCELERATOR CARD SUPPORT
	AH = 61h
	???
Return: ???
Note:	can be used by accelerator card manufacturer to flush RAM cache,
	  ensuring that the cache accurately reflects what the processor would
	  see without the cache.

Top

676100 - INT 67 - EEMS - STB GENERIC ACCELERATOR CARD SUPPORT - INSTALLATION CHECK???

INT 67 - EEMS - STB GENERIC ACCELERATOR CARD SUPPORT - INSTALLATION CHECK???
	AX = 6100h
Return: AH = status (00h if installed???)
Note:	STB's RAPIDMAP.SYS EMS driver calls this function and AX=6101h if
	  the signature "GACXXX" is found at offset 0Ah in the INT 67 handler's
	  segment (i.e. a device driver named GACXXX?? has hooked INT 67)
SeeAlso: AX=6101h,INT 02/SI=0714h

Top

676101 - INT 67 - EEMS - STB GENERIC ACCELERATOR CARD SUPPORT - GET ??? ENTRY POINT

INT 67 - EEMS - STB GENERIC ACCELERATOR CARD SUPPORT - GET ??? ENTRY POINT
	AX = 6101h
Return: AH = status
	---if AH=00h---
	ES:BX -> ??? entry point
SeeAlso: AX=6100h

Top

6768 - INT 67 - EEMS - GET ADDRESSES OF ALL PAGE FRAMES IN SYSTEM

INT 67 - EEMS - GET ADDRESSES OF ALL PAGE FRAMES IN SYSTEM
	AH = 68h
	ES:DI -> buffer
Return: AH = status (see also AH=40h)
	AL = number of entries
	buffer at ES:DI filled
Note:	equivalent to LIM 4.0 function 58h

Top

6769 - INT 67 - EEMS - MAP PAGE INTO FRAME

INT 67 - EEMS - MAP PAGE INTO FRAME
	AH = 69h
	AL = frame number
	BX = page number
	DX = handle
Return: AH = status (see also AH=40h)
Note:	similar to EMS function 44h
SeeAlso: AH=44h,AH=50h,AH=6Ah

Top

676A - INT 67 - EEMS - PAGE MAPPING

INT 67 - EEMS - PAGE MAPPING
	AH = 6Ah
	AL = subfunction
	    00h save partial page map
		CH = first page frame
		CL = number of frames
		ES:DI -> buffer which is to be filled
	    01h restore partial page map
		CH = first page frame
		CL = number of frames
		DI:SI -> previously saved page map
	    02h save and restore partial page map
		CH = first page frame
		CL = number of frames
		ES:DI = buffer for current page map
		DI:SI = new page map
	    03h get size of save array
		CH = first page frame
		CL = number of frames
		Return: AL = size of array in bytes
	    04h switch to standard map register setting
	    05h switch to alternate map register setting
	    06h deallocate pages mapped to frames in conventional memory
		CH = first page frame
		CL = number of frames
Return: AH = status (see #03648)
Note:	similar to EMS function 4Eh, except that a subrange of pages can be
	  specified
SeeAlso: AH=69h

Top

676B - INT 67 - DESQview 2.42-2.53 - BUG

INT 67 - DESQview 2.42-2.53 - BUG
	AH = 6Bh
Note:	the EMM.DVR portion of DESQview branches to a random location on this
	  function due to a fencepost error

Top

67DD - INT 67 - Quadtel QMAPS - API

INT 67 - Quadtel QMAPS - API
	AH = DDh
	AL = function
	???
Return: ???
Notes:	details are not yet available
	Hewlett-Packard's HPMM.SYS is a licensed version of QMAPS, and thus
	  supports this API
SeeAlso: AH=3Fh,AX=FFA5h

Top

67DE0F - INT 67 - Netroom3 - ???

INT 67 - Netroom3 - ???
	AX = DE0Fh
	???
Return: ???
Note:	called by Netroom's DPMI.EXE

Top

67EF - INT 67 - RM386 v6.00+ - EXECUTE XMS FUNCTION

INT 67 - RM386 v6.00+ - EXECUTE XMS FUNCTION
	AH = EFh
	AL = function (00h-12h,80h-8Fh)
	other register as appropriate for XMS function
Return: varies by function (see INT 2F/AX=4310h"XMS")
Note:	these functions appear to be equivalent to the XMS functions with the
	  same numbers
SeeAlso: AX=5DFFh"RM386",INT 2F/AX=4310h"XMS"

Top

67FFA5 - INT 67 - Microsoft EMM386.EXE v4.20+ - INSTALLATION CHECK

INT 67 - Microsoft EMM386.EXE v4.20+ - INSTALLATION CHECK
	AX = FFA5h
Return: AX = 845Ah/84A5h if loaded
	    BX:CX -> API entry point (see #03666)
Notes:	this call is available even if EMM386 is not providing EMS
	the returned AX is 845Ah inside of MSWindows, 84A5h under bare DOS
	if no other program has hooked INT 67, an alternate installation
	  check is to test for the string
	  "MICROSOFT EXPANDED MEMORY MANAGER 386" at offset 14h in the INT 67
	  handler's segment; the word immediately preceding this string
	  contains the offset of the API entry point
SeeAlso: AH=3Fh,AX=FFA5h/BX=4345h,INT 21/AX=4402h"EMM386.EXE"

(Table 03666)
Call EMM386.EXE API entry point with:
	AH = 00h get memory manager's status
	    Return: AH = status
			bit 0: not active (OFF)
			bit 1: in "Auto" mode
	AH = 01h set memory manager's state
	    AL = new state (00h ON, 01h OFF, 02h AUTO)
	AH = 02h Weitek coprocessor support
	    AL = subfunction
		00h get Weitek support state
		    Return: AL = status
				bit 0: Weitek coprocessor is present
				bit 1: Weitek support is enabled
		01h turn on Weitek support
		02h turn off Weitek support
     --- v4.20-4.41 only ---
	AH = 03h Windows support???
	    AL = subfunction (00h, 01h)
	AH = 04h print copyright notice to standard output
		 (using INT 21/AH=09h)
	AH = 05h print available report
		 (the one shown when running EMM386 from the DOS prompt)
SeeAlso: #01513 at INT 21/AX=4402h/SF=02h,#02617 at INT 2F/AX=12FFh/BX=0106h

Top

67FFA5BX4345 - INT 67 U - Compaq CEMM v5.10+ - PRIVATE API

INT 67 U - Compaq CEMM v5.10+ - PRIVATE API
	AX = FFA5h
	BX = 4345h ("CE")
	DX = subfunction
	    0000h unshadow video ROM???
	    0001h shadow video ROM???
	    0002h map pages
		CX = number of pages (00h=one)
		ESI = linear address of first page to map into address space
		EDI = linear starting address at which pages are to be visible
	    0003h get ???
		Return: DX = ??? (0-2)
	    0004h BUG: crashes system due to fencepost error
Return: AH = 84h
	AL = status (84h = error, FFh = success)
Note:	if BX <> 4345h or DX > 0004h on entry, CEMM behaves identically to
	  Microsoft's EMM386 (see AX=FFA5h"EMM386")
SeeAlso: AX=FFA5h"EMM386",#01513 at INT 21/AX=4402h/SF=02h,#03666

Top

7E5857BL57 - INT 7E - XLOAD - INSTALLATION CHECK

INT 7E - XLOAD - INSTALLATION CHECK
	AX = 5857h
	BL = 57h
Return: AX = 0000h if installed
Program: XLOAD is the LOADHIGH-equivalent from Helix Software's Netroom
SeeAlso: AX=5857h/BL=5Ah,AX=5857h/BL=5Bh

Top

7E5857BL5A - INT 7E - XLOAD - GET ???

INT 7E - XLOAD - GET ???
	AX = 5857h
	BL = 5Ah
Return: AX = 0000h
	CX = ???
	DS:SI -> ???
SeeAlso: AX=5857h/BL=57h,AX=5857h/BL=5Bh

Top

7E5857BL5B - INT 7E - XLOAD - GET XLOAD MEMORY SIZE

INT 7E - XLOAD - GET XLOAD MEMORY SIZE
	AX = 5857h
	BL = 5Bh
Return: AX = 0000h
	CX = segment of XLOAD TSR
	DX = size of memory block in which XLOAD TSR is located
SeeAlso: AX=5857h/BL=57h,AX=5857h/BL=5Ah

Top

B5 - INT B5 U - Netroom NETSWAP4 - ???

INT B5 U - Netroom NETSWAP4 - ???
	???
Return: ???
SeeAlso: INT 31/AH=57h

Top

Home Interrupt Index: by Category by ID TOC: by Order Top