BBC OSWORD usage summary
			========================

This is a list of OSWORD calls which I am aware of, their parameters and
exit conditions. Please send mail to ajcd@dcs.ed.ac.uk if you have any
additions to this list.

Note that the OSWORD protocol does not permit passing back values in the
A, X, Y, or Status registers for calls other than 0. If a call is made to
a function that returns values that way, it cannot be guaranteed that they
will be returned on all systems.  OSWORD calls with numbers greater than
&7F should contain the number of parameters to send in the first byte of
the parameter block, and the number of parameters to receive in the second
byte of the parameter block, inclusive of the first two bytes.

Update History
--------------
21-Jun-1993: Angus Duggan, initial list of &00-&0F, &4E..&5E, &7D..&7F ...

28-Feb-1997: J.G.Harston, Re-edited, added &10-&16, &20, &42, &43, &45,
	&5A, &60, &62-&64, &70-&73, &7A, &7B, &BE, &FA, &FE, &FF.
04-Oct-1998: J.G.Harston, updated &20, added &51, &89, &8A, &C8, &FB, &FC,
	&FD.

Hex Dec Function					Appears in
------------------------------------------------------------------------------
&00  0  Input line					Acorn MOS 1.20
	On entry; XY+0,1=>string area, XY+2=maximum line length,
	XY+3=minimum acceptable ASCII value, XY+4=maximum acceptable ASCII
	value. On exit, Y is the line length (excluding CR), and C is set
	if Escape terminated input.

&01  1  Read system clock (=TIME)			Acorn MOS 1.20
	On exit; XY+0..4=current 5-byte system clock value.

&02  2  Write system clock (TIME=)			Acorn MOS 1.20
	On entry; XY+0..4=new 5-byte system clock value.

&03  3  Read interval timer				Acorn MOS 1.20
	On exit; XY+0..4=current 5-byte interval timer value.

&04  4  Write interval timer				Acorn MOS 1.20
	On entry; XY+0..4=new 5-byte interval timer value.

&05  5  Read I/O processor memory			Acorn MOS 1.20
	On entry; XY+0..3=address to read from. On exit, XY+4=the byte
	read. Some systems recognise screen memory at &FFFExxxx and
	sideways roms at &FFFr8000-&FFFr-BFFF.

&06  6  Write I/O processor memory			Acorn MOS 1.20
	On entry; XY+0..3=address to write to, XY+4=byte to be written.

&07  7  Generate a sound				Acorn MOS 1.20
	On entry; XY+0..1=channel, XY+2..3=amplitude or envelope,
	XY+4..5=pitch, XY+6..7=duration.

&08  8  Define a sound envelope				Acorn MOS 1.20
	On entry; XY+0=envelope number, XY+1=length of each envelope step
	(b7=auto repeat pitch envelope), XY+2=change of pitch in step 1,
	XY+3=change of pitch in section 2, XY+4=change of pitch in section
	3, XY+5=number of steps in section 1, XY+6=number of steps in
	section 2, XY+7=number of steps in section 3, XY+8=change of
	amplitude per step in attack phase, XY+9=change of amplitude per
	step in decay phase, XY+10=change of amplitude per step in sustain
	phase, XY+11=change of amplitude per step in release phase, XY+12=
	target amplitude at end of attack phase, XY+13=target amplitude at
	the end of the decay phase.

&09  9  Read screen pixel value				Acorn MOS 1.20
	On entry; XY+0..1=X coordinate, XY+2..3=Y coordinate. On exit,
	XY+4=pixel value, or &FF if the point was off screen or non-
	graphics screen mode.

&0A 10  Read character definition			Acorn MOS 1.20
	On entry; XY+0=character. On exit; XY+1..8=the character raster.
	The results for characters 0..31 and 127 are undefined.

&0B 11  Read palette					Acorn MOS 1.20
	On entry; XY+0=logical colour. On exit; XY+1=physical colour,
	XY+2=red component, XY+3=green component, XY+4=blue component.

&0C 12  Write palette					Acorn MOS 1.20
	On entry; XY+0=logical colour, XY+1=physical colour, XY+2=red
	component, XY+3=green component, XY+4=blue component.

&0D 13  Read last two graphics positions		Acorn MOS 1.20
	On exit, XY+0..1=previous X coordinate, XY+2..3=previous Y
	coordinate, XY+4..5=current X coordinate, XY+6..7= current Y
	coordinate.

&0E 14  Reads CMOS clock				Acorn Master MOS
	On entry; XY+0=function code. On exit; XY... contains the result
	block. Functions are:
	0 - Return CR-terminated string of form "Day,DD Mon Year.HH:MM:SS".
	1 - Return BCD clock value. On exit, XY+0=year (&00-&99), XY+1=
	  month (&01-&12), XY+2=date (&01-&31), XY+3=day of week (&01-&07),
	  XY+4=hours (&00-&23), XY+5=minutes (&00-&59), XY+6=seconds
	  (&00-&59).
	2 - Convert BCD to string. On entry; XY+1..7=BCD value. On exit;
	  XY+1..25=CR-terminated string.

&0F 15  Write CMOS clock				Acorn Master MOS
	On entry, XY+0=function code, XY+1.. contains value to use.
	Functions are:
	8 - Set time to value in format "HH:MM:SS"
	16 - Set date to value in format "Day,DD Mon Year"
	24 - Set time and date to value in format
		"Day,DD Mon Year.HH:MM:SS"

&10 16  Network transmit				NFS
	On entry, XY+0=control byte with b7 set, XY+1=destination port,
	XY+2..3=destination station, XY+4..7= buffer start address,
	XY+8..11=buffer end address. On exit, XY+0=zero if transmission
	failed to start. Transmission must be polled with Osbyte &32 (50).
	If the destination station is &FFFF, a broadcast will be sent, the
	eight bytes of data are in the control block at XY+4 to XY+11. If
	the port number is zero, an immediate operation is transmitted.

&11 17  Open or read network receive block		NFS
	XY+0=0 - Open receive block. On entry, XY+1 must contain &7F,
	  XY+2=port to receive on, XY+3..4=station to receive from,
	  XY+5..8=address of reception buffer, XY+9..12=address of buffer
	  end. On exit, XY+0=0 if no more space to open blocks, or number
	  of opened reception block. Receive blocks can be 'wild', ie will
	  receive from anyone  if the port or station values are set to
	  &00.
	XY+0<>0, Read receive block. On entry, XY+0=receive block number to
	  read. XY+5..8=buffer start address, XY+9..12=buffer end address.
	  On exit, XY+1=flag from transmission block, XY+2=port received
	  on, XY+3..4=station received from, XY+9..12=updated to new
	  address of buffer end. Unread receive blocks must be deleted with
	  Osbyte &34 (52).

&12 18  Read argument block and restore protection mask NFS
	On exit, XY+0..1=station number, XY+2..=supplied data.

&13 19  Read/Write station infomation			NFS
	On entry, XY+0=function, XY+1..=read or written data. Functions
	are:
	 0 - Read file server number to XY+1..2
	 1 - Write file server number from XY+1..2
	 2 - Read printer server number to XY+1..2
	 3 - Write printer server number from XY+1
	 4 - Read protection mask to XY+1
	 5 - Write protection mask from XY+1
	 6 - Read user environment: XY+1=URD, XY+2=CSD, XY+3=LIB
	 7 - Write user environment: XY+1=URD, XY+2=CSD, XY+3=LIB
	 8 - Read local station number to XY+1
	 9 - Read number of arguments to XY+1 and size of argument block to
	     XY+2 for Osword &12 (18) above
	10 - Read extended error number to XY+1
	11 - ?
	12 - ?
	13 - ?
	14 - ?
	15 - Read ANFS timeouts in seconds, XY+1=not listening, XY+2=no
	     reply, XY+3=machine peek
	16 - Write ANFS timeouts in seconds, as above

&14 20  Various NFS/Network functions			NFS
	XY+0=0 - Communicate with fileserver
	 On entry, XY+1=size of rest of block, XY+2=0, XY+3=function,
	    XY+4=0, XY+5=0, XY+6=0, XY+7... contains rest of infomation. On
	    exit, XY+1=updated size of block, XY+2=command code, 0 for ok
	    <>0 to continue with another function, XY+3=error code, 0 for
	    ok <>0 for error, CR-terminated error string following, XY+4..
	    contains returned data.
	XY+0=1 - Send text string to remove station.
	 On entry, XY+1..2=destination station, XY+3... string to send,
	    terminated by CR or &00.  The CR also gets sent.
	XY+0=2 - Generate error on remote machine.
	 On entry, XY+1..2=destination machine.

&15 21  Read/Write mouse and pointer infomation	Arthur
	XY+0=0 - Set pointer size, shape and active point
	 On entry, XY+1=shape number (1-4), XY+2=width in bytes (0-8),
	    XY+3=height in pixels (0-32), XY+4=ActiveX in pixels from left,
	    XY+5=ActiveY in pixels from top, XY+6..9=>pointer shape data.
	XY+0=1 - Define mouse bounding box
	 On entry, XY+1..2=left coordinate, XY+3..4=bottom coordinate,
	    XY+5..6=right coordinate, XY+7..8=top coordinate.
	XY+0=2 - Set mouse multipliers
	 On entry, XY+1=signed 8-bit X multiplier, XY+2=signed 8-bit Y
	    multiplier.
	XY+0=3 - Set mouse position
	 On entry, XY+1..2=X position, XY+3..4=Y position.
	XY+0=4 - Read unbuffer mouse position
	 On exit, XY+1..2=X position, XY+3..4=Y position.
	XY+0=5 - Set pointer position
	 On entry, XY+1..2=X position, XY+3..4=Y position.
	XY+0=6 - Read pointer position
	 On exit, XY+1..2=X position, XY+3..4=Y position.

&16 22  Set screen base start				Arthur
	On entry, XY+0=screen type, XY+1=>screen base. If type b0=1, sets
	   the screen used by the VDU drivers, if type b1=1, sets the
	   screen displayed by the hardware.

&20 32  Acorn User Windowing System by Alan Blundell	AUWIN
	XY+0=0 - Close all windows
	XY+0=1 - Close top window
	XY+0=2 - Release window
	XY+0=3..9 - Open window type 3..9
	 On entry, XY+1=left, XY+2=bottom, XY+3=right, XY+4=top,
	    XY+5=foreground colour, XY+6=background colour, XY+7=title bar
	    colour, XY+8=title bar background colour, XY+9=edge colour,
	    XY+10=edge background colour, XY+11...=Title string, CR
	    terminated.

&28 40 \
  to	 } Allocated to Millipede Prisma 2 Graphics Processor
&31 49 /

&36 54  Stop Press Routines				Stop Press

&40 64  Read mouse pointer and button state		AMX Super Art
	On exit, XY+0..1=graphics X coordinate, XY+2..3=graphics Y
	coordinate, XY+4=text X coordinate, XY+5=text Y coordinate,
	XY+6=button state (~&80=cancel, ~&40=move, ~&20=execute).

&41 65  Miscellaneous graphics commands		AMX Super Art
	On entry, XY+0=command number, XY+1.. contains the arguments.
	Commands are:
	0 - Draw patterned block. XY+1=pattern number, XY+2..3= left X
	    coordinate, XY+4..5=bottom Y coordinate, XY+6..7= right X
	    coordinate, XY+8..9=top Y coordinate.
	1 - Store area of screen. XY+1..4=destination address, XY+5=left
	    text X coordinate, XY+6=bottom text Y coordinate, XY+7=width in
	    characters, XY+8=height in characters.
	2 - Restore area of screen. XY+1..4=source address, XY+5=left text
	    X coordinate, XY+6=bottom text Y coordinate, XY+7=width in
	    characters, XY+8=height in characters.
	3 - Store area then draw window on screen. XY+1..4=destination
	    address, XY+5=left text X coordinate, XY+6=bottom text Y
	    coordinate, XY+7=width in characters, XY+8= height in
	    characters.
	4 - Pull down a menu. XY+1..4=data store address, XY+5= left text X
	    coordinate, XY+6=bottom text Y coordinate, XY+7=width in
	    characters, XY+8=height in characters, XY+9..12=text address,
	    XY+13..15=tick and options flags. Text is stored as
	    CR-separated strings, terminated by a zero byte. Tick and
	    options flags are split into 12 low-order bits (legal
	    selections) and 12 high order bits (ticks).
	5 - Select option from pull down menu. XY+1=left X coordinate,
	    XY+2=bottom Y coordinate, XY+3=right X coordinate, XY+4=top Y
	    coordinate, XY+5..6=illegal options flags. On exit, XY+0=the
	    selection number, or 0 if no item was selected.
	6 - Shift AMX Art screen. XY+1=X shift, XY+2=Y shift.
	7 - Set Mouse coordinates. XY+1..2=X coordinate, XY+3..4=Y
	    coordinate.
	8 - Read AMX ROM details. On exit, XY+1=ROM number, XY+2..3=
	    workspace address, XY+4=mouse flag (0=off, &80=on), XY+5=
	    pointer flag (0=off, &40=on), XY+6..7=RAM pattern address,
	    XY+8=status flag (b0-b3 keys generated by buttons, b4-b6 button
	    status, b7 mouse movement generates cursor key motion),
	    XY+9..10=pointer X coordinate, XY+11..12=pointer Y coordinate,
	    XY+13=mouse sensitivity flag (b0-b2 X sensitivity, b3-b5 Y
	    sensitivity, b6-b7 device type flag), XY+14=ROM version number.

&42 66  Sideways RAM transfer				1770 DFS
	On entry, XY+0=function, XY+1..4=main memory address, XY+5..6=data
	length (two bytes), XY+7=rom number &00..&0F or &10..&13 for banks
	W, X, Y, Z, XY+8..9=sideways address (two bytes).  The functions
	are:
	&00 - Read from absolute address
	&40 - Read from pseudo-address
	&80 - Write to absolute address
	&C0 - Write to pseudo-address

&43 67  Load/Save into/from sideways Ram		1770 DFS
	On entry, XY+0=function as for Osword &42 (66), XY+1..2=>filename
	in I/O processor, XY+3=rom number, XY+4..5=sideways start address,
	XY+6=data length - ignored on LOAD, XY+8..9=buffer address,
	XY+10=buffer length.  If the buffer address is zero, a default
	buffer is used in private workspace.  If the buffer length is
	larger than &7FFF, then language workspace from PAGE to HIMEM is
	used.

&44 68  AMX Super Art Rom commands			AMX Super Art
	On entry, XY+0=manufacturer code (0=AMS), XY+1=command number,
	XY+2=number of arguments to the command, XY+3... contain the
	arguments. Commands are:
	0 - *Buttons off
	1 - *Buttons XY+3
	2 - *Sensitivity XY+3 [,XY+4]
	3 - *Update
	4 - *Icon XY+3 [,XY+4, XY+5]
	5 - *Desk [XY+3, XY+4]
	6 - *Window XY+3, XY+4, XY+5, XY+6
	7 - *Pointer XY+3, XY+4
	8 - *Loop XY+3
	9 - *MovePointer
	10 - *ShowPointer
	11 - *HidePointer
	12 - *MCursor XY+3 (1=on, 0=off)
	13 - *Header
	14 - *MWindow XY+3, XY+4, XY+5, XY+6
	15 - *Pattern XY+3
	16 - *Spray
	17 - *Device

&45 69  Move/Swap memory				Aries B32
	XY+0=function: 0=move, 1=Swap, XY+1=source start address, XY+3=bank
	specifier &00 to &0F for sideways roms/rams and program ram, &80 to
	&8F for sideways rom/rams and video ram, XY+4=source end plus 1,
	XY+6=destination address, XY+8=destination bank specifier (as
	above). XY+9 returns the return code, 0 = ok, 1 = overlapping areas
	for swap, 2=end before start, 3=destination end >&FFFF, 4=no ram in
	bank 13 or 14.

&46 70  Allocated to BBC soft, probably unused.

&4C 76  Extended communications control			TQCOM
	XY+0=operation code, XY+1=port or protocol number. Operations are:
	0 - Initialise port for protocol (and claim vectors required,
	    including &0234).
	1 - Return null terminated port/protocol text name in XY+2.

&4D 77 -

&4E 78  Initialise heap					DVR
	On entry, XY+0..1=start address of the heap, XY+2..3=size of the
	heap. On exit, XY+0=heap handle. C is set and XY are preserved if
	the call failed.

&4F 79  Claim area from heap				DVR
	XY is a heap handle. On entry, XY+0..1=size of the area to
	allocate. On exit, XY is the address of the block allocated. C is
	set and XY are preserved if the call failed.

&50 80  Release area to heap				DVR 
	XY is a heap handle. On entry, XY+0..1=address of the area to
	release. On exit, XY are preserved and C is set if the call failed.

&51 81  Get maximum heap block size			DVR
	XY is a heap handle. On exit, XY+0..1=size of the largest block
	available. If the call failed, XY are preserved, C is set, and XY+0
	is set to zero.

&51 81  SEHK Support					SEHK

&52 82  Initialise file buffer				DVR
	On entry, XY+0..1=a heap handle, XY+2=access flags (&80=writable,
	&40=readable), XY+3=file handle, or zero for a memory file. On
	exit, XY is the buffer handle. C is set and X contains a failure
	code if the call failed. Failure codes are: 1=Memory claim failed,
	2=OSGBPB call failed, 3=access failed, 4=EOF detected, 5=Memory
	release failed (heap corrupt).

&53 83  Finish with file buffer				DVR
	XY is a buffer handle. On exit, C is set and X contains a failure
	code if the call failed. All in-memory blocks are written to the
	file system.

&54 84  Flush file buffer				DVR
	XY is a buffer handle. On entry, XY+0=flush code: 0=flush
	non-modified blocks, not including current block. 1=flush all but
	current block. 2=flush all blocks. On exit, C is set and X contains
	a failure code if the call failed.

&55 85  Get bytes from file buffer			DVR
	XY is a buffer handle. On entry, XY+0..1= number of bytes to get,
	XY+2..4= file pointer to the start of the data. On exit, XY
	contains an address at which the data is found, which is guaranteed
	to stay until another get bytes call or a flush all blocks call. If
	the call failed, C is set and X contains a failure code.

&56 86  Put bytes to file buffer			DVR
	XY is a buffer handle. On entry, XY+0..1=number of bytes to put.
	XY+2..4= file pointer to the data, XY+5..6=address of the data.  On
	exit, C is set and X contains a failure code if the call failed. If
	the call failed due to insufficient memory, the file pointer, data
	address, and number of bytes left are updated to point the the
	unwritten part.

&57 87  Create new binary tree node			DVR
	On entry, XY+0..1=data address, XY+2..3=size of the data, XY+4..5=
	heap handle. If the data address is zero, a new node is allocated,
	but the data is not copied. On exit, XY contains the address of the
	node. C is set if the call failed.

&58 88  Insert node into binary tree			DVR
	On entry, XY+0..1=address of the root of the tree, XY+2..3=address
	of a data comparison routine, XY+4..5=address of the new node. The
	data comparison routine is called with two addresses on the stack
	(low bytes first), and should exit with the Z flag set if the data
	at the addresses compares equal, or the N flag set if the first
	item is less than the second.  On exit, C is set if the node was
	already in the tree and was not inserted, in which case XY contain
	the address of the data in the tree.

&59 89  Delete node from binary tree			DVR
	On entry, XY+0..1=address of the root of the tree, XY+2..3=address
	of a data comparison routine, and XY+4..5=address of the node to
	delete. On exit, C is set if the node could not be found in the
	tree, otherwise XY contain the address of the old node.

&5A 90  Find node in binary tree			DVR
	On entry, XY+0..1=address of the root of the tree, XY+2..3=address
	of a data comparison routine, and XY+4..5=address of the data to
	find. On exit, XY contain the address of the node found. C is set
	if the data was not found.

&5A 90  HADFS Sector read/write/access			HADFS
	This can be called by the user to perform an operation, or called
	by HADFS to access an external drive where a supporting routine
	should respond. XY+0..1 must contain &0600, XY+2..5= address,
	XY+6..9=sector address with the drive number in the top byte (ie
	XY+9), XY+10 contains the number of sectors to read/write, XY+11
	contains the call type and returns the result code. A supporting
	routine should only claim the call if the call type if <&80, and
	the drive number is the one supported.  Call types to recognise (do
	NOT call these) are: 1=write, 2=read, 3=disk size request,
	4=format, 5=bye (ie, dismount - do NOT claim). User call types are:
	&80=read, &81=write. Result codes are as for Osword &7F (127) plus
	&FE=Drive not present. If any external support routines leave the
	call type byte unchanged, HADFS changes it to &FE, Drive not
	present. HADFS will not clash with DVR as long as HADFS is in a
	higher priority rom socket than DVR is.

&5B 91  Traverse binary tree				DVR
	On entry, XY+0..1=address of the root of the tree, XY+2..3=address
	of an action routine, XY+4=traversal order flag (0=forward search,
	&FF=backward search). The action routine is called with the address
	of the current node in XY, and should return with C clear if the
	traversal is to be continued, or C set of it is to be aborted.

&5C 92  Balance binary tree				DVR
	On entry, XY+0..1=address of the root of the tree. The tree is
	rearranged into a route-balanced tree.

&5D 93  Parse option patterns				DVR
	On entry, XY+0..1=address of a pattern list, XY+2..3=address of a
	string list, XY+4..5=address of a result list, XY+6 is the
	case-sensitivity flag (0=case sensitive, &FF=case insensitive). The
	pattern and string lists are lists of length-prefixed strings,
	terminated by a zero byte. The character * in a pattern matches any
	number of characters, and the character ? matches exactly one
	character. On exit, the result list contains one entry for each
	string in the string list. The entry is &FF if no matching pattern
	was found, or 1--#patterns indicating the pattern matched by the
	string. In the latter case, a pair of bytes follow for each
	sequence of * and ?, indicating the start and end indices of the
	corresponding part of the string.

&5E 94  Get string with control character interpretation DVR
	On entry, XY+0..1=address of a CR-terminated string, XY+2..3=
	destination address (for a length-prefixed string), XY+4= flags
	byte (&80=double quoted allowed, &40=single quoting allowed,
	&20=non-quoted characters allowed, &10=skip preceding space,
	&8=enable escape character processing). On exit, the address of the
	source string is updated to indicate the next part of the string to
	be processed. C is set if the string was malformed.
	 
&5F 95  "Monitor reads across tube"			BBC Soft

&60 96  Read Videodisk MSN and status byte		VFS
	Same format as ADFS call &70 (112). On exit, XY+0=Master Sequence
	Number, XY+1=status byte: b7=Tube present, b6=Tube claimed by VFS,
	b5=LVROM controller present, b4=n/u, b3=n/u, b2=*OPT1 flag, b1=Bad
	Free Space Map, b0=IRQ pending.

&61 97  Read free space on VFS disk			VFS
	Unused/unimplemented as VFS is read-only media.

&62 98  Access LVROM controller 			VFS
	Same format as ADFS call &72 (114). Commands are &00=Test drive
	ready, &01=Seek track 0, &03=Request status, &08=Read sectors,
	&1B=Stop/Start drive; stop if XY+9=0, start if XY+9=1, &C8=Read
	F-code result from LVDOS, &CA=Transmit F-code to LVDOS. Results are
	&02=Drive door open, &03=Media error, eg disk dirty, &05=Bad SCSI
	command.

&63 99  Read last VFS error number			VFS
	Same format as ADFS call &73 (115).

&64 100 Read current F-code				VFS
	On exit, XY+0... contains current F-code command string terminated
	by CR.

&6E 110 Read byte from shadow Ram board 		Watford 32K
	On entry, XY+0..1=address within Ram board, XY+2=bank flag, b0=0 -
	&0000-&2FFF is main memory, b0=1 - &0000-&2FFF is shadow memory,
	b1=0 - &3000-&7FFF is main memory, b1=1 - &3000-&7FFF is shadow
	memory. On exit, XY+3=byte read.

&6F 111 Write byte to shadow Ram board			Watford 32K
	On entry, XY+0..1=address within Ram board, XY+2=bank flag, as
	above, XY+3=byte to be written. On exit, XY+3=former contents of
	memory location.

&70 112 Read master sequence number and status byte	ADFS
	On exit, XY+0=Master Sequence Number, XY+1=status byte: b7=Tube
	present, b6=Tube claimed by ADFS, b5=Winchester controller present,
	b4=n/u, b3=n/u, b2=*OPT1 flag, b1=Bad Free Space Map, b0=IRQ
	pending.

&71 113 Read free space on disc 			ADFS
	On exit; XY+0..3=free space on current disk.

&72 114 Read/Write MFM sectors				ADFS
	On entry, XY+0=0, XY+1..4=address, XY+5=command, XY+6=drive number
	in b5-b7, sectorb16-b20 in b0-b4, XY+7=sector middle byte,
	XY+8=sector low byte, XY+9=number of sectors, XY+10=n/u,
	XY+11..14=data length if XY+9=0. This is a standard SCSI command
	block. The drive number in XY+6 is ORed with the current drive.
	Commands are &08=Read data, &0A=Write data, &0B=Seek track. On exit,
	XY+0=result; &48=CRC error, &50=Sector not found, &60=Bad command,
	&61=Bad address, &63=Volume error, &65=Bad drive.

&73 115 Read information about last error		ADFS
	On exit, XY+0..2=sector error occured at, XY+2 b5-b7=drive number,
	XY+3 b0-b6=result code as in Osword &72 (114), XY+3 b7 if clear,
	error occured on a channel, XY+4=channel number if XY+3 b7=0.

&7A 122 Teletext commands				Teletext
	On entry, XY+0=command. The command is &00..&7F for Advanced
	Teletext commands, &80..&FF for standard commands, as follows:
	&00 - Read channel, returned to XY+1, 0=BBC1, etc.
	&01 - Set channel from XY+1, 0=BBC1, etc.
	&02 - Read record flag. Record in XY+1, returned flag in XY+2:
	    b0=HOLD, b1=received, b1=being updated.
	&03 - Set record flag, record in XY+1, flag in XY+2 as above.
	&04 - Read a Page Grabber record. XY+1 contains record. Returns
	    XY+2=magazine, XY+3=BCD page number, XY+4..5=sub-page,
	    XY+6..7=I/O address to store page.
	&05 - Set a Page Grabber record, entry details as above.
	&06 - Read number of rows to be captured to XY+1.
	&07 - Set number of rows to be captured from XY+1.
	&08 - Read header line status to XY+1: &00=header off, &01=header on
	    with clock, &FF=header on without clock.
	&09 - Set header line status from XY+1 as above.
	&0A - Read magazine for header display to XY+1. &FF means all
	    headers.
	&0B - Set magazine for header display from XY+1 as above.
	&0C - Switch off teletext interrupts.
	&0D - Switch on teletext interrupts.
	&0E - Clear all Page Grabber records.
	&0F - Read Television Service Data Packet to XY+1..13 as follows:
	    XY+1=magazine for initial page, XY+2=BCD initial page number
	    or &FF if none, XY+3..4=initial page sub-code, XY+5..6=network
	    group identity, XY+7=Time offset from Universal Coordinated
	    Time, XY+8..10=BCD Modified Julian Time hi to lo,
	    XY+11..13=BCD Universal Coordinated Time hours, minutes,
	    seconds. The offset is: b0=1, b1=half hour, b2=1 hour, b3=2
	    hours, b4=4 hours, b5=8 hours, b6=add/subtract offset, b7=1.
	&10 - Clear Page Grabber record.
	&11 - Read Adapter status to XY+1: &00=on and connected, &01=on, no
	    TV signal, &02=off, but connected, &FF=no adapter connected.
	&12 - Set Subtitle Enable flag. XY+1=&00 to enable, &FF to disable,
	    XY+2=subtitle magazine, XY+3=BCD subtitle page.
	&13 - Set interrupt handling flag from XY+1: &00 to enable, &FF to
	    disable.
	&14 - Enter Tuning routine. Exited by pressing SPACE.
	&15 - Return time from TSDP. On exit, XY+1..9="HH:MM:SS" string,
	    XY+10=flag, &00=ok, &FF=no time found.
	&16 - Return date from TSDP. On exit, XY+1..12="DD/MM/YYYY" string,
	    XY+12=flag, &00=ok, &FF=no date found.
	&17 - Check CRC. On entry, XY+1..2=>page data in I/O. On exit,
	    XY+3=result, &00=no CRC, &01=CRC ok, &FF=CRC failed.
	&18 - Download file from teletext. On entry, XY+1..2=>filename in
	    I/O, XY+3..6=load address, XY+7..10=exec address,
	    XY+11=magazine number, XY+12=BCD page number, XY+13=&00 - Load
	    to memory at OSHWM, &01 - Load to file, XY+14=&00 - Reset
	    default table, &01 Don't reset tables.
	&19 - De-Ham a byte at XY+1. On exit, XY+2=De-Hammed nybble and
	    result. b0-b3 contain nybble, b4-7=%1111 - unrecoverable
	    error, %0xx1 - recoverable error, %0xx0 - no error.

	&80 - Reload Last Page.
	&85 - Fetch Page. On entry, XY+1=page 100s, XY+2=page 10s,
	    XY+3=page 1s, XY+4=subpage 1000s, XY+5=subpage 100s,
	    XY+6=subpage 10s, XY+7=subpage 1s.
	&86 - Chain page. Fetches the next page in a chain.
	&88 - Head of Chain. Follows the chain around until the hear is
	    reached.
	&89 - Test Arrived. On exit, XY+1=result: &00=last page requested
	    not arrived, &FF=last page requested has arrived.
	&8A - Unlock Page. When a page has arrived, it becomes locked. This
	    unlocks it and allows further update.
	&8B - Select Channel. Selects the channel in XY+1 (0-3).
	&8D - Read TSDP. On exit, XY+1..2=Television Service Data Packet.
	&8E - DeHam a Byte. The byte at XY+1 is dehamed and returned in
	    XY+1, with flags as for &19 above.
	&8F - Transfer. The current page is transfered to the address in
	    XY+1..4.
	&92 - Headers. On entry, XY+1..2=address to display 32-character
	    page header.
	&93 - What Channel. Returns the currently selected channel in XY+1.

&7B 123 Modem comands					Prestel Adaptor
	The Prestel adapter modem can be in one of five states. State 0 -
	on-hook, speaker off. State 1 - off-hook, speaker on, modem off.
	State 2 - off-hook, speaker off, modem off, dialing suitable. State
	3 - off-hook, speaker on, modem disabled, checking progress. State
	4 - off-hook, speaker off, modem enabled, data must be sent at 75
	baud and received at 1200 baud. The modem calls are used to step
	through the five states and to monitor the dialling progress. On
	entry, XY+0=command:
	0 - RESET to state 0.
	1 - STEP to next state. Do not use in state 4.
	2 - PULSE. Send a dial pulse. Use in state 2.
	3 - START-DIGIT. Initialise to send a digit, use in state 2.
	4 - END-DIGIT. Terminate dialling a digit, use in state 2.
	5 - DCD-CHECK. Exits with XY+0=0 - unpowered or no carrier, XY+0=1
	    - powered in state 0, carrier present in state 4.
	To dial a number, STEP to state 2, for each digit, START-DIGIT,
	PULSE for the number, END-DIGIT, STEP to state 4.

&7B 123 Modem commands					COMMAND
	On entry, XY+0=command as follows:
	1 - Read stsus byte to XY+0: b0=offline/online, b1=XOFF sent,
	    b2=XOFF received, b3=carrier present.
	2 - Put byte to modem. XY+1=byte to send.
	3 - Get byte from mode. On exit, XY+0=byte, XY+1=255 if valid, 0 if
	    invalid.
	4 - Put string to modem. XY+1=length, XY+2.. contains string. No
	    exit parameters.
	5 - Get string from modem. On exit, XY+0=length read, XY+1..
	    contains string.
	6 - Read from remote computer. XY+1=maximum length, XY+2..3=maximum
	    time in centiseconds. On exit, XY+0=length of string, XY+1..
	    contains string. If RETURN not receieved within the time, a
	    Timout error (103) is generated.

&7B 123 Move a block of memory				HDFS
	On entry, XY+0..3=source address, XY+4..7=length,
	XY+8..12=destination address. Works across Tube and between Tube
	and I/O memory.

&7C 124 Multiple track single density FDC command	HDFS
	On entry, XY+0=drive number, XY+1..4=address, XY+5..6=start sector,
	XY+7..8=number of sectors to transfer, XY+9=8271 FDC command as for
	Osword &7F (127). If the drive number is &FF the current drive is
	used.

&7D 125 Read cycle number of disc			DFS, HDFS
	On exit, XY+0=cycle number.

&7E 126 Read disc (or directory) size			DFS, HDFS
	On exit, XY+0..3=size of the current disc (or directory for HDFS)
	in bytes.

&7F 127 Single track single density FDC command	DFS, HDFS
	On entry, XY+0=drive number, XY+1..4=address, XY+5=number of
	parameters in the 8271 FDC command, XY+6=8271 FDC command,
	XY+7...XY+7+#parameters are the command parameters. On exit, the
	result code is in XY+8+#parameters. If the drive number is &FF the
	current drive is used. Some commands are: &4B=Write sectors,
	&53=Read sectors, &63=format track, &69=Seek track. Results
	returned are: 0=ok, &08=Clock error, &0A=Late DMA, &0C=CRC error in
	ID, &0E=CRC error in data, &10=Drive not ready (shouldn't occur),
	&12=Write protected, &14=Track 0 not found, &16=Write fault,
	&18=Sector not found, &FE 8271 command unknown.

&80 128 "IEEE"

&81 129 ?

&82 130 Read/Write parameters				Cambridge ring

&83 131 Data transmission				Cambridge ring

&84 132 Ring polling					Cambridge ring

&89 137 Read teletext pixel				Dump Out 3
	The control block is incorrectly defined for the Osword protocol,
	and may work incorrectly if called from a coprocessor.
	On entry, XY+0/1=X coord 0-1279, XY+2/3=Y coord 0-1024, XY+11=&FF
	on first call to check for double height. On exit, XY+4=Pixel
	colour or &80 if off-screen, XY+5=Y position with character cell,
	XY+6=foregound colour, XY+7=background colour, XY+8=character
	column containing pixel, XY+9=character row containing pixel,
	XY+10=character containing the pixel, XY+11..13=double height
	table, XY+12=attribute: b1=held separated, b2=separated, b3=hold,
	b4=conceal, b5=double height, b6=graphic, b7=flash, XY+15=current
	hold character.

&8A 138 Set teletext pixel				Dump Out 3
	The control block is incorrectly defined for the Osword protocol,
	and may work incorrectly if called from a coprocessor.
	On entry, XY+0/1=X coord 0-1279, XY+2/3=Y coord 0-1024, XY+6=plot
	number:  69=plot foreground, 70=invert, 71=plot background, b7=1 to
	force overwriting of text. On exit, XY+4=X position within cell,
	XY+5=Y position within cell, XY+8=text column containing cell,
	XY+9=text row containing cell, XY+10=character containing the pixel.

&90 144 "Service interface - Network"

&A0 160 "Isolated word recogniser"

&BE 190 Disassemble data				DISS
	This call disassembles the supplied data to create a single line of
	disassembly. On entry, XY+0=&10 (the send block length), XY+1=&20
	(the receive block length), XY+2=cpu number, XY+3=mask flag
	(usually zero), XY+4..7=address the disassembly comes from, XY+8..
	contains the data to be disassembled (usually four bytes). On exit,
	XY+2=number of bytes disassembled, XY+3=result byte and XY+4
	onwards contains a CR-terminated string with the disassembly in it.
	The inputted mask flag is inverted and ANDed with the result byte
	before it is retuned. Some cpu codes are: 0=reserved, 2=6502,
	6=80x86, 11=pdp11, 12=65C12, 18=80186, 28=80286, 38=80386, 44=ARM,
	48=80486, 65=65xx series, 80=Z80, 88=8080. Also oggin, pdp11.  The
	returned flag contains: b7=unrecognised code, b6=absolute branch,
	jump, return, etc., suitable place for a extra blank line in
	disassembly, b5 to b0 hold cpu-specific infomation. If on entry,
	XY+0=4, ie only the cpu number and flag are sent, the the call
	returns the CPU name in a CR-terminated string at XY+4 onwards.

&C8 200 Pass SWI Operation to Host			JGH
	This call passes a SWI to the host to be executed.  Values passed
	can be translated to and from absolute ARM address by setting bits
	in the translate bytes.  On entry, XY+0=regs*4+8 (the send block
	length), XY+1=regs*4+8 (the receive block length), XY+2=bitmap of
	outgoing register values to translate to ARM absolute addresses
	b0=1 - r0, b1=1 - r1, etc., XY+3=bitmap of incoming register values
	to translate back to local processor addresses as with XY+2,
	XY+4..7=SWI number, XY+8..11=r0 value, XY+12..15=r1 value, and
	onwards up to the number specified by XY+0 and XY+1.  On return
	XY+8 onwards contain the returned register contents.  XY+4..7
	contains the PC/PSR, NZCVIF,PC,S1S0.  Currently, only the flags in
	the bottom four bits of XY+4 are defined to be returned.  If V set,
	an error number is returned in XY+4..7 (ie, r0) and the error
	string in XY+8 onwards, CR terminated.

&FA 250 Data transfer over Tube 			80x86 Tube OS
	On entry, XY+0=parameters to send, &0D or &0E, XY+1=parameters to
	receive, &10, XY+2..5=I/O processor address, XY+6.7=80x86 offset
	address, XY+8..9=80x86 segment address, XY+10..11=data length,
	XY+12=function, XY+13=memory access control if XY+0=&0E. The
	functions are the same as the Tube values:
	0 - write to I/O as single bytes
	1 - read from I/O as single bytes
	2 - write to I/O as byte pairs
	3 - read from I/O as byte pairs
	6 - write to I/O as groups of 256 bytes
	7 - read from I/O as groups of 256 bytes
	If the memory access control byte is used, its format is: b0-b3=rom
	number, b4=0 use specified rom, b4=1 use current rom, b5=0 use main
	memory, b5=1 use screen memory, b6=1 ignore b5 and use shadow
	memory, b7 unused.

&FB 251 WD1770/2 Floppy Disk Control			80x86 DOS
	The control block is ignored, so for speed, set XY+0=0 and XY+1=0.
	Commands are sent from the 80x86 via Tube register 2. These are:
	0 - Finish
	1 - Master FDC command; register 2 sends 4-byte address low to
	    high, R/W command, Write flag, Interrupt mask, number of
	    sectors, FDC command.
	2 - BBC B/B+ command; as for command 1.
	3 - Claim Tube and NMI.
	4 - Release Tube and NMI.
	5..&FF - Write byte sent though register2 to &FExx.

&FC 252 DOS CRTC Control				80x86 DOS
	The control block is ignored, so for speed, set XY+0=0 and XY+1=0.
	Commands are sent from the 80x86 via Tube register 2:
	b7=0 - program CRTC, command specifies register, next byte sent
	    through register 2 is the CRTC data.
	&FC - write to mouse port (does nothing)
	&FD - intercept events
	&FE - initialise mouse driver
	&FF - finish. All other commands finish the transaction.

&FD 253 -

&FE 254 DOS Text output (unimplemented) 		80x86 DOS
	Just returns

&FE 254 Z80 SP Disc Read				Z80 CP/M

&FF 255 DOS fast screen control 			80x86 DOS
	The control block is ignored, so for speed, set XY+0=0 and XY+1=0.
	Commands are sent from the 80x86 via Tube register 2, first, the
	address is sent, high byte then low byte. This address is updated
	for the data sent and wraps round from &7FFF to &4000. If the high
	byte is &00, no low byte is sent, and the routine finishes.  Then
	the command loop is entered. The command is sent through register
	2:
	&FF - single byte read through register 1 fills the following eight
	    bytes of screen memory.
	&00 - eight bytes read though register 1 fill following eight bytes
	    of screen memory.
	Other - loop back to wait for address or termination.

&FF 255 Z80 Data transfer over Tube			Z80 Tube OS
	On entry, XY+0=send length, &0D, XY+1=receive length, &01,
	XY+2..5=I/O address, XY+6..9=Z80 address, XY+10..11=data length,
	XY+12=command, 0=read from I/O, 1=write to I/O.

------------------------------------------------------------------------------
        
ADFS  = Advanced Disc Filing System, Acorn
AMX   = AMX Super Art ROM, Elliot Software for AMS
DISS  = Disassembly routines, JGH
DFS   = Disc Filing System 0.90/1.20, Acorn
DVR   = 6502 Development ROM, AJCD
HADFS = Harston Advance Disk Filing System, JGH
HDFS  = Hierarchical DFS, AJCD
MOS   = Machine Operating System 1.20, Acorn
NFS   = Network Filing System 3.34, Acorn
TQCOM = Tequilacomm, D.A.Sainty