CP/M 3 System Control Block

Jim Lopushinsky, June 24, 1986

HTMLized by John Elliott, 3 November 1995 / 18 May 1998

[John's comments in square brackets. The subtitles come from the source of the BDOS, resbdos.asm]

Here is a complete description of the fields in the CP/M 3.1 System Control Block, as far as I can determine. The undocumented fields were discovered while dissasembling the CCP, Resident BDOS, and Banked BDOS. Digital Research documents the SCB as 100 decimal bytes, but in fact it is 152 or 98 hex bytes long. The SCB occupies the last 152 bytes of the resident portion of the BDOS (just before the BIOS). It begins at xx68h, where xx is the last page in the BDOS; therefore, offset 62h-63h (top of TPA address) is at xxFEh, just before JMP BOOT bios entry. The address of the SCB can also be determined as follows:

	LXI	D,SCBPB
	MVI	C,49
	CALL	BDOS	;page address of SCB in reg H
...
SCBPB:	DB	3AH	;this is where SCB address is
	DB	0	;get operation

To access a field in the SCB, use the above code sequence, then load register L with the field offset as determined from the table below. HL then contains the address of the field.

To accomodate RSXs that modify the BIOS character I/O jump vectors (GET and PUT RSXs), a second jump vector for WBOOT, CONST, CONIN, CONOUT, and LIST are included in the SCB. Only the banked BDOS uses these vectors. Each entry consists of 2 3-byte entries which are normally jumps. An RSX can change the first JMP to an LXI H,addr, where addr is the redirected address of the particular routine in bank 1. The second JMP always points to a Resident BDOS bank switch routine which switches to bank 1, calls the routine as loaded in HL, and on return, switches back to bank 0 and returns to the banked BDOS. The banked BDOS always calls these 5 BIOS routines via the SCB jump table. This feature can be used by BYE RSXs for safely redirecting console I/O in RCP/M systems.

[This feature is obsolete in ZPM3 and the bytes are used for other things]

[BIOS intercept vector]

OFFSET TYPE    Description

68H    inst.   Warm   boot  jump  vector  for  the  banked  BDOS.  
               Normally a jump to the BIOS WBOOT vector,  but can 
               be  changed to LXI H,wboot-addr to  redirect  Warm 
               boots to a routine in bank 1.

6BH    inst.   Jump  instruction  to  resident BDOS  bank  switch 
               routine for redirected WBOOT.

6EH    inst.   Console  status jump vector for the  banked  BDOS.  
               Normally a jump to the BIOS CONST vector,  but can 
               be changed to LXI H,const-addr to redirect console 
               status to a routine in bank 1.

71H    inst.   Jump  instruction  to  resident BDOS  bank  switch 
               routine for redirected CONST.

74H    inst.   Console  input  jump vector for the  banked  BDOS.  
               Normally a jump to the BIOS CONIN vector,  but can 
               be changed to LXI H,conin-addr to redirect console 
               input to a routine in bank 1.

77H    inst.   Jump  instruction  to resident  BDOS  bank  switch 
               routine for redirected CONIN.

7AH    inst.   Console  output  jump vector for the banked  BDOS.  
               Normally a jump to the BIOS CONOUT vector, but can 
               be  changed  to  LXI  H,conout-addr  to   redirect 
               console output to a routine in bank 1.

7DH    inst.   Jump  instruction  to  resident BDOS  bank  switch 
               routine for redirected CONOUT.

80H    inst.   List  output  jump  vector for  the  banked  BDOS.  
               Normally a jump to the BIOS LIST vector,  but  can 
               be  changed  to LXI H,list-addr to  redirect  list 
               output to a routine in bank 1.

[82H   ZPM3    User number to load file, used by ZCCP loader]

83H    inst.   Jump  instruction  to  resident BDOS  bank  switch 
               routine for redirected LIST.

[83H   ZPM3    Address of the Z-System environment, 0 if running
               vanilla CP/M]
[85H   ZPM3    ZPM3 flags, see ZPM3 documentation]

86H-8FH        Unknown. [BDOS does not seem to use these bytes]

90H    word    Bit mapped vector of drives with open files.

92H    word    Bit mapped vector of drives accessed.

94H-97H        Unknown. [The BDOS source calls these bytes "patch$flgs"
                         but never accesses them. They contain the BDOS
                         patchlevel, in the same format as a COM header.]

98H    word    BDOS entry point address.

9AH-A0H        Used by directory hashing routines.  Use Unknown.
[9AH   word    Reserved for use by non-banked BDOS]

[System Control Block]

[Expansion area - 6 bytes]

[9CH   byte    Hash length 0, 2, or 3 ]
[9DH   2 words hash entry ]

A1H    byte    CP/M version.  Contains 31H.

[Utilities Section - 8 bytes]

A2H-A5H        4 bytes for user use.   CCP+ as written by me uses 
               offsets A4H and A5H as follows:

A4H    byte    Bit mapped:
               0-4  Submit user number+1.  0 = use current user.
               5    reserved.
               6    $$$.SUB needs to be erased by the CCP.
               7    Directory name display flag.  1 = on.

A5H    byte    Bit mapped:
               0-4 Load function user number+1. 0= current user.
               5    reserved.
               6    PRL file load
               7    Library member load.

A6H-AAH        Unknown.
[A6H   word    The BDOS source calls this word "dspl$flgs" but never 
               accesses it.]
[A8H   byte    [JCE 10 November 1998: Bits 0 and 1 of this byte have been 
               used by me in the Year 2000-compliant version of CP/M, to hold 
               the date output format: 
                 0 => US
                 1 => UK
                 2 => Year-Month-Day
                 3 => Reserved 
               The rest of this byte and the next would be available for other 
               utility program settings.]

[A9H   byte    Unused.]

[CLP Section - 4 bytes]

[AAH   byte    The CCP source calls this "CLP flags" but does not access it.]
ABH    byte    Submit file drive.

ACH    word    Program return code.

[CCP Section - 8 bytes]

AEH    byte    Base  page of RSX containing the 2nd  of  multiple 
               commands (next to be executed).

AFH    byte    CCP drive.

B0H    byte    CCP user number.

B1H    word    If non-zero, address of 2nd of multiple commands.

B3H    byte    Bit mapped CCP flags:
               0    Submit flag
               1    RSX flag

[ These next four bits are defined in CCP source, but not used:

               2    "parse user numbers in commands"
               3    "echo commands in batch mode"
               4    "execute ccp.ovl for menu systems"
               5    "command line redirection active"
]
               6    Set CCP drive/user to current drive/user.
               7     Chain  flag.   Next  command is  taken  from 
               default DMA buffer (80H).

B4H    byte    Bit mapped CCP flags:
               0-1  Display command source drive/user.
               2    Unknown
[CCP source says:
               0    Display drive and user
               1    Display filename
               2    Display date & time of load (not done in CP/M 3 CCP)

]
               3-4  File type search order:
                    00   .COM only
                    01   .COM, then .SUB
                    10   .SUB, then .COM
                    11   .PRL, then .COM [CCP source says "reserved"]
               5    Reset disk system
               6    Reset page mode to default
               7    CCP is executing (used by ^W recall)

B5H    byte    Bit mapped CCP flags:
               0    Unknown 
                    [CCP source calls this "load RSX, don't fix chain" 
                     but does not use it]
               1    Cold start flag (0=cold)
               2-7  Unknown

Device I/O Section - 32 bytes

B6H    byte    Console width [eg 79 for 80-column screen]

B7H    byte    Current console column position

B8H    byte    Console page length [eg 23 for 24-line screen]

B9H            Unknown
[B9H   byte    BDOS and CCP source reserve this for the current console line 
               position, but never access it]

BAH    word    If non-zero,  address of redirected console  input 
               characters.

BCH    word    If  non-zero,  address of next line of  redirected 
               console input characters.

BEH    word    Bit mapped console input physical devices.

C0H    word    Bit mapped console output physical devices.

C2H    word    Bit mapped auxiliary input physical devices.

C4H    word    Bit mapped auxiliary output physical devices.

C6H    word    Bit mapped list output physical devices.

C8H    byte    Console page mode (0 = page pause).

C9H    byte    Default page mode.

CAH    byte    Ctrl-H mode (backspace). [0 => backspace, else echo
               deleted character]

CBH    byte    Rub/Del mode. [0 => Echo deleted character, else 
               backspace]

CCH-CEH        Used by console routines. 
[CCH  byte     BDOS calls this byte "type$ahead". 
                 When this byte is 0FFh, the BDOS does not check for Control-S
               during the Console status call. ] 
                    
[CDH  word     BDOS calls this word "contran" and according to the CCP source
                    it is the address of a console translation subroutine.
                    Current BDOSses do not seem to use this word.]

CFH    word    Console mode.

D1H    word    Address of 128 byte buffer in common memory.  This 
               buffer  is used only during BDOS function calls by 
               the system,  so it can be used freely between BDOS 
               calls as a scratch buffer.   Also used by the BIOS 
               during warm boot.

D3H    byte    Output delimiter. [normally '$']

D4H    byte    List echo flag (non-zero = echo console output).

D5H    byte    Scroll flag (used by console routines).
               [CCP source calls this "Queue flag for type ahead". 
                The BDOS seems to use this as an extra parameter for the 
                BIOS, and uses two bits:

               6 - set if the next call to CONST
                   or CONIN is to check for 
                   Control-S or Control-Q.
               7 - set if the next call to CONST 
                  is to check for Control-C.

                Comments in the BDOS source refer to these bits being used
                by a "Queue manager". 
		]

[BDOS Section - 42 bytes]

D6H    word    Address of System Control Block.

D8H    word    Current DMA address.

DAH    byte    Current drive.

DBH    word    Current FCB address (in common memory).

DDH    byte    FCB error flag.

DEH    byte    Same drive flag.

DFH    byte    Current BDOS function number.

E0H    byte    Current user number.

E1H    word    Last directory slot number accessed (first = 0)

E3H    word    Address of FCB for function 18 (search next).

E5H    byte    Function 17,  18 search type (0 = ? in drive code, 
               0FH = normal search).

E6H    byte    Multi-sector count.

E7H    byte    BDOS error mode.

E8H    4 bytes Drive search chain. [0=Current, 1-16 = drive A-P,
               255=end of chain]

ECH    byte    Temporary file drive. [0=Current, 1-16 = drive A-P]

EDH    byte    Error drive.
	       [CCP source erroneously describes this area as "Patch flags"
                - see offset 94h]

EEH-EFH        Unknown.

F0H    byte    Drive door open flag [Set by the BIOS if a disc 
               may have been changed since the last access]

F1-F2H         Unknown.

F3H    byte    Bit mapped BDOS flags:
               0-5  Unknown.
               6    Single allocation vectors.
               7    Expanded error messages.

F4H    word    Date (days since Jan 0, 1978).

F6H    byte    Hour (BCD).

F7H    byte    Minute (BCD).

F8H    byte    Second (BCD).

F9H    word    Common memory base address (non-banked = 0).

FBH    inst.   Error message jump instruction to a routine in the 
               banked BDOS.

FEH    word    Current  top  of TPA (points to  entry  in  lowest 
               RSX).
Return to the archive listing