During cold-boot (power-on start-up), after the POST and installation of
default interrupt handlers, BIOS makes a check for external ROMs found on
feature cards (boards installed in a PC slot). This testing is informally
Note: ROM-scan was NOT implemented in the earliest BIOS and the very
oldest PCs (those with a maximum of 64K on the motherboard) will
not have this feature unless a later version of the ROM-BIOS has
External ROM modules may exist between addresses c000:0 and e000:0. Each
2K block in this range is checked for a signature and is in this format:
Offset Size Contents
ßßßßßß ßßßß ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
+0 2 wSignature must be aa55H (55H followed by aaH; i.e. Uª)
+2 1 bLenPgs length of the ROM module in 512-byte pages
+3 ? abCode variable-length code and data of the ROM. It
usually begins with a JMP to get the
initialization portion of the code.
When BIOS finds a ROM signature, it performs a checksum on the defined
module. Each byte is summed modulo 100H and the sum must be exactly 0.
When a module is verified to be valid, BIOS performs a FAR CALL to offset
0003H of its segment and the ROM must eventually return to the BIOS via a
Typically, the ROM module will perform any hardware initialization tasks
necessary and insert its own addresses into one or more interrupt vectors.
The ROM sockets U17 and U37 on the AT motherboard are addressed starting
at e000:0000. A scan occurs in 64K blocks for a valid module. If
present, a module will have the aa55H signature, an unused length byte,
executable code starting at xxxx:0003 and a checksum of 0 modulo 100H at
A MRCI hardware-assist adaptor could install data-compression support
via ROM-Scan, and thus be available immediately on power up. See
INT 1aH b001H (query hardware-based MRCI support).
See Also: POST
BIOS Data Area
System Startup Sequence