Syscalls

When the Spectranet ROM is paged into the Z80 address space, it exposes a fixed jump table: one three-byte entry every $03 bytes from $3E00 through $3EF0. Each address is the start of a small routine in ROM (socket helpers, paging, filesystem calls, and on Spectranext the SPECTRANEXT multiplexer).

Conceptually these are syscalls: your program does not know the physical address of the implementation inside the banked ROM; you call a well-known vector and the ROM does the work, then returns (often via PAGEOUT at $007C) so execution continues in your own code or in the Spectrum ROM.

---

Jump table region ($3E00 … $3EF0)

• Granularity: entries are spaced by $03 bytes (typical jp or jp (hl) / jp (ix) target layout in the table).
• Naming: assembly sources define symbolic names in spectranet.inc (and copies such as the index module include). Use those names instead of hard-coded addresses when possible.
• Paging: on original Spectranet you usually PAGEIN before calling a jump-table address (memory). On Spectranext, a fetch to the trampoline region around $3FF8–$3FFF (for example call IXCALL / call HLCALL) is trapped: the cartridge pages itself in for that access, so you do not need an explicit PAGEIN first. The HLCALL / IXCALL trampolines still arrange a safe return through PAGEOUT.

This article focuses on how you invoke one of these vectors and documents SPECTRANEXT in detail. For the command/status RAM at $3400–$3401, see I/O Ports.

---

Reaching a vector: HLCALL, IXCALL, and PAGEIN

From spectranet.inc (hardware and trampolines):

Address	Symbol	Role
$3FF9	PAGEIN	Page Spectranet ROM into the decode range so jump-table calls are valid.
$3FFA	HLCALL	Call target whose address is in HL (dispatcher pushes PAGEOUT, then jp (hl)).
$3FFD	IXCALL	Call target whose address is in IX (dispatcher pushes PAGEOUT, then jp (ix)).
$007C	PAGEOUT	Return path: M1 at this address unpages Spectranet; the byte fetched is ret, so the stack unwinds back to your caller.

Typical assembly pattern for any IX-based entry (including SPECTRANEXT):

ld   ix, SPECTRANEXT    ; 0x3EF0 — or another equ from spectranet.inc
call IXCALL             ; 0x3FFD — enters ROM, returns via PAGEOUT

On Spectranext, you can use this pattern without having called PAGEIN first: the hardware/firmware recognises the instruction fetch to call IXCALL ($3FFD) in the $3FF8–$3FFF window and pages in the Spectranet ROM so the J_ixdispatch stub and your (IX) target run correctly. That is only for this trampoline address range — calling a raw jump-table address such as $3EF0 with Spectranet still unpaged still requires the ROM to be mapped or another supported entry path.

After the ROM routine returns, you still do not need a manual PAGEOUT: the dispatcher has pushed PAGEOUT ($007C) as the return address, so SPECTRANEXT unwinds through PAGEOUT and Spectranet is unpaged automatically before your code resumes.

For routines that expect the target address in HL, use call HLCALL instead.

From C, the linked Spectranet libraries wrap these details; you include headers and call documented functions rather than raw addresses.

---

SPECTRANEXT ($3EF0)

SPECTRANEXT is the Spectranext operation multiplexer in ROM. It is not a separate syscall per Wi‑Fi/DNS feature; it is one jump-table slot whose behaviour is selected by register A on entry.

• Entry address: SPECTRANEXT equ $3EF0 (see spectranet.inc).
• Invocation: load A with the operation ID, set up inputs in the registers documented below, then ld ix, SPECTRANEXT / call IXCALL. On Spectranet, call IXCALL does not require a prior PAGEIN (see above).

Operations (IDs, inputs, outputs)

ID	Operation	Inputs (before call)	Outputs (on success, carry = 0)
0	Get controller status	DE = pointer to 4-byte IPv4 buffer (host order), filled by ROM	B = controller status · C = Wi‑Fi connection state · IPv4 at (DE..DE+3)
1	Scan Wi‑Fi access points	—	A = number of networks found
2	Get name of scanned AP	C = AP index (0-based) · DE = buffer for NUL-terminated name (staging copy, up to 64 bytes)	Name written at DE
3	Connect to Wi‑Fi	HL = SSID string · DE = password string	—
4	Disconnect Wi‑Fi	—	—
5	DNS: hostname → IPv4	HL = hostname string · DE = 4-byte IPv4 result buffer	IPv4 at (DE..DE+3)

Constants and C prototypes are in spectranext.h (same IDs and semantics). For a concise port-level summary, I/O Ports lists the same operations in table form.

---

Full jump table reference ($3E00 … $3EF0)

The following table lists symbol → address as in spectranet-firmware/include/spectranet.inc. It is a reference, not a full manual for each routine.

Address	Symbol
$3E00	SOCKET
$3E03	CLOSE
$3E06	LISTEN
$3E09	ACCEPT
$3E0C	BIND
$3E0F	CONNECT
$3E12	SEND
$3E15	RECV
$3E18	SENDTO
$3E1B	RECVFROM
$3E1E	POLL
$3E21	POLLALL
$3E24	POLLFD
$3E27	GETHOSTBYNAME
$3E2A	PUTCHAR42
$3E2D	PRINT42
$3E30	CLEAR42
$3E33	SETPAGEA
$3E36	SETPAGEB
$3E39	LONG2IPSTRING
$3E3C	IPSTRING2LONG
$3E3F	ITOA8
$3E42	RAND16
$3E45	REMOTEADDRESS
$3E48	IFCONFIG_INET
$3E4B	IFCONFIG_NETMASK
$3E4E	IFCONFIG_GW
$3E51	INITHW
$3E54	GETHWADDR
$3E57	DECONFIG
$3E5A	MAC2STRING
$3E5D	STRING2MAC
$3E60	ITOH8
$3E63	HTOI8
$3E66	GETKEY
$3E69	KEYUP
$3E6C	INPUTSTRING
$3E6F	GET_IFCONFIG_INET
$3E72	GET_IFCONFIG_NETMASK
$3E75	GET_IFCONFIG_GW
$3E78	SETTRAP
$3E7B	DISABLETRAP
$3E7E	ENABLETRAP
$3E81	PUSHPAGEA
$3E84	POPPAGEA
$3E87	PUSHPAGEB
$3E8A	POPPAGEB
$3E8D	PAGETRAPRETURN
$3E90	TRAPRETURN
$3E93	ADDBASICEXT
$3E96	STATEMENT_END
$3E99	EXIT_SUCCESS
$3E9C	PARSE_ERROR
$3E9F	RESERVEPAGE
$3EA2	FREEPAGE
$3EA5	REPORTERR
$3EA8	MOUNT
$3EAB	UMOUNT
$3EAE	OPENDIR
$3EB1	OPEN
$3EB4	UNLINK
$3EB7	MKDIR
$3EBA	RMDIR
$3EBD	SIZE
$3EC0	FREE
$3EC3	STAT
$3EC6	CHMOD
$3EC9	READ
$3ECC	WRITE
$3ECF	LSEEK
$3ED2	VCLOSE
$3ED5	VPOLL
$3ED8	READDIR
$3EDB	CLOSEDIR
$3EDE	CHDIR
$3EE1	GETCWD
$3EE4	RENAME
$3EE7	SETMOUNTPOINT
$3EEA	FREEMOUNTPOINT
$3EED	RESALLOC
$3EF0	SPECTRANEXT

---

See also

• I/O Ports — $3400/$3401 handshake and operation IDs in one place
• Memory map — paging and PAGEIN / PAGEOUT
• spectranext.h (SDK) — C API for SPECTRANEXT operations