According to Peter Norton, the BIOS code in a PC scans memory starting at
C000 and looking at every 2K block for the signature 0x55AA. (I am
paraphrasing.) This marks a ROM extension, probably in a software cartridge
or on a controller. What follows is supposedly a 1 byte length and a 3 byte
jump instruction. The BIOS initialization will then branch to this code and
execute it. The code can do anything, even take control of the system as is
done with some software cartridges. This ROM block can be at any even 2K
A couple of additions to what you've said :
The extension ROM routine is called after much of the rest of the system
ahs been initialised and after the software interrupt vectors have been
set up. It is common for the extension ROM initialisation routine to
point some of said vectors to itself, and maybe save the old contents
somewhere so the original routine ROM routine could be called if the
requested operation is not handled by the extension ROM. For example you
could intercept the disk read/write INT vector, use routines in the
extension ROM to handle, say, 8" drives on a special controller, and go
back to the routines in the normal BIOS for drives 0 and 1.
Other than this initialisation entry point (and the header/checksum), the
BIOS places no requirements on the format of an extension ROM and never
itself tries to call anything other than the initialisation routine.
-tony