怎样用bios的服务程序

请教:
   我想用dmibios的51h功能函数,其原形如下:
short FAR (*entryPoint)(
short Function, /* PnP BIOS Function 51h */
unsigned short FAR *Structure, /* Structure number/handle to retrieve*/
unsigned char FAR *dmiStrucBuffer, /* Pointer to buffer to copy structure data to */
unsigned short dmiSelector, /* SMBIOS data read/write selector */
unsigned short BiosSelector ); /* PnP BIOS readable/writable selector */.
   *entryPoint的值是我们自己要找出来的,请那位大侠能举个例子,谢谢.

看看你要用的是哪一个51H。
--------H-51---------------------------------
INT 51 - IRQ1 relocated by DESQview
Range: INT 51 to INT F9, selected automatically
Note: this is the default location for older versions; see INT 50\"DESQview\"
 for details of interrupt relocation
SeeAlso: INT 50\"DESQview\",INT 54\"DESQview\",INT 58\"DESQview\"
--------H-51---------------------------------
INT 51 - IRQ1 relocated by IBM 3278 emulation control program
SeeAlso: INT 50\"IBM 3278\",INT 54\"IBM 3278\"
--------H-51---------------------------------
INT 51 - IRQ1 relocated by OS/2 v1.x
SeeAlso: INT 50\"OS/2\",INT 54\"OS/2\"
----------51---------------------------------
INT 51 - TI Professional PC - RESTART TIMING EVENT
AX = timer count in 25ms intervals
DS:DI -> timing-event table (see #03244)
Note: documented as \"for system use only\"; intended for multi-tasking
 software
SeeAlso: INT 50\"TI Professional\",INT 52\"TI Professional\"

Format of TI Professional PC timing event table:
Offset Size Description (Table 03244)
 00h WORD offset of next event table entry
 02h BYTE normally unused (FFh)
 03h BYTE flags:
bit 7 set if timing event active
bits 6-0 not used by BIOS (0), but could be used by option ROMs
 04h WORD timeout count (decremented every 25ms when active)
 06h WORD offset of event handler (in segment F400h) to call on event
 timeout; the F400h segment allows addressing both system ROMs
 and the first 16K of memory (due to the 1M memory wraparound)
--------b-51---------------------------------
INT 51 - Tandy 2000 - KEYBOARD SERVICES
Note: this interrupt is identical to INT 16 on Tandy 2000
SeeAlso: INT 16/AH=00h,INT 16/AH=01h,INT 16/AH=02h,INT 16/AH=04h\"Tandy\"
SeeAlso: INT 16/AH=04h,INT 4A\"Tandy 2000\",INT 4C\"Tandy 2000\",INT 52\"Tandy 2000\"

我要的与中断没有关系，只不过是bios 的服务程序的51h功能。
如果此程序的地址是f000:b093,需要参数如定义。

嗯

//turboc2

WORD BiosSelector;
int far (*entryPoint)(WORD fn, ...);


int pnp_detect(void)
{
UCHAR far *adr, csum;
WORD offset, len,;



for(offset = 0; offset < 0xFFF0; offset += 16)
{
adr = (UCHAR far *)MK_FP(0xF000, offset);

if(adr[0] != \'$\' || adr[1] != \'P\' ||
adr[2] != \'n\' || adr[3] != \'P\')
continue;

len = adr[5];
if(len == 0)
continue;

csum = 0;
for(i = 0; i < len; i++)
csum += adr;
if(csum)
continue;

goto FOUND;
}
printf(\"not found\\n\");
return -1;
FOUND:

i = adr[4];
printf(\"version %u.%u, \", i >> 4, i & 0x0F);

entryPoint = MK_FP(
*(WORD far *)(adr + 15),
*(WORD far *)(adr + 13));

BiosSelector = *(WORD far *)(adr + 27);

return 0;
}

我是这样写的：）
//function 51//
for(n=0;n<*NumStructures;n++)
{


Function=0x51;
handle=&structure;
dmiStrucBuffer=&StrucBuffer[0];
asm{
push BiosSelector
push dmiSelector
push ds
push dmiStrucBuffer
push ds
push handle
push Function

push cs

call fcall
//add sp, 24
mov buffer,ax
jmp next

fcall Proc
mov ax,0f000h
push ax
mov ax,EntryPoint
push ax
retf
fcall endp
// DB 09ah
// DW 0b918h
// DW 0F000h

}

背景：现在已知在某系统内存处会存储以下信息，其signature为 $PnP,从以下可得到对应函数的16 bit的 real /protected mode seg & offset的值。现在我已经能够在内存中找到$PnP,和函数地址的seg & offset值。
 
问题：
1）现在我想在WDM 驱动中调用该函数，也就是说我如何将16 bit的seg & offset 值转化为wdm 中32位的函数地址
2）大家还有什么好的方法，在WDM中索内存空间指定的内容？我是通过驱动将指定的物理地址映射到用户内存空间，让后再此空间查找
 
实现写 DMI 操作的 C 代码我已经实现，
 
Field         Offset                Length               Value
 
Signature    00h                     4 BYTES            $PnP (ASCII)
 
Version      04h                     BYTE                 10h
 
Length       05h                     BYTE                 21h
 
Controlfield 06h                     WORD                 Varies
 
Checksum     08h                     BYTE                 Varies
 
Eventaddress 09h                     DWORD                Varies
 
Real Mode 16-bit offset to entry point  0Dh                    WORD             Varies
 
Real Mode 16-bit code segment address   0Fh                    WORD             Varies
 
16BitProtectedModeoffset to entry point  11h                    WORD             Varies
 
16BitProtectedModecode segment base address 13h                 DWORD            Varies