IBM's patents refer to a "Displaywriter System Manual" which should have everything we need :)
Firmware accesses these port ranges. I've identified some of them:
AM_RANGE(0x0000, 0x0007) AM_DEVREADWRITE8("pic8259", pic8259_device, read, write, 0x00ff)
AM_RANGE(0x0008, 0x000f)...