2 COMBOOT and COM32 files
5 Syslinux supports simple standalone programs, using a file format
6 similar to DOS ".com" files. A 32-bit version, called COM32, is also
7 provided. A simple API provides access to a limited set of filesystem
11 ++++ COMBOOT file format ++++
13 A COMBOOT file is a raw binary file containing 16-bit code. It should
14 be linked to run at offset 0x100, and contain no absolute segment
15 references. It is run in 16-bit real mode.
17 A COMBOOT image can be written to be compatible with MS-DOS. Such a
18 file will usually have extension ".com". A COMBOOT file which is not
19 compatible with MS-DOS will usually have extension ".cbt".
21 Before running the program, Syslinux sets up the following fields in
22 the Program Segment Prefix (PSP), a structure at offset 0 in the
26 0 word Contains an INT 20h instruction
27 2 word Contains the paragraph (16-byte "segment" address) at
28 the end of memory available to the program.
29 128 byte Length of the command line arguments, including the leading
30 space but not including the final CR character.
31 129 127b Command line arguments, starting with a space and ending
32 with a CR character (ASCII 13).
34 The program is allowed to use memory between the PSP paragraph (which
35 all the CS, DS, ES and SS registers point to at program start) and the
36 paragraph value given at offset 2.
38 On startup, SP is set up to point to the end of the 64K segment, at
39 0xfffe. Under DOS it is possible for SP to contain a smaller
40 value if memory is very tight; this is never the case under Syslinux.
42 The program should make no assumptions about what segment address it
43 will be loaded at; instead it should look at the segment registers on
44 program startup. Both DOS and Syslinux will guarantee CS == DS == ES
45 == SS on program start; the program should not assume anything about
46 the values of FS or GS.
48 To exit, a program can either execute a near RET (which will jump to
49 offset 0 which contains an INT 20h instruction, terminating the
50 program), or execute INT 20h or INT 21h AH=00h or INT 21h AH=4Ch.
51 If compatiblity with Syslinux 1.xx is desired, use INT 20h.
54 ++++ COM32R file format ++++
56 A COM32R file is a raw binary file containing 32-bit code. It should
57 be self-relocating, as it will be loaded by the Syslinux core at any
58 4K aligned address. It will be run in flat-memory 32-bit protected
59 mode. Under Syslinux, it will be run in CPL 0, however, since it may
60 be possible to create a COM32 execution engine that would run under
61 something like Linux DOSEMU, it is recommended that the code does not
62 assume CPL 0 unless absolutely necessary.
64 A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
65 eax,21cd4cfeh) as a magic number.
67 The COM32R format replaces the earlier COM32 format, which was linked
68 to a fixed address (0x101000).
70 A COM32R file should have extension ".c32".
72 On startup, CS will be set up as a flat 32-bit code segment, and DS ==
73 ES == SS will be set up as the equivalent flat 32-bit data segment.
74 FS and GS are reserved for future use and are currently initialized to
75 zero. A COM32R image should not assume any particular values of
78 ESP is set up at the end of available memory and also serves as
79 notification to the program how much memory is available.
81 The following arguments are passed to the program on the stack:
84 [ESP] dword Return (termination) address
85 [ESP+4] dword Number of additional arguments (currently 7)
86 [ESP+8] dword Pointer to the command line arguments (null-terminated string)
87 [ESP+12] dword Pointer to INT call helper function
88 [ESP+16] dword Pointer to low memory bounce buffer
89 [ESP+20] dword Size of low memory bounce buffer
90 [ESP+24] dword Pointer to FAR call helper function (new in 2.05)
91 [ESP+28] dword Pointer to CDECL helper function (new in 3.54)
92 [ESP+32] dword Amount of memory controlled by the Syslinux core (new in 3.74)
93 [ESP+36] dword Pointer to protected-mode functions (new in 4.00)
95 The libcom32 startup code loads this into a structure named __com32,
98 extern struct com32_sys_args {
101 void __cdecl(*cs_intcall)(uint8_t, const com32sys_t *, com32sys_t *);
103 uint32_t cs_bounce_size;
104 void __cdecl(*cs_farcall)(uint32_t, const com32sys_t *, com32sys_t *);
105 int __cdecl(*cs_cfarcall)(uint32_t, const void *, uint32_t);
107 struct com32_pmapi *cs_pm;
110 The intcall helper function can be used to issue BIOS or Syslinux API
111 calls, and takes the interrupt number as first argument. The second
112 argument is a pointer to the input register definition, an instance of
113 the following structure (available in <com32.h>):
122 uint16_t gs; /* Offset 0 */
123 uint16_t fs; /* Offset 2 */
124 uint16_t es; /* Offset 4 */
125 uint16_t ds; /* Offset 6 */
127 reg32_t edi; /* Offset 8 */
128 reg32_t esi; /* Offset 12 */
129 reg32_t ebp; /* Offset 16 */
130 reg32_t _unused_esp; /* Offset 20 */
131 reg32_t ebx; /* Offset 24 */
132 reg32_t edx; /* Offset 28 */
133 reg32_t ecx; /* Offset 32 */
134 reg32_t eax; /* Offset 36 */
136 reg32_t eflags; /* Offset 40 */
139 The third argument is a pointer to the output register definition, an
140 instance of the same structure. The third argument can also be zero
143 Since BIOS or Syslinux API calls can generally only manipulate data
144 below address 0x100000, a "bounce buffer" in low memory, at least 64K
145 in size, is available, to copy data in and out.
147 The farcall helper function behaves similarly, but takes as its first
148 argument the CS:IP (in the form (CS << 16) + IP) of procedure to be
149 invoked via a FAR CALL.
151 The cfarcall helper function takes (CS << 16)+IP, a pointer to a stack
152 frame, a size of that stack frame, and returns the return value of EAX
153 (which may need to be appropriate truncated by the user.)
155 Starting in version 4.00, some of these API calls are available as
156 protected-mode function calls, using the regparm(3) calling convention
157 (the first three argumetns in EAX, EDX, ECX; the rest on the stack.)
158 Those functions are defined in struct com32_pmapi, defined in
162 ++++ SYSLINUX API CALLS +++
164 Syslinux provides the following API calls. Syslinux 1.xx only
165 supported INT 20h - terminate program. [] indicates the first version
166 of Syslinux which supported this feature (correctly.)
168 NOTE: Most of the API functionality is still experimental. Expect to
172 ++++ DOS-COMPATIBLE API CALLS ++++
174 INT 20h [1.48] Terminate program
175 INT 21h AH=00h [2.00] Terminate program
176 INT 21h AH=4Ch [2.00] Terminate program
178 All of these terminate the program.
181 INT 21h AH=01h [2.01] Get Key with Echo
183 Reads a key from the console input, with echo to the console
184 output. The read character is returned in AL. Extended
185 characters received from the keyboard are returned as NUL (00h)
186 + the extended character code.
189 INT 21h AH=02h [2.01] Write Character
191 Writes a character in DL to the console (video and serial)
195 INT 21h AH=04h [2.01] Write Character to Serial Port
197 Writes a character in DL to the serial console output
198 (if enabled.) If no serial port is configured, this routine
202 INT 21h AH=08h [2.09] Get Key without Echo
204 Reads a key fron the console input, without echoing it to the
205 console output. The read character is returned in AL.
208 INT 21h AH=09h [2.01] Write DOS String to Console
210 Writes a DOS $-terminated string in DS:DX to the console.
213 INT 21h AH=0Bh [2.00] Check Keyboard
215 Returns AL=FFh if there is a keystroke waiting (which can then
216 be read with INT 21h, AH=01h or AH=08h), otherwise AL=00h.
219 INT 21h AH=30h [2.00] Check DOS Version
221 This function returns AX=BX=CX=DX=0, corresponding to a
222 hypothetical "DOS 0.0", but the high parts of EAX-EBX-ECX-EDX
225 EAX=59530000h EBX=4C530000h ECX=4E490000h EDX=58550000h
227 This function can thus be used to distinguish running on
228 Syslinux from running on DOS.
231 ++++ SYSLINUX-SPECIFIC API CALLS ++++
233 Syslinux-specific API calls are executed using INT 22h, with a
234 function number in AX. INT 22h is used by DOS for internal purposes;
235 do not execute INT 22h under DOS.
237 DOS-compatible function INT 21h, AH=30h can be used to detect if the
238 Syslinux API calls are available.
240 Any register not specifically listed as modified is preserved;
241 however, future versions of Syslinux may add additional output
242 registers to existing calls.
244 All calls return CF=0 on success, CF=1 on failure. The noted outputs
245 apply if CF=0 only unless otherwise noted. All calls clobber the
246 arithmetric flags (CF, PF, AF, ZF, SF and OF) but leave all other
247 flags unchanged unless otherwise noted.
250 AX=0001h [2.00] Get Version
253 Output: AX number of INT 22h API functions available
254 CH Syslinux major version number
255 CL Syslinux minor version number
256 DL Syslinux derivative ID (e.g. 32h = PXELINUX)
257 ES:SI Syslinux version string
258 ES:DI Syslinux copyright string
260 This API call returns the Syslinux version and API
264 AX=0002h [2.01] Write String
267 ES:BX null-terminated string
270 Writes a null-terminated string on the console.
273 AX=0003h [2.01] Run command
276 ES:BX null-terminated command string
277 Output: Does not return
279 This API call terminates the program and executes the command
280 string as if the user had entered it at the Syslinux command
281 line. This API call does not return.
284 AX=0004h [2.01] Run default command
287 Output: Does not return
289 This API call terminates the program and executes the default
290 command string as if the user had pressed Enter alone on the
291 Syslinux command line. This API call does not return.
294 AX=0005h [2.00] Force text mode
299 If the screen was in graphics mode (due to displaying a splash
300 screen using the <Ctrl-X> command in a message file, or
301 similar), return to text mode.
304 AX=0006h [2.08] Open file
307 ES:SI null-terminated filename
308 Output: SI file handle
309 EAX length of file in bytes, or -1
312 Open a file for reading. The exact syntax of the filenames
313 allowed depends on the particular Syslinux derivative.
315 The Syslinux file system is block-oriented. The size of a
316 block will always be a power of two and no greater than 16K.
318 Note: Syslinux considers a zero-length file to be nonexistent.
320 In 3.70 or later, EAX can contain -1 indicating that the file
324 AX=0007h [2.08] Read file
329 CX number of blocks to read
330 Output: SI file handle, or 0 if EOF was reached
331 ECX number of bytes read [3.70]
333 Read blocks from a file. Note that the file handle that is
334 returned in SI may not be the same value that was passed in.
336 If end of file was reached (SI=0), the file was automatically
339 In 3.70 or later, ECX returns the number of bytes read. This
340 will always be a multiple of the block size unless EOF is
343 The address of the buffer (ES:BX) should be at least 512-byte
344 aligned. Syslinux guarantees at least this alignment for the
345 COMBOOT load segment or the COM32 bounce buffer.
347 Keep in mind that a "file" may be a TFTP connection, and that
348 leaving a file open for an extended period of time may result
351 WARNING: Calling this function with an invalid file handle
352 will probably crash the system.
356 size_t cs_pm->read_file(uint16_t *handle, void *buf, size_t blocks)
358 handle - file handle (input and output, set to zero on end of file)
359 buf - buffer to write to
360 blocks - number of blocks to read
362 Returns number of bytes read, or 0 on failure.
365 AX=0008h [2.08] Close file
371 Close a file before reaching the end of file.
373 WARNING: Calling this function with an invalid file handle
374 will probably crash the system.
377 AX=0009h [2.00] Call PXE Stack [PXELINUX ONLY]
380 BX PXE function number
381 ES:DI PXE parameter structure buffer
382 Output: AX PXE return status code
384 Invoke an arbitrary PXE stack function. On SYSLINUX/ISOLINUX,
385 this function returns with an error (CF=1) and no action is
386 taken. On PXELINUX, this function always returns with CF=0
387 indicating that the PXE stack was successfully invoked; check
388 the status code in AX and in the first word of the data buffer
389 to determine if the PXE call succeeded or not.
391 The PXE stack will have the UDP stack OPEN; if you change that
392 you cannot call any of the file-related API functions, and
393 must restore UDP OPEN before returning to PXELINUX.
395 PXELINUX reserves UDP port numbers from 49152 to 65535 for its
396 own use; port numbers below that range is available.
399 AX=000Ah [2.00] Get Derivative-Specific Information
403 CL 9 (to get a valid return in CL for all versions)
404 Output: AL 31h (SYSLINUX), 34h (EXTLINUX)
406 CL sector size as a power of 2 (9 = 512 bytes) [3.35]
407 ES:BX pointer to partition table entry (if DL >= 80h)
408 FS:SI pointer to initial ES:DI value [3.53]
410 Note: This function was broken in EXTLINUX 3.00-3.02.
412 On boot, ES:DI is supposed to point to the BIOS $PnP
413 structure, although in practice most operating systems
414 will search for it in memory. However, preserving
415 this while chainloading is probably a good idea.
417 Note that FS:SI is a pointer to a memory location
418 containing the original ES:DI value, not the value
424 Output: AL 32h (PXELINUX)
425 DX PXE API version detected (DH=major, DL=minor)
426 ECX Local IP number (network byte order) [3.85]
427 ES:BX pointer to PXENV+ or !PXE structure
428 FS:SI pointer to original stack with invocation record
430 Note: DX notes the API version detected by PXELINUX,
431 which may be more conservative than the actual version
432 available. For exact information examine the API
433 version entry in the PXENV+ structure, or the API
434 version entries in the ROMID structures pointed from
437 PXELINUX will use, and provide, the !PXE structure
438 over the PXENV+ structure. Examine the structure
439 signature to determine which particular structure was
442 The FS:SI pointer points to the top of the original stack
443 provided by the PXE stack, with the following values
444 pushed at the time PXELINUX is started:
446 [fs:si+0] GS <- top of stack
459 [fs:si+44] PXE return IP <- t.o.s. when PXELINUX invoked
460 [fs:si+46] PXE return CS
465 Output: AL 33h (ISOLINUX)
467 CL 11 (sector size as a power of 2) [3.35]
470 1 = Hybrid (hard disk), CBIOS mode
471 2 = Hybrid (hard disk), EBIOS mode
472 ES:BX pointer to El Torito spec packet
473 FS:SI pointer to initial ES:DI value [3.53]
475 Note: Some very broken El Torito implementations do
476 not provide the spec packet information. If so, ES:BX
477 may point to all zeroes or to garbage. Call INT 13h,
478 AX=4B01h to obtain the spec packet directly from the
481 This call gives information specific to a particular Syslinux
482 derivative. The value returned in AL is the same as is
483 returned in DL by INT 22h AX=0001h.
486 AX=000Bh [2.00] Get Serial Console Configuration
489 Output: DX serial port I/O base (e.g. 3F8h = COM1...)
490 CX baud rate divisor (1 = 115200 bps, 2 = 57600 bps...)
491 BX flow control configuration bits (see syslinux.txt)
492 -> bit 15 is set if the video console is disabled
494 If no serial port is configured, DX will be set to 0 and the
495 other registers are undefined.
498 AX=000Ch [2.00] Perform final cleanup
500 DX derivative-specific flags (0000h = clean up all)
503 This routine performs any "final cleanup" the boot loader
504 would normally perform before loading a kernel, such as
505 unloading the PXE stack in the case of PXELINUX. AFTER
506 INVOKING THIS CALL, NO OTHER API CALLS MAY BE INVOKED, NOR MAY
507 THE PROGRAM TERMINATE AND RETURN TO THE BOOT LOADER. This
508 call basically tells the boot loader "get out of the way, I'll
509 handle it from here."
511 For COM32 images, the boot loader will continue to provide
512 interrupt and BIOS call thunking services as long its memory
513 areas (0x0800-0xffff, 0x100000-0x100fff) are not overwritten.
514 MAKE SURE TO DISABLE INTERRUPTS, AND INSTALL NEW GDT AND IDTS
515 BEFORE OVERWRITING THESE MEMORY AREAS.
517 The permissible values for DX is an OR of these values:
519 SYSLINUX: 0000h Normal cleanup
521 PXELINUX: 0000h Normal cleanup
522 0003h Keep UNDI and PXE stacks loaded
524 ISOLINUX: 0000h Normal cleanup
526 EXTLINUX: 0000h Normal cleanup
528 All other values are undefined, and may have different
529 meanings in future versions of Syslinux.
532 AX=000Dh [2.08] Cleanup and replace bootstrap code
534 DX derivative-specific flags (see previous function)
535 EDI bootstrap code (linear address, can be in high memory)
536 ECX bootstrap code length in bytes (must fit in low mem)
537 EBX(!) initial value of EDX after bootstrap
538 ESI initial value of ESI after bootstrap
539 DS initial value of DS after bootstrap
540 Output: Does not return
542 This routine performs final cleanup, then takes a piece of
543 code, copies it over the primary bootstrap at address 7C00h,
544 and jumps to it. This can be used to chainload boot sectors,
545 MBRs, bootstraps, etc.
547 Normal boot sectors expect DL to contain the drive number,
548 and, for hard drives (DL >= 80h) DS:SI to contain a pointer to
549 the 16-byte partition table entry. The memory between
550 600h-7FFh is available to put the partition table entry in.
552 For PXELINUX, if the PXE stack is not unloaded, all registers
553 (except DS, ESI and EDX) and the stack will be set up as they
554 were set up by the PXE ROM.
557 AX=000Eh [2.11] Get configuration file name
559 Output: ES:BX null-terminated file name string
561 Returns the name of the configuration file. Note that it is
562 possible that the configuration file doesn't actually exist.
565 AX=000Fh [3.00] Get IPAPPEND strings [PXELINUX]
567 Output: CX number of strings (currently 2)
568 ES:BX pointer to an array of NEAR pointers in
569 the same segment, one for each of the above
572 Returns the same strings that the "ipappend" option would have
573 added to the command line, one for each bit of the "ipappend"
574 flag value, so entry 0 is the "ip=" string and entry 1 is the
578 AX=0010h [3.00] Resolve hostname [PXELINUX]
580 ES:BX pointer to null-terminated hostname
581 Output: EAX IP address of hostname (zero if not found)
583 Queries the DNS server(s) for a specific hostname. If the
584 hostname does not contain a dot (.), the local domain name
585 is automatically appended.
587 This function only return CF=1 if the function is not
588 supported. If the function is supported, but the hostname did
589 not resolve, it returns with CF=0, EAX=0.
591 The IP address is returned in network byte order, i.e. if the
592 IP address is 1.2.3.4, EAX will contain 0x04030201. Note that
593 all uses of IP addresses in PXE are also in network byte order.
596 AX=0011h [3.05] Obsoleted in 3.80
599 AX=0012h [3.50] Cleanup, shuffle and boot
601 DX derivative-specific flags (see function 000Ch)
602 ES:DI shuffle descriptor list (must be in low memory)
603 CX number of shuffle descriptors
604 EBX(!) initial value of EDX after bootstrap
605 ESI initial value of ESI after bootstrap
606 DS initial value of DS after bootstrap
607 EBP CS:IP of routine to jump to
608 Output: Does not return
609 (if CX is too large the routine returns with CF=1)
611 This routine performs final cleanup, then performs a sequence
612 of copies, and jumps to a specified real mode entry point.
613 This is a more general version of function 000Dh, which can
614 also be used to load other types of programs.
616 The copies must not touch memory below address 7C00h.
618 ES:DI points to a list of CX descriptors each of the form:
621 0 dword destination address
622 4 dword source address
623 8 dword length in bytes
625 The copies are overlap-safe, like memmove().
627 Starting in version 3.50, if the source address is -1
628 (FFFFFFFFh) then the block specified by the destination
629 address and the length is set to all zero.
631 Starting in version 3.50, if the destination address is -1
632 (FFFFFFFFh) then the data block is loaded as a new set of
633 descriptors, and processing is continued (and unprocessed
634 descriptors are lost, this is thus typically only used as the
635 last descriptor in a block.) The block must still fit in the
636 internal descriptor buffer (see function 0011h), but can, of
637 course, itself chain another block.
640 Normal boot sectors expect DL to contain the drive number,
641 and, for hard drives (DL >= 80h) DS:SI to contain a pointer to
642 the 16-byte partition table entry. The memory between
643 600h-7FFh is available to put the partition table entry in.
645 For PXELINUX, if the PXE stack is not unloaded, all registers
646 (except DS, ESI and EDX) and the stack will be set up as they
647 were set up by the PXE ROM.
649 This interface was probably broken before version 3.50.
652 AX=0013h [3.08] Idle loop call
656 Call this routine while sitting in an idle loop. It performs
657 any periodic activities required by the filesystem code. At
658 the moment, this is a no-op on all derivatives except
659 PXELINUX, where it executes PXE calls to answer ARP queries.
661 Starting with version 3.10, this API call harmlessly returns
662 failure (CF=1) if invoked on a platform which does not need
663 idle calls. Additionally, it's safe to call this API call on
664 previous Syslinux versions (2.00 or later); it will just
665 harmlessly fail. Thus, if this call returns failure (CF=1),
666 it means that there is no technical reason to call this
667 function again, although doing so is of course safe.
670 AX=0014h [3.10] Local boot [PXELINUX, ISOLINUX]
672 DX Local boot parameter
673 Output: Does not return
675 This function invokes the equivalent of the "localboot"
676 configuration file option. The parameter in DX is the same
677 parameter as would be entered after "localboot" in the
678 configuration file; this parameter is derivative-specific --
679 see syslinux.txt for the definition.
682 AX=0015h [3.10] Get feature flags
684 Output: ES:BX pointer to flags in memory
685 CX number of flag bytes
687 This function reports whether or not this Syslinux version and
688 derivative supports specific features. Keep in mind that
689 future versions might have more bits; remember to treat any
690 bits beyond the end of the array (as defined by the value in
693 Currently the following feature flag is defined:
696 ----------------------------------------------------
697 0 0 Local boot (AX=0014h) supported
698 1 Idle loop call (AX=0013h) is a no-op
700 All other flags are reserved.
703 AX=0016h [3.10] Run kernel image
705 DS:SI Filename of kernel image (zero-terminated string)
706 ES:BX Command line (zero-terminated string)
707 ECX IPAPPEND flags [PXELINUX]
708 EDX Type of file (since 3.50)
709 Output: Does not return if successful; returns with CF=1 if
710 the kernel image is not found.
712 This function is similiar to AX=0003h Run command, except that
713 the filename and command line are treated as if specified in a
714 KERNEL and APPEND statement of a LABEL statement, which means:
716 - The filename has to be exact; no variants are tried;
717 - No global APPEND statement is applied;
718 - ALLOWOPTIONS and IMPLICIT statements in the configuration
719 file do not apply. It is therefore important that the
720 COMBOOT module doesn't allow the end user to violate the
721 intent of the administrator.
723 Additionally, this function returns with a failure if the file
724 doesn't exist, instead of returning to the command line. (It
725 may still return to the command line if the image is somehow
728 The file types are defined as follows:
731 EDX Config Extensions Type of file
732 0 KERNEL Determined by filename extension
733 1 LINUX none Linux kernel image
734 2 BOOT .bs .bin Bootstrap program
735 3 BSS .bss Boot sector with patch [SYSLINUX]
736 4 PXE .0 PXE Network Bootstrap Prog [PXELINUX]
737 5 FDIMAGE .img Floppy disk image [ISOLINUX]
738 6 COMBOOT .com .cbt 16-bit COMBOOT program
739 7 COM32 .c32 COM32 program
740 8 CONFIG Configuration file
743 AX=0017h [3.30] Report video mode change
747 Bit 1: non-default mode
749 Bit 3: text functions not supported
750 CX For graphics modes, pixel columns
751 DX For graphics modes, pixel rows
754 This function is used to report video mode changes to
755 Syslinux. It does NOT actually change the video mode, but
756 rather, allows Syslinux to take appropriate action in response
757 to a video mode change. Modes that cannot be exited either
758 with the conventional BIOS mode set command (INT 10h, AH=00h)
759 or the VESA VBE mode set command (INT 10h, AX=4F02h) should
762 This function returns with a failure if BX contains any bits
763 which are undefined in the current version of Syslinux.
765 The following bits in BX are currently defined:
769 Indicates that the mode is a graphics mode, as opposed
772 Bit 1: non-standard mode
774 A non-standard mode is any mode except text mode and
775 graphics mode 0012h (VGA 640x480, 16 color.)
779 This mode is a VESA mode, and has to be exited with
780 the VESA VBE API (INT 10h, AX=4F02h) as opposed to the
781 conventional BIOS API (INT 10h, AH=00h).
783 Bit 3: Text functions not supported
785 This indicates that the BIOS text output functions
786 (INT 10h, AH=02h, 03h, 06h, 09h, 0Eh, 11h) don't work.
787 If this bit is set, Syslinux will reset the mode
788 before printing any characters on the screen.
790 This is common for VESA modes.
793 AX=0018h [3.30] Query custom font
795 Output: AL Height of custom font in scan lines, or zero
796 ES:BX Pointer to custom font in memory
798 This call queries if a custom display font has been loaded via
799 the "font" configuration file command. If no custom font has
800 been loaded, AL contains zero.
803 AX=0019h [3.50] Read disk [SYSLINUX, ISOLINUX, EXTLINUX]
806 ESI Reserved - MUST BE ZERO
807 EDI Reserved - MUST BE ZERO
812 Read disk blocks from the active filesystem (partition); for
813 disks, sector number zero is the boot sector. For ISOLINUX,
814 this call reads the CD-ROM.
816 For compatiblity with all systems, the buffer should
817 *neither* cross 64K boundaries, *nor* wrap around the segment.
819 This routine reports "boot failed" (and does not return) on
822 Note: for ISOLINUX in hybrid mode, this call uses simulated
823 2048-byte CD-ROM sector numbers.
826 AX=001Ah [3.50] Obsoleted in 3.80
829 AX=001Bh [3.50] Obsoleted in 3.80
832 AX=001Ch [3.60] Get pointer to auxilliary data vector
834 Output: ES:BX Auxilliary data vector
835 CX Size of the ADV (currently 500 bytes)
837 The auxillary data vector is a tagged data structure used
838 to carry a small amount of information (up to 500 bytes) from
842 AX=001Dh [3.60] Write auxilliary data vector
846 Write the auxilliary data vector back to disk. Returns
847 failure for non-disk-based derivatives unless the "auxdata"
848 configuration command is used to specify a disk location
849 (not yet implemented.)
851 In a future version, PXELINUX may end up attempting to save
852 the ADV on the server via TFTP write.
855 AX=001Eh [3.74] Keyboard remapping table
857 DX 0000h - all other values reserved
858 Output: AX format version (1)
859 CX length in bytes (256)
860 ES:BX pointer to keyboard table
862 This call queries the keyboard remapping table. For the current
863 version, the format code is always 1 and the length is always
864 256. This version can be updated simply by overwriting the version
865 in memory; this may not be true in the future.
868 AX=001Fh [3.74] Get current working directory
870 Output: ES:BX null-terminated directory name string
872 Returns the current working directory.
875 AX=0020h [3.74] Obsoleted in 4.00
876 AX=0021h [3.74] Obsoleted in 4.00
877 AX=0022h [3.74] Obsoleted in 4.00
879 These three functions provided opendir/readdir/closedir
880 functionality in the late 3.xx series. They have been
881 replaced by the protected-mode interface.
884 AX=0023h [3.80] Get shuffler parameters
886 Output: CX size of shuffler "safe area" in bytes
887 Other registers reserved for future use
889 This call gives the size of the required shuffler "safe area",
890 in bytes; for call 0024h. In the future, it may provide
891 additional parameters.
894 AX=0024h [3.80] Cleanup, shuffle and boot, raw version
896 DX derivative-specific flags (see function 000Ch)
897 EDI shuffle descriptor list safe area
898 ESI shuffle descriptor list source
899 ECX byte count of shuffle descriptor list
900 Output: Does not return
902 This routine performs final cleanup, then performs a sequence
903 of copies, and jumps to a specified real mode entry point.
904 This is a more general version of function 000Dh, which can
905 also be used to load other types of programs.
907 Unlike previous obsolete versions of this function, there are
908 no restrictions that copies must not touch memory below
909 address 7C00h. Either the shuffle descriptor list or the safe
910 area (or both) may be located in high memory.
912 ESI points to a list of descriptors each of the form:
915 0 dword destination address
916 4 dword source address (-1 = zero)
917 8 dword length in bytes (0 = end of list)
919 The copies are overlap-safe, like memmove().
921 Before actually executing the move list, the list is moved to
922 the address specified in EDI. The caller is responsibe to
923 ensure that the moved descriptor list plus a "safe area"
924 immediately afterwards (the size of which is specified by
925 function 0023h) is not disturbed by the copy sequence. It is,
926 however, safe to overwrite descriptors already consumed.
928 If the source address is -1 (FFFFFFFFh) then the block
929 specified by the destination address and the length is set to
932 The list is terminated by an entry with length 0. For that
933 entry, the destination is used as an entry point, and the
934 source represents the type of entry point:
936 0 16-bit protected mode (dst is CS.base)
937 1 Flat 32-bit protected mode (dst is EIP)
939 This routine does not set up any GPR register state
940 whatsoever, including stack. It is the responsibility of the
941 caller to make sure the entry point provided sets up any
944 For mode 0 (16-bit real mode), EAX will contain CR0 with bit 0
945 masked out, suitable for loading into CR0 to immediately enter
946 real mode. Note: if real-mode entry is planned,
947 (CS.base & 0xfff0000f) should == 0 for compatibility with KVM,
948 and possibly other virtualization solutions.
950 In both mode 0 and mode 1, the data segments will be loaded
951 with read/write data segments, matching the respective code
952 segment. For mode 0, B=0 and the limits will be 64K, for mode
953 1, B=1 and the limits will be 4 GB.
956 ++++ 32-BIT ONLY API CALLS ++++
958 void *pm_cs->lmalloc(size_t bytes)
960 Allocate a buffer in low memory (below 1 MB).
963 void pm_cs->lfree(void *ptr)
965 Free a buffer allocated with pm_cs->lmalloc().
968 DIR *pm_cs->opendir(const char *pathname)
973 struct dirent *pm_cs->readdir(DIR *dir)
975 Read an entry from a directory. The entry is returned in a
979 int pm_cs->closedir(DIR *dir)