2 COMBOOT and COM32 files
5 Syslinux supports simple standalone programs, using a file format
6 similar to DOS ".com" files. A 32-bit version, called COM32, is also
7 provided. A simple API provides access to a limited set of filesystem
11 ++++ COMBOOT file format ++++
13 A COMBOOT file is a raw binary file containing 16-bit code. It should
14 be linked to run at offset 0x100, and contain no absolute segment
15 references. It is run in 16-bit real mode.
17 A COMBOOT image can be written to be compatible with MS-DOS. Such a
18 file will usually have extension ".com". A COMBOOT file which is not
19 compatible with MS-DOS will usually have extension ".cbt".
21 Before running the program, Syslinux sets up the following fields in
22 the Program Segment Prefix (PSP), a structure at offset 0 in the
26 0 word Contains an INT 20h instruction
27 2 word Contains the paragraph (16-byte "segment" address) at
28 the end of memory available to the program.
29 128 byte Length of the command line arguments, including the leading
30 space but not including the final CR character.
31 129 127b Command line arguments, starting with a space and ending
32 with a CR character (ASCII 13).
34 The program is allowed to use memory between the PSP paragraph (which
35 all the CS, DS, ES and SS registers point to at program start) and the
36 paragraph value given at offset 2.
38 On startup, SP is set up to point to the end of the 64K segment, at
39 0xfffe. Under DOS it is possible for SP to contain a smaller
40 value if memory is very tight; this is never the case under Syslinux.
42 The program should make no assumptions about what segment address it
43 will be loaded at; instead it should look at the segment registers on
44 program startup. Both DOS and Syslinux will guarantee CS == DS == ES
45 == SS on program start; the program should not assume anything about
46 the values of FS or GS.
48 To exit, a program can either execute a near RET (which will jump to
49 offset 0 which contains an INT 20h instruction, terminating the
50 program), or execute INT 20h or INT 21h AH=00h or INT 21h AH=4Ch.
51 If compatiblity with Syslinux 1.xx is desired, use INT 20h.
54 ++++ COM32 file format ++++
56 A COM32 file is a raw binary file containing 32-bit code. It should
57 be linked to run at address 0x101000, and should not contain any
58 segment references. It will be run in flat-memory 32-bit protected
59 mode. Under Syslinux, it will be run in CPL 0, however, since it may
60 be possible to create a COM32 execution engine that would run under
61 something like Linux DOSEMU, it is recommended that the code does not
62 assume CPL 0 unless absolutely necessary.
64 It is highly recommended that every COM32 program begins with the byte
65 sequence B8 FF 4C CD 21 (mov eax,21cd4cffh) as a magic number.
67 A COM32 file should have extension ".c32".
69 On startup, CS will be set up as a flat 32-bit code segment, and DS ==
70 ES == SS will be set up as the equivalent flat 32-bit data segment.
71 FS and GS are reserved for future use and are currently initialized to
72 zero. A COM32 image should not assume any particular values of
75 ESP is set up at the end of available memory and also serves as
76 notification to the program how much memory is available.
78 The following arguments are passed to the program on the stack:
81 [ESP] dword Return (termination) address
82 [ESP+4] dword Number of additional arguments (currently 8)
83 [ESP+8] dword Pointer to the command line arguments (null-terminated string)
84 [ESP+12] dword Pointer to INT call helper function
85 [ESP+16] dword Pointer to low memory bounce buffer
86 [ESP+20] dword Size of low memory bounce buffer
87 [ESP+24] dword Pointer to FAR call helper function (new in 2.05)
88 [ESP+28] dword Pointer to CDECL helper function (new in 3.54)
89 [ESP+32] dword Amount of memory controlled by the Syslinux core (new in 3.74)
90 [ESP+36] dword Pointer to the filename of the com32 module (new in 3.86)
92 The intcall helper function can be used to issue BIOS or Syslinux API
93 calls, and takes the interrupt number as first argument. The second
94 argument is a pointer to the input register definition, an instance of
95 the following structure (available in <com32.h>):
104 uint16_t gs; /* Offset 0 */
105 uint16_t fs; /* Offset 2 */
106 uint16_t es; /* Offset 4 */
107 uint16_t ds; /* Offset 6 */
109 reg32_t edi; /* Offset 8 */
110 reg32_t esi; /* Offset 12 */
111 reg32_t ebp; /* Offset 16 */
112 reg32_t _unused_esp; /* Offset 20 */
113 reg32_t ebx; /* Offset 24 */
114 reg32_t edx; /* Offset 28 */
115 reg32_t ecx; /* Offset 32 */
116 reg32_t eax; /* Offset 36 */
118 reg32_t eflags; /* Offset 40 */
121 The third argument is a pointer to the output register definition, an
122 instance of the same structure. The third argument can also be zero
125 Since BIOS or Syslinux API calls can generally only manipulate data
126 below address 0x100000, a "bounce buffer" in low memory, at least 64K
127 in size, is available, to copy data in and out.
129 The farcall helper function behaves similarly, but takes as its first
130 argument the CS:IP (in the form (CS << 16) + IP) of procedure to be
131 invoked via a FAR CALL.
133 The cfarcall helper function takes (CS << 16)+IP, a pointer to a stack
134 frame, a size of that stack frame, and returns the return value of EAX
135 (which may need to be appropriate truncated by the user.)
138 ++++ SYSLINUX API CALLS +++
140 Syslinux provides the following API calls. Syslinux 1.xx only
141 supported INT 20h - terminate program. [] indicates the first version
142 of Syslinux which supported this feature (correctly.)
144 NOTE: Most of the API functionality is still experimental. Expect to
148 ++++ DOS-COMPATIBLE API CALLS ++++
150 INT 20h [1.48] Terminate program
151 INT 21h AH=00h [2.00] Terminate program
152 INT 21h AH=4Ch [2.00] Terminate program
154 All of these terminate the program.
157 INT 21h AH=01h [2.01] Get Key with Echo
159 Reads a key from the console input, with echo to the console
160 output. The read character is returned in AL. Extended
161 characters received from the keyboard are returned as NUL (00h)
162 + the extended character code.
165 INT 21h AH=02h [2.01] Write Character
167 Writes a character in DL to the console (video and serial)
171 INT 21h AH=04h [2.01] Write Character to Serial Port
173 Writes a character in DL to the serial console output
174 (if enabled.) If no serial port is configured, this routine
178 INT 21h AH=08h [2.09] Get Key without Echo
180 Reads a key fron the console input, without echoing it to the
181 console output. The read character is returned in AL.
184 INT 21h AH=09h [2.01] Write DOS String to Console
186 Writes a DOS $-terminated string in DS:DX to the console.
189 INT 21h AH=0Bh [2.00] Check Keyboard
191 Returns AL=FFh if there is a keystroke waiting (which can then
192 be read with INT 21h, AH=01h or AH=08h), otherwise AL=00h.
195 INT 21h AH=30h [2.00] Check DOS Version
197 This function returns AX=BX=CX=DX=0, corresponding to a
198 hypothetical "DOS 0.0", but the high parts of EAX-EBX-ECX-EDX
201 EAX=59530000h EBX=4C530000h ECX=4E490000h EDX=58550000h
203 This function can thus be used to distinguish running on
204 Syslinux from running on DOS.
207 ++++ SYSLINUX-SPECIFIC API CALLS ++++
209 Syslinux-specific API calls are executed using INT 22h, with a
210 function number in AX. INT 22h is used by DOS for internal purposes;
211 do not execute INT 22h under DOS.
213 DOS-compatible function INT 21h, AH=30h can be used to detect if the
214 Syslinux API calls are available.
216 Any register not specifically listed as modified is preserved;
217 however, future versions of Syslinux may add additional output
218 registers to existing calls.
220 All calls return CF=0 on success, CF=1 on failure. The noted outputs
221 apply if CF=0 only unless otherwise noted. All calls clobber the
222 arithmetric flags (CF, PF, AF, ZF, SF and OF) but leave all other
223 flags unchanged unless otherwise noted.
226 AX=0001h [2.00] Get Version
229 Output: AX number of INT 22h API functions available
230 CH Syslinux major version number
231 CL Syslinux minor version number
232 DL Syslinux derivative ID (e.g. 32h = PXELINUX)
233 ES:SI Syslinux version string
234 ES:DI Syslinux copyright string
236 This API call returns the Syslinux version and API
240 AX=0002h [2.01] Write String
243 ES:BX null-terminated string
246 Writes a null-terminated string on the console.
249 AX=0003h [2.01] Run command
252 ES:BX null-terminated command string
253 Output: Does not return
255 This API call terminates the program and executes the command
256 string as if the user had entered it at the Syslinux command
257 line. This API call does not return.
260 AX=0004h [2.01] Run default command
263 Output: Does not return
265 This API call terminates the program and executes the default
266 command string as if the user had pressed Enter alone on the
267 Syslinux command line. This API call does not return.
270 AX=0005h [2.00] Force text mode
275 If the screen was in graphics mode (due to displaying a splash
276 screen using the <Ctrl-X> command in a message file, or
277 similar), return to text mode.
280 AX=0006h [2.08] Open file
283 ES:SI null-terminated filename
284 Output: SI file handle
285 EAX length of file in bytes, or -1
288 Open a file for reading. The exact syntax of the filenames
289 allowed depends on the particular Syslinux derivative.
291 The Syslinux file system is block-oriented. The size of a
292 block will always be a power of two and no greater than 16K.
294 Note: Syslinux considers a zero-length file to be nonexistent.
296 In 3.70 or later, EAX can contain -1 indicating that the file
300 AX=0007h [2.08] Read file
305 CX number of blocks to read
306 Output: SI file handle, or 0 if EOF was reached
307 ECX number of bytes read [3.70]
309 Read blocks from a file. Note that the file handle that is
310 returned in SI may not be the same value that was passed in.
312 If end of file was reached (SI=0), the file was automatically
315 In 3.70 or later, ECX returns the number of bytes read. This
316 will always be a multiple of the block size unless EOF is
319 The address of the buffer (ES:BX) should be at least 512-byte
320 aligned. Syslinux guarantees at least this alignment for the
321 COMBOOT load segment or the COM32 bounce buffer.
323 Keep in mind that a "file" may be a TFTP connection, and that
324 leaving a file open for an extended period of time may result
327 WARNING: Calling this function with an invalid file handle
328 will probably crash the system.
331 AX=0008h [2.08] Close file
337 Close a file before reaching the end of file.
339 WARNING: Calling this function with an invalid file handle
340 will probably crash the system.
343 AX=0009h [2.00] Call PXE Stack [PXELINUX ONLY]
346 BX PXE function number
347 ES:DI PXE parameter structure buffer
348 Output: AX PXE return status code
350 Invoke an arbitrary PXE stack function. On SYSLINUX/ISOLINUX,
351 this function returns with an error (CF=1) and no action is
352 taken. On PXELINUX, this function always returns with CF=0
353 indicating that the PXE stack was successfully invoked; check
354 the status code in AX and in the first word of the data buffer
355 to determine if the PXE call succeeded or not.
357 The PXE stack will have the UDP stack OPEN; if you change that
358 you cannot call any of the file-related API functions, and
359 must restore UDP OPEN before returning to PXELINUX.
361 PXELINUX reserves UDP port numbers from 49152 to 65535 for its
362 own use; port numbers below that range is available.
365 AX=000Ah [2.00] Get Derivative-Specific Information
369 CL 9 (to get a valid return in CL for all versions)
370 Output: AL 31h (SYSLINUX), 34h (EXTLINUX)
372 CL sector size as a power of 2 (9 = 512 bytes) [3.35]
373 ES:BX pointer to partition table entry (if DL >= 80h)
374 FS:SI pointer to initial ES:DI value [3.53]
376 Note: This function was broken in EXTLINUX 3.00-3.02.
378 On boot, ES:DI is supposed to point to the BIOS $PnP
379 structure, although in practice most operating systems
380 will search for it in memory. However, preserving
381 this while chainloading is probably a good idea.
383 Note that FS:SI is a pointer to a memory location
384 containing the original ES:DI value, not the value
390 Output: AL 32h (PXELINUX)
391 DX PXE API version detected (DH=major, DL=minor)
392 ECX Local IP number (network byte order) [3.85]
393 ES:BX pointer to PXENV+ or !PXE structure
394 FS:SI pointer to original stack with invocation record
396 Note: DX notes the API version detected by PXELINUX,
397 which may be more conservative than the actual version
398 available. For exact information examine the API
399 version entry in the PXENV+ structure, or the API
400 version entries in the ROMID structures pointed from
403 PXELINUX will use, and provide, the !PXE structure
404 over the PXENV+ structure. Examine the structure
405 signature to determine which particular structure was
408 The FS:SI pointer points to the top of the original stack
409 provided by the PXE stack, with the following values
410 pushed at the time PXELINUX is started:
412 [fs:si+0] GS <- top of stack
425 [fs:si+44] PXE return IP <- t.o.s. when PXELINUX invoked
426 [fs:si+46] PXE return CS
431 Output: AL 33h (ISOLINUX)
433 CL 11 (sector size as a power of 2) [3.35]
436 1 = Hybrid (hard disk), CBIOS mode
437 2 = Hybrid (hard disk), EBIOS mode
438 ES:BX pointer to El Torito spec packet
439 FS:SI pointer to initial ES:DI value [3.53]
441 Note: Some very broken El Torito implementations do
442 not provide the spec packet information. If so, ES:BX
443 may point to all zeroes or to garbage. Call INT 13h,
444 AX=4B01h to obtain the spec packet directly from the
447 This call gives information specific to a particular Syslinux
448 derivative. The value returned in AL is the same as is
449 returned in DL by INT 22h AX=0001h.
452 AX=000Bh [2.00] Get Serial Console Configuration
455 Output: DX serial port I/O base (e.g. 3F8h = COM1...)
456 CX baud rate divisor (1 = 115200 bps, 2 = 57600 bps...)
457 BX flow control configuration bits (see syslinux.txt)
458 -> bit 15 is set if the video console is disabled
460 If no serial port is configured, DX will be set to 0 and the
461 other registers are undefined.
464 AX=000Ch [2.00] Perform final cleanup
466 DX derivative-specific flags (0000h = clean up all)
469 This routine performs any "final cleanup" the boot loader
470 would normally perform before loading a kernel, such as
471 unloading the PXE stack in the case of PXELINUX. AFTER
472 INVOKING THIS CALL, NO OTHER API CALLS MAY BE INVOKED, NOR MAY
473 THE PROGRAM TERMINATE AND RETURN TO THE BOOT LOADER. This
474 call basically tells the boot loader "get out of the way, I'll
475 handle it from here."
477 For COM32 images, the boot loader will continue to provide
478 interrupt and BIOS call thunking services as long its memory
479 areas (0x0800-0xffff, 0x100000-0x100fff) are not overwritten.
480 MAKE SURE TO DISABLE INTERRUPTS, AND INSTALL NEW GDT AND IDTS
481 BEFORE OVERWRITING THESE MEMORY AREAS.
483 The permissible values for DX is an OR of these values:
485 SYSLINUX: 0000h Normal cleanup
487 PXELINUX: 0000h Normal cleanup
488 0003h Keep UNDI and PXE stacks loaded
490 ISOLINUX: 0000h Normal cleanup
492 EXTLINUX: 0000h Normal cleanup
494 All other values are undefined, and may have different
495 meanings in future versions of Syslinux.
498 AX=000Dh [2.08] Cleanup and replace bootstrap code
500 DX derivative-specific flags (see previous function)
501 EDI bootstrap code (linear address, can be in high memory)
502 ECX bootstrap code length in bytes (must fit in low mem)
503 EBX(!) initial value of EDX after bootstrap
504 ESI initial value of ESI after bootstrap
505 DS initial value of DS after bootstrap
506 Output: Does not return
508 This routine performs final cleanup, then takes a piece of
509 code, copies it over the primary bootstrap at address 7C00h,
510 and jumps to it. This can be used to chainload boot sectors,
511 MBRs, bootstraps, etc.
513 Normal boot sectors expect DL to contain the drive number,
514 and, for hard drives (DL >= 80h) DS:SI to contain a pointer to
515 the 16-byte partition table entry. The memory between
516 600h-7FFh is available to put the partition table entry in.
518 For PXELINUX, if the PXE stack is not unloaded, all registers
519 (except DS, ESI and EDX) and the stack will be set up as they
520 were set up by the PXE ROM.
523 AX=000Eh [2.11] Get configuration file name
525 Output: ES:BX null-terminated file name string
527 Returns the name of the configuration file. Note that it is
528 possible that the configuration file doesn't actually exist.
531 AX=000Fh [3.00] Get IPAPPEND strings [PXELINUX]
533 Output: CX number of strings (currently 2)
534 ES:BX pointer to an array of NEAR pointers in
535 the same segment, one for each of the above
538 Returns the same strings that the "ipappend" option would have
539 added to the command line, one for each bit of the "ipappend"
540 flag value, so entry 0 is the "ip=" string and entry 1 is the
544 AX=0010h [3.00] Resolve hostname [PXELINUX]
546 ES:BX pointer to null-terminated hostname
547 Output: EAX IP address of hostname (zero if not found)
549 Queries the DNS server(s) for a specific hostname. If the
550 hostname does not contain a dot (.), the local domain name
551 is automatically appended.
553 This function only return CF=1 if the function is not
554 supported. If the function is supported, but the hostname did
555 not resolve, it returns with CF=0, EAX=0.
557 The IP address is returned in network byte order, i.e. if the
558 IP address is 1.2.3.4, EAX will contain 0x04030201. Note that
559 all uses of IP addresses in PXE are also in network byte order.
562 AX=0011h [3.05] Obsoleted in 3.80
565 AX=0012h [3.50] Cleanup, shuffle and boot
567 DX derivative-specific flags (see function 000Ch)
568 ES:DI shuffle descriptor list (must be in low memory)
569 CX number of shuffle descriptors
570 EBX(!) initial value of EDX after bootstrap
571 ESI initial value of ESI after bootstrap
572 DS initial value of DS after bootstrap
573 EBP CS:IP of routine to jump to
574 Output: Does not return
575 (if CX is too large the routine returns with CF=1)
577 This routine performs final cleanup, then performs a sequence
578 of copies, and jumps to a specified real mode entry point.
579 This is a more general version of function 000Dh, which can
580 also be used to load other types of programs.
582 The copies must not touch memory below address 7C00h.
584 ES:DI points to a list of CX descriptors each of the form:
587 0 dword destination address
588 4 dword source address
589 8 dword length in bytes
591 The copies are overlap-safe, like memmove().
593 Starting in version 3.50, if the source address is -1
594 (FFFFFFFFh) then the block specified by the destination
595 address and the length is set to all zero.
597 Starting in version 3.50, if the destination address is -1
598 (FFFFFFFFh) then the data block is loaded as a new set of
599 descriptors, and processing is continued (and unprocessed
600 descriptors are lost, this is thus typically only used as the
601 last descriptor in a block.) The block must still fit in the
602 internal descriptor buffer (see function 0011h), but can, of
603 course, itself chain another block.
606 Normal boot sectors expect DL to contain the drive number,
607 and, for hard drives (DL >= 80h) DS:SI to contain a pointer to
608 the 16-byte partition table entry. The memory between
609 600h-7FFh is available to put the partition table entry in.
611 For PXELINUX, if the PXE stack is not unloaded, all registers
612 (except DS, ESI and EDX) and the stack will be set up as they
613 were set up by the PXE ROM.
615 This interface was probably broken before version 3.50.
618 AX=0013h [3.08] Idle loop call
622 Call this routine while sitting in an idle loop. It performs
623 any periodic activities required by the filesystem code. At
624 the moment, this is a no-op on all derivatives except
625 PXELINUX, where it executes PXE calls to answer ARP queries.
627 Starting with version 3.10, this API call harmlessly returns
628 failure (CF=1) if invoked on a platform which does not need
629 idle calls. Additionally, it's safe to call this API call on
630 previous Syslinux versions (2.00 or later); it will just
631 harmlessly fail. Thus, if this call returns failure (CF=1),
632 it means that there is no technical reason to call this
633 function again, although doing so is of course safe.
636 AX=0014h [3.10] Local boot [PXELINUX, ISOLINUX]
638 DX Local boot parameter
639 Output: Does not return
641 This function invokes the equivalent of the "localboot"
642 configuration file option. The parameter in DX is the same
643 parameter as would be entered after "localboot" in the
644 configuration file; this parameter is derivative-specific --
645 see syslinux.txt for the definition.
648 AX=0015h [3.10] Get feature flags
650 Output: ES:BX pointer to flags in memory
651 CX number of flag bytes
653 This function reports whether or not this Syslinux version and
654 derivative supports specific features. Keep in mind that
655 future versions might have more bits; remember to treat any
656 bits beyond the end of the array (as defined by the value in
659 Currently the following feature flag is defined:
662 ----------------------------------------------------
663 0 0 Local boot (AX=0014h) supported
664 1 Idle loop call (AX=0013h) is a no-op
666 All other flags are reserved.
669 AX=0016h [3.10] Run kernel image
671 DS:SI Filename of kernel image (zero-terminated string)
672 ES:BX Command line (zero-terminated string)
673 ECX IPAPPEND flags [PXELINUX]
674 EDX Type of file (since 3.50)
675 Output: Does not return if successful; returns with CF=1 if
676 the kernel image is not found.
678 This function is similiar to AX=0003h Run command, except that
679 the filename and command line are treated as if specified in a
680 KERNEL and APPEND statement of a LABEL statement, which means:
682 - The filename has to be exact; no variants are tried;
683 - No global APPEND statement is applied;
684 - ALLOWOPTIONS and IMPLICIT statements in the configuration
685 file do not apply. It is therefore important that the
686 COMBOOT module doesn't allow the end user to violate the
687 intent of the administrator.
689 Additionally, this function returns with a failure if the file
690 doesn't exist, instead of returning to the command line. (It
691 may still return to the command line if the image is somehow
694 The file types are defined as follows:
697 EDX Config Extensions Type of file
698 0 KERNEL Determined by filename extension
699 1 LINUX none Linux kernel image
700 2 BOOT .bs .bin Bootstrap program
701 3 BSS .bss Boot sector with patch [SYSLINUX]
702 4 PXE .0 PXE Network Bootstrap Prog [PXELINUX]
703 5 FDIMAGE .img Floppy disk image [ISOLINUX]
704 6 COMBOOT .com .cbt 16-bit COMBOOT program
705 7 COM32 .c32 COM32 program
706 8 CONFIG Configuration file
709 AX=0017h [3.30] Report video mode change
713 Bit 1: non-default mode
715 Bit 3: text functions not supported
716 CX For graphics modes, pixel columns
717 DX For graphics modes, pixel rows
720 This function is used to report video mode changes to
721 Syslinux. It does NOT actually change the video mode, but
722 rather, allows Syslinux to take appropriate action in response
723 to a video mode change. Modes that cannot be exited either
724 with the conventional BIOS mode set command (INT 10h, AH=00h)
725 or the VESA VBE mode set command (INT 10h, AX=4F02h) should
728 This function returns with a failure if BX contains any bits
729 which are undefined in the current version of Syslinux.
731 The following bits in BX are currently defined:
735 Indicates that the mode is a graphics mode, as opposed
738 Bit 1: non-standard mode
740 A non-standard mode is any mode except text mode and
741 graphics mode 0012h (VGA 640x480, 16 color.)
745 This mode is a VESA mode, and has to be exited with
746 the VESA VBE API (INT 10h, AX=4F02h) as opposed to the
747 conventional BIOS API (INT 10h, AH=00h).
749 Bit 3: Text functions not supported
751 This indicates that the BIOS text output functions
752 (INT 10h, AH=02h, 03h, 06h, 09h, 0Eh, 11h) don't work.
753 If this bit is set, Syslinux will reset the mode
754 before printing any characters on the screen.
756 This is common for VESA modes.
759 AX=0018h [3.30] Query custom font
761 Output: AL Height of custom font in scan lines, or zero
762 ES:BX Pointer to custom font in memory
764 This call queries if a custom display font has been loaded via
765 the "font" configuration file command. If no custom font has
766 been loaded, AL contains zero.
769 AX=0019h [3.50] Read disk [SYSLINUX, ISOLINUX, EXTLINUX]
772 ESI Reserved - MUST BE ZERO
773 EDI Reserved - MUST BE ZERO
778 Read disk blocks from the active filesystem (partition); for
779 disks, sector number zero is the boot sector. For ISOLINUX,
780 this call reads the CD-ROM.
782 For compatiblity with all systems, the buffer should
783 *neither* cross 64K boundaries, *nor* wrap around the segment.
785 This routine reports "boot failed" (and does not return) on
788 Note: for ISOLINUX in hybrid mode, this call uses simulated
789 2048-byte CD-ROM sector numbers.
792 AX=001Ah [3.50] Obsoleted in 3.80
795 AX=001Bh [3.50] Obsoleted in 3.80
798 AX=001Ch [3.60] Get pointer to auxilliary data vector
800 Output: ES:BX Auxilliary data vector
801 CX Size of the ADV (currently 500 bytes)
803 The auxillary data vector is a tagged data structure used
804 to carry a small amount of information (up to 500 bytes) from
808 AX=001Dh [3.60] Write auxilliary data vector
812 Write the auxilliary data vector back to disk. Returns
813 failure for non-disk-based derivatives unless the "auxdata"
814 configuration command is used to specify a disk location
815 (not yet implemented.)
817 In a future version, PXELINUX may end up attempting to save
818 the ADV on the server via TFTP write.
821 AX=001Eh [3.74] Keyboard remapping table
823 DX 0000h - all other values reserved
824 Output: AX format version (1)
825 CX length in bytes (256)
826 ES:BX pointer to keyboard table
828 This call queries the keyboard remapping table. For the current
829 version, the format code is always 1 and the length is always
830 256. This version can be updated simply by overwriting the version
831 in memory; this may not be true in the future.
834 AX=001Fh [3.74] Get current working directory
836 Output: ES:BX null-terminated directory name string
838 Returns the current working directory. For SYSLINUX, ISOLINUX,
839 and PXELINUX, this will be an absolute path. For EXTLINUX, it
840 currently returns "./".
843 AX=0020h [3.74] Open directory
845 ES:SI /-null-terminated directory name
846 Output: SI directory handle
849 Open a directory for reading. Directory name must have a trailing
850 "/" before the null (otherwise, you're looking for a file)(This
851 may change as this is a BETA call).
854 AX=0021h [3.74] Read directory
857 ES:DI buffer for file name
858 Output: DL Type of file
859 SI directory handle, or 0 if end of directory was reached
863 Read one filename from the directory, incrementing the
864 directory structure at SI as appropriate, storing the filename
865 into the buffer at ES:DI, and returning the type of the file
866 in DL, the file length in EAX, the inode/file number in EBX
867 and the updated directory handle.
870 AX=0022h [3.74] Close directory
878 AX=0023h [3.80] Get shuffler parameters
880 Output: CX size of shuffler "safe area" in bytes
881 Other registers reserved for future use
883 This call gives the size of the required shuffler "safe area",
884 in bytes; for call 0024h. In the future, it may provide
885 additional parameters.
888 AX=0024h [3.80] Cleanup, shuffle and boot, raw version
890 DX derivative-specific flags (see function 000Ch)
891 EDI shuffle descriptor list safe area
892 ESI shuffle descriptor list source
893 ECX byte count of shuffle descriptor list
894 Output: Does not return
896 This routine performs final cleanup, then performs a sequence
897 of copies, and jumps to a specified real mode entry point.
898 This is a more general version of function 000Dh, which can
899 also be used to load other types of programs.
901 Unlike previous obsolete versions of this function, there are
902 no restrictions that copies must not touch memory below
903 address 7C00h. Either the shuffle descriptor list or the safe
904 area (or both) may be located in high memory.
906 ESI points to a list of descriptors each of the form:
909 0 dword destination address
910 4 dword source address (-1 = zero)
911 8 dword length in bytes (0 = end of list)
913 The copies are overlap-safe, like memmove().
915 Before actually executing the move list, the list is moved to
916 the address specified in EDI. The caller is responsibe to
917 ensure that the moved descriptor list plus a "safe area"
918 immediately afterwards (the size of which is specified by
919 function 0023h) is not disturbed by the copy sequence. It is,
920 however, safe to overwrite descriptors already consumed.
922 If the source address is -1 (FFFFFFFFh) then the block
923 specified by the destination address and the length is set to
926 The list is terminated by an entry with length 0. For that
927 entry, the destination is used as an entry point, and the
928 source represents the type of entry point:
930 0 16-bit protected mode (dst is CS.base)
931 1 Flat 32-bit protected mode (dst is EIP)
933 This routine does not set up any GPR register state
934 whatsoever, including stack. It is the responsibility of the
935 caller to make sure the entry point provided sets up any
938 For mode 0 (16-bit real mode), EAX will contain CR0 with bit 0
939 masked out, suitable for loading into CR0 to immediately enter
940 real mode. Note: if real-mode entry is planned,
941 (CS.base & 0xfff0000f) should == 0 for compatibility with KVM,
942 and possibly other virtualization solutions.
944 In both mode 0 and mode 1, the data segments will be loaded
945 with read/write data segments, matching the respective code
946 segment. For mode 0, B=0 and the limits will be 64K, for mode
947 1, B=1 and the limits will be 4 GB.