예제 #1
0
파일: shuffle.c 프로젝트: hildred/syslinux
int syslinux_do_shuffle(struct syslinux_movelist *fraglist,
			struct syslinux_memmap *memmap,
			addr_t entry_point, addr_t entry_type,
			uint16_t bootflags)
{
    int rv = -1;
    struct syslinux_movelist *moves = NULL, *mp;
    struct syslinux_memmap *rxmap = NULL, *ml;
    struct shuffle_descriptor *dp, *dbuf;
    int np;
    int desc_blocks, need_blocks;
    int need_ptrs;
    addr_t desczone, descfree, descaddr;
    int nmoves, nzero;
    com32sys_t ireg;

    descaddr = 0;
    dp = dbuf = NULL;

    /* Count the number of zero operations */
    nzero = 0;
    for (ml = memmap; ml->type != SMT_END; ml = ml->next) {
	if (ml->type == SMT_ZERO)
	    nzero++;
    }

    /* Find the largest contiguous region unused by input *and* output;
       this is where we put the move descriptor list and safe area */

    rxmap = syslinux_dup_memmap(memmap);
    if (!rxmap)
	goto bail;
    /* Avoid using the low 1 MB for the shuffle area -- this avoids
       possible interference with the real mode code or stack */
    if (syslinux_add_memmap(&rxmap, 0, 1024 * 1024, SMT_RESERVED))
	goto bail;
    for (mp = fraglist; mp; mp = mp->next) {
	if (syslinux_add_memmap(&rxmap, mp->src, mp->len, SMT_ALLOC) ||
	    syslinux_add_memmap(&rxmap, mp->dst, mp->len, SMT_ALLOC))
	    goto bail;
    }
    if (syslinux_memmap_largest(rxmap, SMT_FREE, &desczone, &descfree))
	goto bail;

    syslinux_free_memmap(rxmap);

    dprintf("desczone = 0x%08x, descfree = 0x%08x\n", desczone, descfree);

    rxmap = syslinux_dup_memmap(memmap);
    if (!rxmap)
	goto bail;

    __syslinux_get_shuffer_size();
    desc_blocks = (nzero + DESC_BLOCK_SIZE - 1) / DESC_BLOCK_SIZE;
    for (;;) {
	/* We want (desc_blocks) allocation blocks, plus the terminating
	   descriptor, plus the shuffler safe area. */
	addr_t descmem = desc_blocks *
	    sizeof(struct shuffle_descriptor) * DESC_BLOCK_SIZE
	    + sizeof(struct shuffle_descriptor) + shuffler_size;

	descaddr = (desczone + descfree - descmem) & ~3;

	if (descaddr < desczone)
	    goto bail;		/* No memory block large enough */

	/* Mark memory used by shuffle descriptors as reserved */
	if (syslinux_add_memmap(&rxmap, descaddr, descmem, SMT_RESERVED))
	    goto bail;

#if DEBUG > 1
	syslinux_dump_movelist(fraglist);
#endif

	if (syslinux_compute_movelist(&moves, fraglist, rxmap))
	    goto bail;

	nmoves = 0;
	for (mp = moves; mp; mp = mp->next)
	    nmoves++;

	need_blocks = (nmoves + nzero + DESC_BLOCK_SIZE - 1) / DESC_BLOCK_SIZE;

	if (desc_blocks >= need_blocks)
	    break;		/* Sufficient memory, yay */

	desc_blocks = need_blocks;	/* Try again... */
    }

#if DEBUG > 1
    dprintf("Final movelist:\n");
    syslinux_dump_movelist(moves);
#endif

    syslinux_free_memmap(rxmap);
    rxmap = NULL;

    need_ptrs = nmoves + nzero + 1;
    dbuf = malloc(need_ptrs * sizeof(struct shuffle_descriptor));
    if (!dbuf)
	goto bail;

#if DEBUG
    {
	addr_t descoffs = descaddr - (addr_t) dbuf;

	dprintf("nmoves = %d, nzero = %d, dbuf = %p, offs = 0x%08x\n",
		nmoves, nzero, dbuf, descoffs);
    }
#endif

    /* Copy the move sequence into the descriptor buffer */
    np = 0;
    dp = dbuf;
    for (mp = moves; mp; mp = mp->next) {
	dp->dst = mp->dst;
	dp->src = mp->src;
	dp->len = mp->len;
	dprintf2("[ %08x %08x %08x ]\n", dp->dst, dp->src, dp->len);
	dp++;
	np++;
    }

    /* Copy bzero operations into the descriptor buffer */
    for (ml = memmap; ml->type != SMT_END; ml = ml->next) {
	if (ml->type == SMT_ZERO) {
	    dp->dst = ml->start;
	    dp->src = (addr_t) - 1;	/* bzero region */
	    dp->len = ml->next->start - ml->start;
	    dprintf2("[ %08x %08x %08x ]\n", dp->dst, dp->src, dp->len);
	    dp++;
	    np++;
	}
    }

    /* Finally, record the termination entry */
    dp->dst = entry_point;
    dp->src = entry_type;
    dp->len = 0;
    dp++;
    np++;

    if (np != need_ptrs) {
	dprintf("!!! np = %d : nmoves = %d, nzero = %d, desc_blocks = %d\n",
		np, nmoves, nzero, desc_blocks);
    }

    rv = 0;

bail:
    /* This is safe only because free() doesn't use the bounce buffer!!!! */
    if (moves)
	syslinux_free_movelist(moves);
    if (rxmap)
	syslinux_free_memmap(rxmap);

    if (rv)
	return rv;

    /* Actually do it... */
    memset(&ireg, 0, sizeof ireg);
    ireg.edi.l = descaddr;
    ireg.esi.l = (addr_t) dbuf;
    ireg.ecx.l = (addr_t) dp - (addr_t) dbuf;
    ireg.edx.w[0] = bootflags;
    ireg.eax.w[0] = 0x0024;
    __intcall(0x22, &ireg, NULL);

    return -1;			/* Shouldn't have returned! */
}
예제 #2
0
int syslinux_boot_linux(void *kernel_buf, size_t kernel_size,
			struct initramfs *initramfs, char *cmdline)
{
    struct linux_header hdr, *whdr;
    size_t real_mode_size, prot_mode_size;
    addr_t real_mode_base, prot_mode_base;
    addr_t irf_size;
    size_t cmdline_size, cmdline_offset;
    struct syslinux_rm_regs regs;
    struct syslinux_movelist *fraglist = NULL;
    struct syslinux_memmap *mmap = NULL;
    struct syslinux_memmap *amap = NULL;
    bool ok;
    uint32_t memlimit = 0;
    uint16_t video_mode = 0;
    const char *arg;

    cmdline_size = strlen(cmdline) + 1;

    if (kernel_size < 2 * 512)
	goto bail;

    /* Look for specific command-line arguments we care about */
    if ((arg = find_argument(cmdline, "mem=")))
	memlimit = saturate32(suffix_number(arg));

    if ((arg = find_argument(cmdline, "vga="))) {
	switch (arg[0] | 0x20) {
	case 'a':		/* "ask" */
	    video_mode = 0xfffd;
	    break;
	case 'e':		/* "ext" */
	    video_mode = 0xfffe;
	    break;
	case 'n':		/* "normal" */
	    video_mode = 0xffff;
	    break;
	case 'c':		/* "current" */
	    video_mode = 0x0f04;
	    break;
	default:
	    video_mode = strtoul(arg, NULL, 0);
	    break;
	}
    }

    /* Copy the header into private storage */
    /* Use whdr to modify the actual kernel header */
    memcpy(&hdr, kernel_buf, sizeof hdr);
    whdr = (struct linux_header *)kernel_buf;

    if (hdr.boot_flag != BOOT_MAGIC)
	goto bail;

    if (hdr.header != LINUX_MAGIC) {
	hdr.version = 0x0100;	/* Very old kernel */
	hdr.loadflags = 0;
    }

    whdr->vid_mode = video_mode;

    if (!hdr.setup_sects)
	hdr.setup_sects = 4;

    if (hdr.version < 0x0203)
	hdr.initrd_addr_max = 0x37ffffff;

    if (!memlimit && memlimit - 1 > hdr.initrd_addr_max)
	memlimit = hdr.initrd_addr_max + 1;	/* Zero for no limit */

    if (hdr.version < 0x0205 || !(hdr.loadflags & LOAD_HIGH))
	hdr.relocatable_kernel = 0;

    if (hdr.version < 0x0206)
	hdr.cmdline_max_len = 256;

    if (cmdline_size > hdr.cmdline_max_len) {
	cmdline_size = hdr.cmdline_max_len;
	cmdline[cmdline_size - 1] = '\0';
    }

    if (hdr.version < 0x0202 || !(hdr.loadflags & 0x01))
	cmdline_offset = (0x9ff0 - cmdline_size) & ~15;
    else
	cmdline_offset = 0x10000;

    real_mode_size = (hdr.setup_sects + 1) << 9;
    real_mode_base = (hdr.loadflags & LOAD_HIGH) ? 0x10000 : 0x90000;
    prot_mode_base = (hdr.loadflags & LOAD_HIGH) ? 0x100000 : 0x10000;
    prot_mode_size = kernel_size - real_mode_size;

    if (!(hdr.loadflags & LOAD_HIGH) && prot_mode_size > 512 * 1024)
	goto bail;		/* Kernel cannot be loaded low */

    if (initramfs && hdr.version < 0x0200)
	goto bail;		/* initrd/initramfs not supported */

    if (hdr.version >= 0x0200) {
	whdr->type_of_loader = 0x30;	/* SYSLINUX unknown module */
	if (hdr.version >= 0x0201) {
	    whdr->heap_end_ptr = cmdline_offset - 0x0200;
	    whdr->loadflags |= CAN_USE_HEAP;
	}
	if (hdr.version >= 0x0202) {
	    whdr->cmd_line_ptr = real_mode_base + cmdline_offset;
	} else {
	    whdr->old_cmd_line_magic = OLD_CMDLINE_MAGIC;
	    whdr->old_cmd_line_offset = cmdline_offset;
	    /* Be paranoid and round up to a multiple of 16 */
	    whdr->setup_move_size = (cmdline_offset + cmdline_size + 15) & ~15;
	}
    }

    /* Get the memory map */
    mmap = syslinux_memory_map();	/* Memory map for shuffle_boot */
    amap = syslinux_dup_memmap(mmap);	/* Keep track of available memory */
    if (!mmap || !amap)
	goto bail;

#if DEBUG
    dprintf("Initial memory map:\n");
    syslinux_dump_memmap(stdout, mmap);
#endif

    /* If the user has specified a memory limit, mark that as unavailable.
       Question: should we mark this off-limit in the mmap as well (meaning
       it's unavailable to the boot loader, which probably has already touched
       some of it), or just in the amap? */
    if (memlimit)
	if (syslinux_add_memmap(&amap, memlimit, -memlimit, SMT_RESERVED))
	    goto bail;

    /* Place the kernel in memory */

    /* First, find a suitable place for the protected-mode code */
    if (syslinux_memmap_type(amap, prot_mode_base, prot_mode_size)
	!= SMT_FREE) {
	const struct syslinux_memmap *mp;
	if (!hdr.relocatable_kernel)
	    goto bail;		/* Can't relocate - no hope */

	ok = false;
	for (mp = amap; mp; mp = mp->next) {
	    addr_t start, end;
	    start = mp->start;
	    end = mp->next->start;

	    if (mp->type != SMT_FREE)
		continue;

	    if (end <= prot_mode_base)
		continue;	/* Only relocate upwards */

	    if (start <= prot_mode_base)
		start = prot_mode_base;

	    start = ALIGN_UP(start, hdr.kernel_alignment);
	    if (start >= end)
		continue;

	    /* The 3* here is a total fudge factor... it's supposed to
	       account for the fact that the kernel needs to be decompressed,
	       and then followed by the BSS and BRK regions.  This doesn't,
	       however, account for the fact that the kernel is decompressed
	       into a whole other place, either. */
	    if (end - start >= 3 * prot_mode_size) {
		whdr->code32_start += start - prot_mode_base;
		prot_mode_base = start;
		ok = true;
		break;
	    }
	}

	if (!ok)
	    goto bail;
    }

    /* Real mode code */
    if (syslinux_memmap_type(amap, real_mode_base,
			     cmdline_offset + cmdline_size) != SMT_FREE) {
	const struct syslinux_memmap *mp;

	ok = false;
	for (mp = amap; mp; mp = mp->next) {
	    addr_t start, end;
	    start = mp->start;
	    end = mp->next->start;

	    if (mp->type != SMT_FREE)
		continue;

	    if (start < real_mode_base)
		start = real_mode_base;	/* Lowest address we'll use */
	    if (end > 640 * 1024)
		end = 640 * 1024;

	    start = ALIGN_UP(start, 16);
	    if (start > 0x90000 || start >= end)
		continue;

	    if (end - start >= cmdline_offset + cmdline_size) {
		real_mode_base = start;
		ok = true;
		break;
	    }
	}
    }

    if (syslinux_add_movelist(&fraglist, real_mode_base, (addr_t) kernel_buf,
			      real_mode_size))
	goto bail;
    if (syslinux_add_memmap
	(&amap, real_mode_base, cmdline_offset + cmdline_size, SMT_ALLOC))
	goto bail;

    /* Zero region between real mode code and cmdline */
    if (syslinux_add_memmap(&mmap, real_mode_base + real_mode_size,
			    cmdline_offset - real_mode_size, SMT_ZERO))
	goto bail;

    /* Command line */
    if (syslinux_add_movelist(&fraglist, real_mode_base + cmdline_offset,
			      (addr_t) cmdline, cmdline_size))
	goto bail;

    /* Protected-mode code */
    if (syslinux_add_movelist(&fraglist, prot_mode_base,
			      (addr_t) kernel_buf + real_mode_size,
			      prot_mode_size))
	goto bail;
    if (syslinux_add_memmap(&amap, prot_mode_base, prot_mode_size, SMT_ALLOC))
	goto bail;

    /* Figure out the size of the initramfs, and where to put it.
       We should put it at the highest possible address which is
       <= hdr.initrd_addr_max, which fits the entire initramfs. */

    irf_size = initramfs_size(initramfs);	/* Handles initramfs == NULL */

    if (irf_size) {
	addr_t best_addr = 0;
	struct syslinux_memmap *ml;
	const addr_t align_mask = INITRAMFS_MAX_ALIGN - 1;

	if (irf_size) {
	    for (ml = amap; ml->type != SMT_END; ml = ml->next) {
		addr_t adj_start = (ml->start + align_mask) & ~align_mask;
		addr_t adj_end = ml->next->start & ~align_mask;
		if (ml->type == SMT_FREE && adj_end - adj_start >= irf_size)
		    best_addr = (adj_end - irf_size) & ~align_mask;
	    }

	    if (!best_addr)
		goto bail;	/* Insufficient memory for initramfs */

	    whdr->ramdisk_image = best_addr;
	    whdr->ramdisk_size = irf_size;

	    if (syslinux_add_memmap(&amap, best_addr, irf_size, SMT_ALLOC))
		goto bail;

	    if (map_initramfs(&fraglist, &mmap, initramfs, best_addr))
		goto bail;
	}
    }

    /* Set up the registers on entry */
    memset(&regs, 0, sizeof regs);
    regs.es = regs.ds = regs.ss = regs.fs = regs.gs = real_mode_base >> 4;
    regs.cs = (real_mode_base >> 4) + 0x20;
    /* regs.ip = 0; */
    /* Linux is OK with sp = 0 = 64K, but perhaps other things aren't... */
    regs.esp.w[0] = min(cmdline_offset, (size_t) 0xfff0);

#if DEBUG
    dprintf("Final memory map:\n");
    syslinux_dump_memmap(stdout, mmap);

    dprintf("Final available map:\n");
    syslinux_dump_memmap(stdout, amap);

    dprintf("Initial movelist:\n");
    syslinux_dump_movelist(stdout, fraglist);
#endif

    syslinux_shuffle_boot_rm(fraglist, mmap, 0, &regs);

bail:
    syslinux_free_movelist(fraglist);
    syslinux_free_memmap(mmap);
    syslinux_free_memmap(amap);
    return -1;
}
예제 #3
0
파일: pmload.c 프로젝트: 1stMaster/syslinux
int boot_raw(void *ptr, size_t len, addr_t where, char **argv)
{
    struct syslinux_movelist *ml = NULL;
    struct syslinux_memmap *mmap = NULL, *amap = NULL;
    struct syslinux_pm_regs regs;
    int argc;
    addr_t argsize;
    char **argp;
    addr_t lstart, llen;
    char *stack_frame = NULL;
    addr_t stack_frame_size;
    addr_t stack_pointer;
    uint32_t *spp;
    char *sfp;
    addr_t sfa;

    memset(&regs, 0, sizeof regs);

    mmap = syslinux_memory_map();
    amap = syslinux_dup_memmap(mmap);
    if (!mmap || !amap)
	goto bail;

    dprintf("Initial memory map:\n");
    syslinux_dump_memmap(mmap);

    dprintf("Segment at 0x%08x len 0x%08x\n", where, len);

    if (syslinux_memmap_type(amap, where, len) != SMT_FREE) {
	printf("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
	       where, len);
	goto bail;		/* Memory region unavailable */
    }

    /* Mark this region as allocated in the available map */
    if (syslinux_add_memmap(&amap, where, len, SMT_ALLOC))
	goto bail;

    /* Data present region.  Create a move entry for it. */
    if (syslinux_add_movelist(&ml, where, (addr_t) ptr, len))
	goto bail;

    /* Create the invocation record (initial stack frame) */

    argsize = argc = 0;
    for (argp = argv; *argp; argp++) {
	dprintf("argv[%2d] = \"%s\"\n", argc, *argp);
	argc++;
	argsize += strlen(*argp) + 1;
    }

    /* We need the argument strings, argument pointers,
       argc, plus four zero-word terminators. */
    stack_frame_size = argsize + argc * sizeof(char *) + 5 * sizeof(long);
    stack_frame_size = (stack_frame_size + 15) & ~15;
    stack_frame = calloc(stack_frame_size, 1);
    if (!stack_frame)
	goto bail;

    dprintf("Right before syslinux_memmap_largest()...\n");
    syslinux_dump_memmap(amap);

    if (syslinux_memmap_largest(amap, SMT_FREE, &lstart, &llen))
	goto bail;		/* NO free memory?! */

    if (llen < stack_frame_size + MIN_STACK + 16)
	goto bail;		/* Insufficient memory  */

    /* Initial stack pointer address */
    stack_pointer = (lstart + llen - stack_frame_size) & ~15;

    dprintf("Stack frame at 0x%08x len 0x%08x\n",
	    stack_pointer, stack_frame_size);

    /* Create the stack frame.  sfp is the pointer in current memory for
       the next argument string, sfa is the address in its final resting place.
       spp is the pointer into the argument array in current memory. */
    spp = (uint32_t *) stack_frame;
    sfp = stack_frame + argc * sizeof(char *) + 5 * sizeof(long);
    sfa = stack_pointer + argc * sizeof(char *) + 5 * sizeof(long);

    *spp++ = argc;
    for (argp = argv; *argp; argp++) {
	int bytes = strlen(*argp) + 1;	/* Including final null */
	*spp++ = sfa;
	memcpy(sfp, *argp, bytes);
	sfp += bytes;
	sfa += bytes;
    }
    /* Zero fields are aready taken care of by calloc() */

    /* ... and we'll want to move it into the right place... */
#if DEBUG
    if (syslinux_memmap_type(amap, stack_pointer, stack_frame_size)
	!= SMT_FREE) {
	dprintf("Stack frame area not free (how did that happen?)!\n");
	goto bail;		/* Memory region unavailable */
    }
#endif

    if (syslinux_add_memmap(&amap, stack_pointer, stack_frame_size, SMT_ALLOC))
	goto bail;

    if (syslinux_add_movelist(&ml, stack_pointer, (addr_t) stack_frame,
			      stack_frame_size))
	goto bail;

    memset(&regs, 0, sizeof regs);
    regs.eip = where;
    regs.esp = stack_pointer;

    dprintf("Final memory map:\n");
    syslinux_dump_memmap(mmap);

    dprintf("Final available map:\n");
    syslinux_dump_memmap(amap);

    dprintf("Movelist:\n");
    syslinux_dump_movelist(ml);

    /* This should not return... */
    fputs("Booting...\n", stdout);
    syslinux_shuffle_boot_pm(ml, mmap, 0, &regs);

bail:
    if (stack_frame)
	free(stack_frame);
    syslinux_free_memmap(amap);
    syslinux_free_memmap(mmap);
    syslinux_free_movelist(ml);

    return -1;
}
예제 #4
0
int boot_elf(void *ptr, size_t len, char **argv)
{
    char *cptr = ptr;
    Elf32_Ehdr *eh = ptr;
    Elf32_Phdr *ph;
    unsigned int i;
    struct syslinux_movelist *ml = NULL;
    struct syslinux_memmap *mmap = NULL, *amap = NULL;
    struct syslinux_pm_regs regs;
    int argc;
    addr_t argsize;
    char **argp;
    addr_t lstart, llen;
    char *stack_frame = NULL;
    addr_t stack_frame_size;
    addr_t stack_pointer;
    uint32_t *spp;
    char *sfp;
    addr_t sfa;

    memset(&regs, 0, sizeof regs);

    /*
     * Note: mmap is the memory map (containing free and zeroed regions)
     * needed by syslinux_shuffle_boot_pm(); amap is a map where we keep
     * track ourselves which target memory ranges have already been
     * allocated.
     */

    if (len < sizeof(Elf32_Ehdr))
	goto bail;

    /* Must be ELF, 32-bit, littleendian, version 1 */
    if (memcmp(eh->e_ident, "\x7f" "ELF\1\1\1", 6))
	goto bail;

    /* Is this a worthwhile test?  In particular x86-64 normally
       would imply ELF64 support, which we could do as long as
       the addresses are 32-bit addresses, and entry is 32 bits.
       64-bit addresses would take a lot more work. */
    if (eh->e_machine != EM_386 && eh->e_machine != EM_486 &&
	eh->e_machine != EM_X86_64)
	goto bail;

    if (eh->e_version != EV_CURRENT)
	goto bail;

    if (eh->e_ehsize < sizeof(Elf32_Ehdr) || eh->e_ehsize >= len)
	goto bail;

    if (eh->e_phentsize < sizeof(Elf32_Phdr))
	goto bail;

    if (!eh->e_phnum)
	goto bail;

    if (eh->e_phoff + eh->e_phentsize * eh->e_phnum > len)
	goto bail;

    mmap = syslinux_memory_map();
    amap = syslinux_dup_memmap(mmap);
    if (!mmap || !amap)
	goto bail;

#if DEBUG
    dprintf("Initial memory map:\n");
    syslinux_dump_memmap(stdout, mmap);
#endif

    ph = (Elf32_Phdr *) (cptr + eh->e_phoff);

    for (i = 0; i < eh->e_phnum; i++) {
	if (ph->p_type == PT_LOAD || ph->p_type == PT_PHDR) {
	    /* This loads at p_paddr, which is arguably the correct semantics.
	       The SysV spec says that SysV loads at p_vaddr (and thus Linux does,
	       too); that is, however, a major brainfuckage in the spec. */
	    addr_t addr = ph->p_paddr;
	    addr_t msize = ph->p_memsz;
	    addr_t dsize = min(msize, ph->p_filesz);

	    dprintf("Segment at 0x%08x data 0x%08x len 0x%08x\n",
		    addr, dsize, msize);

	    if (syslinux_memmap_type(amap, addr, msize) != SMT_FREE) {
		printf("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
		       addr, msize);
		goto bail;	/* Memory region unavailable */
	    }

	    /* Mark this region as allocated in the available map */
	    if (syslinux_add_memmap(&amap, addr, dsize, SMT_ALLOC))
		goto bail;

	    if (ph->p_filesz) {
		/* Data present region.  Create a move entry for it. */
		if (syslinux_add_movelist
		    (&ml, addr, (addr_t) cptr + ph->p_offset, dsize))
		    goto bail;
	    }
	    if (msize > dsize) {
		/* Zero-filled region.  Mark as a zero region in the memory map. */
		if (syslinux_add_memmap
		    (&mmap, addr + dsize, msize - dsize, SMT_ZERO))
		    goto bail;
	    }
	} else {
	    /* Ignore this program header */
	}

	ph = (Elf32_Phdr *) ((char *)ph + eh->e_phentsize);
    }

    /* Create the invocation record (initial stack frame) */

    argsize = argc = 0;
    for (argp = argv; *argp; argp++) {
	dprintf("argv[%2d] = \"%s\"\n", argc, *argp);
	argc++;
	argsize += strlen(*argp) + 1;
    }

    /* We need the argument strings, argument pointers,
       argc, plus four zero-word terminators. */
    stack_frame_size = argsize + argc * sizeof(char *) + 5 * sizeof(long);
    stack_frame_size = (stack_frame_size + 15) & ~15;
    stack_frame = calloc(stack_frame_size, 1);
    if (!stack_frame)
	goto bail;

#if DEBUG
    dprintf("Right before syslinux_memmap_largest()...\n");
    syslinux_dump_memmap(stdout, amap);
#endif

    if (syslinux_memmap_largest(amap, SMT_FREE, &lstart, &llen))
	goto bail;		/* NO free memory?! */

    if (llen < stack_frame_size + MIN_STACK + 16)
	goto bail;		/* Insufficient memory  */

    /* Initial stack pointer address */
    stack_pointer = (lstart + llen - stack_frame_size) & ~15;

    dprintf("Stack frame at 0x%08x len 0x%08x\n",
	    stack_pointer, stack_frame_size);

    /* Create the stack frame.  sfp is the pointer in current memory for
       the next argument string, sfa is the address in its final resting place.
       spp is the pointer into the argument array in current memory. */
    spp = (uint32_t *) stack_frame;
    sfp = stack_frame + argc * sizeof(char *) + 5 * sizeof(long);
    sfa = stack_pointer + argc * sizeof(char *) + 5 * sizeof(long);

    *spp++ = argc;
    for (argp = argv; *argp; argp++) {
	int bytes = strlen(*argp) + 1;	/* Including final null */
	*spp++ = sfa;
	memcpy(sfp, *argp, bytes);
	sfp += bytes;
	sfa += bytes;
    }
    /* Zero fields are aready taken care of by calloc() */

    /* ... and we'll want to move it into the right place... */
#if DEBUG
    if (syslinux_memmap_type(amap, stack_pointer, stack_frame_size)
	!= SMT_FREE) {
	dprintf("Stack frame area not free (how did that happen?)!\n");
	goto bail;		/* Memory region unavailable */
    }
#endif

    if (syslinux_add_memmap(&amap, stack_pointer, stack_frame_size, SMT_ALLOC))
	goto bail;

    if (syslinux_add_movelist(&ml, stack_pointer, (addr_t) stack_frame,
			      stack_frame_size))
	goto bail;

    memset(&regs, 0, sizeof regs);
    regs.eip = eh->e_entry;
    regs.esp = stack_pointer;

#if DEBUG
    dprintf("Final memory map:\n");
    syslinux_dump_memmap(stdout, mmap);

    dprintf("Final available map:\n");
    syslinux_dump_memmap(stdout, amap);

    dprintf("Movelist:\n");
    syslinux_dump_movelist(stdout, ml);
#endif

    /* This should not return... */
    fputs("Booting...\n", stdout);
    syslinux_shuffle_boot_pm(ml, mmap, 0, &regs);

bail:
    if (stack_frame)
	free(stack_frame);
    syslinux_free_memmap(amap);
    syslinux_free_memmap(mmap);
    syslinux_free_movelist(ml);

    return -1;
}