syslinux: fix booting memtest86+ using pxelinux regression

After syslinux was updated from 4.07 to 6.01, booting memtest86+ using
pxelinux would fail:
PXELINUX 6.01 2013-07-04 Copyright (C) 1994-2013 H. Peter Anvin et al
Loading memtest86... ok
Booting kernel failed: invalid argument

This backports the necessary upstream patches to allow memtest86+ to
boot using pxelinux again.

[YOCTO #5501]

(From OE-Core rev: ed9ccb8622b347173602be8b2126324d4fdf54d8)

Signed-off-by: Jonathan Liu <net147@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

5 files changed, 657 insertions, 1 deletions

diff --git a/meta/recipes-devtools/syslinux/files/0001-movebits-Add-SMT_TERMINAL-a-last-resort-region-type.patch b/meta/recipes-devtools/syslinux/files/0001-movebits-Add-SMT_TERMINAL-a-last-resort-region-type.patch
new file mode 100644
index 0000000000..fb03bbfe2c
--- /dev/null
+++ b/meta/recipes-devtools/syslinux/files/0001-movebits-Add-SMT_TERMINAL-a-last-resort-region-type.patch
@@ -0,0 +1,50 @@
+Upstream-Status: Backport [ba638fd9bf72b0c786c88909014136cfa641a147]
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+
+From b663fd7257481438256f8267831dc10b06363b22 Mon Sep 17 00:00:00 2001
+From: Matt Fleming <matt.fleming@intel.com>
+Date: Tue, 16 Jul 2013 22:16:11 +0100
+Subject: [PATCH 1/4] movebits: Add SMT_TERMINAL - a last resort region type
+
+Some memory regions are usable, but only as a last resort just before we
+hand over control to a kernel image. Add the necessary movebits
+infrastructure to use these regions when all other options have been
+exhausted.
+
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+
+Conflicts:
+        com32/lib/syslinux/zonelist.c
+---
+ com32/include/syslinux/movebits.h | 1 +
+ com32/lib/syslinux/movebits.c     | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/com32/include/syslinux/movebits.h b/com32/include/syslinux/movebits.h
+index 8bcdf3e..114a896 100644
+--- a/com32/include/syslinux/movebits.h
++++ b/com32/include/syslinux/movebits.h
+@@ -34,6 +34,7 @@ enum syslinux_memmap_types {
+     SMT_RESERVED,              /* Unusable memory */
+     SMT_ALLOC,                 /* Memory allocated by user */
+     SMT_ZERO,                  /* Memory that should be zeroed */
++    SMT_TERMINAL,              /* Memory to be used as a last resort */
+ };
+ 
+ struct syslinux_memmap {
+diff --git a/com32/lib/syslinux/movebits.c b/com32/lib/syslinux/movebits.c
+index 7a05f3c..8ffdc63 100644
+--- a/com32/lib/syslinux/movebits.c
++++ b/com32/lib/syslinux/movebits.c
+@@ -160,7 +160,7 @@ static const struct syslinux_memmap *is_free_zone(const struct syslinux_memmap
+        if (list->start <= start) {
+            if (llast >= last) {
+                /* Chunk has a single, well-defined type */
+-               if (list->type == SMT_FREE) {
++               if (list->type == SMT_FREE || list->type == SMT_TERMINAL) {
+                    dprintf("F: 0x%08x bytes at 0x%08x\n",
+                            list->next->start, list->start);
+                    return list;        /* It's free */
+-- 
+1.8.5.3
+
diff --git a/meta/recipes-devtools/syslinux/files/0002-memscan-build-a-linked-list-of-memory-scanners.patch b/meta/recipes-devtools/syslinux/files/0002-memscan-build-a-linked-list-of-memory-scanners.patch
new file mode 100644
index 0000000000..48d3955910
--- /dev/null
+++ b/meta/recipes-devtools/syslinux/files/0002-memscan-build-a-linked-list-of-memory-scanners.patch
@@ -0,0 +1,450 @@
+Upstream-Status: Backport [787d7e568fe08d7080d2cd03cd9ee27c327eca67]
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+
+From 2e05f34c0c5bc0144bb203a169009dfb6837b4e3 Mon Sep 17 00:00:00 2001
+From: Matt Fleming <matt.fleming@intel.com>
+Date: Wed, 17 Jul 2013 12:15:16 +0100
+Subject: [PATCH 2/4] memscan: build a linked list of memory scanners
+
+By registering memory scanners at runtime we can support multiple memory
+scanner functions, which helps us to isolate them and keep things
+modular, only registering them for specific platform/derivative
+combinations. This is preparation for adding a memory scanner that is
+specific to PXELINUX on bios and understands when the memory region
+occupied by the PXE stack can be reused.
+
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+
+Conflicts:
+        com32/include/syslinux/memscan.h
+        com32/lib/syslinux/memscan.c
+---
+ com32/include/syslinux/firmware.h |   4 +-
+ com32/include/syslinux/memscan.h  |  14 +++-
+ com32/lib/syslinux/memscan.c      | 143 +++++++-------------------------------
+ core/bios.c                       | 125 ++++++++++++++++++++++++++++++++-
+ efi/main.c                        |  14 ++--
+ 5 files changed, 173 insertions(+), 127 deletions(-)
+
+diff --git a/com32/include/syslinux/firmware.h b/com32/include/syslinux/firmware.h
+index 4a43c86..6cc06a0 100644
+--- a/com32/include/syslinux/firmware.h
++++ b/com32/include/syslinux/firmware.h
+@@ -1,7 +1,8 @@
+ #ifndef _SYSLINUX_FIRMWARE_H
+ #define _SYSLINUX_FIRMWARE_H
+ 
+-#include <syslinux/memscan.h>
++#include <inttypes.h>
++#include <stdbool.h>
+ 
+ struct term_state;
+ 
+@@ -42,7 +43,6 @@ struct mem_ops {
+        void *(*malloc)(size_t, enum heap, size_t);
+        void *(*realloc)(void *, size_t);
+        void (*free)(void *);
+-       int (*scan_memory)(scan_memory_callback_t, void *);
+ };
+ 
+ struct initramfs;
+diff --git a/com32/include/syslinux/memscan.h b/com32/include/syslinux/memscan.h
+index c3ebf84..ab78e28 100644
+--- a/com32/include/syslinux/memscan.h
++++ b/com32/include/syslinux/memscan.h
+@@ -29,11 +29,19 @@
+ #ifndef _SYSLINUX_MEMSCAN_H
+ #define _SYSLINUX_MEMSCAN_H
+ 
+-#include <stdbool.h>
++#include <linux/list.h>
+ #include <syslinux/movebits.h> /* addr_t */
+ 
+-typedef int (*scan_memory_callback_t) (void *, addr_t, addr_t, bool);
++typedef int (*scan_memory_callback_t) (void *, addr_t, addr_t,
++                                      enum syslinux_memmap_types type);
++
++struct syslinux_memscan {
++    int (*func)(scan_memory_callback_t callback, void *data);
++    struct list_head next;
++};
++
++void syslinux_memscan_add(struct syslinux_memscan *entry);
++int syslinux_memscan_new(int (*func)(scan_memory_callback_t cb, void *data));
+ int syslinux_scan_memory(scan_memory_callback_t callback, void *data);
+-int bios_scan_memory(scan_memory_callback_t callback, void *data);
+ 
+ #endif /* _SYSLINUX_MEMSCAN_H */
+diff --git a/com32/lib/syslinux/memscan.c b/com32/lib/syslinux/memscan.c
+index 0ff25d7..fdb7274 100644
+--- a/com32/lib/syslinux/memscan.c
++++ b/com32/lib/syslinux/memscan.c
+@@ -32,133 +32,44 @@
+  * Query the system for free memory
+  */
+ 
+-#include <assert.h>
+-#include <stdbool.h>
+-#include <stdlib.h>
+-#include <string.h>
+-#include <inttypes.h>
+-#include <com32.h>
+-
+ #include <syslinux/memscan.h>
+-#include <syslinux/firmware.h>
+ 
+-struct e820_entry {
+-    uint64_t start;
+-    uint64_t len;
+-    uint32_t type;
+-};
++static LIST_HEAD(syslinux_memscan_head);
+ 
+-int bios_scan_memory(scan_memory_callback_t callback, void *data)
++/*
++ * Add a memscan entry to the list.
++ */
++void syslinux_memscan_add(struct syslinux_memscan *entry)
+ {
+-    static com32sys_t ireg;
+-    com32sys_t oreg;
+-    struct e820_entry *e820buf;
+-    uint64_t start, len, maxlen;
+-    int memfound = 0;
+-    int rv;
+-    addr_t dosmem;
+-    const addr_t bios_data = 0x510;    /* Amount to reserve for BIOS data */
++    list_add(&entry->next, &syslinux_memscan_head);
++}
+ 
+-    /* Use INT 12h to get DOS memory */
+-    __intcall(0x12, &__com32_zero_regs, &oreg);
+-    dosmem = oreg.eax.w[0] << 10;
+-    if (dosmem < 32 * 1024 || dosmem > 640 * 1024) {
+-       /* INT 12h reports nonsense... now what? */
+-       uint16_t ebda_seg = *(uint16_t *) 0x40e;
+-       if (ebda_seg >= 0x8000 && ebda_seg < 0xa000)
+-           dosmem = ebda_seg << 4;
+-       else
+-           dosmem = 640 * 1024;        /* Hope for the best... */
+-    }
+-    rv = callback(data, bios_data, dosmem - bios_data, true);
+-    if (rv)
+-       return rv;
++/*
++ * Build a new memscan entry and add it to the list.
++ */
++int syslinux_memscan_new(int func(scan_memory_callback_t, void *data))
++{
++    struct syslinux_memscan *entry;
+ 
+-    /* First try INT 15h AX=E820h */
+-    e820buf = lzalloc(sizeof *e820buf);
+-    if (!e820buf)
++    entry = malloc(sizeof *entry);
++    if (!entry)
+        return -1;
+ 
+-    ireg.eax.l = 0xe820;
+-    ireg.edx.l = 0x534d4150;
+-    ireg.ebx.l = 0;
+-    ireg.ecx.l = sizeof(*e820buf);
+-    ireg.es = SEG(e820buf);
+-    ireg.edi.w[0] = OFFS(e820buf);
+-
+-    do {
+-       __intcall(0x15, &ireg, &oreg);
+-
+-       if ((oreg.eflags.l & EFLAGS_CF) ||
+-           (oreg.eax.l != 0x534d4150) || (oreg.ecx.l < 20))
+-           break;
+-
+-       start = e820buf->start;
+-       len = e820buf->len;
+-
+-       if (start < 0x100000000ULL) {
+-           /* Don't rely on E820 being valid for low memory.  Doing so
+-              could mean stuff like overwriting the PXE stack even when
+-              using "keeppxe", etc. */
+-           if (start < 0x100000ULL) {
+-               if (len > 0x100000ULL - start)
+-                   len -= 0x100000ULL - start;
+-               else
+-                   len = 0;
+-               start = 0x100000ULL;
+-           }
+-
+-           maxlen = 0x100000000ULL - start;
+-           if (len > maxlen)
+-               len = maxlen;
+-
+-           if (len) {
+-               rv = callback(data, (addr_t) start, (addr_t) len,
+-                             e820buf->type == 1);
+-               if (rv)
+-                   return rv;
+-               memfound = 1;
+-           }
+-       }
+-
+-       ireg.ebx.l = oreg.ebx.l;
+-    } while (oreg.ebx.l);
+-
+-    lfree(e820buf);
+-
+-    if (memfound)
+-       return 0;
+-
+-    /* Next try INT 15h AX=E801h */
+-    ireg.eax.w[0] = 0xe801;
+-    __intcall(0x15, &ireg, &oreg);
+-
+-    if (!(oreg.eflags.l & EFLAGS_CF) && oreg.ecx.w[0]) {
+-       rv = callback(data, (addr_t) 1 << 20, oreg.ecx.w[0] << 10, true);
+-       if (rv)
+-           return rv;
+-
+-       if (oreg.edx.w[0]) {
+-           rv = callback(data, (addr_t) 16 << 20, oreg.edx.w[0] << 16, true);
+-           if (rv)
+-               return rv;
+-       }
+-
+-       return 0;
+-    }
+-
+-    /* Finally try INT 15h AH=88h */
+-    ireg.eax.w[0] = 0x8800;
+-    if (!(oreg.eflags.l & EFLAGS_CF) && oreg.eax.w[0]) {
+-       rv = callback(data, (addr_t) 1 << 20, oreg.ecx.w[0] << 10, true);
+-       if (rv)
+-           return rv;
+-    }
+-
++    entry->func = func;
++    syslinux_memscan_add(entry);
+     return 0;
+ }
+ 
+ int syslinux_scan_memory(scan_memory_callback_t callback, void *data)
+ {
+-       return firmware->mem->scan_memory(callback, data);
++    struct syslinux_memscan *entry;
++    int rv = 0;
++
++    list_for_each_entry(entry, &syslinux_memscan_head, next) {
++       rv = entry->func(callback, data);
++       if (rv)
++           break;
++    }
++
++    return rv;
+ }
+diff --git a/core/bios.c b/core/bios.c
+index 53223e8..5344833 100644
+--- a/core/bios.c
++++ b/core/bios.c
+@@ -501,6 +501,129 @@ static inline void bios_timer_init(void)
+ 
+ extern uint16_t *bios_free_mem;
+ 
++struct e820_entry {
++    uint64_t start;
++    uint64_t len;
++    uint32_t type;
++};
++
++static int bios_scan_memory(scan_memory_callback_t callback, void *data)
++{
++    static com32sys_t ireg;
++    com32sys_t oreg;
++    struct e820_entry *e820buf;
++    uint64_t start, len, maxlen;
++    int memfound = 0;
++    int rv;
++    addr_t dosmem;
++    const addr_t bios_data = 0x510;    /* Amount to reserve for BIOS data */
++
++    /* Use INT 12h to get DOS memory */
++    __intcall(0x12, &__com32_zero_regs, &oreg);
++    dosmem = oreg.eax.w[0] << 10;
++    if (dosmem < 32 * 1024 || dosmem > 640 * 1024) {
++       /* INT 12h reports nonsense... now what? */
++       uint16_t ebda_seg = *(uint16_t *) 0x40e;
++       if (ebda_seg >= 0x8000 && ebda_seg < 0xa000)
++           dosmem = ebda_seg << 4;
++       else
++           dosmem = 640 * 1024;        /* Hope for the best... */
++    }
++    rv = callback(data, bios_data, dosmem - bios_data, SMT_FREE);
++    if (rv)
++       return rv;
++
++    /* First try INT 15h AX=E820h */
++    e820buf = lzalloc(sizeof *e820buf);
++    if (!e820buf)
++       return -1;
++
++    ireg.eax.l = 0xe820;
++    ireg.edx.l = 0x534d4150;
++    ireg.ebx.l = 0;
++    ireg.ecx.l = sizeof(*e820buf);
++    ireg.es = SEG(e820buf);
++    ireg.edi.w[0] = OFFS(e820buf);
++
++    do {
++       __intcall(0x15, &ireg, &oreg);
++
++       if ((oreg.eflags.l & EFLAGS_CF) ||
++           (oreg.eax.l != 0x534d4150) || (oreg.ecx.l < 20))
++           break;
++
++       start = e820buf->start;
++       len = e820buf->len;
++
++       if (start < 0x100000000ULL) {
++           /* Don't rely on E820 being valid for low memory.  Doing so
++              could mean stuff like overwriting the PXE stack even when
++              using "keeppxe", etc. */
++           if (start < 0x100000ULL) {
++               if (len > 0x100000ULL - start)
++                   len -= 0x100000ULL - start;
++               else
++                   len = 0;
++               start = 0x100000ULL;
++           }
++
++           maxlen = 0x100000000ULL - start;
++           if (len > maxlen)
++               len = maxlen;
++
++           if (len) {
++               enum syslinux_memmap_types type;
++
++               type = e820buf->type == 1 ? SMT_FREE : SMT_RESERVED;
++               rv = callback(data, (addr_t) start, (addr_t) len, type);
++               if (rv)
++                   return rv;
++               memfound = 1;
++           }
++       }
++
++       ireg.ebx.l = oreg.ebx.l;
++    } while (oreg.ebx.l);
++
++    lfree(e820buf);
++
++    if (memfound)
++       return 0;
++
++    /* Next try INT 15h AX=E801h */
++    ireg.eax.w[0] = 0xe801;
++    __intcall(0x15, &ireg, &oreg);
++
++    if (!(oreg.eflags.l & EFLAGS_CF) && oreg.ecx.w[0]) {
++       rv = callback(data, (addr_t) 1 << 20, oreg.ecx.w[0] << 10, SMT_FREE);
++       if (rv)
++           return rv;
++
++       if (oreg.edx.w[0]) {
++           rv = callback(data, (addr_t) 16 << 20,
++                         oreg.edx.w[0] << 16, SMT_FREE);
++           if (rv)
++               return rv;
++       }
++
++       return 0;
++    }
++
++    /* Finally try INT 15h AH=88h */
++    ireg.eax.w[0] = 0x8800;
++    if (!(oreg.eflags.l & EFLAGS_CF) && oreg.eax.w[0]) {
++       rv = callback(data, (addr_t) 1 << 20, oreg.ecx.w[0] << 10, SMT_FREE);
++       if (rv)
++           return rv;
++    }
++
++    return 0;
++}
++
++static struct syslinux_memscan bios_memscan = {
++    .func = bios_scan_memory,
++};
++
+ void bios_init(void)
+ {
+        int i;
+@@ -515,6 +638,7 @@ void bios_init(void)
+ 
+        /* Init the memory subsystem */
+        bios_free_mem = (uint16_t *)0x413;
++       syslinux_memscan_add(&bios_memscan);
+        mem_init();
+ 
+        /* CPU-dependent initialization and related checks. */
+@@ -534,7 +658,6 @@ struct mem_ops bios_mem_ops = {
+        .malloc = bios_malloc,
+        .realloc = bios_realloc,
+        .free = bios_free,
+-       .scan_memory = bios_scan_memory,
+ };
+ 
+ struct firmware bios_fw = {
+diff --git a/efi/main.c b/efi/main.c
+index 13b9403..fb8cf05 100644
+--- a/efi/main.c
++++ b/efi/main.c
+@@ -296,21 +296,21 @@ int efi_scan_memory(scan_memory_callback_t callback, void *data)
+        for (i = 0; i < nr_entries; bufpos += desc_sz, i++) {
+                EFI_MEMORY_DESCRIPTOR *m;
+                UINT64 region_sz;
+-               int valid;
++               enum syslinux_memmap_types type;
+ 
+                m = (EFI_MEMORY_DESCRIPTOR *)bufpos;
+                region_sz = m->NumberOfPages * EFI_PAGE_SIZE;
+ 
+                switch (m->Type) {
+                 case EfiConventionalMemory:
+-                       valid = 1;
++                       type = SMT_FREE;
+                         break;
+                default:
+-                       valid = 0;
++                       type = SMT_RESERVED;
+                        break;
+                }
+ 
+-               rv = callback(data, m->PhysicalStart, region_sz, valid);
++               rv = callback(data, m->PhysicalStart, region_sz, type);
+                if (rv)
+                        break;
+        }
+@@ -319,11 +319,16 @@ int efi_scan_memory(scan_memory_callback_t callback, void *data)
+        return rv;
+ }
+ 
++static struct syslinux_memscan efi_memscan = {
++    .func = efi_scan_memory,
++};
++
+ extern uint16_t *bios_free_mem;
+ void efi_init(void)
+ {
+        /* XXX timer */
+        *bios_free_mem = 0;
++       syslinux_memscan_add(&efi_memscan);
+        mem_init();
+ }
+ 
+@@ -1103,7 +1108,6 @@ struct mem_ops efi_mem_ops = {
+        .malloc = efi_malloc,
+        .realloc = efi_realloc,
+        .free = efi_free,
+-       .scan_memory = efi_scan_memory,
+ };
+ 
+ struct firmware efi_fw = {
+-- 
+1.8.5.3
+
diff --git a/meta/recipes-devtools/syslinux/files/0003-PXELINUX-Add-bios-memscan-function.patch b/meta/recipes-devtools/syslinux/files/0003-PXELINUX-Add-bios-memscan-function.patch
new file mode 100644
index 0000000000..70d65fd71d
--- /dev/null
+++ b/meta/recipes-devtools/syslinux/files/0003-PXELINUX-Add-bios-memscan-function.patch
@@ -0,0 +1,87 @@
+Upstream-Status: Backport [d2f94e74fbd60bf491753895d2474105efb3dedf]
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+
+From 5d57e8eb46f209481069d70eaa778481f6fa3edb Mon Sep 17 00:00:00 2001
+From: Matt Fleming <matt.fleming@intel.com>
+Date: Wed, 17 Jul 2013 13:04:30 +0100
+Subject: [PATCH 3/4] PXELINUX: Add bios memscan function
+
+We can mark the memory region occupied by the PXE stack as SMT_TERMINAL
+provided that KeepPXE isn't set. Historically some very old
+non-relocatable kernel images (memtest86+) have a load address that
+falls within the PXE stack region, so we need to attempt to load into
+that region if at all possible.
+
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+---
+ core/fs/pxe/bios.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/core/fs/pxe/bios.c b/core/fs/pxe/bios.c
+index 81aa715..5f61824 100644
+--- a/core/fs/pxe/bios.c
++++ b/core/fs/pxe/bios.c
+@@ -1,4 +1,5 @@
+ #include <syslinux/firmware.h>
++#include <syslinux/memscan.h>
+ #include <core.h>
+ #include "pxe.h"
+ #include <net.h>
+@@ -10,6 +11,9 @@ static uint16_t real_base_mem;           /* Amount of DOS memory after freeing */
+ static bool has_gpxe;
+ static uint32_t gpxe_funcs;
+ 
++static addr_t pxe_code_start, pxe_code_size;
++static addr_t pxe_data_start, pxe_data_size;
++
+ /*
+  * Validity check on possible !PXE structure in buf
+  * return 1 for success, 0 for failure.
+@@ -88,6 +92,29 @@ static const struct pxenv_t *memory_scan_for_pxenv_struct(void)
+     return memory_scan(0x10000, is_pxenv);
+ }
+ 
++static int pxelinux_scan_memory(scan_memory_callback_t callback, void *data)
++{
++    int rv = 0;
++
++    /*
++     * If we are planning on calling unload_pxe() and unmapping the PXE
++     * region before we transfer control away from PXELINUX we can mark
++     * that region as SMT_TERMINAL to indicate that the region will
++     * become free at some point in the future.
++     */
++    if (!KeepPXE) {
++       dprintf("Marking PXE code region 0x%x - 0x%x as SMT_TERMINAL\n",
++               pxe_code_start, pxe_code_start + pxe_code_size);
++       rv = callback(data, pxe_code_start, pxe_code_size, SMT_TERMINAL);
++
++       dprintf("Marking PXE data region 0x%x - 0x%x as SMT_TERMINAL\n",
++               pxe_data_start, pxe_data_start + pxe_data_size);
++       rv = callback(data, pxe_data_start, pxe_data_size, SMT_TERMINAL);
++    }
++
++    return rv;
++}
++
+ /*
+  * Find the !PXE structure; we search for the following, in order:
+  *
+@@ -204,6 +231,14 @@ int pxe_init(bool quiet)
+        printf("UNDI data segment at %04X len %04X\n", data_seg, data_len);
+     }
+ 
++    pxe_code_start = code_seg << 4;
++    pxe_code_size = code_len;
++
++    pxe_data_start = data_seg << 4;
++    pxe_data_size = data_len;
++
++    syslinux_memscan_new(pxelinux_scan_memory);
++
+     code_seg = code_seg + ((code_len + 15) >> 4);
+     data_seg = data_seg + ((data_len + 15) >> 4);
+ 
+-- 
+1.8.5.3
+
diff --git a/meta/recipes-devtools/syslinux/files/0004-pxe-use-bios_fbm-and-real_base_mem-to-calculate-free.patch b/meta/recipes-devtools/syslinux/files/0004-pxe-use-bios_fbm-and-real_base_mem-to-calculate-free.patch
new file mode 100644
index 0000000000..ee0a77237d
--- /dev/null
+++ b/meta/recipes-devtools/syslinux/files/0004-pxe-use-bios_fbm-and-real_base_mem-to-calculate-free.patch
@@ -0,0 +1,65 @@
+Upstream-Status: Backport [c0ea15936de8378d1da6843d3dbddd8dddba1011]
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+
+From f3347f9b09135d71a4effae1614b22dcdf16a7e2 Mon Sep 17 00:00:00 2001
+From: Matt Fleming <matt.fleming@intel.com>
+Date: Wed, 24 Jul 2013 18:33:14 +0100
+Subject: [PATCH 4/4] pxe: use bios_fbm() and real_base_mem to calculate free
+ space
+
+We don't need to individually add the PXE regions, we already have two
+symbols that denote the memory region that will be freed when calling
+unload_pxe().
+
+This essentially reverts commit 03dda0f1 ("pxe: mark all PXE regions as
+SMT_TERMINAL").
+
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+
+Conflicts:
+        core/fs/pxe/bios.c
+---
+ core/fs/pxe/bios.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/core/fs/pxe/bios.c b/core/fs/pxe/bios.c
+index 5f61824..ffdffaf 100644
+--- a/core/fs/pxe/bios.c
++++ b/core/fs/pxe/bios.c
+@@ -94,24 +94,24 @@ static const struct pxenv_t *memory_scan_for_pxenv_struct(void)
+ 
+ static int pxelinux_scan_memory(scan_memory_callback_t callback, void *data)
+ {
++    addr_t start, size;
+     int rv = 0;
+ 
++    if (KeepPXE)
++       return 0;
++
+     /*
+      * If we are planning on calling unload_pxe() and unmapping the PXE
+      * region before we transfer control away from PXELINUX we can mark
+      * that region as SMT_TERMINAL to indicate that the region will
+      * become free at some point in the future.
+      */
+-    if (!KeepPXE) {
+-       dprintf("Marking PXE code region 0x%x - 0x%x as SMT_TERMINAL\n",
+-               pxe_code_start, pxe_code_start + pxe_code_size);
+-       rv = callback(data, pxe_code_start, pxe_code_size, SMT_TERMINAL);
+-
+-       dprintf("Marking PXE data region 0x%x - 0x%x as SMT_TERMINAL\n",
+-               pxe_data_start, pxe_data_start + pxe_data_size);
+-       rv = callback(data, pxe_data_start, pxe_data_size, SMT_TERMINAL);
+-    }
++    start = bios_fbm() << 10;
++    size = (real_base_mem - bios_fbm()) << 10;
++    dprintf("Marking PXE region 0x%x - 0x%x as SMT_TERMINAL\n",
++       start, start + size);
+ 
++    callback(data, start, size, SMT_TERMINAL);
+     return rv;
+ }
+ 
+-- 
+1.8.5.3
+
diff --git a/meta/recipes-devtools/syslinux/syslinux_6.01.bb b/meta/recipes-devtools/syslinux/syslinux_6.01.bb
index 078f8bc40b..1af6806100 100644
--- a/meta/recipes-devtools/syslinux/syslinux_6.01.bb
+++ b/meta/recipes-devtools/syslinux/syslinux_6.01.bb
@@ -8,7 +8,11 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=0636e73ff0215e8d672dc4c32c317bb3 \
 # ldlinux.* stuff for now, so skip mtools-native
 DEPENDS = "nasm-native util-linux"
 
-SRC_URI = "${KERNELORG_MIRROR}/linux/utils/boot/syslinux/6.xx/syslinux-${PV}.tar.bz2"
+SRC_URI = "${KERNELORG_MIRROR}/linux/utils/boot/syslinux/6.xx/syslinux-${PV}.tar.bz2 \
+           file://0001-movebits-Add-SMT_TERMINAL-a-last-resort-region-type.patch \
+           file://0002-memscan-build-a-linked-list-of-memory-scanners.patch \
+           file://0003-PXELINUX-Add-bios-memscan-function.patch \
+           file://0004-pxe-use-bios_fbm-and-real_base_mem-to-calculate-free.patch"
 
 SRC_URI[md5sum] = "6945ee89e29119d459baed4937bbc534"
 SRC_URI[sha256sum] = "83a04cf81e6a46b80ee5a321926eea095af3498b04317e3674b46c125c7a5b43"