Move malloc code from pmm.c to new files malloc.c and malloc.h.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

43 files changed, 657 insertions, 604 deletions

diff --git a/src/block.c b/src/block.c
index 9cfd7dd..5c8bf75 100644
--- a/src/block.c
+++ b/src/block.c
@@ -13,6 +13,7 @@
 #include "hw/ahci.h" // process_ahci_op
 #include "hw/virtio-blk.h" // process_virtio_blk_op
 #include "hw/blockcmd.h" // cdb_*
+#include "malloc.h" // malloc_low
 #include "stacks.h" // stack_hop
 #include "string.h" // checksum
 
diff --git a/src/bmp.c b/src/bmp.c
index 81be306..68952f6 100644
--- a/src/bmp.c
+++ b/src/bmp.c
@@ -6,8 +6,8 @@
 *
 * This work is licensed under the terms of the GNU LGPLv3.
 */
-#include "util.h" // malloc_tmphigh
 #include "bmp.h" // struct bmp_decdata
+#include "malloc.h" // malloc_tmphigh
 #include "string.h" // memcpy
 
 #define bmp_load4byte(addr) (*(u32 *)(addr))
diff --git a/src/boot.c b/src/boot.c
index 08876fa..cb85325 100644
--- a/src/boot.c
+++ b/src/boot.c
@@ -16,6 +16,7 @@
 #include "hw/usb.h" // struct usbdevice_s
 #include "fw/csm.h" // csm_bootprio_*
 #include "list.h" // hlist_node
+#include "malloc.h" // free
 #include "romfile.h" // romfile_loadint
 #include "string.h" // memset
 
diff --git a/src/bootsplash.c b/src/bootsplash.c
index 493d60d..1bea722 100644
--- a/src/bootsplash.c
+++ b/src/bootsplash.c
@@ -13,6 +13,7 @@
 #include "vbe.h" // struct vbe_info
 #include "bmp.h" // bmp_alloc
 #include "fw/smbios.h" // display_uuid
+#include "malloc.h" // free
 #include "romfile.h" // romfile_loadfile
 #include "stacks.h" // call16_int
 #include "string.h" // memset
diff --git a/src/cdrom.c b/src/cdrom.c
index 0d3fa1f..a9ac9e4 100644
--- a/src/cdrom.c
+++ b/src/cdrom.c
@@ -11,6 +11,7 @@
 #include "biosvar.h" // GET_GLOBAL
 #include "hw/ata.h" // ATA_CMD_REQUEST_SENSE
 #include "hw/blockcmd.h" // CDB_CMD_REQUEST_SENSE
+#include "malloc.h" // free
 #include "string.h" // memset
 
 // Locks for removable devices
diff --git a/src/fw/acpi.c b/src/fw/acpi.c
index f94a6fb..8ad3673 100644
--- a/src/fw/acpi.c
+++ b/src/fw/acpi.c
@@ -15,6 +15,7 @@
 #include "config.h" // CONFIG_*
 #include "paravirt.h" // RamSize
 #include "dev-q35.h"
+#include "malloc.h" // free
 #include "romfile.h" // romfile_loadint
 #include "string.h" // memset
 #include "x86.h" // readl
diff --git a/src/fw/biostables.c b/src/fw/biostables.c
index cd58ff9..06cd864 100644
--- a/src/fw/biostables.c
+++ b/src/fw/biostables.c
@@ -8,6 +8,7 @@
 #include "util.h" // dprintf
 #include "hw/pci.h" // struct pir_header
 #include "acpi.h" // struct rsdp_descriptor
+#include "malloc.h" // malloc_fseg
 #include "mptable.h" // MPTABLE_SIGNATURE
 #include "smbios.h" // struct smbios_entry_point
 #include "string.h" // memcpy
diff --git a/src/fw/coreboot.c b/src/fw/coreboot.c
index ba65dc6..9971f82 100644
--- a/src/fw/coreboot.c
+++ b/src/fw/coreboot.c
@@ -14,6 +14,7 @@
 #include "config.h" // CONFIG_*
 #include "acpi.h" // find_acpi_features
 #include "hw/pci.h" // pci_probe_devices
+#include "malloc.h" // free
 #include "paravirt.h" // PlatformRunningOn
 #include "romfile.h" // romfile_findprefix
 #include "stacks.h" // yield
diff --git a/src/fw/csm.c b/src/fw/csm.c
index 81159b3..9e73a40 100644
--- a/src/fw/csm.c
+++ b/src/fw/csm.c
@@ -17,6 +17,7 @@
 #include "boot.h"
 #include "smbios.h"
 #include "hw/pic.h"
+#include "malloc.h" // csm_malloc_preinit
 #include "stacks.h" // wait_threads
 
 struct rsdp_descriptor csm_rsdp VARFSEG __aligned(16);
@@ -250,9 +251,9 @@ handle_csm_0006(struct bregs *regs)
         size, align, region);
 
     if (region & 2)
-        chunk = pmm_malloc(&ZoneLow, PMM_DEFAULT_HANDLE, size, align);
+        chunk = _malloc(&ZoneLow, MALLOC_DEFAULT_HANDLE, size, align);
     if (!chunk && (region & 1))
-        chunk = pmm_malloc(&ZoneFSeg, PMM_DEFAULT_HANDLE, size, align);
+        chunk = _malloc(&ZoneFSeg, MALLOC_DEFAULT_HANDLE, size, align);
 
     dprintf(3, "Legacy16GetTableAddress size %x align %x region %d yields %p\n",
         size, align, region, chunk);
diff --git a/src/fw/mptable.c b/src/fw/mptable.c
index c79f54f..4562a46 100644
--- a/src/fw/mptable.c
+++ b/src/fw/mptable.c
@@ -10,6 +10,7 @@
 #include "mptable.h" // MPTABLE_SIGNATURE
 #include "hw/pci.h"
 #include "hw/pci_regs.h"
+#include "malloc.h" // free
 #include "romfile.h" // romfile_loadint
 #include "string.h" // memset
 #include "x86.h" // cpuid
diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c
index fd58184..ea2bbfb 100644
--- a/src/fw/paravirt.c
+++ b/src/fw/paravirt.c
@@ -20,6 +20,7 @@
 #include "mptable.h" // mptable_setup
 #include "hw/pci.h" // create_pirtable
 #include "xen.h" // xen_biostable_setup
+#include "malloc.h" // malloc_tmp
 #include "romfile.h" // romfile_loadint
 #include "string.h" // memset
 #include "x86.h" // cpuid
diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c
index ee8d5dd..549c940 100644
--- a/src/fw/pciinit.c
+++ b/src/fw/pciinit.c
@@ -16,6 +16,7 @@
 #include "dev-q35.h" // Q35_HOST_BRIDGE_PCIEXBAR_ADDR
 #include "list.h" // struct hlist_node
 #include "acpi.h" // acpi_pm1a_cnt
+#include "malloc.h" // free
 #include "string.h" // memset
 
 #define PCI_DEVICE_MEM_MIN     0x1000
diff --git a/src/fw/shadow.c b/src/fw/shadow.c
index 45cfcaf..c470592 100644
--- a/src/fw/shadow.c
+++ b/src/fw/shadow.c
@@ -12,6 +12,7 @@
 #include "hw/pci_regs.h" // PCI_VENDOR_ID
 #include "paravirt.h" // runningOnXen
 #include "dev-q35.h" // PCI_VENDOR_ID_INTEL
+#include "malloc.h" // rom_get_last
 #include "string.h" // memset
 #include "x86.h" // wbinvd
 
diff --git a/src/fw/smbios.c b/src/fw/smbios.c
index 2f95d96..beb3143 100644
--- a/src/fw/smbios.c
+++ b/src/fw/smbios.c
@@ -9,6 +9,7 @@
 #include "config.h" // CONFIG_*
 #include "paravirt.h" // RamSize
 #include "smbios.h" // struct smbios_entry_point
+#include "malloc.h" // free
 #include "romfile.h" // romfile_findprefix
 #include "string.h" // memset
 #include "x86.h" // cpuid
diff --git a/src/fw/xen.c b/src/fw/xen.c
index f181e5f..8412330 100644
--- a/src/fw/xen.c
+++ b/src/fw/xen.c
@@ -11,6 +11,7 @@
 #include "types.h" // ASM32FLAT
 #include "util.h" // copy_acpi_rsdp
 #include "acpi.h" // find_acpi_features
+#include "malloc.h" // memalign_high
 #include "string.h" // memcpy
 #include "x86.h" // cpuid
 
diff --git a/src/hw/ahci.c b/src/hw/ahci.c
index 1fa1d3e..3af10d0 100644
--- a/src/hw/ahci.c
+++ b/src/hw/ahci.c
@@ -16,6 +16,7 @@
 #include "ata.h" // ATA_CB_STAT
 #include "ahci.h" // CDB_CMD_READ_10
 #include "blockcmd.h" // CDB_CMD_READ_10
+#include "malloc.h" // free
 #include "stacks.h" // yield
 #include "string.h" // memset
 
diff --git a/src/hw/ata.c b/src/hw/ata.c
index 5e9b905..b58ecc3 100644
--- a/src/hw/ata.c
+++ b/src/hw/ata.c
@@ -19,6 +19,7 @@
 #include "disk.h" // struct ata_s
 #include "ata.h" // ATA_CB_STAT
 #include "blockcmd.h" // CDB_CMD_READ_10
+#include "malloc.h" // malloc_fseg
 #include "stacks.h" // yield
 #include "string.h" // memset
 
diff --git a/src/hw/esp-scsi.c b/src/hw/esp-scsi.c
index 49c74ff..0f55bb9 100644
--- a/src/hw/esp-scsi.c
+++ b/src/hw/esp-scsi.c
@@ -20,6 +20,7 @@
 #include "blockcmd.h" // scsi_drive_setup
 #include "fw/paravirt.h" // runningOnQEMU
 #include "disk.h"
+#include "malloc.h" // free
 #include "string.h" // memset
 
 #define ESP_TCLO      0x00
diff --git a/src/hw/floppy.c b/src/hw/floppy.c
index c8ae756..baae88b 100644
--- a/src/hw/floppy.c
+++ b/src/hw/floppy.c
@@ -14,6 +14,7 @@
 #include "pic.h" // pic_eoi1
 #include "bregs.h" // struct bregs
 #include "boot.h" // boot_add_floppy
+#include "malloc.h" // malloc_fseg
 #include "pci.h" // pci_to_bdf
 #include "pci_ids.h" // PCI_CLASS_BRIDGE_ISA
 #include "romfile.h" // romfile_loadint
diff --git a/src/hw/lsi-scsi.c b/src/hw/lsi-scsi.c
index 0563fab..91ed198 100644
--- a/src/hw/lsi-scsi.c
+++ b/src/hw/lsi-scsi.c
@@ -20,6 +20,7 @@
 #include "blockcmd.h" // scsi_drive_setup
 #include "fw/paravirt.h" // runningOnQEMU
 #include "disk.h"
+#include "malloc.h" // free
 #include "string.h" // memset
 
 #define LSI_REG_DSTAT     0x0c
diff --git a/src/hw/megasas.c b/src/hw/megasas.c
index 19ed1b4..29143eb 100644
--- a/src/hw/megasas.c
+++ b/src/hw/megasas.c
@@ -19,6 +19,7 @@
 #include "boot.h" // bootprio_find_scsi_device
 #include "blockcmd.h" // scsi_drive_setup
 #include "disk.h"
+#include "malloc.h" // free
 #include "stacks.h" // yield
 #include "string.h" // memset
 
diff --git a/src/hw/pci.c b/src/hw/pci.c
index f171d10..9c287ee 100644
--- a/src/hw/pci.c
+++ b/src/hw/pci.c
@@ -10,6 +10,7 @@
 #include "ioport.h" // outl
 #include "util.h" // dprintf
 #include "farptr.h" // MAKE_FLATPTR
+#include "malloc.h" // malloc_tmp
 #include "pci_regs.h" // PCI_VENDOR_ID
 #include "pci_ids.h" // PCI_CLASS_DISPLAY_VGA
 #include "romfile.h" // romfile_loadint
diff --git a/src/hw/ramdisk.c b/src/hw/ramdisk.c
index 3eadd74..a50e7c0 100644
--- a/src/hw/ramdisk.c
+++ b/src/hw/ramdisk.c
@@ -10,6 +10,7 @@
 #include "biosvar.h" // GET_GLOBAL
 #include "bregs.h" // struct bregs
 #include "boot.h" // boot_add_floppy
+#include "malloc.h" // malloc_fseg
 #include "romfile.h" // romfile_findprefix
 #include "stacks.h" // call16_int
 #include "string.h" // memset
diff --git a/src/hw/usb-ehci.c b/src/hw/usb-ehci.c
index bb02293..6786fd3 100644
--- a/src/hw/usb-ehci.c
+++ b/src/hw/usb-ehci.c
@@ -15,6 +15,7 @@
 #include "biosvar.h" // GET_LOWFLAT
 #include "usb-uhci.h" // uhci_setup
 #include "usb-ohci.h" // ohci_setup
+#include "malloc.h" // free
 #include "string.h" // memset
 #include "x86.h" // readl
 
diff --git a/src/hw/usb-msc.c b/src/hw/usb-msc.c
index d5cf1b4..f592726 100644
--- a/src/hw/usb-msc.c
+++ b/src/hw/usb-msc.c
@@ -12,6 +12,7 @@
 #include "blockcmd.h" // cdb_read
 #include "disk.h" // DTYPE_USB
 #include "boot.h" // bootprio_find_usb
+#include "malloc.h" // free
 #include "string.h" // memset
 
 struct usbdrive_s {
diff --git a/src/hw/usb-ohci.c b/src/hw/usb-ohci.c
index 0febcca..c96c1d7 100644
--- a/src/hw/usb-ohci.c
+++ b/src/hw/usb-ohci.c
@@ -11,6 +11,7 @@
 #include "pci_regs.h" // PCI_BASE_ADDRESS_0
 #include "usb.h" // struct usb_s
 #include "biosvar.h" // GET_LOWFLAT
+#include "malloc.h" // free
 #include "string.h" // memset
 #include "x86.h" // readl
 
diff --git a/src/hw/usb-uas.c b/src/hw/usb-uas.c
index c205d7f..ab9a050 100644
--- a/src/hw/usb-uas.c
+++ b/src/hw/usb-uas.c
@@ -22,6 +22,7 @@
 #include "disk.h" // DTYPE_UAS
 #include "boot.h" // bootprio_find_usb
 #include "usb-uas.h" // usb_uas_init
+#include "malloc.h" // free
 #include "string.h" // memset
 
 #define UAS_UI_COMMAND              0x01
diff --git a/src/hw/usb-uhci.c b/src/hw/usb-uhci.c
index 4716d98..2587a56 100644
--- a/src/hw/usb-uhci.c
+++ b/src/hw/usb-uhci.c
@@ -12,6 +12,7 @@
 #include "pci_regs.h" // PCI_BASE_ADDRESS_4
 #include "usb.h" // struct usb_s
 #include "biosvar.h" // GET_LOWFLAT
+#include "malloc.h" // free
 #include "string.h" // memset
 
 struct usb_uhci_s {
diff --git a/src/hw/usb.c b/src/hw/usb.c
index 4026555..5216cce 100644
--- a/src/hw/usb.c
+++ b/src/hw/usb.c
@@ -18,6 +18,7 @@
 #include "usb-uas.h" // usb_uas_setup
 #include "usb.h" // struct usb_s
 #include "biosvar.h" // GET_GLOBAL
+#include "malloc.h" // free
 #include "string.h" // memset
 #include "x86.h" // __fls
 
diff --git a/src/hw/virtio-blk.c b/src/hw/virtio-blk.c
index 761e64f..6b628f3 100644
--- a/src/hw/virtio-blk.c
+++ b/src/hw/virtio-blk.c
@@ -18,6 +18,7 @@
 #include "virtio-ring.h"
 #include "virtio-blk.h"
 #include "disk.h"
+#include "malloc.h" // free
 #include "string.h" // memset
 
 struct virtiodrive_s {
diff --git a/src/hw/virtio-pci.c b/src/hw/virtio-pci.c
index 6a16463..07177ac 100644
--- a/src/hw/virtio-pci.c
+++ b/src/hw/virtio-pci.c
@@ -19,6 +19,7 @@
 #include "virtio-pci.h"
 #include "config.h" // CONFIG_DEBUG_LEVEL
 #include "util.h" // dprintf
+#include "malloc.h" // free
 #include "pci.h" // pci_config_readl
 #include "pci_regs.h" // PCI_BASE_ADDRESS_0
 #include "string.h" // memset
diff --git a/src/hw/virtio-scsi.c b/src/hw/virtio-scsi.c
index 06f7b60..8c9c670 100644
--- a/src/hw/virtio-scsi.c
+++ b/src/hw/virtio-scsi.c
@@ -19,6 +19,7 @@
 #include "virtio-ring.h"
 #include "virtio-scsi.h"
 #include "disk.h"
+#include "malloc.h" // free
 #include "string.h" // memset
 
 struct virtio_lun_s {
diff --git a/src/jpeg.c b/src/jpeg.c
index e7fc337..925aa3d 100644
--- a/src/jpeg.c
+++ b/src/jpeg.c
@@ -40,7 +40,7 @@
  */
 
 #define __LITTLE_ENDIAN
-#include "util.h"
+#include "malloc.h"
 #include "jpeg.h"
 #include "string.h"
 #define ISHIFT 11
diff --git a/src/malloc.c b/src/malloc.c
new file mode 100644
index 0000000..f4783af
--- /dev/null
+++ b/src/malloc.c
@@ -0,0 +1,529 @@
+// Post memory manager (PMM) calls
+//
+// Copyright (C) 2009  Kevin O'Connor <kevin@koconnor.net>
+//
+// This file may be distributed under the terms of the GNU LGPLv3 license.
+
+#include "util.h" // dprintf
+#include "config.h" // BUILD_BIOS_ADDR
+#include "memmap.h" // struct e820entry
+#include "biosvar.h" // GET_BDA
+#include "optionroms.h" // OPTION_ROM_ALIGN
+#include "list.h" // hlist_node
+#include "malloc.h" // _malloc
+#include "stacks.h" // wait_preempt
+#include "string.h" // memset
+
+// Information on a reserved area.
+struct allocinfo_s {
+    struct hlist_node node;
+    void *data, *dataend, *allocend;
+};
+
+// Information on a tracked memory allocation.
+struct allocdetail_s {
+    struct allocinfo_s detailinfo;
+    struct allocinfo_s datainfo;
+    u32 handle;
+};
+
+// The various memory zones.
+struct zone_s {
+    struct hlist_head head;
+};
+
+struct zone_s ZoneLow VARVERIFY32INIT, ZoneHigh VARVERIFY32INIT;
+struct zone_s ZoneFSeg VARVERIFY32INIT;
+struct zone_s ZoneTmpLow VARVERIFY32INIT, ZoneTmpHigh VARVERIFY32INIT;
+
+static struct zone_s *Zones[] VARVERIFY32INIT = {
+    &ZoneTmpLow, &ZoneLow, &ZoneFSeg, &ZoneTmpHigh, &ZoneHigh
+};
+
+
+/****************************************************************
+ * low-level memory reservations
+ ****************************************************************/
+
+// Find and reserve space from a given zone
+static void *
+allocSpace(struct zone_s *zone, u32 size, u32 align, struct allocinfo_s *fill)
+{
+    struct allocinfo_s *info;
+    hlist_for_each_entry(info, &zone->head, node) {
+        void *dataend = info->dataend;
+        void *allocend = info->allocend;
+        void *newallocend = (void*)ALIGN_DOWN((u32)allocend - size, align);
+        if (newallocend >= dataend && newallocend <= allocend) {
+            // Found space - now reserve it.
+            if (!fill)
+                fill = newallocend;
+            fill->data = newallocend;
+            fill->dataend = newallocend + size;
+            fill->allocend = allocend;
+
+            info->allocend = newallocend;
+            hlist_add_before(&fill->node, &info->node);
+            return newallocend;
+        }
+    }
+    return NULL;
+}
+
+// Release space allocated with allocSpace()
+static void
+freeSpace(struct allocinfo_s *info)
+{
+    struct allocinfo_s *next = container_of_or_null(
+        info->node.next, struct allocinfo_s, node);
+    if (next && next->allocend == info->data)
+        next->allocend = info->allocend;
+    hlist_del(&info->node);
+}
+
+// Add new memory to a zone
+static void
+addSpace(struct zone_s *zone, void *start, void *end)
+{
+    // Find position to add space
+    struct allocinfo_s *info;
+    struct hlist_node **pprev;
+    hlist_for_each_entry_pprev(info, pprev, &zone->head, node) {
+        if (info->data < start)
+            break;
+    }
+
+    // Add space using temporary allocation info.
+    struct allocdetail_s tempdetail;
+    tempdetail.datainfo.data = tempdetail.datainfo.dataend = start;
+    tempdetail.datainfo.allocend = end;
+    hlist_add(&tempdetail.datainfo.node, pprev);
+
+    // Allocate final allocation info.
+    struct allocdetail_s *detail = allocSpace(
+        &ZoneTmpHigh, sizeof(*detail), MALLOC_MIN_ALIGN, NULL);
+    if (!detail) {
+        detail = allocSpace(&ZoneTmpLow, sizeof(*detail)
+                            , MALLOC_MIN_ALIGN, NULL);
+        if (!detail) {
+            hlist_del(&tempdetail.datainfo.node);
+            warn_noalloc();
+            return;
+        }
+    }
+
+    // Replace temp alloc space with final alloc space
+    pprev = tempdetail.datainfo.node.pprev;
+    hlist_del(&tempdetail.datainfo.node);
+    memcpy(&detail->datainfo, &tempdetail.datainfo, sizeof(detail->datainfo));
+    detail->handle = MALLOC_DEFAULT_HANDLE;
+    hlist_add(&detail->datainfo.node, pprev);
+}
+
+// Search all zones for an allocation obtained from allocSpace()
+static struct allocinfo_s *
+findAlloc(void *data)
+{
+    int i;
+    for (i=0; i<ARRAY_SIZE(Zones); i++) {
+        struct allocinfo_s *info;
+        hlist_for_each_entry(info, &Zones[i]->head, node) {
+            if (info->data == data)
+                return info;
+        }
+    }
+    return NULL;
+}
+
+// Return the last sentinal node of a zone
+static struct allocinfo_s *
+findLast(struct zone_s *zone)
+{
+    struct allocinfo_s *info, *last = NULL;
+    hlist_for_each_entry(info, &zone->head, node) {
+        last = info;
+    }
+    return last;
+}
+
+
+/****************************************************************
+ * ebda movement
+ ****************************************************************/
+
+// Move ebda
+static int
+relocate_ebda(u32 newebda, u32 oldebda, u8 ebda_size)
+{
+    u32 lowram = GET_BDA(mem_size_kb) * 1024;
+    if (oldebda != lowram)
+        // EBDA isn't at end of ram - give up.
+        return -1;
+
+    // Do copy
+    memmove((void*)newebda, (void*)oldebda, ebda_size * 1024);
+
+    // Update indexes
+    dprintf(1, "ebda moved from %x to %x\n", oldebda, newebda);
+    SET_BDA(mem_size_kb, newebda / 1024);
+    SET_BDA(ebda_seg, FLATPTR_TO_SEG(newebda));
+    return 0;
+}
+
+// Support expanding the ZoneLow dynamically.
+static void *
+zonelow_expand(u32 size, u32 align, struct allocinfo_s *fill)
+{
+    // Make sure to not move ebda while an optionrom is running.
+    if (unlikely(wait_preempt())) {
+        void *data = allocSpace(&ZoneLow, size, align, fill);
+        if (data)
+            return data;
+    }
+
+    struct allocinfo_s *info = findLast(&ZoneLow);
+    if (!info)
+        return NULL;
+    u32 oldpos = (u32)info->allocend;
+    u32 newpos = ALIGN_DOWN(oldpos - size, align);
+    u32 bottom = (u32)info->dataend;
+    if (newpos >= bottom && newpos <= oldpos)
+        // Space already present.
+        return allocSpace(&ZoneLow, size, align, fill);
+    u16 ebda_seg = get_ebda_seg();
+    u32 ebda_pos = (u32)MAKE_FLATPTR(ebda_seg, 0);
+    u8 ebda_size = GET_EBDA(ebda_seg, size);
+    u32 ebda_end = ebda_pos + ebda_size * 1024;
+    if (ebda_end != bottom)
+        // Something else is after ebda - can't use any existing space.
+        newpos = ALIGN_DOWN(ebda_end - size, align);
+    u32 newbottom = ALIGN_DOWN(newpos, 1024);
+    u32 newebda = ALIGN_DOWN(newbottom - ebda_size * 1024, 1024);
+    if (newebda < BUILD_EBDA_MINIMUM)
+        // Not enough space.
+        return NULL;
+
+    // Move ebda
+    int ret = relocate_ebda(newebda, ebda_pos, ebda_size);
+    if (ret)
+        return NULL;
+
+    // Update zone
+    if (ebda_end == bottom) {
+        info->data = (void*)newbottom;
+        info->dataend = (void*)newbottom;
+    } else
+        addSpace(&ZoneLow, (void*)newbottom, (void*)ebda_end);
+
+    return allocSpace(&ZoneLow, size, align, fill);
+}
+
+
+/****************************************************************
+ * tracked memory allocations
+ ****************************************************************/
+
+// Allocate memory from the given zone and track it as a PMM allocation
+void * __malloc
+_malloc(struct zone_s *zone, u32 handle, u32 size, u32 align)
+{
+    ASSERT32FLAT();
+    if (!size)
+        return NULL;
+
+    // Find and reserve space for bookkeeping.
+    struct allocdetail_s *detail = allocSpace(
+        &ZoneTmpHigh, sizeof(*detail), MALLOC_MIN_ALIGN, NULL);
+    if (!detail) {
+        detail = allocSpace(&ZoneTmpLow, sizeof(*detail)
+                            , MALLOC_MIN_ALIGN, NULL);
+        if (!detail)
+            return NULL;
+    }
+
+    // Find and reserve space for main allocation
+    void *data = allocSpace(zone, size, align, &detail->datainfo);
+    if (!CONFIG_MALLOC_UPPERMEMORY && !data && zone == &ZoneLow)
+        data = zonelow_expand(size, align, &detail->datainfo);
+    if (!data) {
+        freeSpace(&detail->detailinfo);
+        return NULL;
+    }
+
+    dprintf(8, "_malloc zone=%p handle=%x size=%d align=%x ret=%p (detail=%p)\n"
+            , zone, handle, size, align, data, detail);
+    detail->handle = handle;
+
+    return data;
+}
+
+// Free a data block allocated with _malloc
+int
+_free(void *data)
+{
+    ASSERT32FLAT();
+    struct allocinfo_s *info = findAlloc(data);
+    if (!info || data == (void*)info || data == info->dataend)
+        return -1;
+    struct allocdetail_s *detail = container_of(
+        info, struct allocdetail_s, datainfo);
+    dprintf(8, "_free %p (detail=%p)\n", data, detail);
+    freeSpace(info);
+    freeSpace(&detail->detailinfo);
+    return 0;
+}
+
+// Find the amount of free space in a given zone.
+u32
+malloc_getspace(struct zone_s *zone)
+{
+    // XXX - doesn't account for ZoneLow being able to grow.
+    // XXX - results not reliable when CONFIG_THREAD_OPTIONROMS
+    u32 maxspace = 0;
+    struct allocinfo_s *info;
+    hlist_for_each_entry(info, &zone->head, node) {
+        u32 space = info->allocend - info->dataend;
+        if (space > maxspace)
+            maxspace = space;
+    }
+
+    if (zone != &ZoneTmpHigh && zone != &ZoneTmpLow)
+        return maxspace;
+    // Account for space needed for PMM tracking.
+    u32 reserve = ALIGN(sizeof(struct allocdetail_s), MALLOC_MIN_ALIGN);
+    if (maxspace <= reserve)
+        return 0;
+    return maxspace - reserve;
+}
+
+// Find the data block allocated with _malloc with a given handle.
+void *
+malloc_find(u32 handle)
+{
+    int i;
+    for (i=0; i<ARRAY_SIZE(Zones); i++) {
+        struct allocinfo_s *info;
+        hlist_for_each_entry(info, &Zones[i]->head, node) {
+            if (info->data != (void*)info)
+                continue;
+            struct allocdetail_s *detail = container_of(
+                info, struct allocdetail_s, detailinfo);
+            if (detail->handle == handle)
+                return detail->datainfo.data;
+        }
+    }
+    return NULL;
+}
+
+
+/****************************************************************
+ * 0xc0000-0xf0000 management
+ ****************************************************************/
+
+static u32 RomEnd = BUILD_ROM_START;
+static struct allocinfo_s *RomBase;
+
+#define OPROM_HEADER_RESERVE 16
+
+// Return the maximum memory position option roms may use.
+u32
+rom_get_max(void)
+{
+    if (CONFIG_MALLOC_UPPERMEMORY)
+        return ALIGN_DOWN((u32)RomBase->allocend - OPROM_HEADER_RESERVE
+                          , OPTION_ROM_ALIGN);
+    extern u8 code32init_end[];
+    u32 end = (u32)code32init_end;
+    return end > BUILD_BIOS_ADDR ? BUILD_BIOS_ADDR : end;
+}
+
+// Return the end of the last deployed option rom.
+u32
+rom_get_last(void)
+{
+    return RomEnd;
+}
+
+// Request space for an optionrom in 0xc0000-0xf0000 area.
+struct rom_header *
+rom_reserve(u32 size)
+{
+    u32 newend = ALIGN(RomEnd + size, OPTION_ROM_ALIGN);
+    if (newend > rom_get_max())
+        return NULL;
+    if (CONFIG_MALLOC_UPPERMEMORY) {
+        if (newend < (u32)zonelow_base)
+            newend = (u32)zonelow_base;
+        RomBase->data = RomBase->dataend = (void*)newend + OPROM_HEADER_RESERVE;
+    }
+    return (void*)RomEnd;
+}
+
+// Confirm space as in use by an optionrom.
+int
+rom_confirm(u32 size)
+{
+    void *new = rom_reserve(size);
+    if (!new) {
+        warn_noalloc();
+        return -1;
+    }
+    RomEnd = ALIGN(RomEnd + size, OPTION_ROM_ALIGN);
+    return 0;
+}
+
+
+/****************************************************************
+ * Setup
+ ****************************************************************/
+
+void
+malloc_preinit(void)
+{
+    ASSERT32FLAT();
+    dprintf(3, "malloc preinit\n");
+
+    // Don't declare any memory between 0xa0000 and 0x100000
+    add_e820(BUILD_LOWRAM_END, BUILD_BIOS_ADDR-BUILD_LOWRAM_END, E820_HOLE);
+
+    // Mark known areas as reserved.
+    add_e820(BUILD_BIOS_ADDR, BUILD_BIOS_SIZE, E820_RESERVED);
+
+    // Populate temp high ram
+    u32 highram = 0;
+    int i;
+    for (i=e820_count-1; i>=0; i--) {
+        struct e820entry *en = &e820_list[i];
+        u64 end = en->start + en->size;
+        if (end < 1024*1024)
+            break;
+        if (en->type != E820_RAM || end > 0xffffffff)
+            continue;
+        u32 s = en->start, e = end;
+        if (!highram) {
+            u32 newe = ALIGN_DOWN(e - BUILD_MAX_HIGHTABLE, MALLOC_MIN_ALIGN);
+            if (newe <= e && newe >= s) {
+                highram = newe;
+                e = newe;
+            }
+        }
+        addSpace(&ZoneTmpHigh, (void*)s, (void*)e);
+    }
+
+    // Populate regions
+    addSpace(&ZoneTmpLow, (void*)BUILD_STACK_ADDR, (void*)BUILD_EBDA_MINIMUM);
+    if (highram) {
+        addSpace(&ZoneHigh, (void*)highram
+                 , (void*)highram + BUILD_MAX_HIGHTABLE);
+        add_e820(highram, BUILD_MAX_HIGHTABLE, E820_RESERVED);
+    }
+}
+
+void
+csm_malloc_preinit(u32 low_pmm, u32 low_pmm_size, u32 hi_pmm, u32 hi_pmm_size)
+{
+    ASSERT32FLAT();
+
+    if (hi_pmm_size > BUILD_MAX_HIGHTABLE) {
+        void *hi_pmm_end = (void *)hi_pmm + hi_pmm_size;
+        addSpace(&ZoneTmpHigh, (void *)hi_pmm, hi_pmm_end - BUILD_MAX_HIGHTABLE);
+        addSpace(&ZoneHigh, hi_pmm_end - BUILD_MAX_HIGHTABLE, hi_pmm_end);
+    } else {
+        addSpace(&ZoneTmpHigh, (void *)hi_pmm, (void *)hi_pmm + hi_pmm_size);
+    }
+    addSpace(&ZoneTmpLow, (void *)low_pmm, (void *)low_pmm + low_pmm_size);
+}
+
+u32 LegacyRamSize VARFSEG;
+
+// Calculate the maximum ramsize (less than 4gig) from e820 map.
+static void
+calcRamSize(void)
+{
+    u32 rs = 0;
+    int i;
+    for (i=e820_count-1; i>=0; i--) {
+        struct e820entry *en = &e820_list[i];
+        u64 end = en->start + en->size;
+        u32 type = en->type;
+        if (end <= 0xffffffff && (type == E820_ACPI || type == E820_RAM)) {
+            rs = end;
+            break;
+        }
+    }
+    LegacyRamSize = rs >= 1024*1024 ? rs : 1024*1024;
+}
+
+// Update pointers after code relocation.
+void
+malloc_init(void)
+{
+    ASSERT32FLAT();
+    dprintf(3, "malloc init\n");
+
+    if (CONFIG_RELOCATE_INIT) {
+        // Fixup malloc pointers after relocation
+        int i;
+        for (i=0; i<ARRAY_SIZE(Zones); i++) {
+            struct zone_s *zone = Zones[i];
+            if (zone->head.first)
+                zone->head.first->pprev = &zone->head.first;
+        }
+    }
+
+    // Initialize low-memory region
+    extern u8 varlow_start[], varlow_end[], final_varlow_start[];
+    memmove(final_varlow_start, varlow_start, varlow_end - varlow_start);
+    if (CONFIG_MALLOC_UPPERMEMORY) {
+        addSpace(&ZoneLow, zonelow_base + OPROM_HEADER_RESERVE
+                 , final_varlow_start);
+        RomBase = findLast(&ZoneLow);
+    } else {
+        addSpace(&ZoneLow, (void*)ALIGN_DOWN((u32)final_varlow_start, 1024)
+                 , final_varlow_start);
+    }
+
+    // Add space available in f-segment to ZoneFSeg
+    extern u8 zonefseg_start[], zonefseg_end[];
+    memset(zonefseg_start, 0, zonefseg_end - zonefseg_start);
+    addSpace(&ZoneFSeg, zonefseg_start, zonefseg_end);
+
+    calcRamSize();
+}
+
+void
+malloc_prepboot(void)
+{
+    ASSERT32FLAT();
+    dprintf(3, "malloc finalize\n");
+
+    u32 base = rom_get_max();
+    memset((void*)RomEnd, 0, base-RomEnd);
+    if (CONFIG_MALLOC_UPPERMEMORY) {
+        // Place an optionrom signature around used low mem area.
+        struct rom_header *dummyrom = (void*)base;
+        dummyrom->signature = OPTION_ROM_SIGNATURE;
+        int size = (BUILD_BIOS_ADDR - base) / 512;
+        dummyrom->size = (size > 255) ? 255 : size;
+    }
+
+    // Reserve more low-mem if needed.
+    u32 endlow = GET_BDA(mem_size_kb)*1024;
+    add_e820(endlow, BUILD_LOWRAM_END-endlow, E820_RESERVED);
+
+    // Clear unused f-seg ram.
+    struct allocinfo_s *info = findLast(&ZoneFSeg);
+    memset(info->dataend, 0, info->allocend - info->dataend);
+    dprintf(1, "Space available for UMB: %x-%x, %x-%x\n"
+            , RomEnd, base, (u32)info->dataend, (u32)info->allocend);
+
+    // Give back unused high ram.
+    info = findLast(&ZoneHigh);
+    if (info) {
+        u32 giveback = ALIGN_DOWN(info->allocend - info->dataend, PAGE_SIZE);
+        add_e820((u32)info->dataend, giveback, E820_RAM);
+        dprintf(1, "Returned %d bytes of ZoneHigh\n", giveback);
+    }
+
+    calcRamSize();
+}
diff --git a/src/malloc.h b/src/malloc.h
new file mode 100644
index 0000000..af8a21d
--- /dev/null
+++ b/src/malloc.h
@@ -0,0 +1,70 @@
+#ifndef __MALLOC_H
+#define __MALLOC_H
+
+#include "types.h" // u32
+
+// malloc.c
+extern struct zone_s ZoneLow, ZoneHigh, ZoneFSeg, ZoneTmpLow, ZoneTmpHigh;
+u32 rom_get_max(void);
+u32 rom_get_last(void);
+struct rom_header *rom_reserve(u32 size);
+int rom_confirm(u32 size);
+void csm_malloc_preinit(u32 low_pmm, u32 low_pmm_size, u32 hi_pmm,
+                        u32 hi_pmm_size);
+void malloc_preinit(void);
+extern u32 LegacyRamSize;
+void malloc_init(void);
+void malloc_prepboot(void);
+void *_malloc(struct zone_s *zone, u32 handle, u32 size, u32 align);
+int _free(void *data);
+u32 malloc_getspace(struct zone_s *zone);
+void *malloc_find(u32 handle);
+
+#define MALLOC_DEFAULT_HANDLE 0xFFFFFFFF
+// Minimum alignment of malloc'd memory
+#define MALLOC_MIN_ALIGN 16
+// Helper functions for memory allocation.
+static inline void *malloc_low(u32 size) {
+    return _malloc(&ZoneLow, MALLOC_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
+}
+static inline void *malloc_high(u32 size) {
+    return _malloc(&ZoneHigh, MALLOC_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
+}
+static inline void *malloc_fseg(u32 size) {
+    return _malloc(&ZoneFSeg, MALLOC_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
+}
+static inline void *malloc_tmplow(u32 size) {
+    return _malloc(&ZoneTmpLow, MALLOC_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
+}
+static inline void *malloc_tmphigh(u32 size) {
+    return _malloc(&ZoneTmpHigh, MALLOC_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
+}
+static inline void *malloc_tmp(u32 size) {
+    void *ret = malloc_tmphigh(size);
+    if (ret)
+        return ret;
+    return malloc_tmplow(size);
+}
+static inline void *memalign_low(u32 align, u32 size) {
+    return _malloc(&ZoneLow, MALLOC_DEFAULT_HANDLE, size, align);
+}
+static inline void *memalign_high(u32 align, u32 size) {
+    return _malloc(&ZoneHigh, MALLOC_DEFAULT_HANDLE, size, align);
+}
+static inline void *memalign_tmplow(u32 align, u32 size) {
+    return _malloc(&ZoneTmpLow, MALLOC_DEFAULT_HANDLE, size, align);
+}
+static inline void *memalign_tmphigh(u32 align, u32 size) {
+    return _malloc(&ZoneTmpHigh, MALLOC_DEFAULT_HANDLE, size, align);
+}
+static inline void *memalign_tmp(u32 align, u32 size) {
+    void *ret = memalign_tmphigh(align, size);
+    if (ret)
+        return ret;
+    return memalign_tmplow(align, size);
+}
+static inline void free(void *data) {
+    _free(data);
+}
+
+#endif // malloc.h
diff --git a/src/optionroms.c b/src/optionroms.c
index 5c79121..560df81 100644
--- a/src/optionroms.c
+++ b/src/optionroms.c
@@ -13,6 +13,7 @@
 #include "hw/pci_regs.h" // PCI_ROM_ADDRESS
 #include "hw/pci_ids.h" // PCI_CLASS_DISPLAY_VGA
 #include "boot.h" // IPL
+#include "malloc.h" // rom_confirm
 #include "optionroms.h" // struct rom_header
 #include "romfile.h" // romfile_loadint
 #include "stacks.h" // farcall16big
diff --git a/src/output.c b/src/output.c
index b5d7ae0..e69a09a 100644
--- a/src/output.c
+++ b/src/output.c
@@ -12,6 +12,7 @@
 #include "config.h" // CONFIG_*
 #include "biosvar.h" // GET_GLOBAL
 #include "fw/paravirt.h" // PlatformRunningOn
+#include "malloc.h" // malloc_tmp
 #include "stacks.h" // call16_int
 #include "string.h" // memset
 
diff --git a/src/pmm.c b/src/pmm.c
index cd6ee89..f6319a4 100644
--- a/src/pmm.c
+++ b/src/pmm.c
@@ -1,541 +1,17 @@
 // Post memory manager (PMM) calls
 //
-// Copyright (C) 2009  Kevin O'Connor <kevin@koconnor.net>
+// Copyright (C) 2009-2013  Kevin O'Connor <kevin@koconnor.net>
 //
 // This file may be distributed under the terms of the GNU LGPLv3 license.
 
+#include "biosvar.h" // FUNC16
+#include "config.h" // CONFIG_*
+#include "farptr.h" // struct segoff_s
+#include "malloc.h" // _malloc
+#include "string.h" // checksum
 #include "util.h" // dprintf
-#include "config.h" // BUILD_BIOS_ADDR
-#include "memmap.h" // struct e820entry
-#include "farptr.h" // GET_FARVAR
-#include "biosvar.h" // GET_BDA
-#include "optionroms.h" // OPTION_ROM_ALIGN
-#include "list.h" // hlist_node
-#include "stacks.h" // wait_preempt
-#include "string.h" // memset
 #include "x86.h" // __ffs
 
-// Information on a reserved area.
-struct allocinfo_s {
-    struct hlist_node node;
-    void *data, *dataend, *allocend;
-};
-
-// Information on a tracked memory allocation.
-struct allocdetail_s {
-    struct allocinfo_s detailinfo;
-    struct allocinfo_s datainfo;
-    u32 handle;
-};
-
-// The various memory zones.
-struct zone_s {
-    struct hlist_head head;
-};
-
-struct zone_s ZoneLow VARVERIFY32INIT, ZoneHigh VARVERIFY32INIT;
-struct zone_s ZoneFSeg VARVERIFY32INIT;
-struct zone_s ZoneTmpLow VARVERIFY32INIT, ZoneTmpHigh VARVERIFY32INIT;
-
-static struct zone_s *Zones[] VARVERIFY32INIT = {
-    &ZoneTmpLow, &ZoneLow, &ZoneFSeg, &ZoneTmpHigh, &ZoneHigh
-};
-
-
-/****************************************************************
- * low-level memory reservations
- ****************************************************************/
-
-// Find and reserve space from a given zone
-static void *
-allocSpace(struct zone_s *zone, u32 size, u32 align, struct allocinfo_s *fill)
-{
-    struct allocinfo_s *info;
-    hlist_for_each_entry(info, &zone->head, node) {
-        void *dataend = info->dataend;
-        void *allocend = info->allocend;
-        void *newallocend = (void*)ALIGN_DOWN((u32)allocend - size, align);
-        if (newallocend >= dataend && newallocend <= allocend) {
-            // Found space - now reserve it.
-            if (!fill)
-                fill = newallocend;
-            fill->data = newallocend;
-            fill->dataend = newallocend + size;
-            fill->allocend = allocend;
-
-            info->allocend = newallocend;
-            hlist_add_before(&fill->node, &info->node);
-            return newallocend;
-        }
-    }
-    return NULL;
-}
-
-// Release space allocated with allocSpace()
-static void
-freeSpace(struct allocinfo_s *info)
-{
-    struct allocinfo_s *next = container_of_or_null(
-        info->node.next, struct allocinfo_s, node);
-    if (next && next->allocend == info->data)
-        next->allocend = info->allocend;
-    hlist_del(&info->node);
-}
-
-// Add new memory to a zone
-static void
-addSpace(struct zone_s *zone, void *start, void *end)
-{
-    // Find position to add space
-    struct allocinfo_s *info;
-    struct hlist_node **pprev;
-    hlist_for_each_entry_pprev(info, pprev, &zone->head, node) {
-        if (info->data < start)
-            break;
-    }
-
-    // Add space using temporary allocation info.
-    struct allocdetail_s tempdetail;
-    tempdetail.datainfo.data = tempdetail.datainfo.dataend = start;
-    tempdetail.datainfo.allocend = end;
-    hlist_add(&tempdetail.datainfo.node, pprev);
-
-    // Allocate final allocation info.
-    struct allocdetail_s *detail = allocSpace(
-        &ZoneTmpHigh, sizeof(*detail), MALLOC_MIN_ALIGN, NULL);
-    if (!detail) {
-        detail = allocSpace(&ZoneTmpLow, sizeof(*detail)
-                            , MALLOC_MIN_ALIGN, NULL);
-        if (!detail) {
-            hlist_del(&tempdetail.datainfo.node);
-            warn_noalloc();
-            return;
-        }
-    }
-
-    // Replace temp alloc space with final alloc space
-    pprev = tempdetail.datainfo.node.pprev;
-    hlist_del(&tempdetail.datainfo.node);
-    memcpy(&detail->datainfo, &tempdetail.datainfo, sizeof(detail->datainfo));
-    detail->handle = PMM_DEFAULT_HANDLE;
-    hlist_add(&detail->datainfo.node, pprev);
-}
-
-// Search all zones for an allocation obtained from allocSpace()
-static struct allocinfo_s *
-findAlloc(void *data)
-{
-    int i;
-    for (i=0; i<ARRAY_SIZE(Zones); i++) {
-        struct allocinfo_s *info;
-        hlist_for_each_entry(info, &Zones[i]->head, node) {
-            if (info->data == data)
-                return info;
-        }
-    }
-    return NULL;
-}
-
-// Return the last sentinal node of a zone
-static struct allocinfo_s *
-findLast(struct zone_s *zone)
-{
-    struct allocinfo_s *info, *last = NULL;
-    hlist_for_each_entry(info, &zone->head, node) {
-        last = info;
-    }
-    return last;
-}
-
-
-/****************************************************************
- * ebda movement
- ****************************************************************/
-
-// Move ebda
-static int
-relocate_ebda(u32 newebda, u32 oldebda, u8 ebda_size)
-{
-    u32 lowram = GET_BDA(mem_size_kb) * 1024;
-    if (oldebda != lowram)
-        // EBDA isn't at end of ram - give up.
-        return -1;
-
-    // Do copy
-    memmove((void*)newebda, (void*)oldebda, ebda_size * 1024);
-
-    // Update indexes
-    dprintf(1, "ebda moved from %x to %x\n", oldebda, newebda);
-    SET_BDA(mem_size_kb, newebda / 1024);
-    SET_BDA(ebda_seg, FLATPTR_TO_SEG(newebda));
-    return 0;
-}
-
-// Support expanding the ZoneLow dynamically.
-static void *
-zonelow_expand(u32 size, u32 align, struct allocinfo_s *fill)
-{
-    // Make sure to not move ebda while an optionrom is running.
-    if (unlikely(wait_preempt())) {
-        void *data = allocSpace(&ZoneLow, size, align, fill);
-        if (data)
-            return data;
-    }
-
-    struct allocinfo_s *info = findLast(&ZoneLow);
-    if (!info)
-        return NULL;
-    u32 oldpos = (u32)info->allocend;
-    u32 newpos = ALIGN_DOWN(oldpos - size, align);
-    u32 bottom = (u32)info->dataend;
-    if (newpos >= bottom && newpos <= oldpos)
-        // Space already present.
-        return allocSpace(&ZoneLow, size, align, fill);
-    u16 ebda_seg = get_ebda_seg();
-    u32 ebda_pos = (u32)MAKE_FLATPTR(ebda_seg, 0);
-    u8 ebda_size = GET_EBDA(ebda_seg, size);
-    u32 ebda_end = ebda_pos + ebda_size * 1024;
-    if (ebda_end != bottom)
-        // Something else is after ebda - can't use any existing space.
-        newpos = ALIGN_DOWN(ebda_end - size, align);
-    u32 newbottom = ALIGN_DOWN(newpos, 1024);
-    u32 newebda = ALIGN_DOWN(newbottom - ebda_size * 1024, 1024);
-    if (newebda < BUILD_EBDA_MINIMUM)
-        // Not enough space.
-        return NULL;
-
-    // Move ebda
-    int ret = relocate_ebda(newebda, ebda_pos, ebda_size);
-    if (ret)
-        return NULL;
-
-    // Update zone
-    if (ebda_end == bottom) {
-        info->data = (void*)newbottom;
-        info->dataend = (void*)newbottom;
-    } else
-        addSpace(&ZoneLow, (void*)newbottom, (void*)ebda_end);
-
-    return allocSpace(&ZoneLow, size, align, fill);
-}
-
-
-/****************************************************************
- * tracked memory allocations
- ****************************************************************/
-
-// Allocate memory from the given zone and track it as a PMM allocation
-void * __malloc
-pmm_malloc(struct zone_s *zone, u32 handle, u32 size, u32 align)
-{
-    ASSERT32FLAT();
-    if (!size)
-        return NULL;
-
-    // Find and reserve space for bookkeeping.
-    struct allocdetail_s *detail = allocSpace(
-        &ZoneTmpHigh, sizeof(*detail), MALLOC_MIN_ALIGN, NULL);
-    if (!detail) {
-        detail = allocSpace(&ZoneTmpLow, sizeof(*detail)
-                            , MALLOC_MIN_ALIGN, NULL);
-        if (!detail)
-            return NULL;
-    }
-
-    // Find and reserve space for main allocation
-    void *data = allocSpace(zone, size, align, &detail->datainfo);
-    if (!CONFIG_MALLOC_UPPERMEMORY && !data && zone == &ZoneLow)
-        data = zonelow_expand(size, align, &detail->datainfo);
-    if (!data) {
-        freeSpace(&detail->detailinfo);
-        return NULL;
-    }
-
-    dprintf(8, "pmm_malloc zone=%p handle=%x size=%d align=%x"
-            " ret=%p (detail=%p)\n"
-            , zone, handle, size, align
-            , data, detail);
-    detail->handle = handle;
-
-    return data;
-}
-
-// Free a data block allocated with pmm_malloc
-int
-pmm_free(void *data)
-{
-    ASSERT32FLAT();
-    struct allocinfo_s *info = findAlloc(data);
-    if (!info || data == (void*)info || data == info->dataend)
-        return -1;
-    struct allocdetail_s *detail = container_of(
-        info, struct allocdetail_s, datainfo);
-    dprintf(8, "pmm_free %p (detail=%p)\n", data, detail);
-    freeSpace(info);
-    freeSpace(&detail->detailinfo);
-    return 0;
-}
-
-// Find the amount of free space in a given zone.
-static u32
-pmm_getspace(struct zone_s *zone)
-{
-    // XXX - doesn't account for ZoneLow being able to grow.
-    // XXX - results not reliable when CONFIG_THREAD_OPTIONROMS
-    u32 maxspace = 0;
-    struct allocinfo_s *info;
-    hlist_for_each_entry(info, &zone->head, node) {
-        u32 space = info->allocend - info->dataend;
-        if (space > maxspace)
-            maxspace = space;
-    }
-
-    if (zone != &ZoneTmpHigh && zone != &ZoneTmpLow)
-        return maxspace;
-    // Account for space needed for PMM tracking.
-    u32 reserve = ALIGN(sizeof(struct allocdetail_s), MALLOC_MIN_ALIGN);
-    if (maxspace <= reserve)
-        return 0;
-    return maxspace - reserve;
-}
-
-// Find the data block allocated with pmm_malloc with a given handle.
-static void *
-pmm_find(u32 handle)
-{
-    int i;
-    for (i=0; i<ARRAY_SIZE(Zones); i++) {
-        struct allocinfo_s *info;
-        hlist_for_each_entry(info, &Zones[i]->head, node) {
-            if (info->data != (void*)info)
-                continue;
-            struct allocdetail_s *detail = container_of(
-                info, struct allocdetail_s, detailinfo);
-            if (detail->handle == handle)
-                return detail->datainfo.data;
-        }
-    }
-    return NULL;
-}
-
-
-/****************************************************************
- * 0xc0000-0xf0000 management
- ****************************************************************/
-
-static u32 RomEnd = BUILD_ROM_START;
-static struct allocinfo_s *RomBase;
-
-#define OPROM_HEADER_RESERVE 16
-
-// Return the maximum memory position option roms may use.
-u32
-rom_get_max(void)
-{
-    if (CONFIG_MALLOC_UPPERMEMORY)
-        return ALIGN_DOWN((u32)RomBase->allocend - OPROM_HEADER_RESERVE
-                          , OPTION_ROM_ALIGN);
-    extern u8 code32init_end[];
-    u32 end = (u32)code32init_end;
-    return end > BUILD_BIOS_ADDR ? BUILD_BIOS_ADDR : end;
-}
-
-// Return the end of the last deployed option rom.
-u32
-rom_get_last(void)
-{
-    return RomEnd;
-}
-
-// Request space for an optionrom in 0xc0000-0xf0000 area.
-struct rom_header *
-rom_reserve(u32 size)
-{
-    u32 newend = ALIGN(RomEnd + size, OPTION_ROM_ALIGN);
-    if (newend > rom_get_max())
-        return NULL;
-    if (CONFIG_MALLOC_UPPERMEMORY) {
-        if (newend < (u32)zonelow_base)
-            newend = (u32)zonelow_base;
-        RomBase->data = RomBase->dataend = (void*)newend + OPROM_HEADER_RESERVE;
-    }
-    return (void*)RomEnd;
-}
-
-// Confirm space as in use by an optionrom.
-int
-rom_confirm(u32 size)
-{
-    void *new = rom_reserve(size);
-    if (!new) {
-        warn_noalloc();
-        return -1;
-    }
-    RomEnd = ALIGN(RomEnd + size, OPTION_ROM_ALIGN);
-    return 0;
-}
-
-
-/****************************************************************
- * Setup
- ****************************************************************/
-
-void
-malloc_preinit(void)
-{
-    ASSERT32FLAT();
-    dprintf(3, "malloc preinit\n");
-
-    // Don't declare any memory between 0xa0000 and 0x100000
-    add_e820(BUILD_LOWRAM_END, BUILD_BIOS_ADDR-BUILD_LOWRAM_END, E820_HOLE);
-
-    // Mark known areas as reserved.
-    add_e820(BUILD_BIOS_ADDR, BUILD_BIOS_SIZE, E820_RESERVED);
-
-    // Populate temp high ram
-    u32 highram = 0;
-    int i;
-    for (i=e820_count-1; i>=0; i--) {
-        struct e820entry *en = &e820_list[i];
-        u64 end = en->start + en->size;
-        if (end < 1024*1024)
-            break;
-        if (en->type != E820_RAM || end > 0xffffffff)
-            continue;
-        u32 s = en->start, e = end;
-        if (!highram) {
-            u32 newe = ALIGN_DOWN(e - BUILD_MAX_HIGHTABLE, MALLOC_MIN_ALIGN);
-            if (newe <= e && newe >= s) {
-                highram = newe;
-                e = newe;
-            }
-        }
-        addSpace(&ZoneTmpHigh, (void*)s, (void*)e);
-    }
-
-    // Populate regions
-    addSpace(&ZoneTmpLow, (void*)BUILD_STACK_ADDR, (void*)BUILD_EBDA_MINIMUM);
-    if (highram) {
-        addSpace(&ZoneHigh, (void*)highram
-                 , (void*)highram + BUILD_MAX_HIGHTABLE);
-        add_e820(highram, BUILD_MAX_HIGHTABLE, E820_RESERVED);
-    }
-}
-
-void
-csm_malloc_preinit(u32 low_pmm, u32 low_pmm_size, u32 hi_pmm, u32 hi_pmm_size)
-{
-    ASSERT32FLAT();
-
-    if (hi_pmm_size > BUILD_MAX_HIGHTABLE) {
-        void *hi_pmm_end = (void *)hi_pmm + hi_pmm_size;
-        addSpace(&ZoneTmpHigh, (void *)hi_pmm, hi_pmm_end - BUILD_MAX_HIGHTABLE);
-        addSpace(&ZoneHigh, hi_pmm_end - BUILD_MAX_HIGHTABLE, hi_pmm_end);
-    } else {
-        addSpace(&ZoneTmpHigh, (void *)hi_pmm, (void *)hi_pmm + hi_pmm_size);
-    }
-    addSpace(&ZoneTmpLow, (void *)low_pmm, (void *)low_pmm + low_pmm_size);
-}
-
-u32 LegacyRamSize VARFSEG;
-
-// Calculate the maximum ramsize (less than 4gig) from e820 map.
-static void
-calcRamSize(void)
-{
-    u32 rs = 0;
-    int i;
-    for (i=e820_count-1; i>=0; i--) {
-        struct e820entry *en = &e820_list[i];
-        u64 end = en->start + en->size;
-        u32 type = en->type;
-        if (end <= 0xffffffff && (type == E820_ACPI || type == E820_RAM)) {
-            rs = end;
-            break;
-        }
-    }
-    LegacyRamSize = rs >= 1024*1024 ? rs : 1024*1024;
-}
-
-// Update pointers after code relocation.
-void
-malloc_init(void)
-{
-    ASSERT32FLAT();
-    dprintf(3, "malloc init\n");
-
-    if (CONFIG_RELOCATE_INIT) {
-        // Fixup malloc pointers after relocation
-        int i;
-        for (i=0; i<ARRAY_SIZE(Zones); i++) {
-            struct zone_s *zone = Zones[i];
-            if (zone->head.first)
-                zone->head.first->pprev = &zone->head.first;
-        }
-    }
-
-    // Initialize low-memory region
-    extern u8 varlow_start[], varlow_end[], final_varlow_start[];
-    memmove(final_varlow_start, varlow_start, varlow_end - varlow_start);
-    if (CONFIG_MALLOC_UPPERMEMORY) {
-        addSpace(&ZoneLow, zonelow_base + OPROM_HEADER_RESERVE
-                 , final_varlow_start);
-        RomBase = findLast(&ZoneLow);
-    } else {
-        addSpace(&ZoneLow, (void*)ALIGN_DOWN((u32)final_varlow_start, 1024)
-                 , final_varlow_start);
-    }
-
-    // Add space available in f-segment to ZoneFSeg
-    extern u8 zonefseg_start[], zonefseg_end[];
-    memset(zonefseg_start, 0, zonefseg_end - zonefseg_start);
-    addSpace(&ZoneFSeg, zonefseg_start, zonefseg_end);
-
-    calcRamSize();
-}
-
-void
-malloc_prepboot(void)
-{
-    ASSERT32FLAT();
-    dprintf(3, "malloc finalize\n");
-
-    u32 base = rom_get_max();
-    memset((void*)RomEnd, 0, base-RomEnd);
-    if (CONFIG_MALLOC_UPPERMEMORY) {
-        // Place an optionrom signature around used low mem area.
-        struct rom_header *dummyrom = (void*)base;
-        dummyrom->signature = OPTION_ROM_SIGNATURE;
-        int size = (BUILD_BIOS_ADDR - base) / 512;
-        dummyrom->size = (size > 255) ? 255 : size;
-    }
-
-    // Reserve more low-mem if needed.
-    u32 endlow = GET_BDA(mem_size_kb)*1024;
-    add_e820(endlow, BUILD_LOWRAM_END-endlow, E820_RESERVED);
-
-    // Clear unused f-seg ram.
-    struct allocinfo_s *info = findLast(&ZoneFSeg);
-    memset(info->dataend, 0, info->allocend - info->dataend);
-    dprintf(1, "Space available for UMB: %x-%x, %x-%x\n"
-            , RomEnd, base, (u32)info->dataend, (u32)info->allocend);
-
-    // Give back unused high ram.
-    info = findLast(&ZoneHigh);
-    if (info) {
-        u32 giveback = ALIGN_DOWN(info->allocend - info->dataend, PAGE_SIZE);
-        add_e820((u32)info->dataend, giveback, E820_RAM);
-        dprintf(1, "Returned %d bytes of ZoneHigh\n", giveback);
-    }
-
-    calcRamSize();
-}
-
-
-/****************************************************************
- * pmm interface
- ****************************************************************/
-
 struct pmmheader {
     u32 signature;
     u8 version;
@@ -580,12 +56,12 @@ handle_pmm00(u16 *args)
         case 0:
             return 0;
         case 1:
-            return pmm_getspace(lowzone);
+            return malloc_getspace(lowzone);
         case 2:
-            return pmm_getspace(highzone);
+            return malloc_getspace(highzone);
         case 3: {
-            u32 spacelow = pmm_getspace(lowzone);
-            u32 spacehigh = pmm_getspace(highzone);
+            u32 spacelow = malloc_getspace(lowzone);
+            u32 spacehigh = malloc_getspace(highzone);
             if (spacelow > spacehigh)
                 return spacelow;
             return spacehigh;
@@ -606,14 +82,14 @@ handle_pmm00(u16 *args)
     case 0:
         return 0;
     case 1:
-        return (u32)pmm_malloc(lowzone, handle, size, align);
+        return (u32)_malloc(lowzone, handle, size, align);
     case 2:
-        return (u32)pmm_malloc(highzone, handle, size, align);
+        return (u32)_malloc(highzone, handle, size, align);
     case 3: {
-        void *data = pmm_malloc(lowzone, handle, size, align);
+        void *data = _malloc(lowzone, handle, size, align);
         if (data)
             return (u32)data;
-        return (u32)pmm_malloc(highzone, handle, size, align);
+        return (u32)_malloc(highzone, handle, size, align);
     }
     }
 }
@@ -624,9 +100,9 @@ handle_pmm01(u16 *args)
 {
     u32 handle = *(u32*)&args[1];
     dprintf(3, "pmm01: handle=%x\n", handle);
-    if (handle == PMM_DEFAULT_HANDLE)
+    if (handle == MALLOC_DEFAULT_HANDLE)
         return 0;
-    return (u32)pmm_find(handle);
+    return (u32)malloc_find(handle);
 }
 
 // PMM - deallocate
@@ -635,7 +111,7 @@ handle_pmm02(u16 *args)
 {
     u32 buffer = *(u32*)&args[1];
     dprintf(3, "pmm02: buffer=%x\n", buffer);
-    int ret = pmm_free((void*)buffer);
+    int ret = _free((void*)buffer);
     if (ret)
         // Error
         return 1;
diff --git a/src/post.c b/src/post.c
index f1cb8a8..701134f 100644
--- a/src/post.c
+++ b/src/post.c
@@ -25,6 +25,7 @@
 #include "hw/lsi-scsi.h" // lsi_scsi_setup
 #include "hw/esp-scsi.h" // esp_scsi_setup
 #include "hw/megasas.h" // megasas_setup
+#include "malloc.h" // malloc_init
 #include "post.h" // interface_init
 #include "string.h" // memset
 
diff --git a/src/romfile.c b/src/romfile.c
index 94e1ed5..835ca99 100644
--- a/src/romfile.c
+++ b/src/romfile.c
@@ -6,6 +6,7 @@
 
 #include "config.h" // CONFIG_*
 #include "util.h" // dprintf
+#include "malloc.h" // free
 #include "romfile.h" // struct romfile_s
 #include "string.h" // memcmp
 
diff --git a/src/stacks.c b/src/stacks.c
index b499872..19cd869 100644
--- a/src/stacks.c
+++ b/src/stacks.c
@@ -8,6 +8,7 @@
 #include "util.h" // dprintf
 #include "bregs.h" // CR0_PE
 #include "list.h" // hlist_node
+#include "malloc.h" // free
 #include "stacks.h" // struct mutex_s
 
 
diff --git a/src/system.c b/src/system.c
index af31db7..bd53f7d 100644
--- a/src/system.c
+++ b/src/system.c
@@ -11,6 +11,7 @@
 #include "memmap.h" // E820_RAM
 #include "hw/pic.h" // pic_reset
 #include "bregs.h" // struct bregs
+#include "malloc.h" // LegacyRamSize
 #include "string.h" // memcpy_far
 
 // Use PS2 System Control port A to set A20 enable
diff --git a/src/util.h b/src/util.h
index a1a10f4..dffc444 100644
--- a/src/util.h
+++ b/src/util.h
@@ -174,67 +174,8 @@ u16 get_pnp_offset(void);
 void pnp_init(void);
 
 // pmm.c
-extern struct zone_s ZoneLow, ZoneHigh, ZoneFSeg, ZoneTmpLow, ZoneTmpHigh;
-u32 rom_get_max(void);
-u32 rom_get_last(void);
-struct rom_header *rom_reserve(u32 size);
-int rom_confirm(u32 size);
-void csm_malloc_preinit(u32 low_pmm, u32 low_pmm_size, u32 hi_pmm,
-                        u32 hi_pmm_size);
-void malloc_preinit(void);
-extern u32 LegacyRamSize;
-void malloc_init(void);
-void malloc_prepboot(void);
-void *pmm_malloc(struct zone_s *zone, u32 handle, u32 size, u32 align);
-int pmm_free(void *data);
 void pmm_init(void);
 void pmm_prepboot(void);
-#define PMM_DEFAULT_HANDLE 0xFFFFFFFF
-// Minimum alignment of malloc'd memory
-#define MALLOC_MIN_ALIGN 16
-// Helper functions for memory allocation.
-static inline void *malloc_low(u32 size) {
-    return pmm_malloc(&ZoneLow, PMM_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
-}
-static inline void *malloc_high(u32 size) {
-    return pmm_malloc(&ZoneHigh, PMM_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
-}
-static inline void *malloc_fseg(u32 size) {
-    return pmm_malloc(&ZoneFSeg, PMM_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
-}
-static inline void *malloc_tmplow(u32 size) {
-    return pmm_malloc(&ZoneTmpLow, PMM_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
-}
-static inline void *malloc_tmphigh(u32 size) {
-    return pmm_malloc(&ZoneTmpHigh, PMM_DEFAULT_HANDLE, size, MALLOC_MIN_ALIGN);
-}
-static inline void *malloc_tmp(u32 size) {
-    void *ret = malloc_tmphigh(size);
-    if (ret)
-        return ret;
-    return malloc_tmplow(size);
-}
-static inline void *memalign_low(u32 align, u32 size) {
-    return pmm_malloc(&ZoneLow, PMM_DEFAULT_HANDLE, size, align);
-}
-static inline void *memalign_high(u32 align, u32 size) {
-    return pmm_malloc(&ZoneHigh, PMM_DEFAULT_HANDLE, size, align);
-}
-static inline void *memalign_tmplow(u32 align, u32 size) {
-    return pmm_malloc(&ZoneTmpLow, PMM_DEFAULT_HANDLE, size, align);
-}
-static inline void *memalign_tmphigh(u32 align, u32 size) {
-    return pmm_malloc(&ZoneTmpHigh, PMM_DEFAULT_HANDLE, size, align);
-}
-static inline void *memalign_tmp(u32 align, u32 size) {
-    void *ret = memalign_tmphigh(align, size);
-    if (ret)
-        return ret;
-    return memalign_tmplow(align, size);
-}
-static inline void free(void *data) {
-    pmm_free(data);
-}
 
 // fw/mtrr.c
 void mtrr_setup(void);