[comboot] Allow for tail recursion of COMBOOT images

Multi-level menus via COMBOOT rely on the COMBOOT program being able
to exit and invoke a new COMBOOT program (the next menu).  This works,
but rapidly (within about five iterations) runs out of space in gPXE's
internal stack, since each new image is executed in a new function
context.

Fix by allowing tail recursion between images; an image can now
specify a replacement image for itself, and image_exec() will perform
the necessary tail recursion.

src/include/gpxe/image.h

@@ -46,6 +46,16 @@ struct image {
 		userptr_t user;
 		unsigned long ul;
 	} priv;
+
+	/** Replacement image
+	 *
+	 * An image wishing to replace itself with another image (in a
+	 * style similar to a Unix exec() call) should return from its
+	 * exec() method with the replacement image set to point to
+	 * the new image.  The new image must already be in a suitable
+	 * state for execution.
+	 */
+	struct image *replacement;
 };
 
 /** Image is loaded */
@@ -79,6 +89,10 @@ struct image_type {
 	 *
 	 * @v image		Loaded image
 	 * @ret rc		Return status code
+	 *
+	 * Note that the image may be invalidated by the act of
+	 * execution, i.e. an image is allowed to choose to unregister
+	 * (and so potentially free) itself.
 	 */
 	int ( * exec ) ( struct image *image );
 };