-
-Google's vboot verifies the firmware and places measurements
-within the TPM.
-
-
-
Root of Trust
-
-When using vboot, the root-of-trust is basically the read-only portion of the
-SPI flash. The following items factor into the trust equation:
-
-
-
The GCC compiler must reliably translate the code into machine code
- without inserting any additional code (virus, backdoor, etc.)
-
-
The CPU must reliably execute the reset sequence and instructions as
- documented by the CPU manufacturer.
-
-
The SPI flash must provide only the code programmed into it to the CPU
- without providing any alternative reset vector or code sequence.
-
-
The SPI flash must honor the write-protect input and protect the
- specified portion of the SPI flash from all erase and write accesses.
-
-
-
-
-The firmware is typically protected using the write-protect pin on the SPI
-flash part and setting some of the write-protect bits in the status register
-during manufacturing. The protected area is platform specific and for x86
-platforms is typically 1/4th of the SPI flash
-part size. Because this portion of the SPI flash is hardware write protected,
-it is not possible to update this portion of the SPI flash in the field,
-without altering the system to eliminate the ground connection to the SPI flash
-write-protect pin. Without hardware modifications, this portion of the SPI
-flash maintains the manufactured state during the system's lifetime.
-
-
-
-
Firmware Layout
-
-Several sections are added to the firmware layout to support vboot:
-
-
-
Read-only section
-
Google Binary Blob (GBB) area
-
Read/write section A
-
Read/write section B
-
-
-The following sections describe the various portions of the flash layout.
-
-
-
Read-Only Section
-
-The read-only section contains a coreboot file system (CBFS) that contains all
-of the boot firmware necessary to perform recovery for the system. This
-firmware is typically protected using the write-protect pin on the SPI flash
-part and setting some of the write-protect bits in the status register during
-manufacturing. The protected area is typically 1/4th of the SPI flash part
-size and must cover the entire read-only section which consists of:
-
-
-
Vital Product Data (VPD) area
-
Firmware ID area
-
Google Binary Blob (GBB) area
-
coreboot file system containing read-only recovery firmware
-
-
-
Google Binary Blob (GBB) Area
-
-The GBB area is part of the read-only section. This area contains a 4096 or
-8192 bit public root RSA key that is used to verify the VBLOCK area to obtain
-the firmware signing key.
-
-
-
Recovery Firmware
-
-The recovery firmware is contained within a coreboot file system and consists
-of:
-
-
-
reset vector
-
bootblock
-
verstage
-
romstage
-
postcar
-
ramstage
-
payload
-
flash map file
-
config file
-
processor specific files:
-
-
Microcode
-
fspm.bin
-
fsps.bin
-
-
-
-
-
-The recovery firmware is written during manufacturing and typically contains
-code to write the storage device (eMMC device or hard disk). The recovery
-image is usually contained on a socketed device such as a USB flash drive or
-an SD card. Depending upon the payload firmware doing the recovery, it may
-be possible for the user to interact with the system to specify the recovery
-image path. Part of the recovery is also to write the A and B areas of the
-SPI flash device to boot the system.
-
-
-
-
Read/Write Section
-
-
-The read/write sections contain an area which contains the firmware signing
-key and signature and an area containing a coreboot file system with a subset
-of the firmware. The firmware files in FW_MAIN_A and FW_MAIN_B are:
-
-
-
romstage
-
postcar
-
ramstage
-
payload
-
config file
-
processor specific files:
-
-
Microcode
-
fspm.bin
-
fsps.bin
-
-
-
-
-
-The firmware subset enables most issues to be fixed in the field with firmware
-updates. The firmware files handle memory and most of silicon initialization.
-These files also produce the tables which get passed to the operating system.
-
-
-
-
Firmware Updates
-
-The read/write sections exist in one of three states:
-
-
-
Invalid
-
Ready to boot
-
Successfully booted
-
-
-
-
-
-Where is this state information written?
- CMOS?
- RW_NVRAM?
- RW_FWID_*
-
-
-
-
-
-Firmware updates are handled by the operating system by writing any read/write
-section that is not in the "successfully booted" state. Upon the next reboot,
-vboot determines the section to boot. If it finds one in the "ready to boot"
-state then it attempts to boot using that section. If the boot fails then
-vboot marks the section as invalid and attempts to fall back to a read/write
-section in the "successfully booted" state. If vboot is not able to find a
-section in the "successfully booted" state then vboot enters recovery mode.
-
-
-
-Only the operating system is able to transition a section from the "ready to
-boot" state to the "successfully booted" state. The transition is typically
-done after the operating system has been running for a while indicating
-that successful boot was possible and the operating system is stable.
-
-
-
-Note that as long as the SPI write protection is in place then the system is
-always recoverable. If the flash update fails then the system will continue
-to boot using the previous read/write area. The same is true if coreboot
-passes control to the payload or the operating system and then the boot fails.
-In the worst case, the SPI flash gets totally corrupted in which case vboot
-fails the signature checks and enters recovery mode. There are no times where
-the SPI flash is exposed and the reset vector or part of the recovery firmware
-gets corrupted.
-
-
-
-
Build Flags
-
-The following Kconfig values need to be selected to enable vboot:
-
-
-
COLLECT_TIMESTAMPS
-
VBOOT
-
-
-
-The starting stage needs to be specified by selecting either
-VBOOT_STARTS_IN_BOOTBLOCK or VBOOT_STARTS_IN_ROMSTAGE.
-
-
-
-If vboot starts in bootblock then vboot may be built as a separate stage by
-selecting VBOOT_SEPARATE_VERSTAGE. Additionally, if static RAM is too small
-to fit both verstage and romstage then selecting VBOOT_RETURN_FROM_VERSTAGE
-enables bootblock to reuse the RAM occupied by verstage for romstage.
-
-
-
-Non-volatile flash is needed for vboot operation. This flash area may be in
-CMOS, the EC, or in a read/write area of the SPI flash device. Select one of
-the following:
-
-
-
VBOOT_VBNV_CMOS
-
VBOOT_VBNV_EC
-
VBOOT_VBNV_FLASH
-
-
-More non-volatile storage features may be found in src/vboot/Kconfig.
-
-
-
-A TPM is also required for vboot operation. TPMs are available in
-drivers/i2c/tpm and drivers/pc80/tpm.
-
-
-
-In addition to adding the coreboot files into the read-only region, enabling
-vboot causes the build script to add the read/write files into coreboot file
-systems in FW_MAIN_A and FW_MAIN_B.
-
-
-
-
Signing the coreboot Image
-
-The following command script is an example of how to sign the coreboot image file.
-This script is used on the Intel Galileo board and creates the GBB area and
-inserts it into the coreboot image. It also updates the VBLOCK areas with the
-firmware signing key and the signature for the FW_MAIN firmware. More details
-are available in 3rdparty/vboot/README.
-
-
-
#!/bin/sh
-#
-# The necessary tools were built and installed using the following commands:
-#
-# pushd 3rdparty/vboot
-# make
-# sudo make install
-# popd
-#
-# The keys were made using the following command
-#
-# 3rdparty/vboot/scripts/keygeneration/create_new_keys.sh \
-# --4k --4k-root --output $PWD/keys
-#
-#
-# The "magic" numbers below are derived from the GBB section in
-# src/mainboard/intel/galileo/vboot.fmd.
-#
-# GBB Header Size: 0x80
-# GBB Offset: 0x611000, 4KiB block number: 1553 (0x611)
-# GBB Length: 0x7f000, 4KiB blocks: 127 (0x7f)
-# COREBOOT Offset: 0x690000, 4KiB block number: 1680 (0x690)
-# COREBOOT Length: 0x170000, 4KiB blocks: 368 (0x170)
-#
-# 0x7f000 (GBB Length) = 0x80 + 0x100 + 0x1000 + 0x7ce80 + 0x1000
-#
-# Create the GBB area blob
-# Parameters: hwid_size,rootkey_size,bmpfv_size,recoverykey_size
-#
-gbb_utility -c 0x100,0x1000,0x7ce80,0x1000 gbb.blob
-
-#
-# Copy from the start of the flash to the GBB region into the signed flash
-# image.
-#
-# 1553 * 4096 = 0x611 * 0x1000 = 0x611000, size of area before GBB
-#
-dd conv=fdatasync ibs=4096 obs=4096 count=1553 \
- if=build/coreboot.rom of=build/coreboot.signed.rom
-
-#
-# Append the empty GBB area to the coreboot.rom image.
-#
-# 1553 * 4096 = 0x611 * 0x1000 = 0x611000, offset to GBB
-#
-dd conv=fdatasync obs=4096 obs=4096 seek=1553 if=gbb.blob \
- of=build/coreboot.signed.rom
-
-#
-# Append the rest of the read-only region into the signed flash image.
-#
-# 1680 * 4096 = 0x690 * 0x1000 = 0x690000, offset to COREBOOT area
-# 368 * 4096 = 0x170 * 0x1000 = 0x170000, length of COREBOOT area
-#
-dd conv=fdatasync ibs=4096 obs=4096 skip=1680 seek=1680 count=368 \
- if=build/coreboot.rom of=build/coreboot.signed.rom
-
-#
-# Insert the HWID and public root and recovery RSA keys into the GBB area.
-#
-gbb_utility \
- --set --hwid='Galileo' \
- -r $PWD/keys/recovery_key.vbpubk \
- -k $PWD/keys/root_key.vbpubk \
- build/coreboot.signed.rom
-
-#
-# Sign the read/write firmware areas with the private signing key and update
-# the VBLOCK_A and VBLOCK_B regions.
-#
-3rdparty/vboot/scripts/image_signing/sign_firmware.sh \
- build/coreboot.signed.rom \
- $PWD/keys \
- build/coreboot.signed.rom
-
-
-
-
Boot Flow
-
-The reset vector exist in the read-only area and points to the bootblock entry
-point. The only copy of the bootblock exists in the read-only area of the SPI
-flash. Verstage may be part of the bootblock or a separate stage. If separate
-then the bootblock loads verstage from the read-only area and transfers control
-to it.
-
-
-
-Upon first boot, verstage attempts to verify the read/write section A. It gets
-the public root key from the GBB area and uses that to verify the VBLOCK area
-in read-write section A. If the VBLOCK area is valid then it extracts the
-firmware signing key (1024-8192 bits) and uses that to verify the FW_MAIN_A
-area of read/write section A. If the verification is successful then verstage
-instructs coreboot to use the coreboot file system in read/write section A for
-the contents of the remaining boot firmware (romstage, postcar, ramstage and
-the payload).
-
-
-
-If verification fails for the read/write area and the other read/write area is
-not valid vboot falls back to the read-only area to boot into system recovery.
-
-
-
-
Chromebook Special Features
-
-Google's Chromebooks have some special features:
-
-
-
Developer mode
-
Write-protect screw
-
-
-
Developer Mode
-
-Developer mode allows the user to use coreboot to boot another operating system.
-This may be a another (beta) version of Chrome OS, or another flavor of
-GNU/Linux. Use of developer mode does not void the system warranty. Upon
-entry into developer mode, all locally saved data on the system is lost.
-This prevents someone from entering developer mode to subvert the system
-security to access files on the local system or cloud.
-
-
-
Write Protect Screw
-
-Chromebooks have a write-protect screw which provides the ground to the
-write-protect pin of the SPI flash. Google specifically did this to allow
-the manufacturing line and advanced developers to re-write the entire SPI flash
-part. Once the screw is removed, any firmware may be placed on the device.
-However, accessing this screw requires opening the case and voids the system
-warranty!
-
-
-
-
Modified: 2 May 2017
-
-
diff --git a/Documentation/POSTCODES b/Documentation/POSTCODES
index 5d337b629dd..0e67dd173cc 100644
--- a/Documentation/POSTCODES
+++ b/Documentation/POSTCODES
@@ -16,6 +16,12 @@ This is an (incomplete) list of POST codes emitted by coreboot v4.
0x66 Devices have been enumerated
0x88 Devices have been configured
0x89 Devices have been enabled
+0xe0 Boot media (e.g. SPI ROM) is corrupt
+0xe1 Resource stored within CBFS is corrupt
+0xe2 Vendor binary (e.g. FSP) generated a fatal error
+0xe3 RAM could not be initialized
+0xe4 Critical hardware component could not initialize
+0xe5 Video subsystem failed to initialize
0xf8 Entry into elf boot
0xf3 Jumping to payload
diff --git a/Documentation/getting_started/kconfig.md b/Documentation/getting_started/kconfig.md
index 249fd4600e9..852ca08bf94 100644
--- a/Documentation/getting_started/kconfig.md
+++ b/Documentation/getting_started/kconfig.md
@@ -1165,8 +1165,6 @@ saved .config file. As always, a 'select' statement overrides any specified
- coreboot has added the glob operator '*' for the 'source' keyword.
- coreboot’s Kconfig always defines variables except for strings. In other
Kconfig implementations, bools set to false/0/no are not defined.
-- IS_ENABLED() is ‘false’ for undefined variables and ‘0’ variables. In Linux
- (where the macro comes from) it’s ‘true’ as soon as the variable is defined.
- coreboot’s version of Kconfig adds the KCONFIG_STRICT environment variable to
error out if there are any issues in the Kconfig files. In the Linux kernel,
Kconfig will generate a warning, but will still output an updated .config or
diff --git a/Documentation/lessons/lesson2.md b/Documentation/lessons/lesson2.md
index d6f800c2901..ae70c70cbc2 100644
--- a/Documentation/lessons/lesson2.md
+++ b/Documentation/lessons/lesson2.md
@@ -5,10 +5,10 @@
If you already have an account, skip to Part 2.
Otherwise, go to in your preferred web browser.
-Select **Register** in the upper right corner.
+Select **Sign in** in the upper right corner.
Select the appropriate sign-in. For example, if you have a Google account,
-select **Google OAuth2** (gerrit-oauth-provider plugin)".**Note:** Your
+select **Google OAuth2** (gerrit-oauth-provider plugin). **Note:** Your
username for the account will be the username of the account you used to
sign-in with. (ex. your Google username).
@@ -17,7 +17,7 @@ sign-in with. (ex. your Google username).
If you prefer to use an HTTP password instead, skip to Part 2b.
For the most up-to-date instructions on how to set up SSH keys with Gerrit go to
-
+
and follow the instructions there. Then, skip to Part 3.
Additionally, that section of the Web site provides explanation on starting
@@ -35,13 +35,13 @@ doing so could overwrite an existing key.
In the upper right corner, select your name and click on **Settings**.
Select **SSH Public Keys** on the left-hand side.
-In a terminal, run "ssh-keygen" and confirm the default path ".ssh/id_rsa".
+In a terminal, run `ssh-keygen` and confirm the default path `.ssh/id_rsa`.
Make a passphrase -- remember this phrase. It will be needed whenever you use
this RSA Public Key. **Note:** You might want to use a short password, or
forego the password altogether as you will be using it very often.
-Open "id_rsa.pub", copy all contents and paste into the textbox under
+Open `id_rsa.pub`, copy all contents and paste into the textbox under
"Add SSH Public Key" in the https://review.coreboot.org webpage.
## Part 2b: Setting up an HTTP Password
@@ -51,7 +51,7 @@ after you select your name and click on **Settings** on the left-hand side, rath
than selecting **SSH Public Keys**, select **HTTP Password**.
Click **Generate Password**. This should fill the "Password" box with a password. Copy
-the password, and add the following to your $HOME/.netrc file:
+the password, and add the following to your `$HOME/.netrc` file:
machine review.coreboot.org login YourUserNameHere password YourPasswordHere
@@ -61,15 +61,19 @@ just generated.
## Part 3: Clone coreboot and configure it for submitting patches
On Gerrit, click on the **Browse** tab in the upper left corner and select
-**Repositories**. From the listing, select the "coreboot" repo. You may have
+**Repositories**. From the listing, select the "coreboot" repo. You may have
to click the next page arrow at the bottom a few times to find it.
If you are using SSH keys, select **ssh** from the tabs under "Project
coreboot" and run the "clone with commit-msg hook" command that's provided.
This should prompt you for your id_rsa passphrase, if you previously set one.
+**Note:** if the **ssh** option is not showing, check that you have a username
+set. Click the profile picture at the top right and select **User Settings**,
+then set your username in the **Profile** section.
+
If you are using HTTP, instead, select **http** from the tabs under "Project coreboot"
-and run the command that appears
+and run the command that appears.
Now is a good time to configure your global git identity, if you haven't
already.
@@ -87,13 +91,13 @@ and other configurations.
An easy first commit to make is fixing existing checkpatch errors and warnings
in the source files. To see errors that are already present, build the files in
-the repository by running 'make lint' in the coreboot directory. Alternatively,
-if you want to run 'make lint' on a specific directory, run:
+the repository by running `make lint` in the coreboot directory. Alternatively,
+if you want to run `make lint` on a specific directory, run:
- for file in $(git ls-files | grep src/amd/quadcore); do \
+ for file in $(git ls-files | grep ); do \
util/lint/checkpatch.pl --file $file --terse; done
-where is the filepath of the directory (ex. src/cpu/amd/car).
+where `filepath` is the filepath of the directory (ex. `src/cpu/amd/car`).
Any changes made to files under the src directory are made locally,
and can be submitted for review.
@@ -116,7 +120,7 @@ To commit the change, run
git commit -s
**Note:** The -s adds a signed-off-by line by the committer. Your commit should be
-signed off with your name and email (i.e. **Your Name** ****, based on
+signed off with your name and email (i.e. **Your Name** **\**, based on
what you set with git config earlier).
Running git commit first checks for any errors and warnings using lint. If
@@ -130,65 +134,73 @@ The first line of your commit message is your commit summary. This is a brief
one-line description of what you changed in the files using the template
below:
-`: Short description`
-*ex. cpu/amd/pi/00630F01: Fix checkpatch warnings and errors*
+ : Short description
+
+For example,
+
+ cpu/amd/pi/00630F01: Fix checkpatch warnings and errors
**Note:** It is good practice to use present tense in your descriptions
and do not punctuate your summary.
Then hit Enter. The next paragraph should be a more in-depth explanation of the
changes you've made to the files. Again, it is good practice to use present
-tense.
-*ex. Fix space prohibited between function name and open parenthesis,
-line over 80 characters, unnecessary braces for single statement blocks,
-space required before open brace errors and warnings.*
+tense. Ex.
+
+ Fix space prohibited between function name and open parenthesis,
+ line over 80 characters, unnecessary braces for single statement blocks,
+ space required before open brace errors and warnings.
When you have finished writing your commit message, save and exit the text
editor. You have finished committing your change. If, after submitting your
-commit, you wish to make changes to it, running "git commit --amend" allows
+commit, you wish to make changes to it, running `git commit --amend` allows
you to take back your commit and amend it.
-When you are done with your commit, run 'git push' to push your commit to
+When you are done with your commit, run `git push` to push your commit to
coreboot.org. **Note:** To submit as a draft, use
-'git push origin HEAD:refs/drafts/master' Submitting as a draft means that
+`git push origin HEAD:refs/drafts/master`. Submitting as a draft means that
your commit will be on coreboot.org, but is only visible to those you add
as reviewers.
This has been a quick primer on how to submit a change to Gerrit for review
-using git. You may wish to review the [Gerrit code review workflow
+using git. You may wish to review the [Gerrit code review workflow
documentation](https://gerrit-review.googlesource.com/Documentation/intro-user.html#code-review),
especially if you plan to work on multiple changes at the same time.
## Part 4b: Using git cola to stage and submit a commit
If git cola is not installed on your machine, see
-https://git-cola.github.io/downloads.html for download instructions.
+ for download instructions.
-After making some edits to src files, rather than run "git add," run
-'git cola' from the command line. You should see all of the files
+After making some edits to src files, rather than run `git add`, run
+`git cola` from the command line. You should see all of the files
edited under "Modified".
In the textbox labeled "Commit summary" provide a brief one-line
description of what you changed in the files according to the template
below:
-`: Short description`
-*ex. cpu/amd/pi/00630F01: Fix checkpatch warnings and errors*
+ : Short description
+
+For example,
+
+ cpu/amd/pi/00630F01: Fix checkpatch warnings and errors
**Note:** It is good practice to use present tense in your descriptions
and do not punctuate your short description.
In the larger text box labeled 'Extended description...' provide a more
in-depth explanation of the changes you've made to the files. Again, it
-is good practice to use present tense.
-*ex. Fix space prohibited between function name and open parenthesis,
-line over 80 characters, unnecessary braces for single statement blocks,
-space required before open brace errors and warnings.*
+is good practice to use present tense. Ex.
+
+ Fix space prohibited between function name and open parenthesis,
+ line over 80 characters, unnecessary braces for single statement blocks,
+ space required before open brace errors and warnings.
Then press Enter two times to move the cursor to below your description.
To the left of the text boxes, there is an icon with an downward arrow.
Press the arrow and select "Sign Off." Make sure that you are signing off
-with your name and email (i.e. **Your Name** ****, based on what
+with your name and email (i.e. **Your Name** **\**, based on what
you set with git config earlier).
Now, review each of your changes and mark either individual changes or
@@ -214,30 +226,30 @@ Note: Be sure to add any other changes that haven't already been
explained in the extended description.
When ready, select 'Commit' again. Once all errors have been satisfied
-and the commit succeeds, move to the command line and run 'git push'.
-**Note:** To submit as a draft, use 'git push origin HEAD:refs/drafts/master'
+and the commit succeeds, move to the command line and run `git push`.
+**Note:** To submit as a draft, use `git push origin HEAD:refs/drafts/master`.
Submitting as a draft means that your commit will be on coreboot.org, but is
only visible to those you add as reviewers.
## Part 5: Getting your commit reviewed
-Your commits can now be seen on review.coreboot.org if you select “Your”
-and click on “Changes” and can be reviewed by others. Your code will
+Your commits can now be seen on review.coreboot.org if you select "Your"
+and click on "Changes" and can be reviewed by others. Your code will
first be reviewed by build bot (Jenkins), which will either give you a warning
or verify a successful build; if so, your commit will receive a +1. Other
-users may also give your commit +1. For a commit to be merged, it needs
-to receive a +2.**Note:** A +1 and a +1 does not make a +2. Only certain users
+users may also give your commit +1. For a commit to be merged, it needs
+to receive a +2. **Note:** A +1 and a +1 does not make a +2. Only certain users
can give a +2.
## Part 6 (optional): bash-git-prompt
To help make it easier to understand the state of the git repository
-without running 'git status' or 'git log', there is a way to make the
+without running `git status` or `git log`, there is a way to make the
command line show the status of the repository at every point. This
is through bash-git-prompt.
Instructions for installing this are found at:
-https://github.com/magicmonty/bash-git-prompt
+.
**Note:** Feel free to search for different versions of git prompt,
as this one is specific to bash.
@@ -250,7 +262,7 @@ Run the following two commands in the command line:
**Note:** cd will change your directory to your home directory, so the
git clone command will be run there.
-Finally, open the ~/.bashrc file and append the following two lines:
+Finally, open the `~/.bashrc` file and append the following two lines:
GIT_PROMPT_ONLY_IN_REPO=1
source ~/.bash-git-prompt/gitprompt.sh
@@ -260,7 +272,7 @@ its state.
There also are additional configurations that you can change depending on your
preferences. If you wish to do so, look at the "All configs for .bashrc" section
-on https://github.com/magicmonty/bash-git-prompt. Listed in that section are
+on . Listed in that section are
various lines that you can copy, uncomment and add to your .bashrc file to
change the configurations. Example configurations include avoid fetching remote
status, and supporting versions of Git older than 1.7.10.
@@ -273,7 +285,7 @@ Suppose you would like to update a commit that has already been pushed to the
remote repository. If the commit you wish to update is the most recent
commit you have made, after making your desired changes, stage the files
(either using git add or in git cola), and amend the commit. To do so,
-if you are using the command line, run "git commit --amend." If you are
+if you are using the command line, run `git commit --amend`. If you are
using git cola, click on the gear icon located on the upper left side under
**Commit** and select **Amend Last Commit** in the drop down menu. Then, stage
the files you have changed, commit the changes, and run git push to push the
diff --git a/Documentation/mainboard/asus/p8h61-m_pro.jpg b/Documentation/mainboard/asus/p8h61-m_pro.jpg
new file mode 100644
index 00000000000..f3d60071b55
Binary files /dev/null and b/Documentation/mainboard/asus/p8h61-m_pro.jpg differ
diff --git a/Documentation/mainboard/asus/p8h61-m_pro.md b/Documentation/mainboard/asus/p8h61-m_pro.md
new file mode 100644
index 00000000000..169678efcd5
--- /dev/null
+++ b/Documentation/mainboard/asus/p8h61-m_pro.md
@@ -0,0 +1,103 @@
+# ASUS P8H61-M Pro
+
+This page describes how to run coreboot on the [ASUS P8H61-M Pro].
+
+## Flashing coreboot
+
+```eval_rst
++---------------------+------------+
+| Type | Value |
++=====================+============+
+| Socketed flash | yes |
++---------------------+------------+
+| Model | W25Q32BV |
++---------------------+------------+
+| Size | 4 MiB |
++---------------------+------------+
+| Package | DIP-8 |
++---------------------+------------+
+| Write protection | no |
++---------------------+------------+
+| Dual BIOS feature | no |
++---------------------+------------+
+| Internal flashing | yes |
++---------------------+------------+
+```
+
+The flash IC is located right next to one of the SATA ports:
+
+
+### Internal programming
+
+The main SPI flash can be accessed using [flashrom]. By default, only
+the BIOS region of the flash is writable. If you wish to change any
+other region (Management Engine or flash descriptor), then an external
+programmer is required.
+
+The following command may be used to flash coreboot:
+
+```
+$ sudo flashrom --noverify-all --ifd -i bios -p internal -w coreboot.rom
+```
+
+The use of `--noverify-all` is required since the Management Engine
+region is not readable even by the host.
+
+## Known issues
+
+- There is no automatic, OS-independent fan control. This is because
+ the super I/O hardware monitor can only obtain valid CPU temperature
+ readings from the PECI agent, whose complete initialisation is not
+ publicly documented. The `coretemp` driver can still be used for
+ accurate CPU temperature readings.
+
+- me_cleaner breaks LPC bus and attached components!
+- PS/2 mouse doesn't work
+
+## Untested
+
+- parallel port
+- EHCI debug
+- S/PDIF audio
+
+## Working
+
+- PS/2 keyboard
+- PCIe graphics
+- USB
+- Gigabit Ethernet
+- Integrated graphics
+- SATA
+- Serial port
+- hardware monitor (see [Known issues](#known-issues) for caveats)
+- front panel audio
+- Native raminit (2 x 2GB, DDR3-1333)
+- Native graphics init (libgfxinit)
+- Wake-on-LAN
+- TPM on TPM-header
+
+## Technology
+
+```eval_rst
++------------------+--------------------------------------------------+
+| Northbridge | :doc:`../../northbridge/intel/sandybridge/index` |
++------------------+--------------------------------------------------+
+| Southbridge | bd82x6x |
++------------------+--------------------------------------------------+
+| CPU | model_206ax |
++------------------+--------------------------------------------------+
+| Super I/O | Nuvoton NCT6776 |
++------------------+--------------------------------------------------+
+| EC | None |
++------------------+--------------------------------------------------+
+| Coprocessor | Intel Management Engine |
++------------------+--------------------------------------------------+
+```
+
+## Extra resources
+
+- [Flash chip datasheet][W25Q32BV]
+
+[ASUS P8H61-M Pro]: https://www.asus.com/Motherboards/P8H61M_Pro/
+[W25Q32BV]: https://www.winbond.com/resource-files/w25q32bv_revi_100413_wo_automotive.pdf
+[flashrom]: https://flashrom.org/Flashrom
diff --git a/Documentation/mainboard/facebook/fbg1701.md b/Documentation/mainboard/facebook/fbg1701.md
new file mode 100644
index 00000000000..89e8a6abbca
--- /dev/null
+++ b/Documentation/mainboard/facebook/fbg1701.md
@@ -0,0 +1,83 @@
+# Facebook FBG-1701
+
+This page describes how to run coreboot on the Facebook FBG1701.
+
+FBG1701 are assembled with different onboard memory modules:
+ Rev 1.0 Onboard Samsung K4B8G1646D-MYKO memory
+ Rev 1.1 and 1.2 Onboard Micron MT41K512M16HA-125A memory
+
+Use make menuconfig to configure `onboard memory manufacturer` in Mainboard
+menu.
+
+## Required blobs
+
+This board currently requires:
+fsp blob 3rdparty/fsp/BraswellFspBinPkg/FspBin/BSWFSP.fd
+Microcode Intel Braswell cpuid 1046C4 version 410
+ (Used pre-build binary retrieved from Intel site)
+
+## Flashing coreboot
+
+### Internal programming
+
+The main SPI flash can be accessed using [flashrom].
+
+### External programming
+
+The system has an internal flash chip which is a 8 MiB soldered SOIC-8 chip.
+This chip is located to the top middle side of the board. It's located
+between SoC and Q7 connector. Use clip (or solder wires) to program
+the chip.
+Specifically, it's a Winbond W25Q64FW (1.8V), whose datasheet can be found
+[here][W25Q64FW].
+
+The system has an external flash chip which is a 8 MiB soldered SOIC-8 chip.
+This chip is located in the middle of carrier board close to the flex cable
+connection.
+Specifically, it's a Winbond W25Q64FV (3.3V), whose datasheet can be found
+[here][W25Q64FV].
+
+## Known issues
+
+- None
+
+## Untested
+
+- hardware monitor
+- SDIO
+- Full Embedded Controller support
+
+## Working
+
+- USB
+- Gigabit Ethernet
+- integrated graphics
+- flashrom
+- external graphics
+- PCIe
+- eMMC
+- SATA
+- serial port
+- SMBus
+- HDA
+- initialization with FSP MR2
+- SeaBIOS payload
+- Embedded Linux (Ubuntu 4.15+)
+
+## Technology
+
+```eval_rst
++------------------+--------------------------------------------------+
+| SoC | Intel Atom Processor N3710 |
++------------------+--------------------------------------------------+
+| CPU | Intel Braswell (N3710) |
++------------------+--------------------------------------------------+
+| Super I/O, EC | ITE8256 |
++------------------+--------------------------------------------------+
+| Coprocessor | Intel Management Engine |
++------------------+--------------------------------------------------+
+```
+
+[W25Q64FW]: https://www.winbond.com/resource-files/w25q64fw%20revn%2005182017%20sfdp.pdf
+[W25Q64FV]: https://www.winbond.com/resource-files/w25q64fv%20revs%2007182017.pdf
+[flashrom]: https://flashrom.org/Flashrom
diff --git a/Documentation/mainboard/hp/8760w.md b/Documentation/mainboard/hp/8760w.md
new file mode 100644
index 00000000000..714745aa043
--- /dev/null
+++ b/Documentation/mainboard/hp/8760w.md
@@ -0,0 +1,82 @@
+# HP EliteBook 8760w
+
+This page describes how to run coreboot on the [HP EliteBook 8760w].
+
+## Flashing coreboot
+
+```eval_rst
++---------------------+------------+
+| Type | Value |
++=====================+============+
+| Socketed flash | no |
++---------------------+------------+
+| Model | W25Q64.V |
++---------------------+------------+
+| Size | 8 MiB |
++---------------------+------------+
+| Package | SOIC-8 |
++---------------------+------------+
+| Write protection | no |
++---------------------+------------+
+| Dual BIOS feature | no |
++---------------------+------------+
+| In circuit flashing | yes |
++---------------------+------------+
+| Internal flashing | yes |
++---------------------+------------+
+```
+
+## Required proprietary blobs
+
+- Intel Firmware Descriptor, ME and GbE firmware
+- EC: please read [EliteBook Series](elitebook_series)
+
+## Flashing instructions
+
+HP EliteBook 8760w has an 8MB SOIC-8 flash chip on the bottom of the
+mainboard. You just need to remove the service cover, and use an SOIC-8
+clip to read and flash the chip.
+
+
+
+## Untested
+
+- dock: serial port, parallel port, ...
+- TPM
+- S3 suspend/resume
+- Gigabit Ethernet
+
+## Working
+
+- i7-2630QM, 0+4G+8G+0
+- i7-3720QM, 8G+8G+8G+8G
+- Arch Linux boot from SeaBIOS payload
+- EHCI debug: the port is at the right side, next to the charging port
+- SATA
+- eSATA
+- USB2 and USB3
+- keyboard, touchpad, trackpad
+- WLAN
+- WWAN
+- EC ACPI
+- Using `me_cleaner`
+
+## Technology
+
+```eval_rst
++------------------+--------------------------------------------------+
+| Northbridge | :doc:`../../northbridge/intel/sandybridge/index` |
++------------------+--------------------------------------------------+
+| Southbridge | bd82x6x |
++------------------+--------------------------------------------------+
+| CPU | model_206ax |
++------------------+--------------------------------------------------+
+| Super I/O | SMSC LPC47n217 |
++------------------+--------------------------------------------------+
+| EC | SMSC KBC1126 |
++------------------+--------------------------------------------------+
+| Coprocessor | Intel Management Engine |
++------------------+--------------------------------------------------+
+```
+
+[HP EliteBook 8760w]: https://support.hp.com/us-en/product/hp-elitebook-8760w-mobile-workstation/5071180
diff --git a/Documentation/mainboard/hp/8760w_flash.jpg b/Documentation/mainboard/hp/8760w_flash.jpg
new file mode 100644
index 00000000000..d9bbac6788a
Binary files /dev/null and b/Documentation/mainboard/hp/8760w_flash.jpg differ
diff --git a/Documentation/mainboard/hp/elitebook_series.md b/Documentation/mainboard/hp/elitebook_series.md
new file mode 100644
index 00000000000..6668928008f
--- /dev/null
+++ b/Documentation/mainboard/hp/elitebook_series.md
@@ -0,0 +1,111 @@
+# HP EliteBook series
+
+This document is about HP EliteBook series laptops up to Ivy Bridge era
+which use SMSC KBC1126 as embedded controller.
+
+## EC
+
+SMSC KBC1098/KBC1126 has been used in HP EliteBooks for many generations.
+They use similar EC firmware that will load other code and data from the
+SPI flash chip, so we need to put some firmware blobs to the coreboot image.
+
+The following document takes EliteBook 2760p as an example.
+
+First, you need to extract the blobs needed by EC firmware using util/kbc1126.
+You can extract them from your backup firmware image, or firmware update
+provided by HP with [unar] as follows:
+
+```bash
+wget https://ftp.hp.com/pub/softpaq/sp79501-80000/sp79710.exe
+unar sp79710.exe
+${COREBOOT_DIR}/util/kbc1126/kbc1126_ec_dump sp79710/Rompaq/68SOU.BIN
+mv 68SOU.BIN.fw1 ${COREBOOT_DIR}/2760p-fw1.bin
+mv 68SOU.BIN.fw2 ${COREBOOT_DIR}/2760p-fw2.bin
+```
+
+When you config coreboot, select:
+
+```text
+Chipset --->
+ [*] Add firmware images for KBC1126 EC
+ (2760p-fw1.bin) KBC1126 firmware #1 path and filename
+ (2760p-fw2.bin) KBC1126 filename #2 path and filename
+```
+
+## Super I/O
+
+EliteBook 8000 series laptops have SMSC LPC47n217 Super I/O to provide
+a serial port and a parallel port, you can debug the laptop via this
+serial port.
+
+## porting
+
+To port coreboot to an HP EliteBook laptop, you need to do the following:
+
+- select Kconfig option `EC_HP_KBC1126`
+- select Kconfig option `SUPERIO_SMSC_LPC47N217` if there is LPC47n217 Super I/O
+- initialize EC and Super I/O in romstage
+- add EC and Super I/O support to devicetree.cb
+
+To get the related values for EC in devicetree.cb, you need to extract the EFI
+module EcThermalInit from the vendor UEFI firmware with [UEFITool]. Usually,
+`ec_data_port`, `ec_cmd_port` and `ec_ctrl_reg` has the following values:
+
+- For xx60 series: 0x60, 0x64, 0xca
+- For xx70 series: 0x62, 0x66, 0x81
+
+You can use [radare2] and the following [r2pipe] Python script to find
+these values from the EcThermalInit EFI module:
+
+```python
+#!/usr/bin/env python
+
+# install radare2 and use `pip3 install --user r2pipe` to install r2pipe
+
+import r2pipe
+import sys
+
+if len(sys.argv) < 2:
+ fn = "ecthermalinit.efi"
+else:
+ fn = sys.argv[1]
+
+r2 = r2pipe.open(fn)
+r2.cmd("aa")
+entryf = r2.cmdj("pdfj")
+
+for insn in entryf["ops"]:
+ if "lea r8" in insn["opcode"]:
+ _callback = insn["ptr"]
+ break
+
+r2.cmd("af @ {}".format(_callback))
+callbackf_insns = r2.cmdj("pdfj @ {}".format(_callback))["ops"]
+
+def find_port(addr):
+ ops = r2.cmdj("pdfj @ {}".format(addr))["ops"]
+ for insn in ops:
+ if "lea r8d" in insn["opcode"]:
+ return insn["ptr"]
+
+ctrl_reg_found = False
+
+for i in range(0, len(callbackf_insns)):
+ if not ctrl_reg_found and "mov cl" in callbackf_insns[i]["opcode"]:
+ ctrl_reg_found = True
+ ctrl_reg = callbackf_insns[i]["ptr"]
+ print("ec_ctrl_reg = 0x%02x" % ctrl_reg)
+ cmd_port = find_port(callbackf_insns[i+1]["jump"])
+ data_port = find_port(callbackf_insns[i+3]["jump"])
+ print("ec_cmd_port = 0x%02x\nec_data_port = 0x%02x" % (cmd_port, data_port))
+
+ if "mov bl" in callbackf_insns[i]["opcode"]:
+ ctrl_value = callbackf_insns[i]["ptr"]
+ print("ec_fan_ctrl_value = 0x%02x" % ctrl_value)
+```
+
+
+[unar]: https://theunarchiver.com/command-line
+[UEFITool]: https://github.com/LongSoft/UEFITool
+[radare2]: https://radare.org/
+[r2pipe]: https://github.com/radare/radare2-r2pipe
diff --git a/Documentation/mainboard/index.md b/Documentation/mainboard/index.md
index 7eaf425e209..f63ef763fb0 100644
--- a/Documentation/mainboard/index.md
+++ b/Documentation/mainboard/index.md
@@ -6,6 +6,7 @@ This section contains documentation about coreboot on specific mainboards.
- [F2A85-M](asus/f2a85-m.md)
- [P8H61-M LX](asus/p8h61-m_lx.md)
+- [P8H61-M Pro](asus/p8h61-m_pro.md)
## ASRock
@@ -29,6 +30,10 @@ The boards in this section are not real mainboards, but emulators.
- [IceLake RVP](intel/icelake_rvp.md)
- [KBLRVP11](intel/kblrvp11.md)
+## Facebook
+
+- [FBG-1701](facebook/fbg1701.md)
+
## Foxconn
- [D41S](foxconn/d41s.md)
@@ -44,11 +49,17 @@ The boards in this section are not real mainboards, but emulators.
## Open Cellular
- [Elgon](opencellular/elgon.md)
+- [Rotundu](opencellular/rotundu.md)
## HP
- [Compaq 8200 Elite SFF](hp/compaq_8200_sff.md)
+### EliteBook series
+
+- [EliteBook common](hp/elitebook_series.md)
+- [EliteBook 8760w](hp/8760w.md)
+
## Lenovo
- [Mainboard codenames](lenovo/codenames.md)
@@ -70,6 +81,14 @@ The boards in this section are not real mainboards, but emulators.
- [T430 / T530 / X230 / W530 common](lenovo/xx30_series.md)
- [T431s](lenovo/t431s.md)
+## MSI
+
+- [MS-7707](msi/ms7707/ms7707.md)
+
+## Roda
+
+- [RK9 Flash Header](roda/rk9/flash_header.md)
+
## SiFive
- [SiFive HiFive Unleashed](sifive/hifive-unleashed.md)
@@ -77,3 +96,7 @@ The boards in this section are not real mainboards, but emulators.
## Supermicro
- [X10SLM+-F](supermicro/x10slm-f.md)
+
+## UP
+
+- [Squared](up/squared/index.md)
diff --git a/Documentation/mainboard/msi/ms7707/J1-flash-protect.jpg b/Documentation/mainboard/msi/ms7707/J1-flash-protect.jpg
new file mode 100644
index 00000000000..b649d059a81
Binary files /dev/null and b/Documentation/mainboard/msi/ms7707/J1-flash-protect.jpg differ
diff --git a/Documentation/mainboard/msi/ms7707/JSPI1-Winbond-W25Q32BVSIG.jpg b/Documentation/mainboard/msi/ms7707/JSPI1-Winbond-W25Q32BVSIG.jpg
new file mode 100644
index 00000000000..7a0df71dd77
Binary files /dev/null and b/Documentation/mainboard/msi/ms7707/JSPI1-Winbond-W25Q32BVSIG.jpg differ
diff --git a/Documentation/mainboard/msi/ms7707/JSPI1-connected.jpg b/Documentation/mainboard/msi/ms7707/JSPI1-connected.jpg
new file mode 100644
index 00000000000..d1eed2760ed
Binary files /dev/null and b/Documentation/mainboard/msi/ms7707/JSPI1-connected.jpg differ
diff --git a/Documentation/mainboard/msi/ms7707/JSPI1.png b/Documentation/mainboard/msi/ms7707/JSPI1.png
new file mode 100644
index 00000000000..b1eadc28e68
Binary files /dev/null and b/Documentation/mainboard/msi/ms7707/JSPI1.png differ
diff --git a/Documentation/mainboard/msi/ms7707/flashlayout.svg b/Documentation/mainboard/msi/ms7707/flashlayout.svg
new file mode 100644
index 00000000000..2bd826b10ca
--- /dev/null
+++ b/Documentation/mainboard/msi/ms7707/flashlayout.svg
@@ -0,0 +1,34 @@
+
+
diff --git a/Documentation/mainboard/msi/ms7707/ms7707.md b/Documentation/mainboard/msi/ms7707/ms7707.md
new file mode 100644
index 00000000000..789431872cc
--- /dev/null
+++ b/Documentation/mainboard/msi/ms7707/ms7707.md
@@ -0,0 +1,112 @@
+# MSI MS-7707 V1.1
+
+* MSI MS-7707 V1.1 (Medion OEM Akoya P4385D MSN10014555)
+* SandyBridge Intel P67 (BD82x6x)
+* Winbond 25Q32BV (4MB)
+* Fintek F71808A SuperIO
+* Intel 82579V Gigabit
+* NEC uPD720200 USB 3.0 Host Controller
+* IME 7.0.4.1197
+
+## Flash chip (Winbond 25Q32BV)
+```eval_rst
++---------------------+--------------------+
+| Type | Value |
++=====================+====================+
+| Size | 4 MiB |
++---------------------+--------------------+
+| BIOS range | 2 MiB |
++---------------------+--------------------+
+| Write protection | Yes (via jumper) |
++---------------------+--------------------+
+| Header | Yes (JSPI1) |
++---------------------+--------------------+
+| Package | SOIC-8 |
++---------------------+--------------------+
+| In circuit flashing | Yes |
++---------------------+--------------------+
+| Internal flashing | Yes |
++---------------------+--------------------+
+| Socketed flash | No |
++---------------------+--------------------+
+| Dual BIOS feature | No |
++---------------------+--------------------+
+| ME removable | Yes |
++---------------------+--------------------+
+```
+
+## Installation instructions
+* The standard method is to only flash the 2MiB BIOS region. In that case it's
+not needed to extract blobs from vendor firmware and internal flashing is
+sufficient.
+* To flash the whole chip (e.g. to disable ME) blobs are needed to build
+coreboot. Blobs can be extracted with util/ifdtool from 4MiB full dump image
+(see below). Its recommended to include the VGA BIOS as well (4MiB write only).
+Kconfig is prepared already if it gets enabled (path and 8086,0102).
+```
+coreboot/3rdparty/blobs/mainboard/msi/ms7707
+├── descriptor.bin
+├── gbe.bin
+├── me.bin
+└── vgabios.bin
+```
+* Never write a full 4MiB image if blobs are not included. The generated
+coreboot.rom file is always 4MiB but the 2MiB flash command below will only
+flash the last 2MiB (BIOS) block.
+* The J1-Jumper sets the 'Flash Descriptor Override Strap-Pin' and enables
+full 4MiB access for internal flasher (read and write).
+* **Write BIOS-range** (2MiB) with J1-Jumper=off (as on picture/default
+ position):
+```
+flashrom -p internal:ich_spi_force=yes --noverify-all --ifd -i bios -w coreboot.rom
+```
+* **Read full dump** (4MiB) with J1-jumper=on:
+```
+flashrom -p internal -r original.rom
+```
+* **Write full dump** (4MiB) with J1-Jumper=on:
+```
+flashrom -p internal -w coreboot.rom
+```
+* After successful flashing turn main power off, wait some seconds to drain
+the capacitors, pull the battery and set the JBAT (clrcmos) jumper for some
+seconds. Setting the jumper alone is not enough (the Fintek is VBAT backed).
+Put all back in place and restart the board. It might need 1-2 AC power cycles
+to reinitialize (running at full fan speed - don't panic).
+* External flashing has been tested with RPi2 without main power connected.
+3.3V provided by RPi2. Read more about flashing methods [here](https://doc.coreboot.org/flash_tutorial/index.html).
+* In case of going back to proprietary BIOS create/save cmos settings as early
+as possible (do not leave BIOS on first start without saving settings).
+The BIOS might corrupt nvram (not cmos!) and leave the system in a dead state
+that needs an external flasher to revive. If stuck, reset the Fintek (see
+above) and restart the system several times and/or try setting J1 to
+temporarily disable ME.
+
+
+
+* The JSPI1 header (5×2 2.0mm pitch pin header) for external flashing is
+directly connected to the flash chip. Additional 3.3V to /HOLD and /WP is not
+needed (internally re-routed already).
+
+
+
+
+
+
+
+## Flash layout
+
+* The 4MiB flashrom is divided into 4 sections:
+
+![][flashlayout]
+
+## Links
+
+- [BIOS ROM]
+- [Fintek F71808A datasheet]
+- [Winbond 25Q32BV datasheet]
+
+[BIOS ROM]: https://www.medion.com/de/servicebackend/_lightbox/treiber_details.php?did=9744
+[Winbond 25Q32BV datasheet]: https://www.winbond.com/resource-files/w25q32bv_revi_100413_wo_automotive.pdf
+[Fintek F71808A datasheet]: https://www.alldatasheet.com/datasheet-pdf/pdf/459069/FINTEK/F71808A.html
+[flashlayout]: flashlayout.svg
diff --git a/Documentation/mainboard/opencellular/rotundu.md b/Documentation/mainboard/opencellular/rotundu.md
new file mode 100644
index 00000000000..8773e960a3b
--- /dev/null
+++ b/Documentation/mainboard/opencellular/rotundu.md
@@ -0,0 +1,76 @@
+# Rutundu
+
+This page describes how to run coreboot on the [Rotundu] compute board
+from [OpenCellular].
+
+## TODO
+
+* Configure UART
+* EC interface
+
+## Flashing coreboot
+
+```eval_rst
++---------------------+------------+
+| Type | Value |
++=====================+============+
+| Socketed flash | no |
++---------------------+------------+
+| Model | W25Q128 |
++---------------------+------------+
+| Size | 16 MiB |
++---------------------+------------+
+| In circuit flashing | yes |
++---------------------+------------+
+| Package | SOIC-8 |
++---------------------+------------+
+| Write protection | No |
++---------------------+------------+
+| Dual BIOS feature | No |
++---------------------+------------+
+| Internal flashing | yes |
++---------------------+------------+
+```
+
+### Internal programming
+
+The SPI flash can be accessed using [flashrom].
+
+### External programming
+
+The GBCv1 board does have a pinheader to flash the SOIC-8 in circuit.
+Directly connecting a Pomona test-clip on the flash is also possible.
+
+**Closeup view of SOIC-8 flash IC**
+
+![][rotundu_flash]
+
+[rotundu_flash]: rotundu_flash.jpg
+
+**SPI header**
+
+![][rotundu_header2]
+
+[rotundu_header2]: rotundu_header2.jpg
+
+**SPI header pinout**
+
+Dediprog compatible pinout.
+
+![][rotundu_j16]
+
+[rotundu_j16]: rotundu_j16.png
+
+## Technology
+
+```eval_rst
++------------------+--------------------------------------------------+
+| SoC | Intel Baytrail |
++------------------+--------------------------------------------------+
+| Coprocessor | Intel ME |
++------------------+--------------------------------------------------+
+```
+
+[Rotundu]: https://github.com/Telecominfraproject/OpenCellular
+[OpenCellular]: https://code.fb.com/connectivity/introducing-opencellular-an-open-source-wireless-access-platform/
+[flashrom]: https://flashrom.org/Flashrom
diff --git a/Documentation/mainboard/opencellular/rotundu_flash.jpg b/Documentation/mainboard/opencellular/rotundu_flash.jpg
new file mode 100644
index 00000000000..f14617c17aa
Binary files /dev/null and b/Documentation/mainboard/opencellular/rotundu_flash.jpg differ
diff --git a/Documentation/mainboard/opencellular/rotundu_header2.jpg b/Documentation/mainboard/opencellular/rotundu_header2.jpg
new file mode 100644
index 00000000000..f6923068423
Binary files /dev/null and b/Documentation/mainboard/opencellular/rotundu_header2.jpg differ
diff --git a/Documentation/mainboard/opencellular/rotundu_j16.png b/Documentation/mainboard/opencellular/rotundu_j16.png
new file mode 100644
index 00000000000..1936365d801
Binary files /dev/null and b/Documentation/mainboard/opencellular/rotundu_j16.png differ
diff --git a/Documentation/mainboard/roda/rk9/flash_header.md b/Documentation/mainboard/roda/rk9/flash_header.md
new file mode 100644
index 00000000000..c2978cbe682
--- /dev/null
+++ b/Documentation/mainboard/roda/rk9/flash_header.md
@@ -0,0 +1,23 @@
+Roda RK9 Flash Header
+=====================
+
+There is a 5x2 pin, 1.27mm pitch header *J1* south of the BIOS flash. It
+follows the pinout of the Dediprog adaptor board:
+
+ +------+
+ | 1 2 | 1: HOLD 2 2: CS 2
+ | 3 4 | 3: CS 1 4: VCC
+ | 5 6 | 5: MISO 6: HOLD 1
+ | 7 8 | 7: 8: CLK
+ | 9 10 | 9: GND 10: MOSI
+ +------+
+
+Pins 3 to 10 directly map to the regular SPI flash pinout.
+
+There is also a *JP17* around. Ideally, it should be closed during
+programming (isolates the SPI bus from the southbridge):
+
+ +---+
+ | 1 | 1: SF100-I/O3
+ | 2 | 2: GND
+ +---+
diff --git a/Documentation/mainboard/sifive/hifive-unleashed.md b/Documentation/mainboard/sifive/hifive-unleashed.md
index cd7c93ca0b9..495dade2122 100644
--- a/Documentation/mainboard/sifive/hifive-unleashed.md
+++ b/Documentation/mainboard/sifive/hifive-unleashed.md
@@ -12,15 +12,13 @@ For general setup instructions, please refer to the [Getting Started Guide].
The following things are still missing from this coreboot port:
- Support running romstage from flash (fix stack) to support boot mode 1
-- CBMEM support
-- FU540 clock configuration
-- FU540 RAM init
-- Placing the ramstage in DRAM
- Starting the U54 cores
- FU540 PIN configuration and GPIO access macros
- Provide serial number to payload (e.g. in device tree)
+- Implement instruction emulation
- Support for booting Linux on RISC-V
-
+- Add support to run OpenSBI payload in m-mode
+- SMP support in trap handler
## Configuration
diff --git a/Documentation/mainboard/up/squared/bottom.jpg b/Documentation/mainboard/up/squared/bottom.jpg
new file mode 100644
index 00000000000..f9aa85db50a
Binary files /dev/null and b/Documentation/mainboard/up/squared/bottom.jpg differ
diff --git a/Documentation/mainboard/up/squared/index.md b/Documentation/mainboard/up/squared/index.md
new file mode 100644
index 00000000000..dcf3ed192de
--- /dev/null
+++ b/Documentation/mainboard/up/squared/index.md
@@ -0,0 +1,99 @@
+# Squared
+
+## Overview
+### Top
+![][overview_top]
+
+### Bottom
+![][overview_bottom]
+
+## Mainboard components
+### Platform
+```eval_rst
++------------------+----------------------------------+
+| CPU | Intel Atom, Celeron, Pentium |
++------------------+----------------------------------+
+| PCH | Intel Apollo Lake |
++------------------+----------------------------------+
+| EC / Super IO | N/A |
++------------------+----------------------------------+
+| Coprocessor | Intel TXE 3.0 |
++------------------+----------------------------------+
+```
+
+### Flash chip
+```eval_rst
++---------------------+------------+
+| Type | Value |
++=====================+============+
+| Socketed flash | no |
++---------------------+------------+
+| Vendor | Winbond |
++---------------------+------------+
+| Model | W25Q128FW |
++---------------------+------------+
+| Voltage | 1.8V |
++---------------------+------------+
+| Size | 16 MiB |
++---------------------+------------+
+| Package | SOIC-8 |
++---------------------+------------+
+| Write protection | No |
++---------------------+------------+
+| Internal flashing | No |
++---------------------+------------+
+| In curcuit flashing | Yes |
++---------------------+------------+
+```
+
+## Board status
+### Working
+- bootblock, romstage, ramstage
+- Serial console UART0, UART1
+- SPI flash console
+- iGPU init with libgfxinit
+- LAN1, LAN2
+- USB2, USB3
+- HDMI, DisplayPort
+- eMMC
+- flashing with flashrom externally
+
+### Work in progress
+- Documentation
+- ACPI
+
+### Not working / Known issues
+- Generally SeaBIOS works, but it can't find the CBFS region and therefore it can't load seavgabios. This is because of changes at the Apollolake platform.
+
+### Untested
+- GPIO pin header
+- 60 pin EXHAT
+- Camera interface
+ - MIPI-CSI2 2-lane (2MP)
+ - MIPI-CSI2 4-lane (8MP)
+- SATA3
+- USB3 OTG
+- embedded DisplayPort
+- M.2 slot
+- mini PCIe
+- flashing with flashrom internally using Linux
+
+## Building and flashing coreboot
+### Building
+
+```bash
+make distclean
+touch .config
+./util/scripts/config --enable VENDOR_UP
+./util/scripts/config --enable BOARD_UP_SQUARED
+./util/scripts/config --enable NEED_IFWI
+./util/scripts/config --enable HAVE_IFD_BIN
+./util/scripts/config --set-str IFWI_FILE_NAME ""
+./util/scripts/config --set-str IFD_BIN_PATH ""
+make olddefconfig
+```
+
+### Flashing
+
+[overview_top]: top.jpg
+[overview_bottom]: bottom.jpg
diff --git a/Documentation/mainboard/up/squared/top.jpg b/Documentation/mainboard/up/squared/top.jpg
new file mode 100644
index 00000000000..71adf459b73
Binary files /dev/null and b/Documentation/mainboard/up/squared/top.jpg differ
diff --git a/Documentation/northbridge/intel/haswell/mrc.bin.md b/Documentation/northbridge/intel/haswell/mrc.bin.md
index 36ab4c4385d..edfe4b8b84a 100644
--- a/Documentation/northbridge/intel/haswell/mrc.bin.md
+++ b/Documentation/northbridge/intel/haswell/mrc.bin.md
@@ -27,6 +27,83 @@ Now, place `mrc.bin` in the root of the coreboot directory.
Alternatively, place `mrc.bin` anywhere you want, and set `MRC_FILE` to
its location when building coreboot.
+## SPD Addresses
+
+When porting a board from vendor firmware, the SPD addresses can be obtained
+through `i2c-tools`, which can be found in many GNU/Linux distributions. A more
+[detailed description](https://hannuhartikainen.fi/blog/hacking-ddr3-spd/) of
+the procedure and beyond can be found in
+[Hannu Hartikainen's blog](https://hannuhartikainen.fi).
+
+First load the kernel modules:
+
+```bash
+modprobe i2c-dev
+modprobe eeprom
+```
+
+Find the SMBus and the addresses of the DIMM's EEPROMs (example output):
+```bash
+$ decode-dimms | grep Decoding
+Decoding EEPROM: /sys/bus/i2c/drivers/eeprom/7-0050
+Decoding EEPROM: /sys/bus/i2c/drivers/eeprom/7-0052
+```
+
+Alternatively, look at the sys filesystem:
+```bash
+$ ls -l /sys/bus/i2c/drivers/eeprom/
+total 0
+lrwxrwxrwx 1 root root 0 Apr 4 01:46 6-0050 -> ../../../../devices/pci0000:00/0000:00:02.0/drm/card0/card0-eDP-1/i2c-6/6-0050/
+lrwxrwxrwx 1 root root 0 Apr 4 01:46 7-0050 -> ../../../../devices/pci0000:00/0000:00:1f.3/i2c-7/7-0050/
+lrwxrwxrwx 1 root root 0 Apr 4 01:46 7-0052 -> ../../../../devices/pci0000:00/0000:00:1f.3/i2c-7/7-0052/
+--w------- 1 root root 4096 Apr 4 01:47 bind
+lrwxrwxrwx 1 root root 0 Apr 4 01:47 module -> ../../../../module/eeprom/
+--w------- 1 root root 4096 Apr 4 01:46 uevent
+--w------- 1 root root 4096 Apr 4 01:47 unbind
+```
+
+The correct I2C bus is 7 in this case, and the EEPROMs are at `0x50` and `0x52`.
+Note that the above values are actually hex values.
+
+You can check the correctness of the SMBus and the addresses of the EEPROMs via
+`i2cdetect`:
+
+```bash
+$ i2cdetect -l
+i2c-3 unknown i915 gmbus dpc N/A
+i2c-1 unknown i915 gmbus vga N/A
+i2c-6 unknown DPDDC-A N/A
+i2c-4 unknown i915 gmbus dpb N/A
+i2c-2 unknown i915 gmbus panel N/A
+i2c-0 unknown i915 gmbus ssc N/A
+i2c-7 unknown SMBus I801 adapter at f040 N/A
+i2c-5 unknown i915 gmbus dpd N/A
+```
+
+Probing the SMBus:
+
+```bash
+$ i2cdetect -r 7
+WARNING! This program can confuse your I2C bus, cause data loss and worse!
+I will probe file /dev/i2c-7 using receive byte commands.
+I will probe address range 0x03-0x77.
+Continue? [Y/n]
+ 0 1 2 3 4 5 6 7 8 9 a b c d e f
+00: -- -- -- -- -- -- -- -- -- -- -- -- --
+10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
+20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
+30: 30 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
+40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- --
+50: UU -- UU -- -- -- -- -- -- -- -- -- -- -- -- --
+60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
+70: -- -- -- -- -- -- -- --
+```
+
+The SPD addresses need to be left-shifted by 1 for `mrc.bin`, i.e., multiplied
+by 2. For example, if the addresses read through `i2c-tools` when booted from
+vendor firmware are `0x50` and `0x52`, the correct values would be `0xa0` and
+`0xa4`. This is because the I2C addresses are 7 bits long.
+
## ECC DRAM
When `mrc.bin` has finished executing, ECC is active on the channels
diff --git a/Documentation/northbridge/intel/sandybridge/index.md b/Documentation/northbridge/intel/sandybridge/index.md
index dcb090aad69..c1d4b9948d2 100644
--- a/Documentation/northbridge/intel/sandybridge/index.md
+++ b/Documentation/northbridge/intel/sandybridge/index.md
@@ -6,3 +6,4 @@ This section contains documentation about coreboot on specific Intel "Sandy Brid
- [Native Ram Initialization](nri.md)
- [RAM initialization feature matrix](nri_features.md)
+- [ME Cleaner](me_cleaner.md)
diff --git a/Documentation/northbridge/intel/sandybridge/me_cleaner.md b/Documentation/northbridge/intel/sandybridge/me_cleaner.md
new file mode 100644
index 00000000000..1086e7e0919
--- /dev/null
+++ b/Documentation/northbridge/intel/sandybridge/me_cleaner.md
@@ -0,0 +1,20 @@
+# ME Cleaner
+It's possible to 'clean' the ME partition within the flash medium as part
+of the build process. While cleaning as much code as possible is removed
+from the ME firmware partition. In this state the ME errors out and doesn't
+operate any more.
+
+**Using a 'cleaned' ME partition may lead to issues and its use should be
+carefully evaulated.**
+
+## Observations with 'cleaned' ME
+
+* Instable LPC bus
+ * SuperIO is malfunctioning
+ * TPM is malfunctioning
+ * Random system shutdowns on high bus activity
+
+## Filing bug reports
+
+Always test with unmodified IFD and ME section before reporting bugs to the
+coreboot project.
diff --git a/Documentation/security/index.md b/Documentation/security/index.md
index 89db42eceec..9ad54866c2a 100644
--- a/Documentation/security/index.md
+++ b/Documentation/security/index.md
@@ -4,4 +4,5 @@ This section describes documentation about the security architecture of coreboot
## Vendor
+- [Verified Boot](vboot/index.md)
- [Measured Boot](vboot/measured_boot.md)
diff --git a/Documentation/security/vboot/index.md b/Documentation/security/vboot/index.md
new file mode 100644
index 00000000000..97420893e57
--- /dev/null
+++ b/Documentation/security/vboot/index.md
@@ -0,0 +1,324 @@
+# vboot - Verified Boot Support
+
+Google's verified boot support consists of:
+
+* A root of trust
+* Special firmware layout
+* Firmware verification
+* Firmware measurements
+* A firmware update mechanism
+* Specific build flags
+* Signing the coreboot image
+
+Google's vboot verifies the firmware and places measurements within the TPM.
+
+***
+
+## Root of Trust
+
+When using vboot, the root-of-trust is basically the read-only portion of the
+SPI flash. The following items factor into the trust equation:
+
+* The GCC compiler must reliably translate the code into machine code
+ without inserting any additional code (virus, backdoor, etc.)
+* The CPU must reliably execute the reset sequence and instructions as
+ documented by the CPU manufacturer.
+* The SPI flash must provide only the code programmed into it to the CPU
+ without providing any alternative reset vector or code sequence.
+* The SPI flash must honor the write-protect input and protect the specified
+ portion of the SPI flash from all erase and write accesses.
+
+The firmware is typically protected using the write-protect pin on the SPI
+flash part and setting some of the write-protect bits in the status register
+during manufacturing. The protected area is platform specific and for x86
+platforms is typically 1/4th of the SPI flash part size.
+Because this portion of the SPI flash is hardware write protected, it is not
+possible to update this portion of the SPI flash in the field, without altering
+the system to eliminate the ground connection to the SPI flash write-protect pin.
+Without hardware modifications, this portion of the SPI flash maintains the
+manufactured state during the system's lifetime.
+
+***
+
+## Firmware Layout
+
+Several sections are added to the firmware layout to support vboot:
+
+* Read-only section
+* Google Binary Blob (GBB) area
+* Read/write section A
+* Read/write section B
+
+The following sections describe the various portions of the flash layout.
+
+### Read-Only Section
+
+The read-only section contains a coreboot file system (CBFS) that contains all
+of the boot firmware necessary to perform recovery for the system. This firmware
+is typically protected using the write-protect pin on the SPI flash part and
+setting some of the write-protect bits in the status register during
+manufacturing.
+The protected area is typically 1/4th of the SPI flash part size and must cover
+the entire read-only section which consists of:
+
+* Vital Product Data (VPD) area
+* Firmware ID area
+* Google Binary Blob (GBB) area
+* coreboot file system containing read-only recovery firmware
+
+### Google Binary Blob (GBB) Area
+
+The GBB area is part of the read-only section. This area contains a 4096 or 8192
+bit public root RSA key that is used to verify the *VBLOCK* area to obtain the
+firmware signing key.
+
+### Recovery Firmware
+
+The recovery firmware is contained within a coreboot file system and consists of:
+
+* reset vector
+* bootblock
+* verstage
+* romstage
+* postcar
+* ramstage
+* payload
+* flash map file
+* config file
+* processor specific files:
+ * Microcode
+ * fspm.bin
+ * fsps.bin
+
+The recovery firmware is written during manufacturing and typically contains
+code to write the storage device (eMMC device or hard disk). The recovery image
+is usually contained on a socketed device such as a USB flash drive or an
+SD card. Depending upon the payload firmware doing the recovery, it may be
+possible for the user to interact with the system to specify the recovery
+image path. Part of the recovery is also to write the A and B areas of the SPI
+flash device to boot the system.
+
+### Read/Write Section
+
+The read/write sections contain an area which contains the firmware signing
+key and signature and an area containing a coreboot file system with a subset
+of the firmware. The firmware files in *FW_MAIN_A* and *FW_MAIN_B* are:
+
+* romstage
+* postcar
+* ramstage
+* payload
+* config file
+* processor specific files:
+ * Microcode
+ * fspm.bin
+ * fsps.bin
+
+The firmware subset enables most issues to be fixed in the field with firmware
+updates. The firmware files handle memory and most of silicon initialization.
+These files also produce the tables which get passed to the operating system.
+
+***
+
+## Firmware Updates
+
+The read/write sections exist in one of three states:
+
+* Invalid
+* Ready to boot
+* Successfully booted
+
+
+Firmware updates are handled by the operating system by writing any read/write
+section that is not in the "successfully booted" state. Upon the next reboot,
+vboot determines the section to boot. If it finds one in the "ready to boot"
+state then it attempts to boot using that section. If the boot fails then
+vboot marks the section as invalid and attempts to fall back to a read/write
+section in the "successfully booted" state. If vboot is not able to find a
+section in the "successfully booted" state then vboot enters recovery mode.
+
+Only the operating system is able to transition a section from the
+"ready to boot" state to the "successfully booted" state.
+The transition is typically done after the operating system has been running
+for a while indicating that successful boot was possible and the operating
+system is stable.
+
+Note that as long as the SPI write protection is in place then the system
+is always recoverable. If the flash update fails then the system will continue
+to boot using the previous read/write area. The same is true if coreboot passes
+control to the payload or the operating system and then the boot fails. In the
+worst case, the SPI flash gets totally corrupted in which case vboot fails the
+signature checks and enters recovery mode. There are no times where the SPI
+flash is exposed and the reset vector or part of the recovery firmware gets
+corrupted.
+
+***
+
+## Build Flags
+
+The following *Kconfig* values need to be selected to enable vboot:
+
+* COLLECT_TIMESTAMPS
+* VBOOT
+
+The starting stage needs to be specified by selecting either
+VBOOT_STARTS_IN_BOOTBLOCK or VBOOT_STARTS_IN_ROMSTAGE.
+
+If vboot starts in bootblock then vboot may be built as a separate stage by
+selecting `VBOOT_SEPARATE_VERSTAGE`. Additionally, if static RAM is too small
+to fit both verstage and romstage then selecting `VBOOT_RETURN_FROM_VERSTAGE`
+enables bootblock to reuse the RAM occupied by verstage for romstage.
+
+Non-volatile flash is needed for vboot operation. This flash area may be in
+CMOS, the EC, or in a read/write area of the SPI flash device.
+Select one of the following:
+
+* `VBOOT_VBNV_CMOS`
+* `VBOOT_VBNV_EC`
+* `VBOOT_VBNV_FLASH`
+
+More non-volatile storage features may be found in `security/vboot/Kconfig`.
+
+A TPM is also required for vboot operation.
+TPMs are available in `drivers/i2c/tpm` and `drivers/pc80/tpm`.
+
+In addition to adding the coreboot files into the read-only region,
+enabling vboot causes the build script to add the read/write files into
+coreboot file systems in *FW_MAIN_A* and *FW_MAIN_B*.
+
+***
+
+## Signing the coreboot Image
+
+The following command script is an example of how to sign the coreboot image
+file. This script is used on the Intel Galileo board and creates the *GBB* area
+and inserts it into the coreboot image. It also updates the *VBLOCK* areas with
+the firmware signing key and the signature for the *FW_MAIN* firmware.
+More details are available in `3rdparty/vboot/README`.
+
+```bash
+#!/bin/sh
+#
+# The necessary tools were built and installed using the following commands:
+#
+# pushd 3rdparty/vboot
+# make
+# sudo make install
+# popd
+#
+# The keys were made using the following command
+#
+# 3rdparty/vboot/scripts/keygeneration/create_new_keys.sh \
+# --4k --4k-root --output $PWD/keys
+#
+#
+# The "magic" numbers below are derived from the GBB section in
+# src/mainboard/intel/galileo/vboot.fmd.
+#
+# GBB Header Size: 0x80
+# GBB Offset: 0x611000, 4KiB block number: 1553 (0x611)
+# GBB Length: 0x7f000, 4KiB blocks: 127 (0x7f)
+# COREBOOT Offset: 0x690000, 4KiB block number: 1680 (0x690)
+# COREBOOT Length: 0x170000, 4KiB blocks: 368 (0x170)
+#
+# 0x7f000 (GBB Length) = 0x80 + 0x100 + 0x1000 + 0x7ce80 + 0x1000
+#
+# Create the GBB area blob
+# Parameters: hwid_size,rootkey_size,bmpfv_size,recoverykey_size
+#
+gbb_utility -c 0x100,0x1000,0x7ce80,0x1000 gbb.blob
+
+#
+# Copy from the start of the flash to the GBB region into the signed flash
+# image.
+#
+# 1553 * 4096 = 0x611 * 0x1000 = 0x611000, size of area before GBB
+#
+dd conv=fdatasync ibs=4096 obs=4096 count=1553 \
+if=build/coreboot.rom of=build/coreboot.signed.rom
+
+#
+# Append the empty GBB area to the coreboot.rom image.
+#
+# 1553 * 4096 = 0x611 * 0x1000 = 0x611000, offset to GBB
+#
+dd conv=fdatasync obs=4096 obs=4096 seek=1553 if=gbb.blob \
+of=build/coreboot.signed.rom
+
+#
+# Append the rest of the read-only region into the signed flash image.
+#
+# 1680 * 4096 = 0x690 * 0x1000 = 0x690000, offset to COREBOOT area
+# 368 * 4096 = 0x170 * 0x1000 = 0x170000, length of COREBOOT area
+#
+dd conv=fdatasync ibs=4096 obs=4096 skip=1680 seek=1680 count=368 \
+if=build/coreboot.rom of=build/coreboot.signed.rom
+
+#
+# Insert the HWID and public root and recovery RSA keys into the GBB area.
+#
+gbb_utility \
+--set --hwid='Galileo' \
+-r $PWD/keys/recovery_key.vbpubk \
+-k $PWD/keys/root_key.vbpubk \
+build/coreboot.signed.rom
+
+#
+# Sign the read/write firmware areas with the private signing key and update
+# the VBLOCK_A and VBLOCK_B regions.
+#
+3rdparty/vboot/scripts/image_signing/sign_firmware.sh \
+build/coreboot.signed.rom \
+$PWD/keys \
+ build/coreboot.signed.rom
+```
+
+***
+
+## Boot Flow
+
+The reset vector exist in the read-only area and points to the bootblock
+entry point. The only copy of the bootblock exists in the read-only area
+of the SPI flash. Verstage may be part of the bootblock or a separate stage.
+If separate then the bootblock loads verstage from the read-only area and
+transfers control to it.
+
+Upon first boot, verstage attempts to verify the read/write section A.
+It gets the public root key from the GBB area and uses that to verify the
+*VBLOCK* area in read-write section A. If the *VBLOCK* area is valid then it
+extracts the firmware signing key (1024-8192 bits) and uses that to verify
+the *FW_MAIN_A* area of read/write section A. If the verification is successful
+then verstage instructs coreboot to use the coreboot file system in read/write
+section A for the contents of the remaining boot firmware (romstage, postcar,
+ramstage and the payload).
+
+If verification fails for the read/write area and the other read/write area is
+not valid vboot falls back to the read-only area to boot into system recovery.
+
+***
+
+## Chromebook Special Features
+
+Google's Chromebooks have some special features:
+
+* Developer mode
+* Write-protect screw
+
+### Developer Mode
+
+Developer mode allows the user to use coreboot to boot another operating system.
+This may be a another (beta) version of Chrome OS, or another flavor of
+GNU/Linux. Use of developer mode does not void the system warranty. Upon entry
+into developer mode, all locally saved data on the system is lost.
+This prevents someone from entering developer mode to subvert the system
+security to access files on the local system or cloud.
+
+### Write Protect Screw
+
+Chromebooks have a write-protect screw which provides the ground to the
+write-protect pin of the SPI flash.
+Google specifically did this to allow the manufacturing line and advanced
+developers to re-write the entire SPI flash part. Once the screw is removed,
+any firmware may be placed on the device.
+However, accessing this screw requires opening the case and voids the
+system warranty!
diff --git a/Documentation/soc/intel/fit.dia b/Documentation/soc/intel/fit.dia
new file mode 100644
index 00000000000..7e07978f710
Binary files /dev/null and b/Documentation/soc/intel/fit.dia differ
diff --git a/Documentation/soc/intel/fit.md b/Documentation/soc/intel/fit.md
new file mode 100644
index 00000000000..8b638f04332
--- /dev/null
+++ b/Documentation/soc/intel/fit.md
@@ -0,0 +1,60 @@
+# Intel Firmware Interface Table
+
+The FIT allows to run code before the actual IA32 reset vector is executed
+by the CPU. The FIT resides in the BIOS region (usually near the reset vector)
+and is pointed to by the FIT pointer residing at `0xFFFFFFC0`.
+
+## Table layout
+The table consists of blocks each 16 bytes in size.
+The first is called *FIT header* the other are called *FIT entry*.
+
+![FIT in x86 memory map][fit]
+
+[fit]: fit.svg
+
+## Fit types
+
+Each entry has a *type* that give the other bits in the entry a different
+meaning. The following types are known:
+
+```eval_rst
++-----------+------------------------------------------------------------------+
+| no. | Description |
++===========+==================================================================+
+| 0x0 | HEADER. |
++-----------+------------------------------------------------------------------+
+| 0x1 | MICROCODE. |
++-----------+------------------------------------------------------------------+
+| 0x2 | STARTUP_ACM. |
++-----------+------------------------------------------------------------------+
+| 0x7 | BIOS_STARTUP_MODULE. |
++-----------+------------------------------------------------------------------+
+| 0x8 | TPM_POLICY. |
++-----------+------------------------------------------------------------------+
+| 0x9 | BIOS_POLICY. |
++-----------+------------------------------------------------------------------+
+| 0xa | TXT_POLICY. |
++-----------+------------------------------------------------------------------+
+| 0xb | KEY_MANIFEST. |
++-----------+------------------------------------------------------------------+
+| 0xc | BOOT_POLICY_MANIFEST. |
++-----------+------------------------------------------------------------------+
+| 0x10 | CSE_SECURE_BOOT. |
++-----------+------------------------------------------------------------------+
+| 0x2d | TXTSX_POLICY. |
++-----------+------------------------------------------------------------------+
+| 0x2f | JMP_DEBUG_POLICY. |
++-----------+------------------------------------------------------------------+
+| 0x7f | SKIP. |
++-----------+------------------------------------------------------------------+
+```
+
+## Usage in coreboot
+
+The most common usage of FIT is to use *Type1* to update microcode before
+execution of the IA32 reset vector happens.
+
+## References
+
+* [Intel TXT LAB handout](https://downloadmirror.intel.com/18931/eng/Intel%20TXT%20LAB%20Handout.pdf)
+* [FIT bios specification](https://www.intel.com/content/dam/www/public/us/en/documents/guides/fit-bios-specification.pdf)
diff --git a/Documentation/soc/intel/fit.svg b/Documentation/soc/intel/fit.svg
new file mode 100644
index 00000000000..eb6c696bb78
--- /dev/null
+++ b/Documentation/soc/intel/fit.svg
@@ -0,0 +1,132 @@
+
+
+
diff --git a/Documentation/soc/intel/index.md b/Documentation/soc/intel/index.md
index 4f6b4f21b6b..86f4de71559 100644
--- a/Documentation/soc/intel/index.md
+++ b/Documentation/soc/intel/index.md
@@ -8,3 +8,4 @@ This section contains documentation about coreboot on specific Intel SOCs.
- [FSP](fsp/index.md)
- [Ice Lake/9th Gen Core-i series](icelake/index.md)
- [MP Initialization](mp_init/mp_init.md)
+- [Firmware Interface Table](fit.md)
diff --git a/Documentation/vendorcode/eltan/index.md b/Documentation/vendorcode/eltan/index.md
new file mode 100644
index 00000000000..4484798a23c
--- /dev/null
+++ b/Documentation/vendorcode/eltan/index.md
@@ -0,0 +1,8 @@
+# Eltan vendorcode-specific documentation
+
+This section contains documentation about coreboot on Eltan specific
+vendorcode.
+
+## Sections
+
+- [Security](security.md)
diff --git a/Documentation/vendorcode/eltan/security.md b/Documentation/vendorcode/eltan/security.md
new file mode 100644
index 00000000000..04537df23ca
--- /dev/null
+++ b/Documentation/vendorcode/eltan/security.md
@@ -0,0 +1,39 @@
+# Eltan Security
+
+## Security
+This code enables measured boot and verified boot support.
+Verified boot is available in coreboot, but based on ChromeOS. This vendorcode
+uses a small encryption library and leave much more space in flash for the
+payload.
+
+## Hashing Library
+The library suppports SHA-1, SHA-256 and SHA-512. The required routines of
+`3rdparty/vboot/firmware/2lib` are used.
+
+## Measured boot
+measured boot support will use TPM2 device if available. The items specified
+in `mb_log_list[]` will be measured.
+
+## Verified boot
+verified boot support will use TPM2 device if available. The items specified
+in the next table will be verified:
+* `bootblock_verify_list[]`
+* `verify_item_t romstage_verify_list[]`
+* `ram_stage_additional_list[]`
+* `ramstage_verify_list[]`
+* `payload_verify_list[]`
+* `oprom_verify_list[]`
+
+## Enabling support
+
+* Measured boot can be enabled using **CONFIG_MBOOT**
+* Create mb_log_list table with list of item to measure
+* Create tables bootblock_verify_list[], verify_item_t romstage_verify_list[],
+ ram_stage_additional_list[], ramstage_verify_list[], payload_verify_list[],
+ oprom_verify_list[]
+* Verified boot can be enabled using **CONFIG_VERIFIED_BOOT**
+* Added Kconfig values for verbose console output
+
+## Debugging
+
+You can enable verbose console output in *menuconfig*.
diff --git a/MAINTAINERS b/MAINTAINERS
index 04f784f8899..f1ae0769373 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -382,6 +382,12 @@ M: Tristan Corrick
S: Maintained
F: src/mainboard/supermicro/x10slm-f/
+FACEBOOK FBG1701 MAINBOARD
+M: Frans Hendriks
+M: Wim Vervoorn
+S: Maintained
+F: src/mainboard/facebook/fbg1701/
+
AMD FAMILY10H & FAMILY15H (NON-AGESA) CPUS & NORTHBRIDGE
M: Timothy Pearson
S: Supported
diff --git a/Makefile.inc b/Makefile.inc
index 36c05dbac47..d4f7597e82d 100644
--- a/Makefile.inc
+++ b/Makefile.inc
@@ -31,7 +31,7 @@ CONFIG_OVERRIDE_DEVICETREE:=$(call strip_quotes, $(CONFIG_OVERRIDE_DEVICETREE))
# misleadingly named, this is the coreboot version
ifeq ($(KERNELVERSION),)
ifeq ($(BUILD_TIMELESS),1)
-KERNELVERSION := TIMELESS
+KERNELVERSION := -TIMELESS--LESSTIME-
else
KERNELVERSION := $(strip $(if $(GIT),\
$(shell git describe --dirty --always || git describe),\
@@ -196,15 +196,12 @@ ifeq ($(CONFIG_USE_BLOBS),y)
# this is necessary because 3rdparty/blobs is update=none, and so is ignored
# unless explicitly requested and enabled through --checkout
forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/blobs))
-ifeq ($(CONFIG_PLATFORM_USES_FSP2_0),y)
-forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/fsp))
-endif
-ifeq ($(CONFIG_PLATFORM_USES_FSP1_0),y)
-ifeq ($(CONFIG_SOC_INTEL_FSP_BROADWELL_DE),y)
+ifeq ($(CONFIG_PLATFORM_USES_FSP1_0)$(CONFIG_PLATFORM_USES_FSP1_1)$(CONFIG_PLATFORM_USES_FSP2_0),y)
+# this is necessary because 3rdparty/fsp is update=none, and so is ignored
+# unless explicitly requested and enabled through --checkout
forgetthis:=$(if $(GIT),$(shell git submodule update --init --checkout 3rdparty/fsp))
endif
endif
-endif
UPDATED_SUBMODULES:=1
COREBOOT_EXPORTS += UPDATED_SUBMODULES
endif
@@ -267,7 +264,14 @@ $(obj)/$(1).aml: $(src)/mainboard/$(MAINBOARDDIR)/$(1).asl $(obj)/config.h
@printf " IASL $$(subst $(top)/,,$$(@))\n"
$(CC_ramstage) -x assembler-with-cpp -E -MMD -MT $$(@) $$(CPPFLAGS_ramstage) -D__ACPI__ -P -include $(src)/include/kconfig.h -I$(obj) -I$(src) -I$(src)/include -I$(src)/arch/$(ARCHDIR-$(ARCH-ramstage-y))/include -I$(src)/mainboard/$(MAINBOARDDIR) $$< -o $(obj)/$(1).asl
cd $$(dir $$@); $(IASL) $(IGNORED_IASL_WARNINGS) -we -p $$(notdir $$@) $(1).asl
- if [ -z "$$$$($(IASL) -d $$@ 2>&1 | grep 'ACPI Warning')" ]; then echo " IASL $$@ disassembled correctly."; true; else echo "Error: Could not correctly disassemble $$@"; $(IASL) -d $$@; false; fi
+ if ! $(IASL) -d $$@ 2>&1 | grep -Eq 'ACPI (Warning|Error)'; then \
+ echo " IASL $$@ disassembled correctly."; \
+ true; \
+ else \
+ echo "Error: Could not correctly disassemble $$@"; \
+ $(IASL) -d $$@; \
+ false; \
+ fi
endef
#######################################################################
@@ -397,7 +401,7 @@ endif
CFLAGS_common += -pipe -g -nostdinc -std=gnu11
CFLAGS_common += -nostdlib -Wall -Wundef -Wstrict-prototypes -Wmissing-prototypes
CFLAGS_common += -Wwrite-strings -Wredundant-decls -Wno-trigraphs
-CFLAGS_common += -Wstrict-aliasing -Wshadow -Wdate-time
+CFLAGS_common += -Wstrict-aliasing -Wshadow -Wdate-time -Wtype-limits
CFLAGS_common += -fno-common -ffreestanding -fno-builtin -fomit-frame-pointer
CFLAGS_common += -ffunction-sections -fdata-sections -fno-pie
ifeq ($(CONFIG_COMPILER_GCC),y)
diff --git a/configs/config.lenovo_t420_static_option_table_no_mem_fuses b/configs/config.lenovo_t420_static_option_table_no_mem_fuses
index a268d88b78d..0a3513cfac4 100644
--- a/configs/config.lenovo_t420_static_option_table_no_mem_fuses
+++ b/configs/config.lenovo_t420_static_option_table_no_mem_fuses
@@ -4,4 +4,6 @@ CONFIG_VENDOR_LENOVO=y
CONFIG_BOARD_LENOVO_T420=y
CONFIG_NATIVE_RAMINIT_IGNORE_MAX_MEM_FUSES=y
CONFIG_NATIVE_RAMINIT_IGNORE_XMP_MAX_DIMMS=y
+CONFIG_VBOOT=y
+CONFIG_H8_FN_KEY_AS_VBOOT_RECOVERY_SW=y
# CONFIG_INTEL_CHIPSET_LOCKDOWN is not set
diff --git a/configs/config.lenovo_x220_mrc_bin b/configs/config.lenovo_x220_mrc_bin
new file mode 100644
index 00000000000..a51c4989049
--- /dev/null
+++ b/configs/config.lenovo_x220_mrc_bin
@@ -0,0 +1,3 @@
+CONFIG_VENDOR_LENOVO=y
+CONFIG_BOARD_LENOVO_X220=y
+# CONFIG_USE_NATIVE_RAMINIT is not set
diff --git a/mmax.config b/mmax.config
new file mode 100644
index 00000000000..cde9d01b503
--- /dev/null
+++ b/mmax.config
@@ -0,0 +1,762 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# coreboot configuration
+#
+
+#
+# General setup
+#
+CONFIG_COREBOOT_BUILD=y
+CONFIG_LOCALVERSION=""
+CONFIG_CBFS_PREFIX="fallback"
+CONFIG_COMPILER_GCC=y
+# CONFIG_COMPILER_LLVM_CLANG is not set
+# CONFIG_ANY_TOOLCHAIN is not set
+# CONFIG_CCACHE is not set
+# CONFIG_FMD_GENPARSER is not set
+# CONFIG_UTIL_GENPARSER is not set
+# CONFIG_USE_OPTION_TABLE is not set
+CONFIG_COMPRESS_RAMSTAGE=y
+CONFIG_INCLUDE_CONFIG_FILE=y
+CONFIG_COLLECT_TIMESTAMPS=y
+# CONFIG_TIMESTAMPS_ON_CONSOLE is not set
+# CONFIG_USE_BLOBS is not set
+# CONFIG_COVERAGE is not set
+# CONFIG_UBSAN is not set
+CONFIG_NO_RELOCATABLE_RAMSTAGE=y
+# CONFIG_RELOCATABLE_RAMSTAGE is not set
+# CONFIG_UPDATE_IMAGE is not set
+# CONFIG_BOOTSPLASH_IMAGE is not set
+# CONFIG_RAMPAYLOAD is not set
+
+#
+# Mainboard
+#
+
+#
+# Important: Run 'make distclean' before switching boards
+#
+# CONFIG_VENDOR_ADI is not set
+# CONFIG_VENDOR_ADLINK is not set
+# CONFIG_VENDOR_ADVANSUS is not set
+# CONFIG_VENDOR_AMD is not set
+# CONFIG_VENDOR_AOPEN is not set
+# CONFIG_VENDOR_APPLE is not set
+# CONFIG_VENDOR_ASROCK is not set
+# CONFIG_VENDOR_ASUS is not set
+# CONFIG_VENDOR_AVALUE is not set
+# CONFIG_VENDOR_BAP is not set
+# CONFIG_VENDOR_BIOSTAR is not set
+# CONFIG_VENDOR_CAVIUM is not set
+# CONFIG_VENDOR_COMPULAB is not set
+# CONFIG_VENDOR_CUBIETECH is not set
+# CONFIG_VENDOR_ELMEX is not set
+# CONFIG_VENDOR_EMULATION is not set
+# CONFIG_VENDOR_ESD is not set
+# CONFIG_VENDOR_FACEBOOK is not set
+# CONFIG_VENDOR_FOXCONN is not set
+# CONFIG_VENDOR_GETAC is not set
+# CONFIG_VENDOR_GIGABYTE is not set
+# CONFIG_VENDOR_GIZMOSPHERE is not set
+# CONFIG_VENDOR_GOOGLE is not set
+# CONFIG_VENDOR_HP is not set
+# CONFIG_VENDOR_IBASE is not set
+# CONFIG_VENDOR_IEI is not set
+CONFIG_VENDOR_INTEL=y
+# CONFIG_VENDOR_JETWAY is not set
+# CONFIG_VENDOR_KONTRON is not set
+# CONFIG_VENDOR_LENOVO is not set
+# CONFIG_VENDOR_LIPPERT is not set
+# CONFIG_VENDOR_MSI is not set
+# CONFIG_VENDOR_OCP is not set
+# CONFIG_VENDOR_OPENCELLULAR is not set
+# CONFIG_VENDOR_PACKARDBELL is not set
+# CONFIG_VENDOR_PCENGINES is not set
+# CONFIG_VENDOR_PURISM is not set
+# CONFIG_VENDOR_RODA is not set
+# CONFIG_VENDOR_SAMSUNG is not set
+# CONFIG_VENDOR_SAPPHIRE is not set
+# CONFIG_VENDOR_SCALEWAY is not set
+# CONFIG_VENDOR_SIEMENS is not set
+# CONFIG_VENDOR_SIFIVE is not set
+# CONFIG_VENDOR_SUPERMICRO is not set
+# CONFIG_VENDOR_TI is not set
+# CONFIG_VENDOR_TYAN is not set
+# CONFIG_VENDOR_VIA is not set
+CONFIG_BOARD_SPECIFIC_OPTIONS=y
+CONFIG_MAINBOARD_DIR="intel/minnowmax"
+CONFIG_MAINBOARD_PART_NUMBER="Minnow Max"
+CONFIG_MAX_CPUS=16
+CONFIG_FSP_FILE="3rdparty/blobs/mainboard/$(MAINBOARDDIR)/fsp.fd"
+CONFIG_CBFS_SIZE=0x00600000
+CONFIG_ENABLE_FSP_FAST_BOOT=y
+CONFIG_VIRTUAL_ROM_SIZE=0x800000
+CONFIG_UART_FOR_CONSOLE=0
+CONFIG_PAYLOAD_CONFIGFILE=""
+CONFIG_MAINBOARD_VENDOR="Intel"
+CONFIG_VGA_BIOS_ID="8086,0f31"
+# CONFIG_ONBOARD_VGA_IS_PRIMARY is not set
+CONFIG_DIMM_SPD_SIZE=256
+CONFIG_VGA_BIOS=y
+CONFIG_MAINBOARD_SERIAL_NUMBER="123456789"
+CONFIG_VGA_BIOS_FILE="3rdparty/blobs/mainboard/$(MAINBOARDDIR)/vga.dat"
+CONFIG_C_ENV_BOOTBLOCK_SIZE=0x10000
+CONFIG_MAINBOARD_SMBIOS_MANUFACTURER="Intel"
+CONFIG_DEVICETREE="devicetree.cb"
+CONFIG_PRERAM_CBMEM_CONSOLE_SIZE=0xc00
+CONFIG_POST_IO=y
+CONFIG_DCACHE_RAM_BASE=0xfef00000
+CONFIG_DCACHE_RAM_SIZE=0x4000
+CONFIG_MAX_REBOOT_CNT=3
+CONFIG_OVERRIDE_DEVICETREE=""
+CONFIG_BOOT_DEVICE_SPI_FLASH_BUS=0
+CONFIG_FMDFILE=""
+CONFIG_MMCONF_BASE_ADDRESS=0xe0000000
+CONFIG_HAVE_INTEL_FIRMWARE=y
+# CONFIG_POST_DEVICE is not set
+CONFIG_DRIVERS_UART_8250IO=y
+# CONFIG_VBOOT is not set
+CONFIG_DIMM_MAX=4
+CONFIG_TTYS0_LCS=3
+# CONFIG_BOARD_INTEL_APOLLOLAKE_RVP1 is not set
+# CONFIG_BOARD_INTEL_APOLLOLAKE_RVP2 is not set
+# CONFIG_BOARD_INTEL_BASKING_RIDGE is not set
+# CONFIG_BOARD_INTEL_BAKERSPORT_FSP is not set
+# CONFIG_BOARD_INTEL_BAYLEYBAY_FSP is not set
+# CONFIG_BOARD_INTEL_CAMELBACKMOUNTAIN_FSP is not set
+# CONFIG_BOARD_INTEL_CANNONLAKE_RVPU is not set
+# CONFIG_BOARD_INTEL_CANNONLAKE_RVPY is not set
+
+#
+# Coffeelake RVP
+#
+# CONFIG_BOARD_INTEL_COFFEELAKE_RVPU is not set
+# CONFIG_BOARD_INTEL_COFFEELAKE_RVP11 is not set
+# CONFIG_BOARD_INTEL_WHISKEYLAKE_RVP is not set
+# CONFIG_BOARD_INTEL_COFFEELAKE_RVP8 is not set
+# CONFIG_BOARD_INTEL_COMETLAKE_RVP is not set
+# CONFIG_BOARD_INTEL_D510MO is not set
+# CONFIG_BOARD_INTEL_D945GCLF is not set
+# CONFIG_BOARD_INTEL_DCP847SKE is not set
+# CONFIG_BOARD_INTEL_DG41WV is not set
+# CONFIG_BOARD_INTEL_DG43GT is not set
+# CONFIG_BOARD_INTEL_EMERALDLAKE2 is not set
+# CONFIG_BOARD_INTEL_GALILEO is not set
+# CONFIG_BOARD_INTEL_GLKRVP is not set
+# CONFIG_BOARD_INTEL_HARCUVAR is not set
+# CONFIG_BOARD_INTEL_ICELAKE_RVPU is not set
+# CONFIG_BOARD_INTEL_ICELAKE_RVPY is not set
+# CONFIG_BOARD_INTEL_KBLRVP3 is not set
+# CONFIG_BOARD_INTEL_KBLRVP7 is not set
+# CONFIG_BOARD_INTEL_KBLRVP8 is not set
+# CONFIG_BOARD_INTEL_KBLRVP11 is not set
+# CONFIG_BOARD_INTEL_KUNIMITSU is not set
+# CONFIG_BOARD_INTEL_LEAFHILL is not set
+# CONFIG_BOARD_INTEL_LITTLEPLAINS is not set
+# CONFIG_BOARD_INTEL_MINNOW3 is not set
+CONFIG_BOARD_INTEL_MINNOWMAX=y
+# CONFIG_BOARD_INTEL_MOHONPEAK is not set
+# CONFIG_BOARD_INTEL_SKLSDLBRK is not set
+# CONFIG_BOARD_INTEL_STRAGO is not set
+# CONFIG_BOARD_INTEL_WTM2 is not set
+CONFIG_MAINBOARD_SMBIOS_PRODUCT_NAME="Minnow Max"
+# CONFIG_BOARD_INTEL_BASEBOARD_GLKRVP is not set
+CONFIG_IFD_BIN_PATH="3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin"
+CONFIG_ME_BIN_PATH="3rdparty/blobs/mainboard/$(MAINBOARDDIR)/txe.bin"
+CONFIG_HAVE_IFD_BIN=y
+CONFIG_CPU_ADDR_BITS=36
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL=7
+CONFIG_FSP_LOC=0xfffc0000
+CONFIG_MAINBOARD_VERSION="1.0"
+# CONFIG_DRIVERS_PS2_KEYBOARD is not set
+# CONFIG_PCIEXP_L1_SUB_STATE is not set
+CONFIG_SMBIOS_ENCLOSURE_TYPE=0x03
+CONFIG_HEAP_SIZE=0x4000
+CONFIG_BOARD_ROMSIZE_KB_8192=y
+# CONFIG_COREBOOT_ROMSIZE_KB_64 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_128 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_256 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_512 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_1024 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_2048 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_4096 is not set
+CONFIG_COREBOOT_ROMSIZE_KB_8192=y
+# CONFIG_COREBOOT_ROMSIZE_KB_10240 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_12288 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_16384 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_32768 is not set
+# CONFIG_COREBOOT_ROMSIZE_KB_65536 is not set
+CONFIG_COREBOOT_ROMSIZE_KB=8192
+CONFIG_ROM_SIZE=0x800000
+# CONFIG_SYSTEM_TYPE_LAPTOP is not set
+# CONFIG_SYSTEM_TYPE_TABLET is not set
+# CONFIG_SYSTEM_TYPE_DETACHABLE is not set
+# CONFIG_SYSTEM_TYPE_CONVERTIBLE is not set
+# CONFIG_CBFS_AUTOGEN_ATTRIBUTES is not set
+
+#
+# Chipset
+#
+
+#
+# SoC
+#
+CONFIG_CPU_SPECIFIC_OPTIONS=y
+CONFIG_SMM_TSEG_SIZE=0x800000
+CONFIG_SMM_RESERVED_SIZE=0x100000
+CONFIG_SMM_MODULE_STACK_SIZE=0x400
+CONFIG_ACPI_CPU_STRING="\\_PR.CP%02d"
+# CONFIG_SOC_CAVIUM_CN81XX is not set
+CONFIG_ARCH_ARMV8_EXTENSION=0
+CONFIG_STACK_SIZE=0x1000
+# CONFIG_SOC_CAVIUM_COMMON is not set
+CONFIG_BOOTBLOCK_CPU_INIT="soc/intel/fsp_baytrail/bootblock/bootblock.c"
+# CONFIG_SOC_INTEL_GLK is not set
+CONFIG_X86_TOP4G_BOOTMEDIA_MAP=y
+CONFIG_ROMSTAGE_ADDR=0x2000000
+CONFIG_VERSTAGE_ADDR=0x2000000
+CONFIG_FSP_HEADER_PATH=""
+CONFIG_SPI_FLASH_INCLUDE_ALL_DRIVERS=y
+CONFIG_ENABLE_BUILTIN_COM1=y
+# CONFIG_PCIEXP_ASPM is not set
+# CONFIG_PCIEXP_COMMON_CLOCK is not set
+# CONFIG_PCIEXP_CLK_PM is not set
+CONFIG_TTYS0_BASE=0x3f8
+# CONFIG_SOC_INTEL_COMMON_CANNONLAKE_BASE is not set
+# CONFIG_SOC_INTEL_COFFEELAKE is not set
+# CONFIG_SOC_INTEL_WHISKEYLAKE is not set
+# CONFIG_SOC_INTEL_COMETLAKE is not set
+# CONFIG_SOC_INTEL_CANNONLAKE_PCH_H is not set
+CONFIG_SOC_INTEL_FSP_BAYTRAIL=y
+# CONFIG_SOC_INTEL_FSP_BAYTRAIL_MD is not set
+CONFIG_CPU_MICROCODE_HEADER_FILES="3rdparty/blobs/mainboard/$(MAINBOARDDIR)/M0130673324.h 3rdparty/blobs/mainboard/$(MAINBOARDDIR)/M0130679901.h"
+CONFIG_BAYTRAIL_FSP_SPECIFIC_OPTIONS=y
+CONFIG_CONSOLE_CBMEM=y
+CONFIG_FSP_SRC_PATH=""
+CONFIG_UART_PCI_ADDR=0x0
+# CONFIG_SOC_INTEL_KABYLAKE is not set
+# CONFIG_SOC_MEDIATEK_MT8173 is not set
+# CONFIG_SOC_MEDIATEK_MT8183 is not set
+# CONFIG_SOC_NVIDIA_TEGRA124 is not set
+# CONFIG_SOC_NVIDIA_TEGRA210 is not set
+# CONFIG_QC_SDI_ENABLE is not set
+# CONFIG_SOC_QC_IPQ40XX is not set
+# CONFIG_SOC_QC_IPQ806X is not set
+# CONFIG_SOC_QUALCOMM_QCS405 is not set
+# CONFIG_SOC_QUALCOMM_SDM845 is not set
+# CONFIG_SOC_ROCKCHIP_RK3288 is not set
+# CONFIG_SOC_ROCKCHIP_RK3399 is not set
+# CONFIG_CPU_SAMSUNG_EXYNOS5250 is not set
+# CONFIG_CPU_SAMSUNG_EXYNOS5420 is not set
+# CONFIG_SOC_UCB_RISCV is not set
+
+#
+# CPU
+#
+# CONFIG_CPU_ALLWINNER_A10 is not set
+CONFIG_XIP_ROM_SIZE=0x10000
+CONFIG_NUM_IPI_STARTS=2
+# CONFIG_CPU_AMD_AGESA is not set
+CONFIG_ENABLE_MRC_CACHE=y
+# CONFIG_CPU_AMD_PI is not set
+# CONFIG_CPU_ARMLTD_CORTEX_A9 is not set
+CONFIG_SSE2=y
+# CONFIG_CPU_INTEL_FIRMWARE_INTERFACE_TABLE is not set
+# CONFIG_CPU_INTEL_TURBO_NOT_PACKAGE_SCOPED is not set
+# CONFIG_CPU_TI_AM335X is not set
+# CONFIG_PARALLEL_CPU_INIT is not set
+CONFIG_PARALLEL_MP=y
+# CONFIG_PARALLEL_MP_AP_WORK is not set
+# CONFIG_UDELAY_IO is not set
+# CONFIG_UDELAY_LAPIC is not set
+CONFIG_UDELAY_TSC=y
+CONFIG_TSC_CONSTANT_RATE=y
+CONFIG_TSC_MONOTONIC_TIMER=y
+# CONFIG_UDELAY_TIMER2 is not set
+# CONFIG_TSC_SYNC_LFENCE is not set
+CONFIG_TSC_SYNC_MFENCE=y
+# CONFIG_NO_FIXED_XIP_ROM_SIZE is not set
+CONFIG_LOGICAL_CPUS=y
+CONFIG_SMM_TSEG=y
+CONFIG_SMM_MODULE_HEAP_SIZE=0x4000
+CONFIG_SMM_STUB_STACK_SIZE=0x400
+# CONFIG_SMM_LAPIC_REMAP_MITIGATION is not set
+# CONFIG_SERIALIZED_SMM_INITIALIZATION is not set
+# CONFIG_X86_AMD_FIXED_MTRRS is not set
+CONFIG_PLATFORM_USES_FSP1_0=y
+# CONFIG_MIRROR_PAYLOAD_TO_RAM_BEFORE_LOADING is not set
+# CONFIG_SOC_SETS_MSRS is not set
+CONFIG_CACHE_AS_RAM=y
+# CONFIG_NO_CAR_GLOBAL_MIGRATION is not set
+CONFIG_SMP=y
+CONFIG_SSE=y
+CONFIG_SUPPORT_CPU_UCODE_IN_CBFS=y
+CONFIG_USES_MICROCODE_HEADER_FILES=y
+CONFIG_MICROCODE_BLOB_NOT_HOOKED_UP=y
+# CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_BINS is not set
+CONFIG_CPU_MICROCODE_CBFS_EXTERNAL_HEADER=y
+# CONFIG_CPU_MICROCODE_CBFS_NONE is not set
+
+#
+# Northbridge
+#
+# CONFIG_NORTHBRIDGE_AMD_AGESA is not set
+# CONFIG_NORTHBRIDGE_AMD_PI is not set
+CONFIG_MAX_PIRQ_LINKS=4
+
+#
+# Southbridge
+#
+# CONFIG_AMD_SB_CIMX is not set
+# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB800 is not set
+# CONFIG_SOUTHBRIDGE_AMD_CIMX_SB900 is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON is not set
+CONFIG_SOUTHBRIDGE_INTEL_COMMON_RESET=y
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_GPIO is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_SMBUS is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_SPI is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_RCBA_PIRQ is not set
+# CONFIG_HAVE_INTEL_CHIPSET_LOCKDOWN is not set
+# CONFIG_SOUTHBRIDGE_INTEL_COMMON_SMM is not set
+CONFIG_INTEL_DESCRIPTOR_MODE_CAPABLE=y
+CONFIG_INTEL_DESCRIPTOR_MODE_REQUIRED=y
+
+#
+# Super I/O
+#
+# CONFIG_SUPERIO_NUVOTON_NCT6776_COM_A is not set
+
+#
+# Embedded Controllers
+#
+# CONFIG_EC_GOOGLE_WILCO is not set
+CONFIG_EC_BASE_ACPI_DATA=0x930
+CONFIG_EC_BASE_ACPI_COMMAND=0x934
+CONFIG_EC_BASE_HOST_DATA=0x940
+CONFIG_EC_BASE_HOST_COMMAND=0x944
+CONFIG_EC_BASE_PACKET=0x950
+CONFIG_SEABIOS_PS2_TIMEOUT=0
+
+#
+# Intel Firmware
+#
+CONFIG_HAVE_ME_BIN=y
+# CONFIG_MAINBOARD_USES_IFD_GBE_REGION is not set
+# CONFIG_MAINBOARD_USES_IFD_EC_REGION is not set
+# CONFIG_DO_NOT_TOUCH_DESCRIPTOR_REGION is not set
+# CONFIG_LOCK_MANAGEMENT_ENGINE is not set
+CONFIG_UNLOCK_FLASH_REGIONS=y
+# CONFIG_CAVIUM_BDK is not set
+# CONFIG_MAINBOARD_HAS_CHROMEOS is not set
+# CONFIG_GOOGLE_SMBIOS_MAINBOARD_VERSION is not set
+CONFIG_FSP_VENDORCODE_HEADER_PATH="fsp1_0/baytrail"
+# CONFIG_UEFI_2_4_BINDING is not set
+# CONFIG_UDK_2015_BINDING is not set
+# CONFIG_UDK_2017_BINDING is not set
+CONFIG_UDK_2013_VERSION=2013
+CONFIG_UDK_2015_VERSION=2015
+CONFIG_UDK_2017_VERSION=2017
+CONFIG_UDK_VERSION=2013
+# CONFIG_USE_SIEMENS_HWILIB is not set
+# CONFIG_ARCH_ARM is not set
+# CONFIG_ARCH_BOOTBLOCK_ARM is not set
+# CONFIG_ARCH_VERSTAGE_ARM is not set
+# CONFIG_ARCH_ROMSTAGE_ARM is not set
+# CONFIG_ARCH_RAMSTAGE_ARM is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV4 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV4 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV4 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV4 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV7 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV7 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7_M is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7_M is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV7_R is not set
+# CONFIG_ARCH_VERSTAGE_ARMV7_R is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV7_R is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV7_R is not set
+# CONFIG_ARM_LPAE is not set
+# CONFIG_ARCH_ARM64 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARM64 is not set
+# CONFIG_ARCH_VERSTAGE_ARM64 is not set
+# CONFIG_ARCH_ROMSTAGE_ARM64 is not set
+# CONFIG_ARCH_RAMSTAGE_ARM64 is not set
+# CONFIG_ARCH_BOOTBLOCK_ARMV8_64 is not set
+# CONFIG_ARCH_VERSTAGE_ARMV8_64 is not set
+# CONFIG_ARCH_ROMSTAGE_ARMV8_64 is not set
+# CONFIG_ARCH_RAMSTAGE_ARMV8_64 is not set
+# CONFIG_ARM64_USE_ARCH_TIMER is not set
+# CONFIG_ARM64_A53_ERRATUM_843419 is not set
+# CONFIG_ARCH_MIPS is not set
+# CONFIG_ARCH_BOOTBLOCK_MIPS is not set
+# CONFIG_ARCH_VERSTAGE_MIPS is not set
+# CONFIG_ARCH_ROMSTAGE_MIPS is not set
+# CONFIG_ARCH_RAMSTAGE_MIPS is not set
+# CONFIG_ARCH_PPC64 is not set
+# CONFIG_ARCH_BOOTBLOCK_PPC64 is not set
+# CONFIG_ARCH_VERSTAGE_PPC64 is not set
+# CONFIG_ARCH_ROMSTAGE_PPC64 is not set
+# CONFIG_ARCH_RAMSTAGE_PPC64 is not set
+# CONFIG_ARCH_RISCV is not set
+CONFIG_ARCH_RISCV_M=y
+# CONFIG_ARCH_RISCV_S is not set
+# CONFIG_ARCH_RISCV_U is not set
+# CONFIG_ARCH_RISCV_RV64 is not set
+# CONFIG_ARCH_RISCV_RV32 is not set
+# CONFIG_ARCH_RISCV_PMP is not set
+# CONFIG_ARCH_BOOTBLOCK_RISCV is not set
+# CONFIG_ARCH_VERSTAGE_RISCV is not set
+# CONFIG_ARCH_ROMSTAGE_RISCV is not set
+# CONFIG_ARCH_RAMSTAGE_RISCV is not set
+# CONFIG_RISCV_USE_ARCH_TIMER is not set
+CONFIG_ARCH_X86=y
+CONFIG_ARCH_BOOTBLOCK_X86_32=y
+CONFIG_ARCH_VERSTAGE_X86_32=y
+CONFIG_ARCH_ROMSTAGE_X86_32=y
+# CONFIG_ARCH_POSTCAR_X86_32 is not set
+CONFIG_ARCH_RAMSTAGE_X86_32=y
+# CONFIG_ARCH_BOOTBLOCK_X86_64 is not set
+# CONFIG_ARCH_VERSTAGE_X86_64 is not set
+# CONFIG_ARCH_ROMSTAGE_X86_64 is not set
+# CONFIG_ARCH_POSTCAR_X86_64 is not set
+# CONFIG_ARCH_RAMSTAGE_X86_64 is not set
+# CONFIG_USE_MARCH_586 is not set
+# CONFIG_AP_IN_SIPI_WAIT is not set
+# CONFIG_SIPI_VECTOR_IN_ROM is not set
+CONFIG_RAMBASE=0xe00000
+CONFIG_RAMTOP=0x1000000
+# CONFIG_CBMEM_TOP_BACKUP is not set
+# CONFIG_EARLY_EBDA_INIT is not set
+CONFIG_PC80_SYSTEM=y
+# CONFIG_BOOTBLOCK_DEBUG_SPINLOOP is not set
+# CONFIG_BOOTBLOCK_SAVE_BIST_AND_TIMESTAMP is not set
+# CONFIG_HAVE_CMOS_DEFAULT is not set
+CONFIG_IOAPIC_INTERRUPTS_ON_FSB=y
+# CONFIG_IOAPIC_INTERRUPTS_ON_APIC_SERIAL_BUS is not set
+# CONFIG_HPET_ADDRESS_OVERRIDE is not set
+CONFIG_HPET_ADDRESS=0xfed00000
+CONFIG_ID_SECTION_OFFSET=0x80
+# CONFIG_POSTCAR_STAGE is not set
+# CONFIG_VERSTAGE_DEBUG_SPINLOOP is not set
+# CONFIG_ROMSTAGE_DEBUG_SPINLOOP is not set
+CONFIG_BOOTBLOCK_SIMPLE=y
+# CONFIG_BOOTBLOCK_NORMAL is not set
+CONFIG_BOOTBLOCK_SOURCE="bootblock_simple.c"
+CONFIG_ACPI_HAVE_PCAT_8259=y
+# CONFIG_COLLECT_TIMESTAMPS_NO_TSC is not set
+CONFIG_COLLECT_TIMESTAMPS_TSC=y
+# CONFIG_PAGING_IN_CACHE_AS_RAM is not set
+# CONFIG_IDT_IN_EVERY_STAGE is not set
+CONFIG_HAVE_CF9_RESET=y
+
+#
+# Devices
+#
+# CONFIG_MAINBOARD_HAS_NATIVE_VGA_INIT is not set
+# CONFIG_MAINBOARD_HAS_LIBGFXINIT is not set
+# CONFIG_VGA_ROM_RUN is not set
+CONFIG_NO_GFX_INIT=y
+# CONFIG_MULTIPLE_VGA_ADAPTERS is not set
+# CONFIG_SMBUS_HAS_AUX_CHANNELS is not set
+CONFIG_PCI=y
+# CONFIG_NO_MMCONF_SUPPORT is not set
+CONFIG_MMCONF_SUPPORT=y
+# CONFIG_HYPERTRANSPORT_PLUGIN_SUPPORT is not set
+CONFIG_PCIX_PLUGIN_SUPPORT=y
+CONFIG_CARDBUS_PLUGIN_SUPPORT=y
+# CONFIG_AZALIA_PLUGIN_SUPPORT is not set
+CONFIG_PCIEXP_PLUGIN_SUPPORT=y
+# CONFIG_EARLY_PCI_BRIDGE is not set
+CONFIG_SUBSYSTEM_VENDOR_ID=0x0000
+CONFIG_SUBSYSTEM_DEVICE_ID=0x0000
+# CONFIG_VGA_BIOS_DGPU is not set
+# CONFIG_SOFTWARE_I2C is not set
+
+#
+# Generic Drivers
+#
+# CONFIG_DRIVERS_AS3722_RTC is not set
+# CONFIG_GIC is not set
+# CONFIG_IPMI_KCS is not set
+# CONFIG_DRIVERS_LENOVO_WACOM is not set
+# CONFIG_RT8168_GET_MAC_FROM_VPD is not set
+# CONFIG_RT8168_SET_LED_MODE is not set
+# CONFIG_SMMSTORE_IN_CBFS is not set
+CONFIG_SPI_FLASH=y
+CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP=y
+# CONFIG_BOOT_DEVICE_SPI_FLASH_RW_NOMMAP_EARLY is not set
+# CONFIG_SPI_FLASH_NO_FAST_READ is not set
+CONFIG_SPI_FLASH_ADESTO=y
+CONFIG_SPI_FLASH_AMIC=y
+CONFIG_SPI_FLASH_ATMEL=y
+CONFIG_SPI_FLASH_EON=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_SPANSION=y
+CONFIG_SPI_FLASH_SST=y
+CONFIG_SPI_FLASH_STMICRO=y
+CONFIG_SPI_FLASH_WINBOND=y
+# CONFIG_SPI_FLASH_FAST_READ_DUAL_OUTPUT_3B is not set
+# CONFIG_SPI_FLASH_HAS_VOLATILE_GROUP is not set
+CONFIG_HAVE_SPI_CONSOLE_SUPPORT=y
+CONFIG_DRIVERS_UART=y
+# CONFIG_DRIVERS_UART_8250IO_SKIP_INIT is not set
+# CONFIG_NO_UART_ON_SUPERIO is not set
+# CONFIG_UART_OVERRIDE_INPUT_CLOCK_DIVIDER is not set
+# CONFIG_UART_OVERRIDE_REFCLK is not set
+# CONFIG_DRIVERS_UART_8250MEM is not set
+# CONFIG_DRIVERS_UART_8250MEM_32 is not set
+# CONFIG_HAVE_UART_SPECIAL is not set
+# CONFIG_DRIVERS_UART_OXPCIE is not set
+# CONFIG_DRIVERS_UART_PL011 is not set
+# CONFIG_UART_USE_REFCLK_AS_INPUT_CLOCK is not set
+# CONFIG_HAVE_USBDEBUG is not set
+# CONFIG_HAVE_USBDEBUG_OPTIONS is not set
+# CONFIG_VPD is not set
+# CONFIG_DRIVERS_AMD_PI is not set
+# CONFIG_SMBIOS_PROVIDED_BY_MOBO is not set
+# CONFIG_DRIVERS_I2C_MAX98373 is not set
+# CONFIG_DRIVERS_I2C_MAX98927 is not set
+# CONFIG_DRIVERS_I2C_PCA9538 is not set
+# CONFIG_DRIVERS_I2C_PCF8523 is not set
+# CONFIG_DRIVERS_I2C_RT5663 is not set
+# CONFIG_DRIVERS_I2C_RTD2132 is not set
+# CONFIG_DRIVERS_I2C_RX6110SA is not set
+# CONFIG_DRIVERS_I2C_SX9310 is not set
+# CONFIG_MAINBOARD_HAS_I2C_TPM_ATMEL is not set
+# CONFIG_MAINBOARD_HAS_I2C_TPM_CR50 is not set
+# CONFIG_MAINBOARD_HAS_I2C_TPM_GENERIC is not set
+
+#
+# Intel FSP
+#
+CONFIG_HAVE_FSP_BIN=y
+CONFIG_MRC_CACHE_FMAP=y
+CONFIG_USE_GENERIC_FSP_CAR_INC=y
+CONFIG_FSP_USES_UPD=y
+# CONFIG_PLATFORM_USES_FSP2_0 is not set
+# CONFIG_PLATFORM_USES_FSP2_1 is not set
+# CONFIG_INTEL_DDI is not set
+# CONFIG_INTEL_EDID is not set
+# CONFIG_INTEL_INT15 is not set
+# CONFIG_INTEL_GMA_ACPI is not set
+# CONFIG_INTEL_GMA_SSC_ALTERNATE_REF is not set
+# CONFIG_INTEL_GMA_SWSMISCI is not set
+# CONFIG_DRIVER_INTEL_I210 is not set
+# CONFIG_DRIVERS_INTEL_MIPI_CAMERA is not set
+CONFIG_DRIVERS_INTEL_WIFI=y
+# CONFIG_USE_SAR is not set
+# CONFIG_DRIVERS_LENOVO_HYBRID_GRAPHICS is not set
+# CONFIG_DRIVER_MAXIM_MAX77686 is not set
+# CONFIG_DRIVER_PARADE_PS8625 is not set
+# CONFIG_DRIVER_PARADE_PS8640 is not set
+CONFIG_DRIVERS_MC146818=y
+# CONFIG_LPC_TPM is not set
+# CONFIG_MAINBOARD_HAS_LPC_TPM is not set
+# CONFIG_DRIVERS_RICOH_RCE822 is not set
+# CONFIG_DRIVER_SIEMENS_NC_FPGA is not set
+# CONFIG_NC_FPGA_NOTIFY_CB_READY is not set
+# CONFIG_DRIVERS_SIL_3114 is not set
+# CONFIG_MAINBOARD_HAS_SPI_TPM_CR50 is not set
+# CONFIG_DRIVER_TI_TPS65090 is not set
+# CONFIG_DRIVERS_TI_TPS65913 is not set
+# CONFIG_DRIVERS_TI_TPS65913_RTC is not set
+# CONFIG_DRIVERS_USB_ACPI is not set
+# CONFIG_DRIVER_XPOWERS_AXP209 is not set
+# CONFIG_COMMONLIB_STORAGE is not set
+
+#
+# Security
+#
+
+#
+# Verified Boot (vboot)
+#
+
+#
+# Trusted Platform Module
+#
+CONFIG_USER_NO_TPM=y
+# CONFIG_ACPI_SATA_GENERATOR is not set
+CONFIG_ACPI_INTEL_HARDWARE_SLEEP_VALUES=y
+# CONFIG_ACPI_AMD_HARDWARE_SLEEP_VALUES is not set
+# CONFIG_BOOT_DEVICE_NOT_SPI_FLASH is not set
+CONFIG_BOOT_DEVICE_SPI_FLASH=y
+CONFIG_BOOT_DEVICE_MEMORY_MAPPED=y
+# CONFIG_BOOT_DEVICE_SUPPORTS_WRITES is not set
+# CONFIG_RTC is not set
+
+#
+# Console
+#
+CONFIG_SQUELCH_EARLY_SMP=y
+CONFIG_CONSOLE_SERIAL=y
+
+#
+# I/O mapped, 8250-compatible
+#
+
+#
+# Serial port base address = 0x3f8
+#
+# CONFIG_CONSOLE_SERIAL_921600 is not set
+# CONFIG_CONSOLE_SERIAL_460800 is not set
+# CONFIG_CONSOLE_SERIAL_230400 is not set
+CONFIG_CONSOLE_SERIAL_115200=y
+# CONFIG_CONSOLE_SERIAL_57600 is not set
+# CONFIG_CONSOLE_SERIAL_38400 is not set
+# CONFIG_CONSOLE_SERIAL_19200 is not set
+# CONFIG_CONSOLE_SERIAL_9600 is not set
+CONFIG_TTYS0_BAUD=115200
+# CONFIG_SPKMODEM is not set
+# CONFIG_CONSOLE_NE2K is not set
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x20000
+# CONFIG_CONSOLE_SPI_FLASH is not set
+# CONFIG_SPI_CONSOLE is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_8 is not set
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL_7=y
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_6 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_5 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_4 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_3 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_2 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1 is not set
+# CONFIG_DEFAULT_CONSOLE_LOGLEVEL_0 is not set
+# CONFIG_NO_POST is not set
+# CONFIG_CMOS_POST is not set
+# CONFIG_CONSOLE_POST is not set
+CONFIG_POST_IO_PORT=0x80
+# CONFIG_NO_EARLY_BOOTBLOCK_POSTCODES is not set
+CONFIG_HWBASE_DEBUG_CB=y
+# CONFIG_HAVE_ACPI_RESUME is not set
+# CONFIG_ACPI_HUGE_LOWMEM_BACKUP is not set
+# CONFIG_HAVE_ROMSTAGE_CONSOLE_SPINLOCK is not set
+# CONFIG_HAVE_ROMSTAGE_NVRAM_CBFS_SPINLOCK is not set
+# CONFIG_HAVE_ROMSTAGE_MICROCODE_CBFS_SPINLOCK is not set
+CONFIG_HAVE_MONOTONIC_TIMER=y
+# CONFIG_GENERIC_UDELAY is not set
+# CONFIG_TIMER_QUEUE is not set
+CONFIG_HAVE_OPTION_TABLE=y
+# CONFIG_PIRQ_ROUTE is not set
+CONFIG_HAVE_SMI_HANDLER=y
+# CONFIG_PCI_IO_CFG_EXT is not set
+# CONFIG_IOAPIC is not set
+# CONFIG_USE_WATCHDOG_ON_BOOT is not set
+# CONFIG_GFXUMA is not set
+CONFIG_HAVE_ACPI_TABLES=y
+# CONFIG_COMMON_FADT is not set
+# CONFIG_ACPI_NHLT is not set
+
+#
+# System tables
+#
+# CONFIG_GENERATE_MP_TABLE is not set
+# CONFIG_GENERATE_PIRQ_TABLE is not set
+CONFIG_GENERATE_SMBIOS_TABLES=y
+
+#
+# Payload
+#
+# CONFIG_PAYLOAD_NONE is not set
+# CONFIG_PAYLOAD_ELF is not set
+# CONFIG_PAYLOAD_BAYOU is not set
+# CONFIG_PAYLOAD_FILO is not set
+# CONFIG_PAYLOAD_GRUB2 is not set
+# CONFIG_PAYLOAD_LINUXBOOT is not set
+CONFIG_PAYLOAD_SEABIOS=y
+# CONFIG_PAYLOAD_UBOOT is not set
+# CONFIG_PAYLOAD_YABITS is not set
+# CONFIG_PAYLOAD_LINUX is not set
+# CONFIG_PAYLOAD_TIANOCORE is not set
+CONFIG_PAYLOAD_FILE="payloads/external/SeaBIOS/seabios/out/bios.bin.elf"
+CONFIG_SEABIOS_STABLE=y
+# CONFIG_SEABIOS_MASTER is not set
+# CONFIG_SEABIOS_REVISION is not set
+# CONFIG_SEABIOS_THREAD_OPTIONROMS is not set
+CONFIG_SEABIOS_BOOTORDER_FILE=""
+CONFIG_SEABIOS_ADD_SERCON_PORT_FILE=y
+CONFIG_SEABIOS_SERCON_PORT_ADDR=0x3f8
+CONFIG_SEABIOS_DEBUG_LEVEL=-1
+
+#
+# Using default SeaBIOS log level
+#
+CONFIG_PAYLOAD_OPTIONS=""
+CONFIG_PXE=y
+
+#
+# PXE Options
+#
+# CONFIG_PXE_ROM is not set
+CONFIG_BUILD_IPXE=y
+CONFIG_IPXE_STABLE=y
+# CONFIG_IPXE_MASTER is not set
+CONFIG_PXE_ROM_ID="8086,1539"
+CONFIG_PXE_SERIAL_CONSOLE=y
+CONFIG_COMPRESSED_PAYLOAD_LZMA=y
+# CONFIG_COMPRESSED_PAYLOAD_LZ4 is not set
+# CONFIG_PAYLOAD_IS_FLAT_BINARY is not set
+CONFIG_COMPRESS_SECONDARY_PAYLOAD=y
+
+#
+# Secondary Payloads
+#
+CONFIG_COREINFO_SECONDARY_PAYLOAD=y
+CONFIG_BAREFLANK_SECONDARY_PAYLOAD=y
+CONFIG_MEMTEST_SECONDARY_PAYLOAD=y
+# CONFIG_NVRAMCUI_SECONDARY_PAYLOAD is not set
+# CONFIG_TINT_SECONDARY_PAYLOAD is not set
+CONFIG_MEMTEST_STABLE=y
+# CONFIG_MEMTEST_MASTER is not set
+# CONFIG_MEMTEST_REVISION is not set
+
+#
+# Reserve RAM for payload
+#
+CONFIG_CUSTOM_RAM_RES_ADDR=0x21000000
+CONFIG_CUSTOM_RAM_RES_SIZE=0x20920000
+
+#
+# Debugging
+#
+
+#
+# CPU Debug Settings
+#
+# CONFIG_DEBUG_SMM_RELOCATION is not set
+
+#
+# General Debug Settings
+#
+# CONFIG_GDB_STUB is not set
+# CONFIG_FATAL_ASSERTS is not set
+# CONFIG_DEBUG_CBFS is not set
+# CONFIG_HAVE_DEBUG_RAM_SETUP is not set
+# CONFIG_HAVE_DEBUG_SMBUS is not set
+# CONFIG_DEBUG_SMI is not set
+# CONFIG_DEBUG_MALLOC is not set
+# CONFIG_DEBUG_ACPI is not set
+# CONFIG_DEBUG_CONSOLE_INIT is not set
+# CONFIG_DEBUG_SPI_FLASH is not set
+# CONFIG_TRACE is not set
+# CONFIG_DEBUG_BOOT_STATE is not set
+# CONFIG_DEBUG_ADA_CODE is not set
+CONFIG_HAVE_EM100_SUPPORT=y
+# CONFIG_EM100 is not set
+CONFIG_NO_EDID_FILL_FB=y
+# CONFIG_ENABLE_APIC_EXT_ID is not set
+CONFIG_WARNINGS_ARE_ERRORS=y
+# CONFIG_POWER_BUTTON_DEFAULT_ENABLE is not set
+# CONFIG_POWER_BUTTON_DEFAULT_DISABLE is not set
+# CONFIG_POWER_BUTTON_FORCE_ENABLE is not set
+# CONFIG_POWER_BUTTON_FORCE_DISABLE is not set
+# CONFIG_POWER_BUTTON_IS_OPTIONAL is not set
+CONFIG_REG_SCRIPT=y
+# CONFIG_NO_XIP_EARLY_STAGES is not set
+# CONFIG_EARLY_CBMEM_LIST is not set
+CONFIG_RELOCATABLE_MODULES=y
+CONFIG_NO_STAGE_CACHE=y
+CONFIG_BOOTBLOCK_CUSTOM=y
diff --git a/payloads/Kconfig b/payloads/Kconfig
index d0f8a440800..d339cfeb34b 100644
--- a/payloads/Kconfig
+++ b/payloads/Kconfig
@@ -124,6 +124,13 @@ config COREINFO_SECONDARY_PAYLOAD
coreinfo can be loaded as a secondary payload under SeaBIOS, GRUB,
or any other payload that can load additional payloads.
+config BAREFLANK_SECONDARY_PAYLOAD
+ bool "Load Bareflank as a secondary payload"
+ default n
+ depends on ARCH_X86
+ help
+ Bareflank can be loaded before primary payload.
+
config MEMTEST_SECONDARY_PAYLOAD
bool "Load Memtest86+ as a secondary payload"
default n
@@ -151,4 +158,20 @@ config TINT_SECONDARY_PAYLOAD
source "payloads/external/*/Kconfig.secondary"
endmenu # "Secondary Payloads"
+
+menu "Reserve RAM for payload"
+
+config CUSTOM_RAM_RES_ADDR
+ hex "Base address for reserved memory"
+ default 0
+ help
+ If a payload needs some preallocated memory this field specifies
+ starting address of reserved memory region.
+
+config CUSTOM_RAM_RES_SIZE
+ hex "Size of reserved memory"
+ default 0
+ help
+ Size (in bytes) of reserved memory region.
+endmenu
endmenu
diff --git a/payloads/Makefile.inc b/payloads/Makefile.inc
index 83d3910ce06..3f77fe432e8 100644
--- a/payloads/Makefile.inc
+++ b/payloads/Makefile.inc
@@ -13,6 +13,11 @@
## GNU General Public License for more details.
##
+cbfs-files-$(CONFIG_BAREFLANK_SECONDARY_PAYLOAD) += $(CONFIG_CBFS_PREFIX)/payload
+$(CONFIG_CBFS_PREFIX)/payload-file := payloads/bareflank/build/bareflank.elf
+$(CONFIG_CBFS_PREFIX)/payload-type := payload
+$(CONFIG_CBFS_PREFIX)/payload-compression := $(CBFS_SECONDARY_PAYLOAD_COMPRESS_FLAG)
+
cbfs-files-$(CONFIG_COREINFO_SECONDARY_PAYLOAD) += img/coreinfo
img/coreinfo-file := payloads/coreinfo/build/coreinfo.elf
img/coreinfo-type := payload
@@ -24,6 +29,7 @@ img/nvramcui-type := payload
img/nvramcui-compression := $(CBFS_SECONDARY_PAYLOAD_COMPRESS_FLAG)
PAYLOADS_LIST=\
+payloads/bareflank \
payloads/coreinfo \
payloads/nvramcui \
payloads/libpayload \
@@ -38,6 +44,9 @@ payloads/external/GRUB2 \
payloads/external/LinuxBoot \
payloads/external/Yabits \
+payloads/bareflank/build/bareflank.elf bareflank:
+ $(MAKE) -C payloads/bareflank defaultbuild CONFIG_CBFS_PREFIX=$(CONFIG_CBFS_PREFIX)
+
payloads/coreinfo/build/coreinfo.elf coreinfo:
$(MAKE) -C payloads/coreinfo defaultbuild
diff --git a/payloads/bareflank/Kconfig b/payloads/bareflank/Kconfig
new file mode 100644
index 00000000000..8cee21381db
--- /dev/null
+++ b/payloads/bareflank/Kconfig
@@ -0,0 +1,17 @@
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+#
+# For a description of the syntax of this configuration file,
+# see http://lxr.linux.no/source/Documentation/kbuild/kconfig-language.txt.
+#
+
+mainmenu "Bareflank Configuration"
diff --git a/payloads/bareflank/Makefile b/payloads/bareflank/Makefile
new file mode 100644
index 00000000000..c19fcb79dd6
--- /dev/null
+++ b/payloads/bareflank/Makefile
@@ -0,0 +1,144 @@
+##
+## This file is part of the coreinfo project.
+##
+## Copyright (C) 2008 Advanced Micro Devices, Inc.
+## Copyright (C) 2008 Uwe Hermann
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+src := $(CURDIR)
+srctree := $(src)
+srck := $(src)/../../util/kconfig
+coreinfo_obj := $(src)/build
+objk := $(src)/build/util/kconfig
+
+ifeq ($(filter %clean,$(MAKECMDGOALS)),)
+export KERNELVERSION := 0.1.0
+export KCONFIG_AUTOHEADER := $(coreinfo_obj)/config.h
+export KCONFIG_AUTOCONFIG := $(coreinfo_obj)/auto.conf
+export KCONFIG_DEPENDENCIES := $(coreinfo_obj)/auto.conf.cmd
+export KCONFIG_SPLITCONFIG := $(coreinfo_obj)/config
+export KCONFIG_TRISTATE := $(coreinfo_obj)/tristate.conf
+export KCONFIG_CONFIG := $(CURDIR)/.config
+export KCONFIG_NEGATIVES := 1
+export Kconfig := Kconfig
+
+export V := $(V)
+
+CONFIG_SHELL := sh
+KBUILD_DEFCONFIG := configs/defconfig
+UNAME_RELEASE := $(shell uname -r)
+HAVE_DOTCONFIG := $(wildcard .config)
+MAKEFLAGS += -rR --no-print-directory
+
+# Make is silent per default, but 'make V=1' will show all compiler calls.
+ifneq ($(V),1)
+.SILENT:
+endif
+
+HOSTCC ?= gcc
+HOSTCXX ?= g++
+HOSTCFLAGS := -I$(srck) -I$(objk)
+HOSTCXXFLAGS := -I$(srck) -I$(objk)
+
+LIBPAYLOAD_PATH := $(realpath ../libpayload)
+LIBPAYLOAD_OBJ := $(coreinfo_obj)/libpayload
+HAVE_LIBPAYLOAD := $(wildcard $(LIBPAYLOAD_OBJ)/lib/libpayload.a)
+LIBPAYLOAD_CONFIG ?= configs/defconfig-tinycurses-64
+OBJCOPY ?= objcopy
+
+INCLUDES = -I$(coreinfo_obj) -include $(LIBPAYLOAD_OBJ)/include/kconfig.h -I$(src)/../../src/commonlib/include -I$(src)/include -I$(src)
+OBJECTS = common.o entry.o platform.o
+OBJS = $(patsubst %,$(coreinfo_obj)/%,$(OBJECTS))
+TARGET = $(coreinfo_obj)/bareflank.elf
+
+all: real-all
+
+# in addition to the dependency below, create the file if it doesn't exist
+# to silence warnings about a file that would be generated anyway.
+$(if $(wildcard .xcompile),,$(eval $(shell ../../util/xcompile/xcompile $(XGCCPATH) > .xcompile || rm -f .xcompile)))
+.xcompile: ../../util/xcompile/xcompile
+ $< $(XGCCPATH) > $@.tmp
+ \mv -f $@.tmp $@ 2> /dev/null || rm -f $@.tmp $@
+
+CONFIG_COMPILER_GCC := y
+ARCH-y := x86_64
+
+include .xcompile
+
+CC := $(CC_$(ARCH-y))
+AS := $(AS_$(ARCH-y))
+OBJCOPY := $(OBJCOPY_$(ARCH-y))
+
+LPCC := CC="$(CC)" $(LIBPAYLOAD_OBJ)/bin/lpgcc
+LPAS := AS="$(AS)" $(LIBPAYLOAD_OBJ)/bin/lpas
+
+CFLAGS += -Wall -Werror -Os -fno-builtin $(CFLAGS_$(ARCH-y)) $(INCLUDES)
+
+ifneq ($(strip $(HAVE_DOTCONFIG)),)
+include $(src)/.config
+real-all: $(TARGET)
+
+$(TARGET): $(src)/.config $(coreinfo_obj)/config.h $(OBJS) libpayload
+ printf " LPCC $(subst $(CURDIR)/,,$(@)) (LINK)\n"
+ $(LPCC) -o $@ $(OBJS)
+ $(OBJCOPY) --only-keep-debug $@ $(TARGET).debug
+ $(OBJCOPY) --strip-debug $@
+ $(OBJCOPY) --add-gnu-debuglink=$(TARGET).debug $@
+
+$(coreinfo_obj)/%.S.o: $(src)/%.S libpayload
+ printf " LPAS $(subst $(CURDIR)/,,$(@))\n"
+ $(LPAS) -o $@ $<
+
+$(coreinfo_obj)/%.o: $(src)/%.c libpayload
+ printf " LPCC $(subst $(CURDIR)/,,$(@))\n"
+ $(LPCC) $(CFLAGS) -c -o $@ $< -DCONFIG_CBFS_PREFIX=\"$(CONFIG_CBFS_PREFIX)\"
+
+else
+real-all: config
+endif
+
+defaultbuild:
+ $(MAKE) olddefconfig
+ $(MAKE) all
+
+ifneq ($(strip $(HAVE_LIBPAYLOAD)),)
+libpayload:
+ printf "Found Libpayload $(LIBPAYLOAD_OBJ).\n"
+else
+LPOPTS=obj="$(CURDIR)/lpbuild" DOTCONFIG="$(CURDIR)/lp.config"
+libpayload:
+ printf "Building libpayload @ $(LIBPAYLOAD_PATH).\n"
+ $(MAKE) -C $(LIBPAYLOAD_PATH) $(LPOPTS) distclean coreinfo_obj=$(coreinfo_obj)/libptmp
+ $(MAKE) -C $(LIBPAYLOAD_PATH) $(LPOPTS) defconfig KBUILD_DEFCONFIG=$(LIBPAYLOAD_CONFIG)
+ $(MAKE) -C $(LIBPAYLOAD_PATH) $(LPOPTS) install DESTDIR=$(coreinfo_obj)
+endif
+
+$(coreinfo_obj)/config.h:
+ $(MAKE) oldconfig
+
+$(shell mkdir -p $(coreinfo_obj) $(objk)/lxdialog $(KCONFIG_SPLITCONFIG))
+
+include $(srck)/Makefile
+
+.PHONY: $(PHONY) prepare
+
+else
+
+clean:
+ rm -rf build/*.elf build/*.o .xcompile
+
+distclean: clean
+ rm -rf build lpbuild
+ rm -f .config* lp.config*
+
+.PHONY: clean distclean
+endif
diff --git a/payloads/bareflank/common.c b/payloads/bareflank/common.c
new file mode 100755
index 00000000000..2e1d55ab6bb
--- /dev/null
+++ b/payloads/bareflank/common.c
@@ -0,0 +1,521 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+/* -------------------------------------------------------------------------- */
+/* Global */
+/* -------------------------------------------------------------------------- */
+
+int64_t g_num_modules = 0;
+struct bfelf_binary_t g_modules[MAX_NUM_MODULES];
+
+_start_t _start_func = 0;
+struct crt_info_t g_info;
+struct bfelf_loader_t g_loader;
+
+int64_t g_num_cpus_started = 0;
+int64_t g_vmm_status = VMM_UNLOADED;
+
+void *g_tls = 0;
+void *g_stack = 0;
+
+uint64_t g_tls_size = 0;
+uint64_t g_stack_size = 0;
+uint64_t g_stack_top = 0;
+
+void *g_rsdp = 0;
+
+/* -------------------------------------------------------------------------- */
+/* Helpers */
+/* -------------------------------------------------------------------------- */
+
+int64_t
+private_setup_stack(void)
+{
+ g_stack_size = STACK_SIZE * 2;
+
+ g_stack = platform_alloc_rw(g_stack_size);
+ if (g_stack == 0) {
+ return BF_ERROR_OUT_OF_MEMORY;
+ }
+
+ g_stack_top = (uint64_t)g_stack + g_stack_size;
+ g_stack_top = (g_stack_top & ~(STACK_SIZE - 1)) - 1;
+
+ platform_memset(g_stack, 0, g_stack_size);
+ return BF_SUCCESS;
+}
+
+int64_t
+private_setup_tls(void)
+{
+ g_tls_size = THREAD_LOCAL_STORAGE_SIZE * (uint64_t)platform_num_cpus();
+
+ g_tls = platform_alloc_rw(g_tls_size);
+ if (g_tls == 0) {
+ return BF_ERROR_OUT_OF_MEMORY;
+ }
+
+ platform_memset(g_tls, 0, g_tls_size);
+ return BF_SUCCESS;
+}
+
+int64_t
+private_setup_rsdp(void)
+{
+ g_rsdp = platform_get_rsdp();
+ return BF_SUCCESS;
+}
+
+int64_t
+private_add_raw_md_to_memory_manager(uint64_t virt, uint64_t type)
+{
+ int64_t ret = 0;
+ struct memory_descriptor md = {0, 0, 0};
+
+ md.virt = virt;
+ md.phys = (uint64_t)platform_virt_to_phys((void *)md.virt);
+ md.type = type;
+
+ ret = platform_call_vmm_on_core(
+ 0, BF_REQUEST_ADD_MDL, (uintptr_t)&md, 0);
+
+ if (ret != MEMORY_MANAGER_SUCCESS) {
+ return ret;
+ }
+
+ return BF_SUCCESS;
+}
+
+int64_t
+private_add_md_to_memory_manager(struct bfelf_binary_t *module)
+{
+ bfelf64_word s = 0;
+
+ for (s = 0; s < bfelf_file_get_num_load_instrs(&module->ef); s++) {
+
+ int64_t ret = 0;
+
+ uint64_t exec_s = 0;
+ uint64_t exec_e = 0;
+ const struct bfelf_load_instr *instr = 0;
+
+ ret = bfelf_file_get_load_instr(&module->ef, s, &instr);
+ bfignored(ret);
+
+ exec_s = (uint64_t)module->exec + instr->mem_offset;
+ exec_e = (uint64_t)module->exec + instr->mem_offset + instr->memsz;
+ exec_s &= ~(BAREFLANK_PAGE_SIZE - 1);
+ exec_e &= ~(BAREFLANK_PAGE_SIZE - 1);
+
+ for (; exec_s <= exec_e; exec_s += BAREFLANK_PAGE_SIZE) {
+ if ((instr->perm & bfpf_x) != 0) {
+ ret = private_add_raw_md_to_memory_manager(
+ exec_s, MEMORY_TYPE_R | MEMORY_TYPE_E);
+ }
+ else {
+ ret = private_add_raw_md_to_memory_manager(
+ exec_s, MEMORY_TYPE_R | MEMORY_TYPE_W);
+ }
+
+ if (ret != MEMORY_MANAGER_SUCCESS) {
+ return ret;
+ }
+ }
+ }
+
+ return BF_SUCCESS;
+}
+
+int64_t
+private_add_tss_mdl(void)
+{
+ uint64_t i = 0;
+
+ for (i = 0; i < g_tls_size; i += BAREFLANK_PAGE_SIZE) {
+
+ int64_t ret = private_add_raw_md_to_memory_manager(
+ (uint64_t)g_tls + i, MEMORY_TYPE_R | MEMORY_TYPE_W);
+
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ return BF_SUCCESS;
+}
+
+int64_t
+private_add_modules_mdl(void)
+{
+ int64_t i = 0;
+
+ for (i = 0; i < g_num_modules; i++) {
+ int64_t ret = private_add_md_to_memory_manager(&g_modules[i]);
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ return BF_SUCCESS;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Implementation */
+/* -------------------------------------------------------------------------- */
+
+int64_t
+common_vmm_status(void)
+{ return g_vmm_status; }
+
+void
+common_reset(void)
+{
+ int64_t i;
+
+ for (i = 0; i < g_num_modules; i++) {
+ if (g_modules[i].exec != 0) {
+ platform_free_rwe(g_modules[i].exec, g_modules[i].exec_size);
+ }
+ }
+
+ platform_memset(&g_modules, 0, sizeof(g_modules));
+ platform_memset(&g_loader, 0, sizeof(struct bfelf_loader_t));
+ platform_memset(&g_info, 0, sizeof(struct crt_info_t));
+ platform_memset(&g_loader, 0, sizeof(struct bfelf_loader_t));
+
+ _start_func = 0;
+
+ g_num_modules = 0;
+ g_num_cpus_started = 0;
+ g_vmm_status = VMM_UNLOADED;
+
+ if (g_tls != 0) {
+ platform_free_rw(g_tls, g_tls_size);
+ }
+
+ if (g_stack != 0) {
+ platform_free_rw(g_stack, g_stack_size);
+ }
+
+ g_tls = 0;
+ g_stack = 0;
+ g_stack_top = 0;
+
+ g_rsdp = 0;
+}
+
+int64_t
+common_init(void)
+{
+ int64_t ret = platform_init();
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+
+ common_reset();
+
+ return BF_SUCCESS;
+}
+
+int64_t
+common_fini(void)
+{
+ if (common_vmm_status() == VMM_RUNNING) {
+ if (common_stop_vmm() != BF_SUCCESS) {
+ BFALERT("common_fini: failed to stop vmm\n");
+ }
+ }
+
+ if (common_vmm_status() == VMM_LOADED) {
+ if (common_unload_vmm() != BF_SUCCESS) {
+ BFALERT("common_fini: failed to unload vmm\n");
+ }
+ }
+
+ if (common_vmm_status() == VMM_CORRUPT) {
+ return BF_ERROR_VMM_CORRUPTED;
+ }
+
+ if (g_num_modules > 0) {
+ common_reset();
+ }
+
+ return BF_SUCCESS;
+}
+
+int64_t
+common_add_module(const char *file, uint64_t fsize)
+{
+ if (file == 0 || fsize == 0) {
+ return BF_ERROR_INVALID_ARG;
+ }
+
+ switch (common_vmm_status()) {
+ case VMM_CORRUPT:
+ return BF_ERROR_VMM_CORRUPTED;
+ case VMM_LOADED:
+ return BF_ERROR_VMM_INVALID_STATE;
+ case VMM_RUNNING:
+ return BF_ERROR_VMM_INVALID_STATE;
+ default:
+ break;
+ }
+
+ if (g_num_modules >= MAX_NUM_MODULES) {
+ return BF_ERROR_MAX_MODULES_REACHED;
+ }
+
+ g_modules[g_num_modules].file = file;
+ g_modules[g_num_modules].file_size = fsize;
+
+ g_num_modules++;
+ return BF_SUCCESS;
+}
+
+int64_t
+common_load_vmm(void)
+{
+ int64_t ret = 0;
+ int64_t ignore_ret = 0;
+
+ switch (common_vmm_status()) {
+ case VMM_CORRUPT:
+ return BF_ERROR_VMM_CORRUPTED;
+ case VMM_LOADED:
+ return BF_SUCCESS;
+ case VMM_RUNNING:
+ return BF_ERROR_VMM_INVALID_STATE;
+ default:
+ break;
+ }
+
+ if (g_num_modules == 0) {
+ return BF_ERROR_NO_MODULES_ADDED;
+ }
+
+ ret = private_setup_stack();
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = private_setup_tls();
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = private_setup_rsdp();
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = bfelf_load(g_modules, (uint64_t)g_num_modules,(void **)&_start_func, &g_info, &g_loader);
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = platform_call_vmm_on_core(0, BF_REQUEST_INIT, 0, 0);
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = platform_call_vmm_on_core(0, BF_REQUEST_SET_RSDP, (uint64_t)g_rsdp, 0);
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = private_add_modules_mdl();
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ ret = private_add_tss_mdl();
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ g_vmm_status = VMM_LOADED;
+ return BF_SUCCESS;
+
+failure:
+
+ ignore_ret = common_unload_vmm();
+ bfignored(ignore_ret);
+
+ return ret;
+}
+
+int64_t
+common_unload_vmm(void)
+{
+ int64_t ret = 0;
+
+ switch (common_vmm_status()) {
+ case VMM_CORRUPT:
+ return BF_ERROR_VMM_CORRUPTED;
+ case VMM_RUNNING:
+ return BF_ERROR_VMM_INVALID_STATE;
+ case VMM_UNLOADED:
+ goto unloaded;
+ default:
+ break;
+ }
+
+ ret = platform_call_vmm_on_core(0, BF_REQUEST_FINI, 0, 0);
+ if (ret != BF_SUCCESS) {
+ goto corrupted;
+ }
+
+unloaded:
+
+ common_reset();
+
+ g_vmm_status = VMM_UNLOADED;
+ return BF_SUCCESS;
+
+corrupted:
+
+ g_vmm_status = VMM_CORRUPT;
+ return ret;
+}
+
+int64_t
+common_start_vmm(void)
+{
+ int64_t ret = 0;
+ int64_t cpuid = 0;
+ int64_t ignore_ret = 0;
+
+ switch (common_vmm_status()) {
+ case VMM_CORRUPT:
+ return BF_ERROR_VMM_CORRUPTED;
+ case VMM_RUNNING:
+ return BF_SUCCESS;
+ case VMM_UNLOADED:
+ return BF_ERROR_VMM_INVALID_STATE;
+ default:
+ break;
+ }
+
+ for (cpuid = 0, g_num_cpus_started = 0; cpuid < platform_num_cpus(); cpuid++) {
+ ret = platform_call_vmm_on_core(
+ (uint64_t)cpuid, BF_REQUEST_VMM_INIT, (uint64_t)cpuid, 0);
+
+ if (ret != BF_SUCCESS) {
+ goto failure;
+ }
+
+ g_num_cpus_started++;
+ }
+
+ g_vmm_status = VMM_RUNNING;
+ return BF_SUCCESS;
+
+failure:
+
+ ignore_ret = common_stop_vmm();
+ bfignored(ignore_ret);
+
+ return ret;
+}
+
+int64_t
+common_stop_vmm(void)
+{
+ int64_t ret = 0;
+ int64_t cpuid = 0;
+
+ switch (common_vmm_status()) {
+ case VMM_CORRUPT:
+ return BF_ERROR_VMM_CORRUPTED;
+ case VMM_UNLOADED:
+ return BF_ERROR_VMM_INVALID_STATE;
+ default:
+ break;
+ }
+
+ for (cpuid = g_num_cpus_started - 1; cpuid >= 0 ; cpuid--) {
+ ret = platform_call_vmm_on_core(
+ (uint64_t)cpuid, BF_REQUEST_VMM_FINI, (uint64_t)cpuid, 0);
+
+ if (ret != BFELF_SUCCESS) {
+ goto corrupted;
+ }
+
+ g_num_cpus_started--;
+ }
+
+ g_vmm_status = VMM_LOADED;
+ return BF_SUCCESS;
+
+corrupted:
+
+ g_vmm_status = VMM_CORRUPT;
+ return ret;
+}
+
+int64_t
+common_dump_vmm(struct debug_ring_resources_t **drr, uint64_t vcpuid)
+{
+ int64_t ret = 0;
+
+ if (drr == 0) {
+ return BF_ERROR_INVALID_ARG;
+ }
+
+ if (common_vmm_status() == VMM_UNLOADED) {
+ return BF_ERROR_VMM_INVALID_STATE;
+ }
+
+ ret = platform_call_vmm_on_core(
+ 0, BF_REQUEST_GET_DRR, (uint64_t)vcpuid, (uint64_t)drr);
+
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+
+ return BF_SUCCESS;
+}
+
+typedef struct thread_context_t tc_t;
+
+int64_t
+common_call_vmm(
+ uint64_t cpuid, uint64_t request, uintptr_t arg1, uintptr_t arg2)
+{
+ int64_t ignored_ret = 0;
+ tc_t *tc = (tc_t *)(g_stack_top - sizeof(tc_t));
+
+ ignored_ret = bfelf_set_integer_args(&g_info, request, arg1, arg2, 0);
+ bfignored(ignored_ret);
+
+ tc->cpuid = cpuid;
+ tc->tlsptr = (uint64_t *)((uint64_t)g_tls + (THREAD_LOCAL_STORAGE_SIZE * (uint64_t)cpuid));
+
+ return _start_func((void *)(g_stack_top - sizeof(tc_t) - 1), &g_info);
+}
diff --git a/payloads/bareflank/entry.c b/payloads/bareflank/entry.c
new file mode 100644
index 00000000000..fc24858d0b3
--- /dev/null
+++ b/payloads/bareflank/entry.c
@@ -0,0 +1,205 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include // TODO: read file from CBFS?
+#include
+
+#include
+#include
+#include
+#include
+
+#include
+#include
+#include
+
+extern void i386_do_exec(void* addr, int argc, char **argv, int *ret);
+
+/* -------------------------------------------------------------------------- */
+/* Global */
+/* -------------------------------------------------------------------------- */
+
+uint64_t g_vcpuid = 0;
+
+struct pmodule_t {
+ const char *data;
+ uint64_t size;
+};
+
+uint64_t g_num_pmodules = 0;
+struct pmodule_t pmodules[MAX_NUM_MODULES] = {{0}};
+
+/* -------------------------------------------------------------------------- */
+/* Misc Device */
+/* -------------------------------------------------------------------------- */
+
+static int64_t
+ioctl_add_module(const char *file, uint64_t len)
+{
+ char *buf;
+ int64_t ret;
+
+ if (g_num_pmodules >= MAX_NUM_MODULES) {
+ BFALERT("IOCTL_ADD_MODULE: too many modules have been loaded\n");
+ return BF_IOCTL_FAILURE;
+ }
+
+ buf = platform_alloc_rw(len);
+ if (buf == NULL) {
+ BFALERT("IOCTL_ADD_MODULE: failed to allocate memory for the module\n");
+ return BF_IOCTL_FAILURE;
+ }
+
+ platform_memcpy(buf, file, len);
+
+ ret = common_add_module(buf, len);
+ if (ret != BF_SUCCESS) {
+ BFALERT("IOCTL_ADD_MODULE: common_add_module failed: %p - %s\n", (void *)ret, ec_to_str(ret));
+ goto failed;
+ }
+
+ pmodules[g_num_pmodules].data = buf;
+ pmodules[g_num_pmodules].size = len;
+
+ g_num_pmodules++;
+
+ return BF_IOCTL_SUCCESS;
+
+failed:
+
+ platform_free_rw(buf, len);
+
+ BFALERT("IOCTL_ADD_MODULE: failed\n");
+ return BF_IOCTL_FAILURE;
+}
+
+static long
+ioctl_load_vmm(void)
+{
+ int64_t ret;
+
+ ret = common_load_vmm();
+ if (ret != BF_SUCCESS) {
+ BFALERT("IOCTL_LOAD_VMM: common_load_vmm failed: %p - %s\n", (void *)ret, ec_to_str(ret));
+ goto failure;
+ }
+
+ return BF_IOCTL_SUCCESS;
+
+failure:
+
+ BFDEBUG("IOCTL_LOAD_VMM: failed\n");
+ return BF_IOCTL_FAILURE;
+}
+
+static long
+ioctl_start_vmm(void)
+{
+ int64_t ret;
+
+ ret = common_start_vmm();
+ if (ret != BF_SUCCESS) {
+ BFALERT("IOCTL_START_VMM: common_start_vmm failed: %p - %s\n", (void *)ret, ec_to_str(ret));
+ goto failure;
+ }
+
+ return BF_IOCTL_SUCCESS;
+
+failure:
+
+ BFDEBUG("IOCTL_START_VMM: failed\n");
+ return BF_IOCTL_FAILURE;
+}
+
+static void cbfs_run_payload(struct cbfs_payload *pay)
+{
+ struct cbfs_payload_segment *seg = &pay->segments;
+ for (;;) {
+ void *src = (void*)pay + ntohl(seg->offset);
+ void *dest = (void*)ntohll(seg->load_addr);
+ u32 src_len = ntohl(seg->len);
+ u32 dest_len = ntohl(seg->mem_len);
+ switch (seg->type) {
+ case PAYLOAD_SEGMENT_BSS:
+ printf("BSS segment %d@%p\n", dest_len, dest);
+ memset(dest, 0, dest_len);
+ break;
+ case PAYLOAD_SEGMENT_ENTRY: {
+ printf("Calling addr %p\n", dest);
+ i386_do_exec(dest, 0, NULL, NULL);
+ return;
+ }
+ default:
+ printf("Segment %x %d@%p -> %d@%p\n", seg->type, src_len, src,
+ dest_len, dest);
+ if (seg->compression == ntohl(CBFS_COMPRESS_NONE)) {
+ if (src_len > dest_len)
+ src_len = dest_len;
+ memcpy(dest, src, src_len);
+ } else if (CONFIG_LP_LZMA
+ && seg->compression == ntohl(CBFS_COMPRESS_LZMA)) {
+ int ret = ulzman(src, src_len, dest, dest_len);
+ if (ret < 0)
+ return;
+ src_len = ret;
+ } else {
+ printf("No support for compression type %x\n", seg->compression);
+ return;
+ }
+ if (dest_len > src_len)
+ memset(dest + src_len, 0, dest_len - src_len);
+ break;
+ }
+ seg++;
+ }
+}
+
+/* -------------------------------------------------------------------------- */
+/* Entry / Exit */
+/* -------------------------------------------------------------------------- */
+
+int main(void)
+{
+ void *payload = NULL;
+
+ printf("\n");
+ printf(" ___ __ _ _ \n");
+ printf(" | _ ) __ _ _ _ ___ / _| |__ _ _ _ | |__\n");
+ printf(" | _ \\/ _` | '_/ -_) _| / _` | ' \\| / /\n");
+ printf(" |___/\\__,_|_| \\___|_| |_\\__,_|_||_|_\\_\\\n");
+ printf("\n");
+ printf(" Please give us a star on: https://github.com/Bareflank/hypervisor\n");
+ printf("\n");
+
+ if (common_init() != BF_SUCCESS) {
+ return -1;
+ }
+
+ ioctl_add_module((char *)vmm, vmm_len);
+ ioctl_load_vmm();
+ ioctl_start_vmm();
+
+ payload = cbfs_load_payload(CBFS_DEFAULT_MEDIA, CONFIG_CBFS_PREFIX "/realpayload");
+
+ cbfs_run_payload(payload);
+
+ printf("Should not get here...\n");
+
+ return 0;
+}
diff --git a/payloads/bareflank/include/bfaffinity.h b/payloads/bareflank/include/bfaffinity.h
new file mode 100644
index 00000000000..1fb98f38e51
--- /dev/null
+++ b/payloads/bareflank/include/bfaffinity.h
@@ -0,0 +1,61 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfbuffer.h
+///
+///
+
+#ifdef WIN64
+
+#include
+
+inline int
+set_affinity(uint64_t core)
+{
+ if (SetProcessAffinityMask(GetCurrentProcess(), 1ULL << core) == 0) {
+ return -1;
+ }
+
+ return 0;
+}
+
+#else
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include
+
+inline int
+set_affinity(uint64_t core)
+{
+ cpu_set_t mask;
+
+ CPU_ZERO(&mask);
+ CPU_SET(core, &mask);
+
+ if (sched_setaffinity(0, sizeof(mask), &mask) != 0) {
+ return -1;
+ }
+
+ return 0;
+}
+
+#endif
diff --git a/payloads/bareflank/include/bfarch.h b/payloads/bareflank/include/bfarch.h
new file mode 100644
index 00000000000..17c6ea47e3a
--- /dev/null
+++ b/payloads/bareflank/include/bfarch.h
@@ -0,0 +1,49 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2017 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFARCH_H
+#define BFARCH_H
+
+#ifndef BF_ARCH
+
+#if defined(_MSC_VER)
+# if defined(_M_X64)
+# define BF_ARCH "intel_x64"
+# define BF_X64
+# define BF_INTEL_X64
+# else
+# error "bfarch.h: unsupported architecture"
+# endif
+#elif defined(__GNUC__) || defined(__clang__)
+# if defined(__x86_64__)
+# define BF_ARCH "intel_x64"
+# define BF_X64
+# define BF_INTEL_X64
+# elif defined(__aarch64__)
+# define BF_ARCH "aarch64"
+# define BF_AARCH64
+# else
+# error "bfarch.h: unsupported architecture"
+# endif
+#else
+# error "bfarch.h: unsupported compiler"
+#endif
+
+#endif
+#endif
diff --git a/payloads/bareflank/include/bfbenchmark.h b/payloads/bareflank/include/bfbenchmark.h
new file mode 100644
index 00000000000..6d78980accb
--- /dev/null
+++ b/payloads/bareflank/include/bfbenchmark.h
@@ -0,0 +1,114 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULLAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+#ifndef BFBENCHMARK_H
+#define BFBENCHMARK_H
+
+#if defined(__clang__) || defined(__GNUC__)
+#pragma GCC system_header
+#endif
+
+#include
+#include
+
+#include
+
+template
+uint64_t benchmark(T func)
+{
+ auto s = std::chrono::high_resolution_clock::now();
+ func();
+ auto e = std::chrono::high_resolution_clock::now();
+
+ return static_cast((e - s).count());
+}
+
+size_t g_page_allocs = 0;
+size_t g_nonpage_allocs = 0;
+
+inline void *
+custom_new(std::size_t size)
+{
+ if ((size & 0xFFF) == 0) {
+ g_page_allocs += size;
+ }
+ else {
+ g_nonpage_allocs += size;
+ }
+
+ return malloc(size);
+}
+
+inline void
+custom_delete(void *ptr, std::size_t size)
+{
+ bfignored(size);
+ free(ptr);
+}
+
+void *
+operator new[](std::size_t size)
+{ return custom_new(size); }
+
+void *
+operator new (std::size_t size)
+{ return custom_new(size); }
+
+void *
+operator new (std::size_t count, const std::nothrow_t &)
+{ return custom_new(count); }
+
+void *
+operator new[](std::size_t count, const std::nothrow_t &)
+{ return custom_new(count); }
+
+void
+operator delete (void *ptr, std::size_t size) throw()
+{ custom_delete(ptr, size); }
+
+void
+operator delete (void *ptr) throw()
+{ operator delete (ptr, static_cast(0)); }
+
+void
+operator delete[](void *ptr, std::size_t size) throw()
+{ custom_delete(ptr, size); }
+
+void
+operator delete[](void *ptr) throw()
+{ operator delete[](ptr, static_cast(0)); }
+
+inline void
+print_memory_stats()
+{
+ auto page_allocs = g_page_allocs;
+ auto nonpage_allocs = g_nonpage_allocs;
+
+ bfdebug_nhex(0, "bytes allocated", page_allocs + nonpage_allocs);
+ bfdebug_subnhex(0, "page aligned bytes allocated", page_allocs);
+ bfdebug_subnhex(0, "non-page aligned bytes allocated", nonpage_allocs);
+}
+
+inline void
+clear_memory_stats()
+{
+ g_page_allocs = 0;
+ g_nonpage_allocs = 0;
+}
+
+#endif
diff --git a/payloads/bareflank/include/bfbitmanip.h b/payloads/bareflank/include/bfbitmanip.h
new file mode 100644
index 00000000000..528ddbb9ec3
--- /dev/null
+++ b/payloads/bareflank/include/bfbitmanip.h
@@ -0,0 +1,274 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULLAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfbitmanip.h
+///
+
+#ifndef BFBITMANIP_H
+#define BFBITMANIP_H
+
+#include
+
+#include
+#include
+
+/// Set Bit
+///
+/// Sets a bit given the bit position and an integer.
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be set
+/// @param b bit position
+/// @return t with bit set at position b
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+set_bit(T t, B b) noexcept
+{
+ return t | (0x1ULL << b);
+}
+
+/// Set Bit
+///
+/// Sets a bit given the bit position and an integer.
+///
+/// @expects
+/// @ensures
+///
+/// @param view view whose bit is to be set
+/// @param b bit position
+/// @return t with bit set at position b
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+set_bit(gsl::span &view, B b)
+{
+ auto byte_view = gsl::as_writeable_bytes(view);
+ byte_view.at(b >> 3) |= gsl::narrow_cast((1 << (b & 7)));
+}
+
+/// Clear Bit
+///
+/// Clears a bit given the bit position and an integer.
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be cleared
+/// @param b bit position
+/// @return t with bit cleared at position b
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+clear_bit(T t, B b) noexcept
+{
+ return t & ~(0x1ULL << b);
+}
+
+/// Clear Bit
+///
+/// Clears a bit given the bit position and an integer.
+///
+/// @expects
+/// @ensures
+///
+/// @param view view whose bit is to be cleared
+/// @param b bit position
+/// @return t with bit cleared at position b
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+clear_bit(gsl::span &view, B b)
+{
+ auto byte_view = gsl::as_writeable_bytes(view);
+ byte_view.at(b >> 3) &= gsl::narrow_cast(~(1 << (b & 7)));
+}
+
+/// Get Bit
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be gotten
+/// @param b bit position
+/// @return value of bit b for integer t
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+get_bit(T t, B b) noexcept
+{
+ return (t & (0x1ULL << b)) >> b;
+}
+
+/// Get Bit
+///
+/// @expects
+/// @ensures
+///
+/// @param view view whose bit is to be gotten
+/// @param b bit position
+/// @return value of bit b for integer t
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+get_bit(const gsl::span &view, B b)
+{
+ auto byte_view = gsl::as_writeable_bytes(view);
+ return byte_view.at(b >> 3) & gsl::narrow_cast((1 << (b & 7)));
+}
+
+/// Is Bit Set
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be tested
+/// @param b bit position
+/// @return true if bit b in t is set, false otherwise
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+is_bit_set(T t, B b) noexcept
+{
+ return static_cast(get_bit(t, b)) != static_cast(0);
+}
+
+/// Is Bit Cleared
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be tested
+/// @param b bit position
+/// @return true if bit b in t is cleared, false otherwise
+///
+template <
+ typename T,
+ typename B,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+is_bit_cleared(T t, B b) noexcept
+{
+ return static_cast(get_bit(t, b)) == static_cast(0);
+}
+
+/// Number of Bits Set
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bit is to be tested
+/// @return the number of bits set in t
+///
+template <
+ typename T,
+ typename = std::enable_if::value>
+ >
+auto
+num_bits_set(T t) noexcept
+{
+ std::bitset<64> b{t};
+ return b.count();
+}
+
+/// Get Bits
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bits are to be gotten
+/// @param m the bit mask
+/// @return t & m
+///
+template <
+ typename T,
+ typename M,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+get_bits(T t, M m) noexcept
+{
+ return t & m;
+}
+
+/// Set Bits
+///
+/// @expects
+/// @ensures
+///
+/// @param t integer whose bits are to be set
+/// @param m the bit mask
+/// @param v the bits to set
+/// @return t with bits set to v masked by m
+///
+template <
+ typename T,
+ typename M,
+ typename V,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+constexpr auto
+set_bits(T t, M m, V v) noexcept
+{
+ return (t & ~m) | (v & m);
+}
+
+#endif
diff --git a/payloads/bareflank/include/bfbuffer.h b/payloads/bareflank/include/bfbuffer.h
new file mode 100644
index 00000000000..7ca1c0a5944
--- /dev/null
+++ b/payloads/bareflank/include/bfbuffer.h
@@ -0,0 +1,309 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfbuffer.h
+///
+
+#ifndef BFBUFFER_H
+#define BFBUFFER_H
+
+#include
+#include
+
+namespace bfn
+{
+
+/// Buffer
+///
+/// Simple character buffer class that stores both a buffer and its size.
+/// This class is a hybrid between std::array, and std::unique_ptr. It's
+/// dynamic, doesn't have support for iterators or random memory access,
+/// and cannot be copied.
+///
+class buffer
+{
+public:
+
+ using size_type = std::size_t; ///< Size type of buffer
+ using data_type = char; ///< Data type of buffer
+
+ /// Default Constructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ buffer() = default;
+
+ /// Allocate Buffer Constructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param size the size of the buffer to allocate
+ ///
+ /// @throws std::bad_alloc if this constructor is unable to allocate memory for the buffer
+ ///
+ buffer(size_type size) :
+ m_size(size),
+ m_data(std::make_unique(m_size))
+ {
+ expects(size != 0);
+ }
+
+ /// Pre-Allocated Buffer Constructor
+ ///
+ /// @note Takes ownership of data, and frees the provided buffer when the
+ /// buffer goes out of scope
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param data a pointer to the buffer to store.
+ /// @param size the size of the provided buffer
+ ///
+ buffer(void *data, size_type size) :
+ m_size(size),
+ m_data(static_cast(data))
+ {
+ expects(size != 0 || data == nullptr);
+ expects(data != nullptr || size == 0);
+ }
+
+ /// Initializer List Constructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param list initial list to create the buffer
+ ///
+ /// @throws std::bad_alloc if this constructor is unable to allocate memory for the buffer
+ ///
+ buffer(std::initializer_list list) :
+ m_size(list.size()),
+ m_data(std::make_unique(list.size()))
+ {
+ auto _i = 0LL;
+ auto _span = span();
+
+ for (const auto &elem : list) {
+ _span[_i++] = elem;
+ }
+ }
+
+ /// Default Destructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ ~buffer() = default;
+
+ /// Get Data
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns a pointer to the buffer
+ ///
+ data_type *get() noexcept
+ { return m_data.get(); }
+
+ /// Get Data
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns a pointer to the buffer
+ ///
+ data_type *data() noexcept
+ { return m_data.get(); }
+
+ /// Get Data
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns a pointer to the buffer
+ ///
+ const data_type *data() const noexcept
+ { return m_data.get(); }
+
+ /// Is Empty
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns true if size() == 0, false otherwise
+ ///
+ bool empty() const noexcept
+ { return m_size == 0; }
+
+ /// Valid
+ ///
+ /// @return returns true if the buffer is valid, false otherwise
+ ///
+ operator bool() const noexcept
+ { return m_data.operator bool(); }
+
+ /// Size
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns the size of the buffer
+ ///
+ size_type size() const noexcept
+ { return m_size; }
+
+ /// Release
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ void
+ release() noexcept
+ {
+ m_size = 0;
+ m_data.release();
+ }
+
+ /// Swap
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param other the other buffer to swap with
+ ///
+ void
+ swap(buffer &other) noexcept
+ {
+ std::swap(m_size, other.m_size);
+ std::swap(m_data, other.m_data);
+ }
+
+ /// Span
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @return returns a gsl::span that can be used to access the buffer.
+ ///
+ gsl::span
+ span() const
+ { return gsl::make_span(m_data.get(), gsl::narrow_cast(m_size)); }
+
+ /// Resize
+ ///
+ /// Resize the buffer. If count is smaller than the original size, the
+ /// data is truncated. If count is larger than the original size, the
+ /// remaining data is undefined.
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param count the number of bytes to resize the buffer to
+ ///
+ /// @throws std::bad_alloc if this method is unable to allocate memory for the buffer
+ ///
+ void
+ resize(size_type count)
+ {
+ auto new_data = std::make_unique(count);
+ memcpy(new_data.get(), m_data.get(), std::min(m_size, count));
+
+ m_size = count;
+ m_data = std::move(new_data);
+ }
+
+private:
+
+ size_type m_size{0};
+ std::unique_ptr m_data;
+
+public:
+
+ /// @cond
+
+ buffer(buffer &&) noexcept = default;
+ buffer &operator=(buffer &&) noexcept = default;
+
+ buffer(const buffer &) = delete;
+ buffer &operator=(const buffer &) = delete;
+
+ /// @endcond
+};
+
+/// Swap
+///
+/// @expects none
+/// @ensures none
+///
+/// @param lhs buffer to swap
+/// @param rhs buffer to swap
+///
+inline void
+swap(buffer &lhs, buffer &rhs) noexcept
+{ lhs.swap(rhs); }
+
+/// Equals
+///
+/// @expects none
+/// @ensures none
+///
+/// @param lhs buffer to compare
+/// @param rhs buffer to compare
+/// @return true if ==, false otherwise
+///
+inline bool
+operator==(const buffer &lhs, const buffer &rhs) noexcept
+{
+ if (lhs.size() != rhs.size()) {
+ return false;
+ }
+
+ return memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
+}
+
+/// Not Equals
+///
+/// @expects none
+/// @ensures none
+///
+/// @param lhs buffer to compare
+/// @param rhs buffer to compare
+/// @return true if !=, false otherwise
+///
+inline bool
+operator!=(const buffer &lhs, const buffer &rhs) noexcept
+{ return !(lhs == rhs); }
+
+/// Default Out Stream Operator
+///
+/// @expects none
+/// @ensures none
+///
+/// @param os the out stream object
+/// @return os
+///
+inline std::ostream &
+operator<<(std::ostream &os, const buffer &)
+{ return os; }
+
+}
+
+#endif
diff --git a/payloads/bareflank/include/bfcallonce.h b/payloads/bareflank/include/bfcallonce.h
new file mode 100644
index 00000000000..05a7776bb39
--- /dev/null
+++ b/payloads/bareflank/include/bfcallonce.h
@@ -0,0 +1,56 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULLAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+#ifndef BFCALLONCE
+#define BFCALLONCE
+
+/// @cond
+
+#include
+
+// TODO
+//
+// This code is only needed because there seems to be a bug with GCC that
+// causes a system error when --coverage is enabled. The following was written
+// to have the same names and implementation as std::call_once so that at
+// some point this code can easily be removed.
+//
+namespace bfn
+{
+
+struct once_flag {
+ bool m_value{false};
+ mutable std::mutex m_mutex{};
+};
+
+template
+void call_once(once_flag &flag, FUNC func)
+{
+ std::lock_guard lock(flag.m_mutex);
+
+ if (!flag.m_value) {
+ func();
+ flag.m_value = true;
+ }
+}
+
+}
+
+/// @endcond
+
+#endif
diff --git a/payloads/bareflank/include/bfconstants.h b/payloads/bareflank/include/bfconstants.h
new file mode 100755
index 00000000000..f3334e21176
--- /dev/null
+++ b/payloads/bareflank/include/bfconstants.h
@@ -0,0 +1,277 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFCONSTANTS_H
+#define BFCONSTANTS_H
+
+#include
+#include
+
+/*
+ * Max Physical Address
+ *
+ * Defines the maximum physical address the system can access. This can be
+ * used by CR3 and EPT to define the memory map used by the VMM. Note that
+ * if this value is too large, its possible additional memory would be needed
+ * by the VMM to setup CR3 or EPT depending on the granulairty used.
+ *
+ * Note: defined in bytes
+ */
+#ifndef MAX_PHYS_ADDR
+#define MAX_PHYS_ADDR 0x1000000000
+#endif
+
+/*
+ * Bareflank Page Size
+ *
+ * Defines the page size that is supported by the VMM. For now, this is
+ * set to a value that is likely supported by most hardware.
+ *
+ * Note: defined in bytes
+ */
+#ifndef BAREFLANK_PAGE_SIZE
+#define BAREFLANK_PAGE_SIZE (0x1000ULL)
+#endif
+
+/*
+ * Page Pool K
+ *
+ * Defines the size of the initial page pool used by the VMM. If more memory
+ * is needed by the VMM initially, this value may be increased. Note that
+ * increasing "K" by 1 will double the amount of memory.
+ */
+#ifndef PAGE_POOL_K
+#define PAGE_POOL_K (15ULL)
+#endif
+
+/*
+* Huge Pool K
+*
+* Defines the size of the initial huge pool used by the VMM. If more memory
+* is needed by the VMM initially, this value may be increased. Note that
+* increasing "K" by 1 will double the amount of memory.
+*/
+
+#ifndef HUGE_POOL_K
+#define HUGE_POOL_K (15ULL)
+#endif
+/*
+* Memory Map Pool K
+*
+* Defines the size of the initial mem map pool used by the VMM. If more memory
+* is needed by the VMM for mapping, this value may be increased. Note that
+* increasing "K" by 1 will double the amount of memory.
+*/
+#ifndef MEM_MAP_POOL_K
+#define MEM_MAP_POOL_K (15ULL)
+#endif
+
+/*
+ * Memory Map Pool Start
+ *
+ * This defines the starting location of the virtual memory that is used
+ * for memory mapping. Note that on some systems, this might need to be
+ * changed to prevent collisions.
+ *
+ * Note: defined in bytes (defaults to 2MB)
+ */
+#ifndef MEM_MAP_POOL_START
+#define MEM_MAP_POOL_START 0x200000ULL
+#endif
+
+/*
+ * Max Supported Modules
+ *
+ * The maximum number of modules supported by the VMM. If you VMM has a large
+ * number of dynamic libraries to load, this value might need to be increased
+ */
+#ifndef MAX_NUM_MODULES
+#define MAX_NUM_MODULES (75LL)
+#endif
+
+/*
+ * Debug Ring Size
+ *
+ * Defines the size of the debug ring. Note that the memory manager is used to
+ * allocate memory for the debug ring, so if you need more than one ring,
+ * which is supported, make sure the memory manager has enough memory in
+ * the huge pool to support your needs.
+ *
+ * Note: Must be defined using a bit shift as this prevents the debug ring from
+ * allocating memory that generates fragmentation in the memory manager
+ *
+ * Note: defined in bytes
+ */
+#define DEBUG_RING_SIZE (1 << 15ULL)
+
+/*
+ * Stack Size
+ *
+ * Each entry function is guarded with a custom stack to prevent stack
+ * overflows from corrupting the kernel, as well as providing a larger stack
+ * that's common in userspace code, but not in the kernel. If stack corruption
+ * is occuring, this function likely needs to be increased. Note one stack
+ * frame is allocated per CPU, so only increase this if needed.
+ *
+ * Note: Must be defined using a bit shift as we will mask to get the
+ * bottom of the stack if needed.
+ *
+ * Note: This is hard coded in the thread_context.asm as there is no way to
+ * use this include in NASM. If you change this, you must change the
+ * value in that file as well.
+ *
+ * Note: defined in bytes
+ */
+#ifndef STACK_SIZE
+#define STACK_SIZE (1ULL << 15ULL)
+#endif
+
+/*
+ * Thread Local Storage (TLS) Size
+ *
+ * Bareflank don't support threads, but it does support Multi-Core, and
+ * we need a way to store CPU specific information. Certain libc++
+ * operations (for example, std::uncaught_exceptions) need to use this CPU
+ * specific storage so that the cores are not interfering with each other.
+ * So as far as the code is concerned, TLS is being used, even if a "thread"
+ * in the traditional sense isn't.
+ *
+ * Note: Defined in bytes
+ */
+#ifndef THREAD_LOCAL_STORAGE_SIZE
+#define THREAD_LOCAL_STORAGE_SIZE (0x1000ULL)
+#endif
+
+/*
+ * Default Serial COM Port
+ *
+ * On x64, possible values include (but not limited to):
+ * - 0x03F8U // COM1
+ * - 0x02F8U // COM2
+ * - 0x03E8U // COM3
+ * - 0x02E8U // COM4
+ * - 0xE000U
+ * - 0xE010U
+ *
+ * On aarch64, the value is the serial peripheral's physical base address.
+ *
+ * Note: See bfvmm/serial/serial_ns16550a.h
+ */
+#ifndef DEFAULT_COM_PORT
+#if defined(BF_AARCH64)
+# define DEFAULT_COM_PORT 0x09000000
+#else
+# define DEFAULT_COM_PORT 0x03F8U
+# define DEFAULT_COM_DRIVER serial_ns16550a
+#endif
+#endif
+
+/*
+ * Serial Port Driver
+ *
+ * Possible values include:
+ * - serial_ns16550a
+ * - serial_pl011
+ *
+ * On x64, this should always be serial_ns16550a.
+ */
+#ifndef DEFAULT_COM_DRIVER
+#if defined(BF_AARCH64)
+# define DEFAULT_COM_DRIVER serial_pl011
+#else
+# define DEFAULT_COM_DRIVER serial_ns16550a
+#endif
+#endif
+
+/*
+ * Serial port memory length (aarch64 only)
+ *
+ * This is the length of the memory region occupied by the memory-mapped
+ * serial port.
+ */
+#if !defined(DEFAULT_COM_LENGTH) && defined(BF_AARCH64)
+#define DEFAULT_COM_LENGTH 0x1000
+#endif
+
+/*
+ * Default Serial Baud Rate
+ *
+ * Note: See bfvmm/serial/serial_ns16550a.h
+ */
+#ifndef DEFAULT_BAUD_RATE
+#define DEFAULT_BAUD_RATE baud_rate_115200
+#endif
+
+/*
+ * Default serial baud rate divisor, integer part (for PL011)
+ *
+ * Note: See bfvmm/serial/serial_pl011.h
+ */
+#ifndef DEFAULT_BAUD_RATE_INT
+#define DEFAULT_BAUD_RATE_INT 0x4
+#endif
+
+/*
+ * Default serial baud rate divisor, fractional part (for PL011)
+ *
+ * Note: See bfvmm/serial/serial_pl011.h
+ */
+#ifndef DEFAULT_BAUD_RATE_FRAC
+#define DEFAULT_BAUD_RATE_FRAC 0x0
+#endif
+
+/*
+ * Default Serial Data Bits
+ *
+ * Note: See bfvmm/serial/serial_ns16550a.h
+ */
+#ifndef DEFAULT_DATA_BITS
+#define DEFAULT_DATA_BITS char_length_8
+#endif
+
+/*
+ * Default Serial Stop Bits
+ *
+ * Note: See bfvmm/serial/serial_ns16550a.h
+ */
+#ifndef DEFAULT_STOP_BITS
+#define DEFAULT_STOP_BITS stop_bits_1
+#endif
+
+/*
+ * Default Serial Parity Bits
+ *
+ * Note: See bfvmm/serial/serial_ns16550a.h
+ */
+#ifndef DEFAULT_PARITY_BITS
+#define DEFAULT_PARITY_BITS parity_none
+#endif
+
+/*
+ * Debug Level
+ *
+ * Defines how noisy Bareflank is. This defaults to 0 which only prints status
+ * information. Raise this level to include additional verbosity. Note that
+ * as you increase this level, performance will degrade.
+ */
+#ifndef DEBUG_LEVEL
+#define DEBUG_LEVEL 0
+#endif
+
+#endif
diff --git a/payloads/bareflank/include/bfdebug.h b/payloads/bareflank/include/bfdebug.h
new file mode 100644
index 00000000000..03cf53b2214
--- /dev/null
+++ b/payloads/bareflank/include/bfdebug.h
@@ -0,0 +1,1137 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFDEBUG_H
+#define BFDEBUG_H
+
+#include
+
+/** @cond */
+
+/* -------------------------------------------------------------------------- */
+/* C++ Debugging */
+/* -------------------------------------------------------------------------- */
+
+#ifdef __cplusplus
+
+#include
+#include
+
+#include
+
+#ifdef _MSC_VER
+#define bfcolor_black ""
+#define bfcolor_red ""
+#define bfcolor_green ""
+#define bfcolor_yellow ""
+#define bfcolor_blue ""
+#define bfcolor_magenta ""
+#define bfcolor_cyan ""
+#define bfcolor_end ""
+#else
+#define bfcolor_black "\033[1;30m"
+#define bfcolor_red "\033[1;31m"
+#define bfcolor_green "\033[1;32m"
+#define bfcolor_yellow "\033[1;33m"
+#define bfcolor_blue "\033[1;34m"
+#define bfcolor_magenta "\033[1;35m"
+#define bfcolor_cyan "\033[1;36m"
+#define bfcolor_end "\033[0m"
+#endif
+
+#define bfcolor_debug bfcolor_green
+#define bfcolor_alert bfcolor_yellow
+#define bfcolor_error bfcolor_red
+
+using cstr_t = const char *;
+
+#ifdef UNIX
+#define __BFFUNC__ static_cast(__PRETTY_FUNCTION__)
+#else
+#define __BFFUNC__ static_cast(__FUNCTION__)
+#endif
+
+#ifdef VMM
+extern "C" uint64_t thread_context_cpuid(void);
+extern "C" uint64_t write_str(const std::string &str);
+#else
+#include
+#endif
+
+#ifdef _MSC_VER
+#pragma warning(push)
+#pragma warning(disable : 4312)
+#endif
+
+template <
+ typename T,
+ typename = std::enable_if_t <
+ std::is_pointer::value ||
+ std::is_integral::value
+ >
+ >
+const void *
+view_as_pointer(const T val)
+{ return reinterpret_cast(val); }
+
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
+
+extern "C" uint64_t
+unsafe_write_cstr(const char *cstr, size_t len);
+
+/* ---------------------------------------------------------------------------*/
+/* Low Level Debugging */
+/* ---------------------------------------------------------------------------*/
+
+inline char *
+bfitoa(size_t value, char *str, size_t base)
+{
+ const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+ int i = 0, j = 0;
+ size_t remainder;
+
+ do {
+ remainder = value % base;
+ str[i++] = digits[remainder];
+ value = value / base;
+ }
+ while (value != 0);
+
+ str[i] = '\0';
+
+ for (j = 0, i--; j < i; j++, i--) {
+ char c = str[j];
+ str[j] = str[i];
+ str[i] = c;
+ }
+
+ return str;
+}
+
+#define CALLED() \
+ { \
+ const auto *str_text = "\033[1;32mDEBUG\033[0m: function called = "; \
+ const auto *str_func = __BFFUNC__; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(str_func, strlen(str_func)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define WARNING(a) \
+ { \
+ const auto *str_text = "\033[1;33mWARNING\033[0m: " a " = "; \
+ const auto *str_func = __BFFUNC__; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(str_func, strlen(str_func)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define UNHANDLED() \
+ { \
+ const auto *str_text = "\033[1;33mWARNING\033[0m: unsupported function called = "; \
+ const auto *str_func = __BFFUNC__; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(str_func, strlen(str_func)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define ARG_UNSUPPORTED(a) \
+ { \
+ const auto *str_text = "\033[1;33mWARNING\033[0m: " a " not supported for function called = "; \
+ const auto *str_func = __BFFUNC__; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(str_func, strlen(str_func)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+
+#define DEBUG_STR(a,b) \
+ { \
+ const auto *str_text = "\033[1;32mDEBUG\033[0m: " a " = "; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(b, strlen(b)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define DEBUG_DEC(a,b) \
+ { \
+ char numstr[64]; \
+ bfitoa(b, numstr, 10); \
+ const auto *str_text = "\033[1;32mDEBUG\033[0m: " a " = "; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(numstr, strlen(numstr)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define DEBUG_HEX(a,b) \
+ { \
+ char numstr[64]; \
+ bfitoa(b, numstr, 16); \
+ const auto *str_text = "\033[1;32mDEBUG\033[0m: " a " = "; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(numstr, strlen(numstr)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+#define DEBUG_LINE() \
+ { \
+ char numstr[64]; \
+ bfitoa(__LINE__, numstr, 10); \
+ const auto *str_text = "\033[1;32mDEBUG\033[0m: "; \
+ const auto *str_func = __BFFUNC__; \
+ const auto *str_next = " = "; \
+ const auto *str_endl = "\n"; \
+ unsafe_write_cstr(str_text, strlen(str_text)); \
+ unsafe_write_cstr(str_func, strlen(str_func)); \
+ unsafe_write_cstr(str_next, strlen(str_next)); \
+ unsafe_write_cstr(numstr, strlen(numstr)); \
+ unsafe_write_cstr(str_endl, strlen(str_endl)); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Helpers (Private) */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_core(gsl::not_null msg)
+{
+ *msg += bfcolor_cyan;
+ *msg += "[";
+ *msg += bfcolor_yellow;
+#ifdef VMM
+ *msg += std::to_string(thread_context_cpuid());
+#else
+ *msg += '0';
+#endif
+ *msg += bfcolor_cyan;
+ *msg += "] ";
+ *msg += bfcolor_end;
+}
+
+inline void
+__bfdebug_type(gsl::not_null msg, cstr_t color, cstr_t type)
+{
+ *msg += color;
+ *msg += type;
+ *msg += bfcolor_end;
+ *msg += ": ";
+}
+
+inline void
+__bfdebug_jtfy(gsl::not_null msg, uint64_t width, cstr_t title, cstr_t indent)
+{
+ if (title != nullptr) {
+ auto len = width - strlen(title);
+
+ if (indent != nullptr) {
+ len -= strlen(indent);
+ *msg += indent;
+ }
+
+ *msg += title;
+ *msg += std::string(len, ' ');
+ }
+ else {
+ *msg += std::string(width, ' ');
+ }
+}
+
+template
+void __bfdebug_transaction(F func)
+{
+ std::string msg;
+ msg.reserve(0x1000);
+ func(&msg);
+
+#ifdef VMM
+ write_str(msg);
+#else
+ std::cout << msg;
+#endif
+}
+
+template
+void __bfdebug_add_line(std::string *msg, F func)
+{
+ if (msg == nullptr) {
+ __bfdebug_transaction([&](std::string * tmsg) {
+ func(tmsg);
+ });
+ }
+ else {
+ std::string ln;
+ ln.reserve(0x1000);
+
+ func(&ln);
+
+ if (msg->size() + ln.size() > msg->capacity()) {
+ msg->reserve(msg->capacity() + 0x1000);
+ }
+
+ *msg += ln;
+ }
+}
+
+#define bfdebug_transaction(level,func) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_transaction(func); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Get Macro Magic */
+/* ---------------------------------------------------------------------------*/
+
+/*
+ * This is a cleaned up version of the following:
+ * https://stackoverflow.com/questions/11761703/overloading-macro-on-number-of-arguments
+ *
+ * This is needed because some of the debug macros only take a single argument,
+ * which means __VA_ARGS__ gets mad because it's not used. For macros with more
+ * than one arg, this is not needed. Also, if this becomes needed for other
+ * things in the future, we should move this to it's own header
+ *
+ * The bug fix for MSVC comes from the following:
+ * https://stackoverflow.com/questions/5134523/msvc-doesnt-expand-va-args-correctly
+ */
+
+#define __BUGFX(x) x
+
+#define __NARG2(...) __BUGFX(__NARG1(__VA_ARGS__,__RSEQN()))
+#define __NARG1(...) __BUGFX(__ARGSN(__VA_ARGS__))
+#define __ARGSN(_1,_2,_3,_4,_5,_6,_7,_8,_9,_10,N,...) N
+#define __RSEQN() 10,9,8,7,6,5,4,3,2,1,0
+
+#define __FUNC2(name,n) name ## n
+#define __FUNC1(name,n) __FUNC2(name,n)
+#define GET_MACRO(func,...) __FUNC1(func,__BUGFX(__NARG2(__VA_ARGS__))) (__VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Info */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_info_core(cstr_t color, cstr_t type, cstr_t title, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+
+ if (title != nullptr) {
+ *msg += std::string(title);
+ }
+
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_info(cstr_t color, cstr_t type, cstr_t title, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_info_core(color, type, title, ln);
+ });
+}
+
+#define bfdebug_info(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_info(bfcolor_debug, "DEBUG", __VA_ARGS__); \
+ }
+
+#define bfalert_info(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_info(bfcolor_alert, "ALERT", __VA_ARGS__); \
+ }
+
+#define bferror_info(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_info(bfcolor_error, "ERROR", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Line Break */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_lnbr_core(cstr_t color, cstr_t type, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_lnbr(cstr_t color, cstr_t type, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_lnbr_core(color, type, ln);
+ });
+}
+
+#define bfdebug_lnbr1(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_debug, "DEBUG"); \
+ }
+
+#define bfalert_lnbr1(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_alert, "ALERT"); \
+ }
+
+#define bferror_lnbr1(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_error, "ERROR"); \
+ }
+
+#define bfdebug_lnbr2(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_debug, "DEBUG", msg); \
+ }
+
+#define bfalert_lnbr2(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_alert, "ALERT", msg); \
+ }
+
+#define bferror_lnbr2(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_lnbr(bfcolor_error, "ERROR", msg); \
+ }
+
+#define bfdebug_lnbr(...) GET_MACRO(bfdebug_lnbr, __VA_ARGS__)
+#define bfalert_lnbr(...) GET_MACRO(bfalert_lnbr, __VA_ARGS__)
+#define bferror_lnbr(...) GET_MACRO(bferror_lnbr, __VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Horizontal Line Break1 */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_brk1_core(cstr_t color, cstr_t type, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+
+ *msg += "======================================================================";
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_brk1(cstr_t color, cstr_t type, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_brk1_core(color, type, ln);
+ });
+}
+
+#define bfdebug_brk11(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_debug, "DEBUG"); \
+ }
+
+#define bfalert_brk11(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_alert, "ALERT"); \
+ }
+
+#define bferror_brk11(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_error, "ERROR"); \
+ }
+
+#define bfdebug_brk12(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_debug, "DEBUG", msg); \
+ }
+
+#define bfalert_brk12(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_alert, "ALERT", msg); \
+ }
+
+#define bferror_brk12(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk1(bfcolor_error, "ERROR", msg); \
+ }
+
+#define bfdebug_brk1(...) GET_MACRO(bfdebug_brk1, __VA_ARGS__)
+#define bfalert_brk1(...) GET_MACRO(bfalert_brk1, __VA_ARGS__)
+#define bferror_brk1(...) GET_MACRO(bferror_brk1, __VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Horizontal Line Break2 */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_brk2_core(cstr_t color, cstr_t type, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+
+ *msg += "----------------------------------------------------------------------";
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_brk2(cstr_t color, cstr_t type, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_brk2_core(color, type, ln);
+ });
+}
+
+#define bfdebug_brk21(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_debug, "DEBUG"); \
+ }
+
+#define bfalert_brk21(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_alert, "ALERT"); \
+ }
+
+#define bferror_brk21(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_error, "ERROR"); \
+ }
+
+#define bfdebug_brk22(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_debug, "DEBUG", msg); \
+ }
+
+#define bfalert_brk22(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_alert, "ALERT", msg); \
+ }
+
+#define bferror_brk22(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk2(bfcolor_error, "ERROR", msg); \
+ }
+
+#define bfdebug_brk2(...) GET_MACRO(bfdebug_brk2, __VA_ARGS__)
+#define bfalert_brk2(...) GET_MACRO(bfalert_brk2, __VA_ARGS__)
+#define bferror_brk2(...) GET_MACRO(bferror_brk2, __VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Horizontal Line Break3 */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_brk3_core(cstr_t color, cstr_t type, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+
+ *msg += "......................................................................";
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_brk3(cstr_t color, cstr_t type, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_brk3_core(color, type, ln);
+ });
+}
+
+#define bfdebug_brk31(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_debug, "DEBUG"); \
+ }
+
+#define bfalert_brk31(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_alert, "ALERT"); \
+ }
+
+#define bferror_brk31(level) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_error, "ERROR"); \
+ }
+
+#define bfdebug_brk32(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_debug, "DEBUG", msg); \
+ }
+
+#define bfalert_brk32(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_alert, "ALERT", msg); \
+ }
+
+#define bferror_brk32(level,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_brk3(bfcolor_error, "ERROR", msg); \
+ }
+
+#define bfdebug_brk3(...) GET_MACRO(bfdebug_brk3, __VA_ARGS__)
+#define bfalert_brk3(...) GET_MACRO(bfalert_brk3, __VA_ARGS__)
+#define bferror_brk3(...) GET_MACRO(bferror_brk3, __VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Hex Number */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_nhex_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, uint64_t nhex, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 52, title, indent);
+
+ *msg += bfn::to_string(nhex, 16);
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_nhex(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, uint64_t nhex, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_nhex_core(color, type, indent, title, nhex, ln);
+ });
+}
+
+inline void
+__bfdebug_nhex(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, void *nhex, std::string *msg = nullptr)
+{ __bfdebug_nhex(color, type, indent, title, reinterpret_cast(nhex), msg); }
+
+#define bfdebug_nhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_nhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_nhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subnhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subnhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subnhex(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_nhex(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Decimal Number */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_ndec_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, uint64_t ndec, gsl::not_null msg)
+{
+ auto str = bfn::to_string(ndec, 10);
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 70 - str.length(), title, indent);
+
+ *msg += str;
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_ndec(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, uint64_t ndec, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_ndec_core(color, type, indent, title, ndec, ln);
+ });
+}
+
+#define bfdebug_ndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_ndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_ndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subndec(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_ndec(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Boolean */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_bool_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, bool val, gsl::not_null msg)
+{
+ auto str = val ? "true" : "false";
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 70 - strlen(str), title, indent);
+
+ *msg += str;
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_bool(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, bool val, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_bool_core(color, type, indent, title, val, ln);
+ });
+}
+
+#define bfdebug_bool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_bool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_bool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subbool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subbool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subbool(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_bool(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Text */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_text_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, cstr_t text, gsl::not_null msg)
+{
+ auto str = text == nullptr ? std::string{} : std::string{text};
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 70 - str.length(), title, indent);
+
+ *msg += str;
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_text(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, cstr_t text, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_text_core(color, type, indent, title, text, ln);
+ });
+}
+
+#define bfdebug_text(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_text(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_text(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subtext(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subtext(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subtext(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_text(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Pass */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_pass_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 66, title, indent);
+
+ *msg += bfcolor_green "pass" bfcolor_end;
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_pass(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_pass_core(color, type, indent, title, ln);
+ });
+}
+
+#define bfdebug_pass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_pass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_pass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subpass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subpass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subpass(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_pass(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Fail */
+/* ---------------------------------------------------------------------------*/
+
+inline void
+__bfdebug_fail_core(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, gsl::not_null msg)
+{
+ __bfdebug_core(msg);
+ __bfdebug_type(msg, color, type);
+ __bfdebug_jtfy(msg, 66, title, indent);
+
+ *msg += bfcolor_red "fail <----" bfcolor_end;
+ *msg += '\n';
+}
+
+inline void
+__bfdebug_fail(
+ cstr_t color, cstr_t type, cstr_t indent, cstr_t title, std::string *msg = nullptr)
+{
+ __bfdebug_add_line(msg, [&](std::string * ln) {
+ __bfdebug_fail_core(color, type, indent, title, ln);
+ });
+}
+
+#define bfdebug_fail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_debug, "DEBUG", nullptr, __VA_ARGS__); \
+ }
+
+#define bfalert_fail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_alert, "ALERT", nullptr, __VA_ARGS__); \
+ }
+
+#define bferror_fail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_error, "ERROR", nullptr, __VA_ARGS__); \
+ }
+
+#define bfdebug_subfail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_debug, "DEBUG", " - ", __VA_ARGS__); \
+ }
+
+#define bfalert_subfail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_alert, "ALERT", " - ", __VA_ARGS__); \
+ }
+
+#define bferror_subfail(level, ...) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ __bfdebug_fail(bfcolor_error, "ERROR", " - ", __VA_ARGS__); \
+ }
+
+/* ---------------------------------------------------------------------------*/
+/* Test */
+/* ---------------------------------------------------------------------------*/
+
+#define bfdebug_test3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfdebug_pass(level,title); \
+ } \
+ else { \
+ bfdebug_fail(level,title); \
+ } \
+ }
+
+#define bfdebug_subtest3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfdebug_subpass(level,title); \
+ } \
+ else { \
+ bfdebug_subfail(level,title); \
+ } \
+ }
+
+#define bfalert_test3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfalert_pass(level,title); \
+ } \
+ else { \
+ bfalert_fail(level,title); \
+ } \
+ }
+
+#define bfalert_subtest3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfalert_subpass(level,title); \
+ } \
+ else { \
+ bfalert_subfail(level,title); \
+ } \
+ }
+
+#define bferror_test3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bferror_pass(level,title); \
+ } \
+ else { \
+ bferror_fail(level,title); \
+ } \
+ }
+
+#define bferror_subtest3(level,title,val) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bferror_subpass(level,title); \
+ } \
+ else { \
+ bferror_subfail(level,title); \
+ } \
+ }
+
+#define bfdebug_test4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfdebug_pass(level,title,msg); \
+ } \
+ else { \
+ bfdebug_fail(level,title,msg); \
+ } \
+ }
+
+#define bfdebug_subtest4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfdebug_subpass(level,title,msg); \
+ } \
+ else { \
+ bfdebug_subfail(level,title,msg); \
+ } \
+ }
+
+#define bfalert_test4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfalert_pass(level,title,msg); \
+ } \
+ else { \
+ bfalert_fail(level,title,msg); \
+ } \
+ }
+
+#define bfalert_subtest4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bfalert_subpass(level,title,msg); \
+ } \
+ else { \
+ bfalert_subfail(level,title,msg); \
+ } \
+ }
+
+#define bferror_test4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bferror_pass(level,title,msg); \
+ } \
+ else { \
+ bferror_fail(level,title,msg); \
+ } \
+ }
+
+#define bferror_subtest4(level,title,val,msg) \
+ if (GSL_UNLIKELY(level <= DEBUG_LEVEL)) { \
+ if ((val)) { \
+ bferror_subpass(level,title,msg); \
+ } \
+ else { \
+ bferror_subfail(level,title,msg); \
+ } \
+ }
+
+#define bfdebug_test(...) GET_MACRO(bfdebug_test, __VA_ARGS__)
+#define bfdebug_subtest(...) GET_MACRO(bfdebug_subtest, __VA_ARGS__)
+#define bfalert_test(...) GET_MACRO(bfalert_test, __VA_ARGS__)
+#define bfalert_subtest(...) GET_MACRO(bfalert_subtest, __VA_ARGS__)
+#define bferror_test(...) GET_MACRO(bferror_test, __VA_ARGS__)
+#define bferror_subtest(...) GET_MACRO(bferror_subtest, __VA_ARGS__)
+
+/* ---------------------------------------------------------------------------*/
+/* Line / Field */
+/* ---------------------------------------------------------------------------*/
+
+#define bfline bfdebug_ndec(0, "line", __LINE__);
+#define __bffield1(a,b) bfdebug_ndec(0, "[" #b "] " #a, a);
+#define __bffield2(a,b) __bffield1(a,b);
+#define bffield(a) __bffield2(a,__LINE__)
+#define __bffield_hex1(a,b) bfdebug_nhex(0, "[" #b "] " #a, a);
+#define __bffield_hex2(a,b) __bffield_hex1(a,b);
+#define bffield_hex(a) __bffield_hex2(a,__LINE__)
+
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* C Debugging */
+/* -------------------------------------------------------------------------- */
+
+#ifndef KERNEL
+#ifdef __cplusplus
+#include
+#else
+#include
+#endif
+#define BFDEBUG(...) printf("[BAREFLANK DEBUG]: " __VA_ARGS__)
+#define BFALERT(...) printf("[BAREFLANK ALERT]: " __VA_ARGS__)
+#define BFERROR(...) printf("[BAREFLANK ERROR]: " __VA_ARGS__)
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* Linux Debugging */
+/* -------------------------------------------------------------------------- */
+
+#ifdef KERNEL
+#ifdef __linux__
+#include
+#define BFDEBUG(...) printk(KERN_INFO "[BAREFLANK DEBUG]: " __VA_ARGS__)
+#define BFALERT(...) printk(KERN_INFO "[BAREFLANK ALERT]: " __VA_ARGS__)
+#define BFERROR(...) printk(KERN_ALERT "[BAREFLANK ERROR]: " __VA_ARGS__)
+#endif
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* Windows Debugging */
+/* -------------------------------------------------------------------------- */
+
+#ifdef KERNEL
+#ifdef _WIN32
+#include
+#define BFDEBUG(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "[BAREFLANK DEBUG]: " __VA_ARGS__)
+#define BFALERT(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, "[BAREFLANK ALERT]: " __VA_ARGS__)
+#define BFERROR(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[BAREFLANK ERROR]: " __VA_ARGS__)
+#endif
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* EFI Debugging */
+/* -------------------------------------------------------------------------- */
+
+#ifdef KERNEL
+#ifdef EFI
+#include "efi.h"
+#include "efilib.h"
+#define BFDEBUG(...) Print(L"[BAREFLANK DEBUG]: " __VA_ARGS__)
+#define BFALERT(...) Print(L"[BAREFLANK ALERT]: " __VA_ARGS__)
+#define BFERROR(...) Print(L"[BAREFLANK ERROR]: " __VA_ARGS__)
+#endif
+#endif
+
+
+/** @endcond */
+
+#endif
diff --git a/payloads/bareflank/include/bfdebugringinterface.h b/payloads/bareflank/include/bfdebugringinterface.h
new file mode 100644
index 00000000000..6aedf3b8f58
--- /dev/null
+++ b/payloads/bareflank/include/bfdebugringinterface.h
@@ -0,0 +1,163 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfdebug.h
+ */
+
+#ifndef BFDEBUGRINGINTERFACE_H
+#define BFDEBUGRINGINTERFACE_H
+
+#include
+#include
+#include
+#include
+
+#pragma pack(push, 1)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * Get Debug Ring Resource Typedef
+ *
+ * @expects none
+ * @ensures none
+ *
+ * This is used by the driver entry to as the function signature for
+ * getting it's internal debug ring
+ */
+typedef struct debug_ring_resources_t *(*get_drr_t)(uint64_t vcpuid);
+
+/**
+ * @struct debug_ring_resources_t
+ *
+ * Debug Ring Resources
+ *
+ * Each driver entry needs to allocate some memory for the debug ring, and
+ * then cast this structure over the allocated memory to access the bits used
+ * by the ring.
+ *
+ * Prior to providing this structure to the debug ring, the memory should be
+ * cleared, and the len of the buffer should be set to the total length of
+ * memory allocated minus the size of debug_ring_resources_t.
+ *
+ * @code
+ *
+ * int len = PAGE_SIZE * 100;
+ * struct debug_ring_resources_t *drr = valloc(len);
+ *
+ * memset(drr, 0, len);
+ * drr->len = len - sizeof(debug_ring_resources_t);
+ *
+ *
+ *
+ * int ret;
+ * char read_buf[len]
+ *
+ * ret = debug_ring_read(drr, read_buf, len);
+ * if(ret < 0)
+ *
+ *
+ * @endcode
+ *
+ * Note there are many different designs for cicular buffers, but all of the
+ * designs have to face the same problem. How to detect when the buffer is
+ * full vs when it is empty. This design uses two counters the grow
+ * forever. The current position in the buffer is then pos % len. If the
+ * counters are 64bit, it would take a life time for the counters to
+ * overflow.
+ *
+ * @var debug_ring_resources_t::epos
+ * the end position in the circular buffer
+ * @var debug_ring_resources_t::spos
+ * the start position in the circular buffer
+ * @var debug_ring_resources_t::tag1
+ * used to identify the debug ring from a memory dump
+ * @var debug_ring_resources_t::buf
+ * the circular buffer that stores the debug strings.
+ * @var debug_ring_resources_t::tag2
+ * used to identify the debug ring from a memory dump
+ */
+struct debug_ring_resources_t {
+ uint64_t epos;
+ uint64_t spos;
+
+ uint64_t tag1;
+ char buf[DEBUG_RING_SIZE];
+ uint64_t tag2;
+};
+
+/**
+ * Debug Ring Read
+ *
+ * Reads strings that have been written to the debug ring. Although you can
+ * provide any buffer size you want, it's advised to provide a buffer that
+ * is the same size as the buffer that was originally allocated.
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param drr the debug_ring_resource that was used to create the
+ * debug ring
+ * @param str the buffer to read the string into. should be the same size
+ * as drr in bytes
+ * @param len the length of the str buffer in bytes
+ * @return the number of bytes read from the debug ring, 0
+ * on error
+ */
+static inline uint64_t
+debug_ring_read(struct debug_ring_resources_t *drr, char *str, uint64_t len)
+{
+ uint64_t i;
+ uint64_t spos;
+ uint64_t count;
+ uint64_t content;
+
+ if (drr == 0 || str == 0 || len == 0) {
+ return 0;
+ }
+
+ if (drr->spos > drr->epos) {
+ return 0;
+ }
+
+ spos = drr->spos % DEBUG_RING_SIZE;
+ content = drr->epos - drr->spos;
+
+ for (i = 0, count = 0; i < content && i < len - 1; i++) {
+ if (drr->buf[spos] != '\0') {
+ str[count++] = drr->buf[spos];
+ }
+
+ spos = ((spos + 1) % DEBUG_RING_SIZE);
+ }
+
+ str[i] = '\0';
+ return count;
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#pragma pack(pop)
+
+#endif
diff --git a/payloads/bareflank/include/bfdelegate.h b/payloads/bareflank/include/bfdelegate.h
new file mode 100644
index 00000000000..7e661f82678
--- /dev/null
+++ b/payloads/bareflank/include/bfdelegate.h
@@ -0,0 +1,282 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULLAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfdelegate.h
+///
+
+#ifndef BFDELEGATE_H
+#define BFDELEGATE_H
+
+#include
+
+// -----------------------------------------------------------------------------
+// Delegate Definition
+// -----------------------------------------------------------------------------
+
+template <
+ typename T,
+ typename = std::enable_if::value>
+ >
+class delegate;
+
+// -----------------------------------------------------------------------------
+// Delegate Partial Specialization
+// -----------------------------------------------------------------------------
+
+/// Delegate
+///
+/// This delegate class provides the ability to register a call back function
+/// that originates from:
+/// - A free function
+/// - A member function
+/// - A lambda function (including capture lists)
+///
+/// It should be noted that this class attempts to provide the most effcient
+/// implementation without the need for malloc / free, or inheritance, at
+/// the expense of a very specific syntax requirement.
+///
+template <
+ typename RET,
+ typename ...PARAMS
+ >
+class delegate
+{
+ using stub_t = RET(*)(void *, PARAMS...); ///< Stub function type
+
+public:
+
+ /// Default Constructor
+ ///
+ /// Creates a nullptr delegate. Note that attempts to execute a nullptr
+ /// delegate will result in a crash as we do not perform a check for
+ /// null
+ ///
+ delegate() noexcept = default;
+
+ /// Default Destructor
+ ///
+ ~delegate() noexcept = default;
+
+ /// Is Valid
+ ///
+ /// @return true if valid, false otherwise
+ ///
+ constexpr bool is_valid() const noexcept
+ { return m_stub != nullptr; }
+
+ /// Is Valid
+ ///
+ /// @return true if valid, false otherwise
+ ///
+ constexpr explicit operator bool() const noexcept
+ { return is_valid(); }
+
+ /// Create (Member Function Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// test_class t;
+ /// auto d = delegate::create(&t);
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @param obj a pointer to the class who's member function will
+ /// be executed.
+ /// @return resulting delegate
+ ///
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...),
+ typename = std::enable_if::value>
+ >
+ constexpr static delegate create(T &obj) noexcept
+ { return delegate(std::addressof(obj), member_stub); }
+
+ /// Create (Member Function Pointer Class Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// test_class t;
+ /// auto d = delegate::create(&t);
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @param obj a pointer to the class who's member function will
+ /// be executed.
+ /// @return resulting delegate
+ ///
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...),
+ typename = std::enable_if::value>
+ >
+ constexpr static delegate create(T *obj) noexcept
+ { return delegate(obj, member_stub); }
+
+ /// Create (Member Function Unique Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// auto t = make_unique();
+ /// auto d = delegate::create(t);
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @param obj a pointer to the class who's member function will
+ /// be executed.
+ /// @return resulting delegate
+ ///
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...),
+ typename = std::enable_if::value>
+ >
+ constexpr static delegate create(const std::unique_ptr &obj) noexcept
+ { return delegate(obj.get(), member_stub); }
+
+ /// Create (Const Member Function Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// test_class t;
+ /// auto d = delegate::create(&t);
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @note this function has to have _const appended to it's name because
+ /// MSVC doesn't understand the template overload and fails to
+ /// compile.
+ ///
+ /// @param obj a pointer to the class who's member function will
+ /// be executed.
+ /// @return resulting delegate
+ ///
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...) const,
+ typename = std::enable_if::value>
+ >
+ constexpr static delegate create_const(const T &obj) noexcept
+ { return delegate(const_cast(std::addressof(obj)), const_member_stub); }
+
+ /// Create (Function Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// auto d = delegate::create<&foo>();
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @return resulting delegate
+ ///
+ template
+ constexpr static delegate create() noexcept
+ { return delegate(nullptr, function_stub); }
+
+ /// Create (Lambda Pointer)
+ ///
+ /// Example usage:
+ /// @code
+ /// test_class t;
+ /// auto d = delegate::create([](int val) -> int { return val; });
+ /// std::cout << "d: " << d(1) << '\n';
+ /// @endcode
+ ///
+ /// @param ptr a pointer to the lambda function that will
+ /// be executed.
+ /// @return resulting delegate
+ ///
+ template
+ constexpr static delegate create(const LAMBDA &ptr) noexcept
+ { return delegate(reinterpret_cast(const_cast(std::addressof(ptr))), lambda_stub); }
+
+ /// Operator ()
+ ///
+ /// @param params the parameters to pass to the delegate function.
+ /// @return the result of executing the delegate function
+ ///
+ constexpr RET operator()(PARAMS... params) const
+ { return (*m_stub)(m_obj, std::forward(params)...); }
+
+private:
+
+ /// @cond
+
+ // Note:
+ //
+ // The only public constructor is the default constructor. To create a
+ // delegate, use the delegate::create function.
+ //
+
+ constexpr explicit delegate(void *obj, stub_t stub) noexcept :
+ m_obj(obj),
+ m_stub(stub)
+ { }
+
+ /// @endcond
+
+private:
+
+ /// @cond
+
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...),
+ typename = std::enable_if::value>
+ >
+ constexpr static RET member_stub(void *obj, PARAMS... params)
+ { return (static_cast(obj)->*FUNC)(std::forward(params)...); }
+
+ template <
+ typename T,
+ RET(T::*FUNC)(PARAMS...) const,
+ typename = std::enable_if::value>
+ >
+ constexpr static RET const_member_stub(void *obj, PARAMS... params)
+ { return (static_cast(obj)->*FUNC)(std::forward(params)...); }
+
+ template
+ constexpr static RET function_stub(void *, PARAMS... params)
+ { return (FUNC)(std::forward(params)...); }
+
+ template
+ constexpr static RET lambda_stub(void *ptr, PARAMS... params)
+ { return (static_cast(ptr)->operator())(std::forward(params)...); }
+
+ /// @endcond
+
+private:
+
+ void *m_obj{nullptr}; ///< Object containing member function
+ stub_t m_stub{nullptr}; ///< Stub that executes the delegate function
+
+public:
+
+ /// @cond
+
+ delegate(const delegate &other) noexcept = default;
+ delegate &operator=(const delegate &other) noexcept = default;
+
+ delegate(delegate &&other) noexcept = default;
+ delegate &operator=(delegate &&other) noexcept = default;
+
+ /// @endcond
+};
+
+#endif
diff --git a/payloads/bareflank/include/bfdriverinterface.h b/payloads/bareflank/include/bfdriverinterface.h
new file mode 100644
index 00000000000..af07deb8ee7
--- /dev/null
+++ b/payloads/bareflank/include/bfdriverinterface.h
@@ -0,0 +1,116 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFDRIVERINTERFACE_H
+#define BFDRIVERINTERFACE_H
+
+#include
+#include
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* Common */
+/* -------------------------------------------------------------------------- */
+
+#define VMM_UNLOADED 10
+#define VMM_LOADED 11
+#define VMM_RUNNING 12
+#define VMM_CORRUPT 100
+
+#ifndef BAREFLANK_NAME
+#define BAREFLANK_NAME "bareflank"
+#endif
+
+#ifndef BAREFLANK_MAJOR
+#define BAREFLANK_MAJOR 150
+#endif
+
+#ifndef BAREFLANK_DEVICETYPE
+#define BAREFLANK_DEVICETYPE 0xF00D
+#endif
+
+#define IOCTL_ADD_MODULE_LENGTH_CMD 0x801
+#define IOCTL_ADD_MODULE_CMD 0x802
+#define IOCTL_LOAD_VMM_CMD 0x803
+#define IOCTL_UNLOAD_VMM_CMD 0x804
+#define IOCTL_START_VMM_CMD 0x805
+#define IOCTL_STOP_VMM_CMD 0x806
+#define IOCTL_DUMP_VMM_CMD 0x807
+#define IOCTL_VMM_STATUS_CMD 0x808
+#define IOCTL_SET_VCPUID_CMD 0x80A
+
+/* -------------------------------------------------------------------------- */
+/* Linux Interfaces */
+/* -------------------------------------------------------------------------- */
+
+#ifdef __linux__
+
+#define IOCTL_ADD_MODULE_LENGTH _IOW(BAREFLANK_MAJOR, IOCTL_ADD_MODULE_LENGTH_CMD, uint64_t *)
+#define IOCTL_ADD_MODULE _IOW(BAREFLANK_MAJOR, IOCTL_ADD_MODULE_CMD, char *)
+#define IOCTL_LOAD_VMM _IO(BAREFLANK_MAJOR, IOCTL_LOAD_VMM_CMD)
+#define IOCTL_UNLOAD_VMM _IO(BAREFLANK_MAJOR, IOCTL_UNLOAD_VMM_CMD)
+#define IOCTL_START_VMM _IO(BAREFLANK_MAJOR, IOCTL_START_VMM_CMD)
+#define IOCTL_STOP_VMM _IO(BAREFLANK_MAJOR, IOCTL_STOP_VMM_CMD)
+#define IOCTL_DUMP_VMM _IOR(BAREFLANK_MAJOR, IOCTL_DUMP_VMM_CMD, struct debug_ring_resources_t *)
+#define IOCTL_VMM_STATUS _IOR(BAREFLANK_MAJOR, IOCTL_VMM_STATUS_CMD, int64_t *)
+#define IOCTL_SET_VCPUID _IOW(BAREFLANK_MAJOR, IOCTL_SET_VCPUID_CMD, uint64_t *)
+
+#endif
+
+/* -------------------------------------------------------------------------- */
+/* Windows Interfaces */
+/* -------------------------------------------------------------------------- */
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+
+#include
+
+DEFINE_GUID(
+ GUID_DEVINTERFACE_bareflank,
+ 0x1d9c9218,
+ 0x3c88,
+ 0x4b81,
+ 0x8e,
+ 0x81,
+ 0xb4,
+ 0x62,
+ 0x2a,
+ 0x4d,
+ 0xcb,
+ 0x44);
+
+#define IOCTL_ADD_MODULE CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_ADD_MODULE_CMD, METHOD_IN_DIRECT, FILE_WRITE_DATA)
+#define IOCTL_LOAD_VMM CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_LOAD_VMM_CMD, METHOD_BUFFERED, 0)
+#define IOCTL_UNLOAD_VMM CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_UNLOAD_VMM_CMD, METHOD_BUFFERED, 0)
+#define IOCTL_START_VMM CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_START_VMM_CMD, METHOD_BUFFERED, 0)
+#define IOCTL_STOP_VMM CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_STOP_VMM_CMD, METHOD_BUFFERED, 0)
+#define IOCTL_DUMP_VMM CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_DUMP_VMM_CMD, METHOD_OUT_DIRECT, FILE_READ_DATA)
+#define IOCTL_VMM_STATUS CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_VMM_STATUS_CMD, METHOD_BUFFERED, FILE_READ_DATA)
+#define IOCTL_SET_VCPUID CTL_CODE(BAREFLANK_DEVICETYPE, IOCTL_SET_VCPUID_CMD, METHOD_IN_DIRECT, FILE_WRITE_DATA)
+
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/payloads/bareflank/include/bfdwarf.h b/payloads/bareflank/include/bfdwarf.h
new file mode 100644
index 00000000000..b13bc99b7bd
--- /dev/null
+++ b/payloads/bareflank/include/bfdwarf.h
@@ -0,0 +1,96 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfdwarf.h
+ */
+
+#ifndef BFDWARF_H
+#define BFDWARF_H
+
+#include
+#include
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @struct dwarf_sections_t
+ *
+ * Struct to hold pointers to all the used DWARF sections
+ *
+ * @var dwarf_sections_t::debug_info_addr
+ * the virtual address of ".debug_info" after relocation
+ * @var dwarf_sections_t::debug_info_size
+ * the size of ".debug_info"
+ * @var dwarf_sections_t::debug_abbrev_addr
+ * the virtual address of ".debug_abbrev" after relocation
+ * @var dwarf_sections_t::debug_abbrev_size
+ * the size of ".debug_abbrev"
+ * @var dwarf_sections_t::debug_line_addr
+ * the virtual address of ".debug_line" after relocation
+ * @var dwarf_sections_t::debug_line_size
+ * the size of ".debug_line"
+ * @var dwarf_sections_t::debug_str_addr
+ * the virtual address of ".debug_str" after relocation
+ * @var dwarf_sections_t::debug_str_size
+ * the size of ".debug_str"
+ * @var dwarf_sections_t::debug_ranges_addr
+ * the virtual address of ".debug_ranges" after relocation
+ * @var dwarf_sections_t::debug_ranges_size
+ * the size of ".debug_ranges"
+ */
+struct dwarf_sections_t {
+ void *debug_info_addr;
+ uint64_t debug_info_size;
+
+ void *debug_abbrev_addr;
+ uint64_t debug_abbrev_size;
+
+ void *debug_line_addr;
+ uint64_t debug_line_size;
+
+ void *debug_str_addr;
+ uint64_t debug_str_size;
+
+ void *debug_ranges_addr;
+ uint64_t debug_ranges_size;
+};
+
+/**
+ * Get DWARF sections
+ *
+ * @expects none
+ * @ensures ret != nullptr
+ *
+ * Returns a list containing pointers to the found DWARF sections. These
+ * sections are used to map instruction pointers to function names in the
+ * unwinder.
+ *
+ * @return dwarf_sections_t pointer
+ */
+struct dwarf_sections_t *
+get_dwarf_sections() noexcept;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/payloads/bareflank/include/bfehframelist.h b/payloads/bareflank/include/bfehframelist.h
new file mode 100644
index 00000000000..5d9be204303
--- /dev/null
+++ b/payloads/bareflank/include/bfehframelist.h
@@ -0,0 +1,68 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfehframelist.h
+ */
+
+#ifndef BFEHFRAMELIST_H
+#define BFEHFRAMELIST_H
+
+#include
+#include
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @struct eh_frame_t
+ *
+ * Defines a ".eh_frame" section.
+ *
+ * @var eh_frame_t::addr
+ * the starting address of the the .eh_frame section
+ * @var eh_frame_t::size
+ * the size of the .eh_frame section
+ */
+struct eh_frame_t {
+ void *addr;
+ uint64_t size;
+};
+
+/**
+ * Get EH Framework List
+ *
+ * @expects none
+ * @ensures ret != nullptr
+ *
+ * Returns a list of ".eh_frame" sections, containing their start address,
+ * and size. This is used by the unwind library to find stack frames. The
+ * list should have one .eh_frame section for each module that is loaded.
+ *
+ * @return eh_frame list (of size MAX_NUM_MODULES)
+ */
+struct eh_frame_t *
+get_eh_frame_list() noexcept;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/payloads/bareflank/include/bfelf_loader.h b/payloads/bareflank/include/bfelf_loader.h
new file mode 100644
index 00000000000..7e0113fe540
--- /dev/null
+++ b/payloads/bareflank/include/bfelf_loader.h
@@ -0,0 +1,2531 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfelf_loader.h
+ */
+
+#ifndef BFELF_LOADER_H
+#define BFELF_LOADER_H
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#pragma pack(push, 1)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Defines */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+#ifndef BFELF_MAX_NEEDED
+#define BFELF_MAX_NEEDED (25)
+#endif
+
+#ifndef BFELF_MAX_SEGMENTS
+#define BFELF_MAX_SEGMENTS (4)
+#endif
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Data Types */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * Data Representation
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 2
+ */
+
+/* @cond */
+
+#ifndef __cplusplus
+typedef uint64_t bfelf64_addr;
+typedef uint64_t bfelf64_off;
+typedef uint16_t bfelf64_half;
+typedef uint32_t bfelf64_word;
+typedef int32_t bfelf64_sword;
+typedef uint64_t bfelf64_xword;
+typedef int64_t bfelf64_sxword;
+#else
+using bfelf64_addr = uint64_t;
+using bfelf64_off = uint64_t;
+using bfelf64_half = uint16_t;
+using bfelf64_word = uint32_t;
+using bfelf64_sword = int32_t;
+using bfelf64_xword = uint64_t;
+using bfelf64_sxword = int64_t;
+#endif
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Error Codes */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline int64_t
+private_error(const char *header, const char *msg, const char *func, int line, int64_t code)
+{
+ BFALERT("%s [%d] %s: %s\n", func, line, header, msg);
+ return code;
+}
+
+#define bfinvalid_argument(a) \
+ private_error("invalid argument", a, __func__, __LINE__, BFELF_ERROR_INVALID_ARG);
+
+#define bfinvalid_file(a) \
+ private_error("invalid file", a, __func__, __LINE__, BFELF_ERROR_INVALID_FILE);
+
+#define bfinvalid_index(a) \
+ private_error("invalid index", a, __func__, __LINE__, BFELF_ERROR_INVALID_INDEX);
+
+#define bfinvalid_signature(a) \
+ private_error("invalid signature", a, __func__, __LINE__, BFELF_ERROR_INVALID_SIGNATURE);
+
+#define bfunsupported_file(a) \
+ private_error("unsupported elf file", a, __func__, __LINE__, BFELF_ERROR_UNSUPPORTED_FILE);
+
+#define bfloader_full(a) \
+ private_error("loader full", a, __func__, __LINE__, BFELF_ERROR_LOADER_FULL);
+
+#define bfno_such_symbol(a) \
+ private_error("no such symbol", a, __func__, __LINE__, BFELF_ERROR_NO_SUCH_SYMBOL);
+
+#define bfunsupported_rel(a) \
+ private_error("unsupported relocation", a, __func__, __LINE__, BFELF_ERROR_UNSUPPORTED_RELA);
+
+#define bfout_of_memory(a) \
+ private_error("out of memory", a, __func__, __LINE__, BFELF_ERROR_OUT_OF_MEMORY);
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Helpers */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline int64_t
+private_strcmp(const char *s1, const char *s2)
+{
+ while ((*s1 != 0) && (*s1 == *s2)) {
+ s1++, s2++;
+ }
+
+ return *s1 == *s2 ? BFELF_SUCCESS : BFELF_ERROR_MISMATCH;
+}
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF File Definition */
+/* ---------------------------------------------------------------------------------------------- */
+
+struct bfelf_dyn;
+struct bfelf_sym;
+struct bfelf_rela;
+struct bfelf_shdr;
+struct bfelf_phdr;
+struct bfelf_ehdr;
+
+/**
+ * @struct bfelf_load_instr
+ *
+ * ELF Load Segment
+ *
+ * The load instructions that each segment provides is missing some helpful
+ * info. This structure provides the info that is needed, in a cleaned up
+ * format.
+ *
+ * Note that there are two different char * buffers that you need to know about
+ * when loading a segment. There is the char * for the ELF file, and the char *
+ * for the memory that the ELF file is being loaded into. The ELF file does
+ * not equal memory. The best example is the BSS section, which is empty in the
+ * ELF file. Also, the RE vs RW sections are usually aligned. To use this
+ * information use the following steps:
+ * - get the total size of memory
+ * - allocate RW memory for the total size
+ * - get the number of load instructions
+ * - loop through each load instruction and copy the file char * to the mem
+ * char * using the file/mem offset/size.
+ * - map memory using the virt_addr and mem_size
+ *
+ * @var bfelf_load_instr::perm
+ * defines the permissions (read/write/execute) for this segment
+ * @var bfelf_load_instr::mem_offset
+ * defines the segment offset in memory
+ * @var bfelf_load_instr::file_offset
+ * defines the segment offset in the ELF file
+ * @var bfelf_load_instr::memsz
+ * defines the segment size in memory
+ * @var bfelf_load_instr::filesz
+ * defines the segment size in the ELF file
+ * @var bfelf_load_instr::virt_addr
+ * defines the assumed virtual address of the segment if PIC == false
+ */
+struct bfelf_load_instr {
+ bfelf64_word perm;
+ bfelf64_off mem_offset;
+ bfelf64_off file_offset;
+ bfelf64_xword memsz;
+ bfelf64_xword filesz;
+ bfelf64_addr virt_addr;
+};
+
+/*
+ * ELF File
+ *
+ * The following is used by this API to store information about the ELF file
+ * being used.
+ *
+ * @cond
+ */
+struct bfelf_file_t {
+ uint64_t filesz;
+ const char *file;
+
+ char *exec_addr;
+ char *exec_virt;
+
+ bfelf64_off entry;
+
+ bfelf64_xword num_load_instr;
+ struct bfelf_load_instr load_instr[BFELF_MAX_SEGMENTS];
+
+ bfelf64_xword num_loadable_segments;
+ const struct bfelf_phdr *loadable_segments[BFELF_MAX_SEGMENTS];
+
+ bfelf64_addr start_addr;
+ bfelf64_xword total_memsz;
+
+ bfelf64_xword num_needed;
+ bfelf64_xword needed[BFELF_MAX_NEEDED];
+
+ const struct bfelf_ehdr *ehdr;
+ const struct bfelf_phdr *phdrtab;
+ const struct bfelf_shdr *shdrtab;
+
+ bfelf64_addr dynoff;
+
+ const char *strtab;
+ const char *strtab_offset;
+ const char *shstrtab;
+
+ bfelf64_word nbucket;
+ bfelf64_word nchain;
+ const bfelf64_word *bucket;
+ const bfelf64_word *chain;
+ const bfelf64_word *hash;
+
+ bfelf64_xword dynnum;
+ const struct bfelf_dyn *dyntab;
+
+ bfelf64_xword symnum;
+ const struct bfelf_sym *symtab;
+
+ bfelf64_xword relanum_dyn;
+ const struct bfelf_rela *relatab_dyn;
+
+ bfelf64_xword relanum_plt;
+ const struct bfelf_rela *relatab_plt;
+
+ bfelf64_addr init;
+ bfelf64_addr fini;
+
+ bfelf64_addr init_array;
+ bfelf64_xword init_arraysz;
+
+ bfelf64_addr fini_array;
+ bfelf64_xword fini_arraysz;
+
+ bfelf64_addr eh_frame;
+ bfelf64_xword eh_framesz;
+
+ bfelf64_xword flags_1;
+ bfelf64_xword stack_flags;
+
+ bfelf64_addr relaro_vaddr;
+ bfelf64_xword relaro_memsz;
+
+ bfelf64_word added;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF File Header */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * e_ident indexes
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 3
+ *
+ * @cond
+ */
+#define bfei_mag0 bfscast(bfelf64_sword, 0)
+#define bfei_mag1 bfscast(bfelf64_sword, 1)
+#define bfei_mag2 bfscast(bfelf64_sword, 2)
+#define bfei_mag3 bfscast(bfelf64_sword, 3)
+#define bfei_class bfscast(bfelf64_sword, 4)
+#define bfei_data bfscast(bfelf64_sword, 5)
+#define bfei_version bfscast(bfelf64_sword, 6)
+#define bfei_osabi bfscast(bfelf64_sword, 7)
+#define bfei_abiversion bfscast(bfelf64_sword, 8)
+#define bfei_pad bfscast(bfelf64_sword, 9)
+#define bfei_nident bfscast(bfelf64_sword, 16)
+
+/* @endcond */
+
+/*
+ * ELF Class Types
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 5
+ *
+ * @cond
+ */
+#define bfelfclass32 bfscast(unsigned char, 1)
+#define bfelfclass64 bfscast(unsigned char, 2)
+
+/* @endcond */
+
+/*
+ * ELF Data Types
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 5
+ *
+ * @cond
+ */
+#define bfelfdata2lsb bfscast(unsigned char, 1)
+#define bfelfdata2msb bfscast(unsigned char, 2)
+
+/* @endcond */
+
+/*
+ * ELF Version
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 4
+ *
+ * @cond
+ */
+#define bfev_current bfscast(unsigned char, 1)
+
+/* @endcond */
+
+/*
+ * ELF OS / ABI Types
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 5
+ *
+ * @cond
+ */
+#define bfelfosabi_sysv bfscast(unsigned char, 0)
+#define bfelfosabi_hpux bfscast(unsigned char, 1)
+#define bfelfosabi_standalone bfscast(unsigned char, 255)
+
+/* @endcond */
+
+/*
+ * ELF Types
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 5
+ *
+ * @cond
+ */
+#define bfet_none bfscast(bfelf64_half, 0)
+#define bfet_rel bfscast(bfelf64_half, 1)
+#define bfet_exec bfscast(bfelf64_half, 2)
+#define bfet_dyn bfscast(bfelf64_half, 3)
+#define bfet_core bfscast(bfelf64_half, 4)
+#define bfet_loos bfscast(bfelf64_half, 0xFE00)
+#define bfet_hios bfscast(bfelf64_half, 0xFEFF)
+#define bfet_loproc bfscast(bfelf64_half, 0xFF00)
+#define bfet_hiproc bfscast(bfelf64_half, 0xFFFF)
+
+/* @endcond */
+
+/*
+ * ELF Machine Codes
+ *
+ * The following is defined in the Linux kernel sources:
+ * linux/include/uapi/linux/elf-em.h
+ *
+ * @cond
+ */
+#define bfem_none bfscast(bfelf64_half, 0)
+#define bfem_m32 bfscast(bfelf64_half, 1)
+#define bfem_sparc bfscast(bfelf64_half, 2)
+#define bfem_386 bfscast(bfelf64_half, 3)
+#define bfem_68k bfscast(bfelf64_half, 4)
+#define bfem_88k bfscast(bfelf64_half, 5)
+#define bfem_486 bfscast(bfelf64_half, 6)
+#define bfem_860 bfscast(bfelf64_half, 7)
+#define bfem_mips bfscast(bfelf64_half, 8)
+#define bfem_mips_rs3_le bfscast(bfelf64_half, 10)
+#define bfem_mips_rs4_be bfscast(bfelf64_half, 11)
+#define bfem_parisc bfscast(bfelf64_half, 15)
+#define bfem_sparc32plus bfscast(bfelf64_half, 18)
+#define bfem_ppc bfscast(bfelf64_half, 20)
+#define bfem_ppc64 bfscast(bfelf64_half, 21)
+#define bfem_spu bfscast(bfelf64_half, 23)
+#define bfem_arm bfscast(bfelf64_half, 40)
+#define bfem_sh bfscast(bfelf64_half, 42)
+#define bfem_sparcv9 bfscast(bfelf64_half, 43)
+#define bfem_h8_300 bfscast(bfelf64_half, 46)
+#define bfem_ia_64 bfscast(bfelf64_half, 50)
+#define bfem_x86_64 bfscast(bfelf64_half, 62)
+#define bfem_s390 bfscast(bfelf64_half, 22)
+#define bfem_cris bfscast(bfelf64_half, 76)
+#define bfem_v850 bfscast(bfelf64_half, 87)
+#define bfem_m32r bfscast(bfelf64_half, 88)
+#define bfem_mn10300 bfscast(bfelf64_half, 89)
+#define bfem_openrisc bfscast(bfelf64_half, 92)
+#define bfem_blackfin bfscast(bfelf64_half, 106)
+#define bfem_altera_nios2 bfscast(bfelf64_half, 113)
+#define bfem_ti_c6000 bfscast(bfelf64_half, 140)
+#define bfem_aarch64 bfscast(bfelf64_half, 183)
+#define bfem_frv bfscast(bfelf64_half, 0x5441)
+#define bfem_avr32 bfscast(bfelf64_half, 0x18AD)
+#define bfem_alpha bfscast(bfelf64_half, 0x9026)
+#define bfem_cygnus_v850 bfscast(bfelf64_half, 0x9080)
+#define bfem_cygnus_m32r bfscast(bfelf64_half, 0x9041)
+#define bfem_s390_old bfscast(bfelf64_half, 0xA390)
+#define bfem_cygnus_mn10300 bfscast(bfelf64_half, 0xBEEF)
+
+/* @endcond */
+
+/*
+ * ELF File Header
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 3
+ *
+ * The file header is located at the beginning of the file, and is used to
+ * locate the other parts of the file.
+ *
+ * @cond
+ */
+struct bfelf_ehdr {
+ unsigned char e_ident[bfei_nident];
+ bfelf64_half e_type;
+ bfelf64_half e_machine;
+ bfelf64_word e_version;
+ bfelf64_addr e_entry;
+ bfelf64_off e_phoff;
+ bfelf64_off e_shoff;
+ bfelf64_word e_flags;
+ bfelf64_half e_ehsize;
+ bfelf64_half e_phentsize;
+ bfelf64_half e_phnum;
+ bfelf64_half e_shentsize;
+ bfelf64_half e_shnum;
+ bfelf64_half e_shstrndx;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Section Header Table */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Section Type
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 7
+ *
+ * @cond
+ */
+#define bfsht_null bfscast(bfelf64_word, 0)
+#define bfsht_progbits bfscast(bfelf64_word, 1)
+#define bfsht_symtab bfscast(bfelf64_word, 2)
+#define bfsht_strtab bfscast(bfelf64_word, 3)
+#define bfsht_rela bfscast(bfelf64_word, 4)
+#define bfsht_hash bfscast(bfelf64_word, 5)
+#define bfsht_dynamic bfscast(bfelf64_word, 6)
+#define bfsht_note bfscast(bfelf64_word, 7)
+#define bfsht_nobits bfscast(bfelf64_word, 8)
+#define bfsht_rel bfscast(bfelf64_word, 9)
+#define bfsht_shlib bfscast(bfelf64_word, 10)
+#define bfsht_dynsym bfscast(bfelf64_word, 11)
+#define bfsht_init_array bfscast(bfelf64_word, 14)
+#define bfsht_fini_array bfscast(bfelf64_word, 15)
+#define bfsht_loos bfscast(bfelf64_word, 0x60000000)
+#define bfsht_hios bfscast(bfelf64_word, 0x6FFFFFFF)
+#define bfsht_loproc bfscast(bfelf64_word, 0x70000000)
+#define bfsht_x86_64_unwind bfscast(bfelf64_word, 0x70000001)
+#define bfsht_hiproc bfscast(bfelf64_word, 0x7FFFFFFF)
+
+/* @endcond */
+
+/*
+ * ELF Section Attributes
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 8
+ *
+ * @cond
+ */
+#define bfshf_write bfscast(bfelf64_xword, 0x1)
+#define bfshf_alloc bfscast(bfelf64_xword, 0x2)
+#define bfshf_execinstr bfscast(bfelf64_xword, 0x4)
+#define bfshf_maskos bfscast(bfelf64_xword, 0x0F000000)
+#define bfshf_maskproc bfscast(bfelf64_xword, 0xF0000000)
+#define bfshf_undocumneted bfscast(bfelf64_xword, 0x00000060)
+
+#define bfshf_a (bfshf_alloc)
+#define bfshf_wa (bfshf_write | bfshf_alloc)
+#define bfshf_ai (bfshf_alloc | bfshf_write | bfshf_undocumneted)
+
+/* @endcond */
+
+/*
+ * ELF Section Header Entry
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 6
+ *
+ * Sections contain all the information in an ELF file, except for the ELF
+ * header, program header table, and section header table. Sections are
+ * identified by an index into the section header table.
+ *
+ * @cond
+ */
+struct bfelf_shdr {
+ bfelf64_word sh_name;
+ bfelf64_word sh_type;
+ bfelf64_xword sh_flags;
+ bfelf64_addr sh_addr;
+ bfelf64_off sh_offset;
+ bfelf64_xword sh_size;
+ bfelf64_word sh_link;
+ bfelf64_word sh_info;
+ bfelf64_xword sh_addralign;
+ bfelf64_xword sh_entsize;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Dynamic Section */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Dynamic Table Entry Tags
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 14
+ *
+ * @cond
+ */
+#define bfdt_null bfscast(bfelf64_xword, 0)
+#define bfdt_needed bfscast(bfelf64_xword, 1)
+#define bfdt_pltrelsz bfscast(bfelf64_xword, 2)
+#define bfdt_pltgot bfscast(bfelf64_xword, 3)
+#define bfdt_hash bfscast(bfelf64_xword, 4)
+#define bfdt_strtab bfscast(bfelf64_xword, 5)
+#define bfdt_symtab bfscast(bfelf64_xword, 6)
+#define bfdt_rela bfscast(bfelf64_xword, 7)
+#define bfdt_relasz bfscast(bfelf64_xword, 8)
+#define bfdt_relaent bfscast(bfelf64_xword, 9)
+#define bfdt_strsz bfscast(bfelf64_xword, 10)
+#define bfdt_syment bfscast(bfelf64_xword, 11)
+#define bfdt_init bfscast(bfelf64_xword, 12)
+#define bfdt_fini bfscast(bfelf64_xword, 13)
+#define bfdt_soname bfscast(bfelf64_xword, 14)
+#define bfdt_rpath bfscast(bfelf64_xword, 15)
+#define bfdt_symbolic bfscast(bfelf64_xword, 16)
+#define bfdt_rel bfscast(bfelf64_xword, 17)
+#define bfdt_relsz bfscast(bfelf64_xword, 18)
+#define bfdt_relent bfscast(bfelf64_xword, 19)
+#define bfdt_pltrel bfscast(bfelf64_xword, 20)
+#define bfdt_debug bfscast(bfelf64_xword, 21)
+#define bfdt_textrel bfscast(bfelf64_xword, 22)
+#define bfdt_jmprel bfscast(bfelf64_xword, 23)
+#define bfdt_bind_now bfscast(bfelf64_xword, 24)
+#define bfdt_init_array bfscast(bfelf64_xword, 25)
+#define bfdt_fini_array bfscast(bfelf64_xword, 26)
+#define bfdt_init_arraysz bfscast(bfelf64_xword, 27)
+#define bfdt_fini_arraysz bfscast(bfelf64_xword, 28)
+#define bfdt_loos bfscast(bfelf64_xword, 0x60000000)
+#define bfdt_relacount bfscast(bfelf64_xword, 0x6ffffff9)
+#define bfdt_relcount bfscast(bfelf64_xword, 0x6ffffffa)
+#define bfdt_flags_1 bfscast(bfelf64_xword, 0x6ffffffb)
+#define bfdt_hios bfscast(bfelf64_xword, 0x6FFFFFFF)
+#define bfdt_loproc bfscast(bfelf64_xword, 0x70000000)
+#define bfdt_hiproc bfscast(bfelf64_xword, 0x7FFFFFFF)
+
+#define bfdf_1_now bfscast(bfelf64_xword, 0x00000001)
+#define bfdf_1_global bfscast(bfelf64_xword, 0x00000002)
+#define bfdf_1_group bfscast(bfelf64_xword, 0x00000004)
+#define bfdf_1_nodelete bfscast(bfelf64_xword, 0x00000008)
+#define bfdf_1_loadfltr bfscast(bfelf64_xword, 0x00000010)
+#define bfdf_1_initfirst bfscast(bfelf64_xword, 0x00000020)
+#define bfdf_1_noopen bfscast(bfelf64_xword, 0x00000040)
+#define bfdf_1_origin bfscast(bfelf64_xword, 0x00000080)
+#define bfdf_1_direct bfscast(bfelf64_xword, 0x00000100)
+#define bfdf_1_trans bfscast(bfelf64_xword, 0x00000200)
+#define bfdf_1_interpose bfscast(bfelf64_xword, 0x00000400)
+#define bfdf_1_nodeflib bfscast(bfelf64_xword, 0x00000800)
+#define bfdf_1_nodump bfscast(bfelf64_xword, 0x00001000)
+#define bfdf_1_confalt bfscast(bfelf64_xword, 0x00002000)
+#define bfdf_1_endfiltee bfscast(bfelf64_xword, 0x00004000)
+#define bfdf_1_dispreldne bfscast(bfelf64_xword, 0x00008000)
+#define bfdf_1_disprelpnd bfscast(bfelf64_xword, 0x00010000)
+#define bfdf_1_nodirect bfscast(bfelf64_xword, 0x00020000)
+#define bfdf_1_ignmuldef bfscast(bfelf64_xword, 0x00040000)
+#define bfdf_1_noksyms bfscast(bfelf64_xword, 0x00080000)
+#define bfdf_1_nohdr bfscast(bfelf64_xword, 0x00100000)
+#define bfdf_1_edited bfscast(bfelf64_xword, 0x00200000)
+#define bfdf_1_noreloc bfscast(bfelf64_xword, 0x00400000)
+#define bfdf_1_symintpose bfscast(bfelf64_xword, 0x00800000)
+#define bfdf_1_globaudit bfscast(bfelf64_xword, 0x01000000)
+#define bfdf_1_singleton bfscast(bfelf64_xword, 0x02000000)
+#define bfdf_1_pie bfscast(bfelf64_xword, 0x08000000)
+
+/* @endcond */
+
+/*
+ * ELF Dynamic Table
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 14
+ *
+ * NOTE: The spec actually uses a union, but the use of a union goes against
+ * the C++ Core Guidelines, and Windows seems to get really mad. There really
+ * is not need for a union since the type size if the same. For this reason,
+ * we simply use d_val and cast when needed.
+ *
+ * @cond
+ */
+struct bfelf_dyn {
+ bfelf64_sxword d_tag;
+ bfelf64_xword d_val;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Symbol Table */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Symbol Bindings
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 10
+ *
+ * @cond
+ */
+#define bfstb_local bfscast(unsigned char, 0)
+#define bfstb_global bfscast(unsigned char, 1)
+#define bfstb_weak bfscast(unsigned char, 2)
+#define bfstb_loos bfscast(unsigned char, 10)
+#define bfstb_hios bfscast(unsigned char, 12)
+#define bfstb_loproc bfscast(unsigned char, 13)
+#define bfstb_hiproc bfscast(unsigned char, 15)
+
+/* @endcond */
+
+/*
+ * ELF Symbol Types
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 10
+ *
+ * @cond
+ */
+#define bfstt_notype bfscast(unsigned char, 0)
+#define bfstt_object bfscast(unsigned char, 1)
+#define bfstt_func bfscast(unsigned char, 2)
+#define bfstt_section bfscast(unsigned char, 3)
+#define bfstt_file bfscast(unsigned char, 4)
+#define bfstt_loos bfscast(unsigned char, 10)
+#define bfstt_hios bfscast(unsigned char, 12)
+#define bfstt_loproc bfscast(unsigned char, 13)
+#define bfstt_hiproc bfscast(unsigned char, 15)
+
+/* @endcond */
+
+/*
+ * ELF Symbol Info Algorithms
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 11
+ *
+ * @cond
+ */
+#define BFELF_SYM_BIND(x) ((x) >> 4)
+#define BFELF_SYM_TYPE(x) ((x)&0xF)
+
+/* @endcond */
+
+/*
+ * ELF Undefined Symbol Index
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 9
+ *
+ * @cond
+ */
+#define STN_UNDEF 0
+
+/* @endcond */
+
+/*
+ * ELF Symbol
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 9
+ *
+ * @cond
+ */
+struct bfelf_sym {
+ bfelf64_word st_name;
+ unsigned char st_info;
+ unsigned char st_other;
+ bfelf64_half st_shndx;
+ bfelf64_addr st_value;
+ bfelf64_xword st_size;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Relocations */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Relocation
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 11
+ *
+ * @cond
+ */
+struct bfelf_rel {
+ bfelf64_addr r_offset;
+ bfelf64_xword r_info;
+};
+
+/* @endcond */
+
+/*
+ * ELF Relocation Addend
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 11
+ *
+ * @cond
+ */
+struct bfelf_rela {
+ bfelf64_addr r_offset;
+ bfelf64_xword r_info;
+ bfelf64_sxword r_addend;
+};
+
+/* @endcond */
+
+/*
+ * ELF Relocation Info Algorithms
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 11
+ *
+ * @cond
+ */
+#define BFELF_REL_SYM(i) ((i) >> 32)
+#define BFELF_REL_TYPE(i) ((i)&0xFFFFFFFFL)
+
+/* @endcond */
+
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Program Header */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Section Attributes
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 12
+ *
+ * @cond
+ */
+#define bfpt_null bfscast(bfelf64_word, 0)
+#define bfpt_load bfscast(bfelf64_word, 1)
+#define bfpt_dynamic bfscast(bfelf64_word, 2)
+#define bfpt_interp bfscast(bfelf64_word, 3)
+#define bfpt_note bfscast(bfelf64_word, 4)
+#define bfpt_shlib bfscast(bfelf64_word, 5)
+#define bfpt_phdr bfscast(bfelf64_word, 6)
+#define bfpt_loos bfscast(bfelf64_word, 0x60000000)
+#define bfpt_gnu_eh_frame bfscast(bfelf64_word, 0x6474e550)
+#define bfpt_gnu_stack bfscast(bfelf64_word, 0x6474e551)
+#define bfpt_gnu_relro bfscast(bfelf64_word, 0x6474e552)
+#define bfpt_hios bfscast(bfelf64_word, 0x6FFFFFFF)
+#define bfpt_loproc bfscast(bfelf64_word, 0x70000000)
+#define bfpt_hiproc bfscast(bfelf64_word, 0x7FFFFFFF)
+
+/* @endcond */
+
+/*
+ * ELF Section Attributes
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 13
+ *
+ * @cond
+ */
+#define bfpf_x bfscast(bfelf64_xword, 0x1)
+#define bfpf_w bfscast(bfelf64_xword, 0x2)
+#define bfpf_r bfscast(bfelf64_xword, 0x4)
+#define bfpf_maskos bfscast(bfelf64_xword, 0x00FF0000)
+#define bfpf_maskproc bfscast(bfelf64_xword, 0xFF000000)
+
+/* @endcond */
+
+/*
+ * ELF Program Header Entry
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.uclibc.org/docs/elf-64-gen.pdf, page 12
+ *
+ * In executable and shared object files, sections are grouped into segments for
+ * loading. The program header table contains a list of entries describing
+ * each segment. This information is needed when using the ELF loader to
+ * load each segment into memory allocated by the user. For more information
+ * on how to do this, please see the unit tests.
+ *
+ * @cond
+ */
+struct bfelf_phdr {
+ bfelf64_word p_type;
+ bfelf64_word p_flags;
+ bfelf64_off p_offset;
+ bfelf64_addr p_vaddr;
+ bfelf64_addr p_paddr;
+ bfelf64_xword p_filesz;
+ bfelf64_xword p_memsz;
+ bfelf64_xword p_align;
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Loader Definition */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * ELF Loader
+ *
+ * The following structure is used to create an ELF loader, which groups up
+ * all of the ELF files used by a single program, mainly needed for global
+ * symbol searching.
+ *
+ * @cond
+ */
+struct bfelf_loader_t {
+ bfelf64_word num;
+ bfelf64_word relocated;
+ struct bfelf_file_t *efs[MAX_NUM_MODULES];
+};
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Symbol Table Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline unsigned long
+private_hash(const char *name)
+{
+ unsigned long h = 0;
+
+ while (*name != 0) {
+ char c = *name++;
+ unsigned long g;
+ unsigned char uc = bfscast(unsigned char, c);
+
+ if (c >= 0) {
+ h = (h << 4) + uc;
+ }
+ else {
+ h = (h << 4) - uc;
+ }
+
+ if ((g = (h & 0xf0000000)) != 0) {
+ h ^= g >> 24;
+ }
+
+ h &= 0x0fffffff;
+ }
+
+ return h;
+}
+
+static inline int64_t
+private_get_sym_by_hash(
+ struct bfelf_file_t *ef, const char *name, const struct bfelf_sym **sym)
+{
+ bfelf64_word i = 0;
+ unsigned long x = private_hash(name);
+
+ i = ef->bucket[x % ef->nbucket];
+ while (i > STN_UNDEF && i < ef->nchain) {
+ int64_t ret = 0;
+ const char *str = nullptr;
+
+ *sym = &(ef->symtab[i]);
+ str = &(ef->strtab[(*sym)->st_name]);
+
+ ret = private_strcmp(name, str);
+ if (ret == BFELF_ERROR_MISMATCH) {
+ i = ef->chain[i];
+ continue;
+ }
+
+ return BFELF_SUCCESS;
+ }
+
+ return BFELF_ERROR_NO_SUCH_SYMBOL;
+}
+
+static inline int64_t
+private_get_sym_by_name(
+ struct bfelf_file_t *ef, const char *name, const struct bfelf_sym **sym)
+{
+ bfelf64_word i = 0;
+
+ if (ef->hash != nullptr) {
+ return private_get_sym_by_hash(ef, name, sym);
+ }
+
+ for (i = 0; i < ef->symnum; i++) {
+ int64_t ret = 0;
+ const char *str = nullptr;
+
+ *sym = &(ef->symtab[i]);
+ str = &(ef->strtab[(*sym)->st_name]);
+
+ ret = private_strcmp(name, str);
+ if (ret == BFELF_ERROR_MISMATCH) {
+ continue;
+ }
+
+ return BFELF_SUCCESS;
+ }
+
+ return BFELF_ERROR_NO_SUCH_SYMBOL;
+}
+
+static inline int64_t
+private_get_sym_global(
+ const struct bfelf_loader_t *loader, const char *name,
+ struct bfelf_file_t **ef_found, const struct bfelf_sym **sym)
+{
+ int64_t ret = 0;
+ bfelf64_word i = 0;
+ struct bfelf_file_t *ef_ignore = *ef_found;
+ const struct bfelf_sym *found_sym = nullptr;
+
+ *sym = nullptr;
+ *ef_found = nullptr;
+
+ for (i = 0; i < loader->num; i++) {
+ if (loader->efs[i] == ef_ignore) {
+ continue;
+ }
+
+ ret = private_get_sym_by_name(loader->efs[i], name, &found_sym);
+ if (ret == BFELF_ERROR_NO_SUCH_SYMBOL) {
+ continue;
+ }
+
+ if (found_sym->st_value == 0) {
+ continue;
+ }
+
+ *sym = found_sym;
+ *ef_found = loader->efs[i];
+
+ if (BFELF_SYM_BIND(found_sym->st_info) == bfstb_weak) {
+ continue;
+ }
+
+ return BFELF_SUCCESS;
+ }
+
+ if (*sym != nullptr) {
+ return BFELF_SUCCESS;
+ }
+
+ return bfno_such_symbol(name);
+}
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Relocations Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/*
+ * Forward declarations required by relocator
+ *
+ * @cond
+ */
+
+static inline int64_t
+private_get_sym_global(
+ const struct bfelf_loader_t *loader, const char *name,
+ struct bfelf_file_t **ef_found, const struct bfelf_sym **sym);
+
+/* @endcond */
+
+/*
+ * Relocation definitions and relocators
+ *
+ * @cond
+ */
+
+#if defined(BF_AARCH64)
+# include
+#elif defined(BF_X64)
+# include
+#else
+# error "Unsupported architecture"
+#endif
+
+/* @endcond */
+
+/* @cond */
+
+static inline int64_t
+private_relocate_symbols(struct bfelf_loader_t *loader, struct bfelf_file_t *ef)
+{
+ int64_t ret = 0;
+ bfelf64_word i = 0;
+
+ for (i = 0; i < ef->relanum_dyn; i++) {
+ const struct bfelf_rela *rela = &(ef->relatab_dyn[i]);
+
+ ret = private_relocate_symbol(loader, ef, rela);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ for (i = 0; i < ef->relanum_plt; i++) {
+ const struct bfelf_rela *rela = &(ef->relatab_plt[i]);
+
+ ret = private_relocate_symbol(loader, ef, rela);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ return BFELF_SUCCESS;
+}
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF File Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline int64_t
+private_check_signature(struct bfelf_file_t *ef)
+{
+ if (ef->ehdr->e_ident[bfei_mag0] != 0x7F) {
+ return bfinvalid_signature("magic #0 has unexpected value");
+ }
+
+ if (ef->ehdr->e_ident[bfei_mag1] != 'E') {
+ return bfinvalid_signature("magic #1 has unexpected value");
+ }
+
+ if (ef->ehdr->e_ident[bfei_mag2] != 'L') {
+ return bfinvalid_signature("magic #2 has unexpected value");
+ }
+
+ if (ef->ehdr->e_ident[bfei_mag3] != 'F') {
+ return bfinvalid_signature("magic #3 has unexpected value");
+ }
+
+ return BFELF_SUCCESS;
+}
+
+static inline int64_t
+private_check_support(struct bfelf_file_t *ef)
+{
+ if (ef->ehdr->e_ident[bfei_class] != bfelfclass64) {
+ return bfunsupported_file("file is not 64bit");
+ }
+
+ if (ef->ehdr->e_ident[bfei_data] != bfelfdata2lsb) {
+ return bfunsupported_file("file is not little endian");
+ }
+
+ if (ef->ehdr->e_ident[bfei_version] != bfev_current) {
+ return bfunsupported_file("unsupported version");
+ }
+
+ if (ef->ehdr->e_ident[bfei_osabi] != bfelfosabi_sysv) {
+ return bfunsupported_file("file does not use the system v abi");
+ }
+
+ if (ef->ehdr->e_ident[bfei_abiversion] != 0) {
+ return bfunsupported_file("unsupported abi version");
+ }
+
+ if (ef->ehdr->e_type != bfet_dyn && ef->ehdr->e_type != bfet_exec) {
+ return bfunsupported_file("file must be an executable or shared library");
+ }
+
+#ifdef BF_AARCH64
+ if (ef->ehdr->e_machine != bfem_aarch64) {
+ return bfunsupported_file("file must be compiled for aarch64");
+ }
+#endif
+
+#ifdef BF_X64
+ if (ef->ehdr->e_machine != bfem_x86_64) {
+ return bfunsupported_file("file must be compiled for x86_64");
+ }
+#endif
+
+ if (ef->ehdr->e_version != bfev_current) {
+ return bfunsupported_file("unsupported version");
+ }
+
+ if (ef->ehdr->e_flags != 0) {
+ return bfunsupported_file("unsupported flags");
+ }
+
+ return BFELF_SUCCESS;
+}
+
+static inline void
+private_process_segments(struct bfelf_file_t *ef)
+{
+ bfelf64_xword i = 0;
+
+ for (i = 0; i < ef->ehdr->e_phnum; i++) {
+ const struct bfelf_phdr *phdr = &(ef->phdrtab[i]);
+
+ switch (phdr->p_type) {
+ case bfpt_load:
+
+ if (ef->num_loadable_segments < BFELF_MAX_SEGMENTS) {
+ ef->total_memsz = phdr->p_vaddr + phdr->p_memsz;
+ ef->loadable_segments[ef->num_loadable_segments++] = phdr;
+ }
+
+ break;
+
+ case bfpt_dynamic:
+ ef->dynoff = phdr->p_offset;
+ ef->dynnum = phdr->p_filesz / sizeof(struct bfelf_dyn);
+ break;
+
+ case bfpt_gnu_stack:
+ ef->stack_flags = phdr->p_flags;
+ break;
+
+ case bfpt_gnu_relro:
+ ef->relaro_vaddr = phdr->p_vaddr;
+ ef->relaro_memsz = phdr->p_memsz;
+ break;
+ }
+ }
+
+ if (ef->num_loadable_segments > 0) {
+ ef->start_addr = ef->loadable_segments[0]->p_vaddr;
+ ef->total_memsz -= ef->start_addr;
+ }
+
+ for (i = 0; i < ef->num_loadable_segments; i++) {
+ const struct bfelf_phdr *phdr = ef->loadable_segments[i];
+
+ ef->load_instr[i].perm = phdr->p_flags;
+ ef->load_instr[i].mem_offset = phdr->p_vaddr - ef->start_addr;
+ ef->load_instr[i].file_offset = phdr->p_offset;
+ ef->load_instr[i].memsz = phdr->p_memsz;
+ ef->load_instr[i].filesz = phdr->p_filesz;
+ ef->load_instr[i].virt_addr = phdr->p_vaddr;
+
+ ef->num_load_instr++;
+ }
+}
+
+static inline void
+private_process_dynamic_section(struct bfelf_file_t *ef)
+{
+ bfelf64_xword i = 0;
+
+ if (ef->dynnum == 0 || ef->dynoff == 0) {
+ return;
+ }
+
+ ef->num_needed = 0;
+ ef->dyntab = bfrcast(const struct bfelf_dyn *, ef->file + ef->dynoff);
+
+ for (i = 0; i < ef->dynnum; i++) {
+ const struct bfelf_dyn *dyn = &(ef->dyntab[i]);
+
+ switch (dyn->d_tag) {
+ case bfdt_null:
+ return;
+
+ case bfdt_needed:
+
+ if (ef->num_needed < BFELF_MAX_NEEDED) {
+ ef->needed[ef->num_needed++] = dyn->d_val;
+ }
+
+ break;
+
+ case bfdt_pltrelsz:
+ ef->relanum_plt = dyn->d_val / sizeof(struct bfelf_rela);
+ break;
+
+ case bfdt_hash:
+ ef->hash = bfrcast(bfelf64_word *, dyn->d_val);
+ break;
+
+ case bfdt_strtab:
+ ef->strtab_offset = bfrcast(char *, dyn->d_val);
+ break;
+
+ case bfdt_symtab:
+ ef->symtab = bfrcast(struct bfelf_sym *, dyn->d_val);
+ break;
+
+ case bfdt_rela:
+ ef->relatab_dyn = bfrcast(struct bfelf_rela *, dyn->d_val);
+ break;
+
+ case bfdt_relasz:
+ ef->relanum_dyn = dyn->d_val / sizeof(struct bfelf_rela);
+ break;
+
+ case bfdt_init:
+ ef->init = dyn->d_val;
+ break;
+
+ case bfdt_fini:
+ ef->fini = dyn->d_val;
+ break;
+
+ case bfdt_jmprel:
+ ef->relatab_plt = bfrcast(struct bfelf_rela *, dyn->d_val);
+ break;
+
+ case bfdt_init_array:
+ ef->init_array = dyn->d_val;
+ break;
+
+ case bfdt_fini_array:
+ ef->fini_array = dyn->d_val;
+ break;
+
+ case bfdt_init_arraysz:
+ ef->init_arraysz = dyn->d_val;
+ break;
+
+ case bfdt_fini_arraysz:
+ ef->fini_arraysz = dyn->d_val;
+ break;
+
+ case bfdt_flags_1:
+ ef->flags_1 = dyn->d_val;
+ break;
+
+ default:
+ break;
+ }
+ }
+}
+
+/* @endcond */
+
+/**
+ * Initialize an ELF file
+ *
+ * This function initializes an ELF file structure given the file's contents
+ * in memory. The resulting structure will be used by all of the other
+ * functions.
+ *
+ * @expects file != nullptr
+ * @expects filesz != nullptr
+ * @expects ef != nullptr
+ * @ensures
+ *
+ * @param file a character buffer containing the contents of the ELF file to
+ * be loaded.
+ * @param filesz the size of the character buffer
+ * @param ef the ELF file structure to initialize.
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_init(const char *file, uint64_t filesz, struct bfelf_file_t *ef)
+{
+ int64_t ret = 0;
+ bfelf64_word i = 0;
+
+ if (file == nullptr) {
+ return bfinvalid_argument("file == nullptr");
+ }
+
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (filesz < sizeof(struct bfelf_ehdr)) {
+ return bfinvalid_argument("filesz invalid");
+ }
+
+ ef->file = file;
+ ef->filesz = filesz;
+
+ ef->ehdr = bfrcast(const struct bfelf_ehdr *, file);
+ ef->phdrtab = bfrcast(const struct bfelf_phdr *, file + ef->ehdr->e_phoff);
+ ef->shdrtab = bfrcast(const struct bfelf_shdr *, file + ef->ehdr->e_shoff);
+
+ ret = private_check_signature(ef);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+
+ ret = private_check_support(ef);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+
+ private_process_segments(ef);
+ private_process_dynamic_section(ef);
+
+ ef->entry = ef->ehdr->e_entry;
+ ef->shstrtab = bfrcast(const char *, file + ef->shdrtab[ef->ehdr->e_shstrndx].sh_offset);
+
+ /*
+ * ld from binutils 2.27 only has rela.dyn, while ld.gold and ld.lld both
+ * have rela.dyn and rela.plt. ld from binutils 2.27 also uses
+ * .init_array / .fini_array instead of .ctors / .dtors, while ld.gold and
+ * ld.lld still use the old .ctors / .dtors, which do not seems to show
+ * up in the .dynamic section, so we need to manually search for them.
+ * Since you will likely only have one or the other, if we see the old
+ * .ctors / .dtors, we treat it like .init_array / .fini_array for now
+ * which keeps things simple. Also, ld from binutils 2.27 marks .eh_frame
+ * with bfsht_x86_64_unwind, while ld.gold and ld.lld both mark .eh_frame
+ * with bfsht_progbits, also requiring a manual string search.
+ *
+ * Note that the file provided in this function is assumed to be deleted
+ * after this function is called, and thus, we have to search for these
+ * sections now because the file will not be available later.
+ */
+
+ for (i = 0; i < ef->ehdr->e_shnum; i++) {
+ const struct bfelf_shdr *shdr = &(ef->shdrtab[i]);
+ const char *name = &ef->shstrtab[shdr->sh_name];
+
+ if (private_strcmp(name, ".eh_frame") == BFELF_SUCCESS) {
+ ef->eh_frame = shdr->sh_addr;
+ ef->eh_framesz = shdr->sh_size;
+ continue;
+ }
+
+ if (private_strcmp(name, ".ctors") == BFELF_SUCCESS) {
+ ef->init_array = shdr->sh_addr;
+ ef->init_arraysz = shdr->sh_size;
+ continue;
+ }
+
+ if (private_strcmp(name, ".dtors") == BFELF_SUCCESS) {
+ ef->fini_array = shdr->sh_addr;
+ ef->fini_arraysz = shdr->sh_size;
+ continue;
+ }
+ }
+
+ /*
+ * The string table is located in both ELF file provided here, as well as
+ * in the exec provided to bfelf_loader_add. By the time bfelf_loader_add
+ * is called, we assume that the file provided to this function has been
+ * deleted, but up to this point, the user is free to use some of the
+ * functions (like bfelf_file_get_needed), and for these we need a valid
+ * string table, so we store the location of the string table relative
+ * to the provided file, and then overwrite this when the user adds the
+ * ELF file to the loader, in which case we reference the string table
+ * relative to the provided exec.
+ */
+ ef->strtab = bfcadd(const char *, ef->strtab_offset, bfrcast(bfelf64_addr, file));
+
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get number of load instructions
+ *
+ * Once an ELF file has been initialized, the next step is to load all of the
+ * program segments into memory, relocate them, and then execute the entry
+ * point. To assist this operation, this function returns the total number of
+ * load instructions.
+ *
+ * @expects ef != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file
+ * @return number of load instructions on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_num_load_instrs(const struct bfelf_file_t *ef)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ return bfscast(int64_t, ef->num_load_instr);
+}
+
+/**
+ * Get load instructions
+ *
+ * Once you know how many load instructions there are, you can use this
+ * function to get each instruction structure.
+ *
+ * @expects ef != nullptr
+ * @expects index < bfelf_file_get_num_load_instrs()
+ * @expects instr != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file
+ * @param index the index of the instructions to get
+ * @param instr where to store the load instructions
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_load_instr(
+ const struct bfelf_file_t *ef, uint64_t index, const struct bfelf_load_instr **instr)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (instr == nullptr) {
+ return bfinvalid_argument("phdr == nullptr");
+ }
+
+ if (index >= ef->num_load_instr) {
+ return bfinvalid_index("index >= number of load instructions");
+ }
+
+ *instr = &(ef->load_instr[index]);
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Info
+ *
+ * Once an ELF loader has had all of it's ELF files initialized and added,
+ * use the relocate ELF loader to setup the ELF files such that they can
+ * be executed. Once this is done, this function can be used to get the
+ * C runtime information for bootstrapping a binary / module.
+ *
+ * @expects ef != nullptr
+ * @expects info != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the info structure for
+ * @param info the info structure to store the results.
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_section_info(
+ const struct bfelf_file_t *ef, struct section_info_t *info)
+{
+ bfelf64_word i = 0;
+
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (info == nullptr) {
+ return bfinvalid_argument("info == nullptr");
+ }
+
+ if (ef->added == 0) {
+ return bfinvalid_argument("ef must be added to a loader first");
+ }
+
+ for (i = 0; i < sizeof(struct section_info_t); i++) {
+ bfrcast(char *, info)[i] = 0;
+ }
+
+ if (ef->init != 0) {
+ info->init_addr = ef->init + ef->exec_virt;
+ }
+
+ if (ef->fini != 0) {
+ info->fini_addr = ef->fini + ef->exec_virt;
+ }
+
+ if (ef->init_array != 0) {
+ info->init_array_addr = ef->init_array + ef->exec_virt;
+ info->init_array_size = ef->init_arraysz;
+ }
+
+ if (ef->fini_array != 0) {
+ info->fini_array_addr = ef->fini_array + ef->exec_virt;
+ info->fini_array_size = ef->fini_arraysz;
+ }
+
+ if (ef->eh_frame != 0) {
+ info->eh_frame_addr = ef->eh_frame + ef->exec_virt;
+ info->eh_frame_size = ef->eh_framesz;
+ }
+
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Entry Point
+ *
+ * Returns the entry point of the ELF file.
+ *
+ * @expects ef != nullptr
+ * @expects addr != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the entry location from
+ * @param addr the resulting address of the entry point
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_entry(const struct bfelf_file_t *ef, void **addr)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (addr == nullptr) {
+ return bfinvalid_argument("addr == nullptr");
+ }
+
+ if (ef->added == 0) {
+ return bfinvalid_argument("ef must be added to a loader first");
+ }
+
+ *addr = bfrcast(void *, ef->entry + ef->exec_virt);
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Stack Permissions
+ *
+ * Returns the ELF file's stack permissions.
+ *
+ * @expects ef != nullptr
+ * @expects perm != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the stack permission info from
+ * @param perm the resulting permissions
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_stack_perm(const struct bfelf_file_t *ef, bfelf64_xword *perm)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (perm == nullptr) {
+ return bfinvalid_argument("perm == nullptr");
+ }
+
+ *perm = ef->stack_flags;
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Relocation Read-Only Info
+ *
+ * Returns the ELF file's RELRO information for
+ * re-mapping previously writable memory to read-only
+ *
+ * @expects ef != nullptr
+ * @expects addr != nullptr
+ * @expects size != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the relro info from
+ * @param addr the resulting address
+ * @param size the resulting size
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_relro(
+ const struct bfelf_file_t *ef, bfelf64_addr *addr, bfelf64_xword *size)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (addr == nullptr) {
+ return bfinvalid_argument("addr == nullptr");
+ }
+
+ if (size == nullptr) {
+ return bfinvalid_argument("size == nullptr");
+ }
+
+ if (ef->added == 0) {
+ return bfinvalid_argument("ef must be added to a loader first");
+ }
+
+ *addr = ef->relaro_vaddr + bfrcast(bfelf64_addr, ef->exec_virt);
+ *size = ef->relaro_memsz;
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Number of Needed Libraries
+ *
+ * Returns the number of DT_NEEDED entries in the ELF
+ * file
+ *
+ * @expects ef != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the number of needed files from
+ * @return number of needed entries on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_num_needed(const struct bfelf_file_t *ef)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ return bfscast(int64_t, ef->num_needed);
+}
+
+/**
+ * Get Needed Library
+ *
+ * Returns the name of a shared library that is needed by this
+ * ELF file
+ *
+ * @expects ef != nullptr
+ * @expects index < bfelf_file_get_num_needed()
+ * @expects needed != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the needed filename from
+ * @param index the shared library name to get
+ * @param needed the resulting needed library
+ * @return number of needed entries on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_needed(
+ const struct bfelf_file_t *ef, uint64_t index, const char **needed)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (needed == nullptr) {
+ return bfinvalid_argument("needed == nullptr");
+ }
+
+ if (index >= ef->num_needed) {
+ return bfinvalid_index("index >= number of needed");
+ }
+
+ *needed = &(ef->strtab[ef->needed[index]]);
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Get Total Memory Size
+ *
+ * Returns the total number of bytes needed in memory for this ELF file
+ * when loading the ELF file
+ *
+ * @expects ef != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the total size from
+ * @return number of needed entries on success, negative on error
+ */
+static inline int64_t
+bfelf_file_get_total_size(const struct bfelf_file_t *ef)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ return bfscast(int64_t, ef->total_memsz);
+}
+
+/**
+ * Get PIC/PIE
+ *
+ * Returns 1 if this ELF file was compiled using PIC / PIE, or
+ * 0 otherwise
+ *
+ * @expects ef != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param ef the ELF file to get the pic/pie info from
+ * @return 1 if compiled with PIC/PIE, 0 otherwise
+ */
+static inline int64_t
+bfelf_file_get_pic_pie(const struct bfelf_file_t *ef)
+{
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ return ef->start_addr == 0 ? 1 : 0;
+}
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Loader Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/**
+ * Add ELF file to an ELF loader
+ *
+ * Once an ELF loader has been initialized, use this function to add an
+ * ELF file to the ELF loader
+ *
+ * @expects loader != nullptr
+ * @expects ef != nullptr
+ * @expects exec_addr != nullptr
+ * @expects exec_virt != nullptr
+ * @ensures
+ *
+ * @param loader the ELF loader
+ * @param ef the ELF file to add
+ * @param exec_addr the address in memory where this ELF file was loaded.
+ * @param exec_virt the address in memory where this ELF file will be run.
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_loader_add(
+ struct bfelf_loader_t *loader, struct bfelf_file_t *ef, char *exec_addr, char *exec_virt)
+{
+ bfelf64_addr start;
+
+ if (loader == nullptr) {
+ return bfinvalid_argument("loader == nullptr");
+ }
+
+ if (ef == nullptr) {
+ return bfinvalid_argument("ef == nullptr");
+ }
+
+ if (exec_addr == nullptr) {
+ return bfinvalid_argument("exec_addr == nullptr");
+ }
+
+ if (loader->num >= MAX_NUM_MODULES) {
+ return bfloader_full("increase MAX_NUM_MODULES");
+ }
+
+ if (ef->added++ != 0) {
+ return bfinvalid_argument("ef already added");
+ }
+
+ ef->exec_addr = exec_addr;
+
+ if (ef->start_addr == 0) {
+ ef->exec_virt = exec_virt;
+ }
+
+ start = bfrcast(bfelf64_addr, ef->exec_addr - ef->start_addr);
+
+ ef->hash = bfcadd(const bfelf64_word *, ef->hash, start);
+ ef->strtab = bfcadd(const char *, ef->strtab_offset, start);
+ ef->symtab = bfcadd(const struct bfelf_sym *, ef->symtab, start);
+ ef->relatab_dyn = bfcadd(const struct bfelf_rela *, ef->relatab_dyn, start);
+ ef->relatab_plt = bfcadd(const struct bfelf_rela *, ef->relatab_plt, start);
+
+ ef->nbucket = ef->hash[0];
+ ef->nchain = ef->hash[1];
+ ef->bucket = &(ef->hash[2]);
+ ef->chain = &(ef->hash[2 + ef->nbucket]);
+
+ /*
+ * Sadly, the only way to determine the total size of the dynamic symbol
+ * table is to assume that the dynamic string table is always after the
+ * dynamic symbol table. :(
+ */
+ ef->symnum = (bfrcast(bfelf64_addr, ef->strtab) - bfrcast(bfelf64_addr, ef->symtab)) /
+ sizeof(struct bfelf_sym);
+
+ loader->efs[loader->num++] = ef;
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Relocate ELF Loader
+ *
+ * Relocates all of the ELF files that have been added to the ELF loader.
+ * Once all of the ELF files have been relocated, it's safe to resolve
+ * symbols for execution.
+ *
+ * @expects loader != nullptr
+ * @ensures
+ *
+ * @param loader the ELF loader
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_loader_relocate(struct bfelf_loader_t *loader)
+{
+ bfelf64_word i = 0;
+
+ if (loader == nullptr) {
+ return bfinvalid_argument("loader == nullptr");
+ }
+
+ if (loader->relocated == 1) {
+ return BFELF_SUCCESS;
+ }
+
+ for (i = 0; i < loader->num; i++) {
+ int64_t ret = private_relocate_symbols(loader, loader->efs[i]);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ loader->relocated = 1;
+ return BFELF_SUCCESS;
+}
+
+/**
+ * Resolve Symbol
+ *
+ * Once an ELF loader has had all of it's ELF files initialized and added,
+ * use the relocate ELF loader to setup the ELF files such that they can
+ * be executed. If the ELF file is relocated into memory that is accessible
+ * via the ELF loader, the resolve symbol function can be used to get the
+ * address of a specific symbol so that it can be executed.
+ *
+ * @expects loader != nullptr
+ * @expects loader != name
+ * @expects loader != addr
+ * @ensures
+ *
+ * @param loader the ELF loader
+ * @param name the name of the symbol to resolve
+ * @param addr the resulting address if the symbol is successfully resolved
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_loader_resolve_symbol(
+ const struct bfelf_loader_t *loader, const char *name, void **addr)
+{
+ int64_t ret = 0;
+
+ struct bfelf_file_t *found_ef = nullptr;
+ const struct bfelf_sym *found_sym = nullptr;
+
+ if (loader == nullptr) {
+ return bfinvalid_argument("loader == nullptr");
+ }
+
+ if (name == nullptr) {
+ return bfinvalid_argument("name == nullptr");
+ }
+
+ if (addr == nullptr) {
+ return bfinvalid_argument("addr == nullptr");
+ }
+
+ ret = private_get_sym_global(loader, name, &found_ef, &found_sym);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+
+ *addr = found_ef->exec_virt + found_sym->st_value;
+ return BFELF_SUCCESS;
+}
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Loading APIs */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+struct bfelf_binary_t {
+ char *exec;
+ const char *file;
+ uint64_t exec_size;
+ uint64_t file_size;
+ struct bfelf_file_t ef;
+};
+
+static inline int64_t
+private_load_binary(struct bfelf_binary_t *binary)
+{
+ int64_t i = 0;
+ int64_t ret = 0;
+ int64_t num_segments = 0;
+
+ /*
+ * Note:
+ *
+ * This function expects that binary->file and binary->file_size have
+ * already been filled in before executing this function. It will
+ * allocate the exec, and then copy each program segment in the provided
+ * file into the exec
+ */
+
+ if (binary->ef.file == nullptr) {
+ ret = bfelf_file_init(binary->file, binary->file_size, &binary->ef);
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ num_segments = bfelf_file_get_num_load_instrs(&binary->ef);
+ binary->exec_size = bfscast(uint64_t, bfelf_file_get_total_size(&binary->ef));
+
+ /*
+ * TODO:
+ *
+ * Currently we allocate RWE memory instead of W^E. This code is used in
+ * two different places, the hypervisor and guest applications. In both
+ * cases this memory is changed to W^E by either the hypervisor's memory
+ * manager, or by a set of hypercalls. The only time the memory is actually
+ * used as RWE is during the initialization of the hypervisor, and not it's
+ * normal operation.
+ *
+ * Since this has to be cross platform, most operating systems support some
+ * form of RWE so this is what we use today. The risk for attack is limited
+ * to the initialization of the hypervisor which in most cases will be
+ * performed by a root-of-trust, so the attack surface is low. Still,
+ * someday it would be nice to find an mprotect like function for all
+ * operating systems such that memory can be allocated RW, and changed
+ * to RE as needed. If this functionality is found, the code here will have
+ * to be changed to support this.
+ */
+
+ binary->exec = bfscast(char *, platform_alloc_rwe(binary->exec_size));
+ if (binary->exec == nullptr) {
+ return bfout_of_memory("unable to allocate exec RWE memory");
+ }
+
+ platform_memset(binary->exec, 0, binary->exec_size);
+
+ for (i = 0; i < num_segments; i++) {
+ const struct bfelf_load_instr *instr = nullptr;
+
+ const char *src = nullptr;
+ char *dst = nullptr;
+
+ ret = bfelf_file_get_load_instr(&binary->ef, bfscast(uint64_t, i), &instr);
+ bfignored(ret);
+
+ if (instr != nullptr) {
+ dst = bfadd(char *, binary->exec, instr->mem_offset);
+ src = bfcadd(const char *, binary->file, instr->file_offset);
+
+ platform_memcpy(dst, src, instr->filesz);
+ }
+ }
+
+ return BF_SUCCESS;
+}
+
+static inline int64_t
+private_relocate_binaries(
+ struct bfelf_binary_t *binaries, uint64_t num_binaries, struct bfelf_loader_t *loader)
+{
+ uint64_t i = 0;
+ int64_t ret = 0;
+
+ for (i = 0; i < num_binaries; i++) {
+ ret = bfelf_loader_add(loader, &binaries[i].ef, binaries[i].exec, binaries[i].exec);
+ bfignored(ret);
+ }
+
+ ret = bfelf_loader_relocate(loader);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+
+ return BF_SUCCESS;
+}
+
+static inline int64_t
+private_crt_info(
+ struct bfelf_binary_t *binaries, uint64_t num_binaries, struct crt_info_t *crt_info)
+{
+ uint64_t i = 0;
+
+ for (i = 0; i < num_binaries; i++) {
+
+ int64_t ret = 0;
+ struct section_info_t section_info;
+
+ ret = bfelf_file_get_section_info(&binaries[i].ef, §ion_info);
+ bfignored(ret);
+
+ crt_info->info[crt_info->info_num++] = section_info;
+ }
+
+ return BF_SUCCESS;
+}
+
+/* @endcond */
+
+/**
+ * Load
+ *
+ * Takes an array of ELF binaries and loads them. The resulting output is an
+ * entry point that can be executed. The CRT info and the ELF loader are also
+ * provided as a result.
+ *
+ * @note This function gets the entry point of the last binary provided.
+ * For this reason, the main executable should ALWAYS be last in the list
+ * of ELF binaries provided
+ *
+ * @note It is assumed that file and file_size are already provided for each
+ * ELF binary. This function will loop through each binary, and use this
+ * information to actually load everything into ELF file specific
+ * structures.
+ *
+ * @expects binaries != null
+ * @expects num_binaries != 0 && num_binaries < MAX_NUM_MODULES
+ * @expects entry != null
+ * @expects crt_info != null
+ * @expects loader != null
+ * @ensures none
+ *
+ * @param binaries the list of ELF binaries to load
+ * @param num_binaries the number of binaries provided
+ * @param entry the resulting entry point
+ * @param crt_info the resulting CRT info
+ * @param loader the resulting ELF loader
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_load(
+ struct bfelf_binary_t *binaries, uint64_t num_binaries, void **entry,
+ struct crt_info_t *crt_info, struct bfelf_loader_t *loader)
+{
+ uint64_t i = 0;
+ int64_t ret = 0;
+
+ if (binaries == nullptr) {
+ return bfinvalid_argument("binaries == nullptr");
+ }
+
+ if (num_binaries == 0 || num_binaries >= MAX_NUM_MODULES) {
+ return bfinvalid_argument("num_binaries == 0 || num_binaries >= MAX_NUM_MODULES");
+ }
+
+ if (entry == nullptr) {
+ return bfinvalid_argument("entry == nullptr");
+ }
+
+ if (crt_info == nullptr) {
+ return bfinvalid_argument("crt_info == nullptr");
+ }
+
+ if (loader == nullptr) {
+ return bfinvalid_argument("loader == nullptr");
+ }
+
+ for (i = 0; i < num_binaries; i++) {
+ ret = private_load_binary(&binaries[i]);
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ ret = private_relocate_binaries(binaries, num_binaries, loader);
+ if (ret != BF_SUCCESS) {
+ return ret;
+ }
+
+ ret = private_crt_info(binaries, num_binaries, crt_info);
+ bfignored(ret);
+
+ ret = bfelf_file_get_entry(&binaries[num_binaries - 1].ef, entry);
+ bfignored(ret);
+
+ return BF_SUCCESS;
+}
+
+/**
+ * Set Args
+ *
+ * Tells the CRT info to use the standard main(arc, argv) function, and sets
+ * the values of these. This information will be passed to the resulting
+ * entry point
+ *
+ * @expects crt_info != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param crt_info the CRT info to fill where the args will be stored
+ * @param argc the total number of args
+ * @param argv the args
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_set_args(struct crt_info_t *crt_info, int argc, const char **argv)
+{
+ if (crt_info == nullptr) {
+ return bfinvalid_argument("crt_info == nullptr");
+ }
+
+ crt_info->argc = argc;
+ crt_info->argv = argv;
+ crt_info->arg_type = 0;
+
+ return BF_SUCCESS;
+}
+
+/**
+ * Set Integer Args
+ *
+ * There are two different types of main functions supported: the standard
+ * main(arc, argv) and then another form that uses 64bit integers in the
+ * form int64_t bfmain(int64_t, int64_t, int64_t, int64_t). This function tells
+ * the CRT info to use the integer version, and sets the values of these.
+ * This information will be passed to the resulting entry point
+ *
+ * @expects crt_info != nullptr
+ * @ensures returns BFELF_SUCCESS if params == valid
+ *
+ * @param crt_info the CRT info to fill where the args will be stored
+ * @param request the request id
+ * @param arg1 integer arg #1
+ * @param arg2 integer arg #2
+ * @param arg3 integer arg #3
+ * @return BFELF_SUCCESS on success, negative on error
+ */
+static inline int64_t
+bfelf_set_integer_args(
+ struct crt_info_t *crt_info, uintptr_t request, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3)
+{
+ if (crt_info == nullptr) {
+ return bfinvalid_argument("crt_info == nullptr");
+ }
+
+ crt_info->request = request;
+ crt_info->arg1 = arg1;
+ crt_info->arg2 = arg2;
+ crt_info->arg3 = arg3;
+ crt_info->arg_type = 1;
+
+ return BF_SUCCESS;
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#ifdef __cplusplus
+
+#include
+#include
+#include
+
+#include
+#include
+#include
+#include
+
+/* @cond */
+
+inline auto
+private_read_binary(
+ gsl::not_null f, const std::string &filename, bfelf_binary_t &binary)
+{
+ auto buffer = f->read_binary(filename);
+
+ binary.file = buffer.get();
+ binary.file_size = buffer.size();
+
+ return buffer;
+}
+
+inline auto
+private_get_needed_list(const bfelf_file_t &ef)
+{
+ int64_t ret = 0;
+ std::vector list;
+
+ for (auto i = 0LL; i < bfelf_file_get_num_needed(&ef); i++) {
+ const char *needed = nullptr;
+
+ ret = bfelf_file_get_needed(&ef, static_cast(i), &needed);
+ bfignored(ret);
+
+ list.emplace_back(needed);
+ }
+
+ return list;
+}
+
+/* @endcond */
+
+/**
+ * Read Binary and Get Needed List
+ *
+ * This function takes a filename, and a list of paths to locate the
+ * provide file. If the ELF binary is located, the function then parses
+ * the ELF file and returns the list of binaries that are needed (i.e.
+ * have to be linked to this ELF binary to resolve needed symbols). If
+ * the binary cannot be located, an exception is thrown.
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param f the file object to read the located filename
+ * @param filename the name of the ELF binary to get the needed list from
+ * @param paths a list of paths to locate the ELF binary from
+ * @param buffer the buffer to read the ELF binary into
+ * @param binary the binary object
+ * @return list of needed binaries or throws
+ */
+inline auto
+bfelf_read_binary_and_get_needed_list(
+ gsl::not_null f, const std::string &filename,
+ const std::vector &paths, bfn::buffer &buffer, bfelf_binary_t &binary)
+{
+ buffer = private_read_binary(f, filename, binary);
+
+ auto ret = bfelf_file_init(buffer.data(), buffer.size(), &binary.ef);
+ if (ret != BFELF_SUCCESS) {
+ throw std::runtime_error("bfelf_file_init failed: " + std::to_string(ret));
+ }
+
+ auto list = f->find_files(private_get_needed_list(binary.ef), paths);
+ return list;
+}
+
+/**
+ * Binaries Info
+ *
+ * Provides a C++ wrapper for all of the ELF structures that are needed to
+ * load an ELF binary.
+ */
+class binaries_info
+{
+public:
+
+ using index_type = std::size_t; ///< Index type
+ using info_type = crt_info_t; ///< CRT info type
+ using entry_type = void *; ///< Entry point address type
+ using loader_type = bfelf_loader_t; ///< ELF loader type
+
+ /**
+ * Constructor
+ *
+ * Loads the file provided, and searches the needed list to identify
+ * any other files that are needed for symbol resolution.
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param f the file object to read the located filename
+ * @param filename the name of the ELF binary to load
+ * @param paths a list of paths to locate the ELF binary from
+ * @param load if true, loads the binaries
+ */
+ binaries_info(
+ gsl::not_null f, const std::string &filename, const std::vector &paths, bool load = true)
+ {
+ bfn::buffer data;
+ bfelf_binary_t binary = {};
+
+ auto filenames = bfelf_read_binary_and_get_needed_list(f, filename, paths, data, binary);
+
+ this->init_binaries(f, filenames);
+ this->push_binary(std::move(data), std::move(binary));
+
+ auto ___ = gsl::on_failure([&] {
+ this->unload_binaries();
+ });
+
+ if (load) {
+ this->load_binaries();
+ }
+ }
+
+ /**
+ * Constructor
+ *
+ * Loads all of the files provided. This does not search the needed list
+ * and instead expects that the list of binaries provided is complete.
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param f the file object to read the located filename
+ * @param filenames the list of files to load
+ * @param load if true, loads the binaries
+ */
+ binaries_info(
+ gsl::not_null f, const std::vector &filenames, bool load = true)
+ {
+ this->init_binaries(f, filenames);
+
+ auto ___ = gsl::on_failure([&] {
+ this->unload_binaries();
+ });
+
+ if (load) {
+ this->load_binaries();
+ }
+ }
+
+ /**
+ * Default Destructor
+ */
+ ~binaries_info()
+ { this->unload_binaries(); }
+
+ /**
+ * Set Args
+ *
+ * Sets the argc and argv for this binary.
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param argc the number of arguments to pass to this binary
+ * @param argv the arguments to pass to this binary
+ */
+ void
+ set_args(int argc, const char **argv)
+ {
+ auto ret = bfelf_set_args(&m_info, argc, argv);
+ bfignored(ret);
+ }
+
+ /**
+ * Get Main ELF Binary
+ *
+ * Returns the main ELF binary (i.e. does not return the shared libraries
+ * needed by the main binary)
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return main binary
+ */
+ auto &
+ ef()
+ { return m_binaries.back().ef; }
+
+ /**
+ * Get Specific ELF Binary
+ *
+ * Returns a specific ELF binary given an index
+ *
+ * @expects index is valid
+ * @ensures none
+ *
+ * @param index of the ELF binary to get
+ * @return main binary
+ */
+ auto &
+ ef(index_type index)
+ { return m_binaries.at(index).ef; }
+
+ /**
+ * Get A Specific Binary
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @param index of the specific binary to get
+ * @return returns a specific binary
+ */
+ auto &
+ at(index_type index)
+ { return m_binaries.at(index); }
+
+ /**
+ * Get The First Binary
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns the first binary
+ */
+ auto &
+ front()
+ { return m_binaries.front(); }
+
+ /**
+ * Get The Last Binary
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns the last binary
+ */
+ auto &
+ back()
+ { return m_binaries.back(); }
+
+ /**
+ * Get Binaries
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns the Binaries
+ */
+ auto &
+ binaries()
+ { return m_binaries; }
+
+ /**
+ * Get CRT Info
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns CRT info
+ */
+ const auto &
+ info() const
+ { return m_info; }
+
+ /**
+ * Get Entry Point Address
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns entry point address
+ */
+ auto
+ entry() const
+ { return m_entry; }
+
+ /**
+ * Get ELF Loader
+ *
+ * @expects none
+ * @ensures none
+ *
+ * @return returns the ELF loader
+ */
+ auto &
+ loader()
+ { return m_loader; }
+
+private:
+
+ void
+ push_binary(bfn::buffer &&data, bfelf_binary_t &&binary)
+ {
+ m_datas.push_back(std::move(data));
+ m_binaries.push_back(std::move(binary));
+ }
+
+ void
+ init_binaries(gsl::not_null f, const std::vector &filenames)
+ {
+ expects(!filenames.empty());
+
+ for (const auto &filename : filenames) {
+ bfelf_binary_t binary = {};
+ this->push_binary(private_read_binary(f, filename, binary), std::move(binary));
+ }
+ }
+
+ void
+ load_binaries()
+ {
+ auto ret = bfelf_load(m_binaries.data(), m_binaries.size(), &m_entry, &m_info, &m_loader);
+ if (ret != BF_SUCCESS) {
+ throw std::runtime_error("bfelf_load failed: " + bfn::to_string(ret, 16));
+ }
+ }
+
+ void
+ unload_binaries()
+ {
+ for (const auto &binary : m_binaries) {
+ platform_free_rwe(binary.exec, binary.exec_size);
+ }
+ }
+
+ info_type m_info{};
+ entry_type m_entry{};
+ loader_type m_loader{};
+
+ std::vector m_binaries;
+ std::vector m_datas;
+
+public:
+
+ /** @cond */
+
+ binaries_info(binaries_info &&) noexcept = default;
+ binaries_info &operator=(binaries_info &&) noexcept = default;
+
+ binaries_info(const binaries_info &) = delete;
+ binaries_info &operator=(const binaries_info &) = delete;
+
+ /** @endcond */
+};
+
+#endif
+
+#pragma pack(pop)
+#endif
diff --git a/payloads/bareflank/include/bfelf_loader_reloc_aarch64.h b/payloads/bareflank/include/bfelf_loader_reloc_aarch64.h
new file mode 100644
index 00000000000..80155de61cb
--- /dev/null
+++ b/payloads/bareflank/include/bfelf_loader_reloc_aarch64.h
@@ -0,0 +1,263 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2017 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfelf_loader_reloc_aarch64.h
+ */
+
+/*
+ * AArch64 Relocations
+ *
+ * The following is defined in the "ELF for the ARM 64-bit architecture"
+ * specification:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0056b/IHI0056B_aaelf64.pdf
+ *
+ * @cond
+ */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* Miscellaneous relocations */
+/* ---------------------------------------------------------------------------------------------- */
+#define BFR_AARCH64_NONE bfscast(bfelf64_xword, 0)
+
+/* ---------------------------------------------------------------------------------------------- */
+/* Static data relocations */
+/* ---------------------------------------------------------------------------------------------- */
+/* Data relocations */
+#define BFR_AARCH64_ABS64 bfscast(bfelf64_xword, 257)
+#define BFR_AARCH64_ABS32 bfscast(bfelf64_xword, 258)
+#define BFR_AARCH64_ABS16 bfscast(bfelf64_xword, 259)
+#define BFR_AARCH64_PREL64 bfscast(bfelf64_xword, 260)
+#define BFR_AARCH64_PREL32 bfscast(bfelf64_xword, 261)
+#define BFR_AARCH64_PREL16 bfscast(bfelf64_xword, 262)
+
+/* ---------------------------------------------------------------------------------------------- */
+/* Static AArch64 relocations */
+/* ---------------------------------------------------------------------------------------------- */
+/* Group relocations to create an unsigned data value or address inline */
+#define BFR_AARCH64_MOVW_UABS_G0 bfscast(bfelf64_xword, 263)
+#define BFR_AARCH64_MOVW_UABS_G0_NC bfscast(bfelf64_xword, 264)
+#define BFR_AARCH64_MOVW_UABS_G1 bfscast(bfelf64_xword, 265)
+#define BFR_AARCH64_MOVW_UABS_G1_NC bfscast(bfelf64_xword, 266)
+#define BFR_AARCH64_MOVW_UABS_G2 bfscast(bfelf64_xword, 267)
+#define BFR_AARCH64_MOVW_UABS_G2_NC bfscast(bfelf64_xword, 268)
+#define BFR_AARCH64_MOVW_UABS_G3 bfscast(bfelf64_xword, 269)
+
+/* Group relocations to create a signed data or offset value inline */
+#define BFR_AARCH64_MOVW_SABS_G0 bfscast(bfelf64_xword, 270)
+#define BFR_AARCH64_MOVW_SABS_G1 bfscast(bfelf64_xword, 271)
+#define BFR_AARCH64_MOVW_SABS_G2 bfscast(bfelf64_xword, 272)
+
+/* Relocations to generate PC-relative addresses */
+#define BFR_AARCH64_LD_PREL_LO19 bfscast(bfelf64_xword, 273)
+#define BFR_AARCH64_ADR_PREL_LO21 bfscast(bfelf64_xword, 274)
+#define BFR_AARCH64_ADR_PREL_PG_HI21 bfscast(bfelf64_xword, 275)
+#define BFR_AARCH64_ADR_PREL_PG_HI21_NC bfscast(bfelf64_xword, 276)
+#define BFR_AARCH64_ADD_ABS_LO12_NC bfscast(bfelf64_xword, 277)
+#define BFR_AARCH64_LDST8_ABS_LO12_NC bfscast(bfelf64_xword, 278)
+#define BFR_AARCH64_LDST16_ABS_LO12_NC bfscast(bfelf64_xword, 284)
+#define BFR_AARCH64_LDST32_ABS_LO12_NC bfscast(bfelf64_xword, 285)
+#define BFR_AARCH64_LDST64_ABS_LO12_NC bfscast(bfelf64_xword, 286)
+#define BFR_AARCH64_LDST128_ABS_LO12_NC bfscast(bfelf64_xword, 299)
+
+/* Relocations for control-flow instructions */
+#define BFR_AARCH64_TSTBR14 bfscast(bfelf64_xword, 279)
+#define BFR_AARCH64_CONDBR19 bfscast(bfelf64_xword, 280)
+#define BFR_AARCH64_JUMP26 bfscast(bfelf64_xword, 282)
+#define BFR_AARCH64_CALL26 bfscast(bfelf64_xword, 283)
+
+/* Group relocations to create a PC-relative offset inline */
+#define BFR_AARCH64_MOVW_PREL_G0 bfscast(bfelf64_xword, 287)
+#define BFR_AARCH64_MOVW_PREL_G0_NC bfscast(bfelf64_xword, 288)
+#define BFR_AARCH64_MOVW_PREL_G1 bfscast(bfelf64_xword, 289)
+#define BFR_AARCH64_MOVW_PREL_G1_NC bfscast(bfelf64_xword, 290)
+#define BFR_AARCH64_MOVW_PREL_G2 bfscast(bfelf64_xword, 291)
+#define BFR_AARCH64_MOVW_PREL_G2_NC bfscast(bfelf64_xword, 292)
+#define BFR_AARCH64_MOVW_PREL_G3 bfscast(bfelf64_xword, 293)
+
+/* Group relocations to create a GOT-relative offset inline */
+#define BFR_AARCH64_MOVW_GOTOFF_G0 bfscast(bfelf64_xword, 300)
+#define BFR_AARCH64_MOVW_GOTOFF_G0_NC bfscast(bfelf64_xword, 301)
+#define BFR_AARCH64_MOVW_GOTOFF_G1 bfscast(bfelf64_xword, 302)
+#define BFR_AARCH64_MOVW_GOTOFF_G1_NC bfscast(bfelf64_xword, 303)
+#define BFR_AARCH64_MOVW_GOTOFF_G2 bfscast(bfelf64_xword, 304)
+#define BFR_AARCH64_MOVW_GOTOFF_G2_NC bfscast(bfelf64_xword, 305)
+#define BFR_AARCH64_MOVW_GOTOFF_G3 bfscast(bfelf64_xword, 306)
+
+/* GOT-relative data relocations */
+#define BFR_AARCH64_GOTREL64 bfscast(bfelf64_xword, 307)
+#define BFR_AARCH64_GOTREL32 bfscast(bfelf64_xword, 308)
+
+/* GOT-relative instruction relocations */
+#define BFR_AARCH64_GOT_LD_PREL19 bfscast(bfelf64_xword, 309)
+#define BFR_AARCH64_LD64_GOTOFF_LO15 bfscast(bfelf64_xword, 310)
+#define BFR_AARCH64_ADR_GOT_PAGE bfscast(bfelf64_xword, 311)
+#define BFR_AARCH64_LD64_GOT_LO12_NC bfscast(bfelf64_xword, 312)
+#define BFR_AARCH64_LD64_GOTPAGE_LO15 bfscast(bfelf64_xword, 313)
+
+/* ---------------------------------------------------------------------------------------------- */
+/* Relocations for thread-local storage */
+/* ---------------------------------------------------------------------------------------------- */
+/* General dynamic TLS relocations */
+#define BFR_AARCH64_TLSGD_ADR_PREL21 bfscast(bfelf64_xword, 512)
+#define BFR_AARCH64_TLSGD_ADR_PAGE21 bfscast(bfelf64_xword, 513)
+#define BFR_AARCH64_TLSGD_ADD_LO12_NC bfscast(bfelf64_xword, 514)
+#define BFR_AARCH64_TLSGD_MOVW_G1 bfscast(bfelf64_xword, 515)
+#define BFR_AARCH64_TLSGD_MOVW_G0_NC bfscast(bfelf64_xword, 516)
+
+/* Local dynamic TLS relocations */
+#define BFR_AARCH64_TLSLD_ADR_PREL21 bfscast(bfelf64_xword, 517)
+#define BFR_AARCH64_TLSLD_ADR_PAGE21 bfscast(bfelf64_xword, 518)
+#define BFR_AARCH64_TLSLD_ADD_LO12_NC bfscast(bfelf64_xword, 519)
+#define BFR_AARCH64_TLSLD_MOVW_G1 bfscast(bfelf64_xword, 520)
+#define BFR_AARCH64_TLSLD_MOVW_G0_NC bfscast(bfelf64_xword, 521)
+#define BFR_AARCH64_TLSLD_LD_PREL19 bfscast(bfelf64_xword, 522)
+#define BFR_AARCH64_TLSLD_MOVW_DTPREL_G2 bfscast(bfelf64_xword, 523)
+#define BFR_AARCH64_TLSLD_MOVW_DTPREL_G1 bfscast(bfelf64_xword, 524)
+#define BFR_AARCH64_TLSLD_MOVW_DTPREL_G1_NC bfscast(bfelf64_xword, 525)
+#define BFR_AARCH64_TLSLD_MOVW_DTPREL_G0 bfscast(bfelf64_xword, 526)
+#define BFR_AARCH64_TLSLD_MOVW_DTPREL_G0_NC bfscast(bfelf64_xword, 527)
+#define BFR_AARCH64_TLSLD_ADD_DTPREL_HI12 bfscast(bfelf64_xword, 528)
+#define BFR_AARCH64_TLSLD_ADD_DTPREL_LO12 bfscast(bfelf64_xword, 529)
+#define BFR_AARCH64_TLSLD_ADD_DTPREL_LO12_NC bfscast(bfelf64_xword, 530)
+#define BFR_AARCH64_TLSLD_LDST8_DTPREL_LO12 bfscast(bfelf64_xword, 531)
+#define BFR_AARCH64_TLSLD_LDST8_DTPREL_LO12_NC bfscast(bfelf64_xword, 532)
+#define BFR_AARCH64_TLSLD_LDST16_DTPREL_LO12 bfscast(bfelf64_xword, 533)
+#define BFR_AARCH64_TLSLD_LDST16_DTPREL_LO12_NC bfscast(bfelf64_xword, 534)
+#define BFR_AARCH64_TLSLD_LDST32_DTPREL_LO12 bfscast(bfelf64_xword, 535)
+#define BFR_AARCH64_TLSLD_LDST32_DTPREL_LO12_NC bfscast(bfelf64_xword, 536)
+#define BFR_AARCH64_TLSLD_LDST64_DTPREL_LO12 bfscast(bfelf64_xword, 537)
+#define BFR_AARCH64_TLSLD_LDST64_DTPREL_LO12_NC bfscast(bfelf64_xword, 538)
+#define BFR_AARCH64_TLSLD_LDST128_DTPREL_LO12 bfscast(bfelf64_xword, 572)
+#define BFR_AARCH64_TLSLD_LDST128_DTPREL_LO12_NC bfscast(bfelf64_xword, 573)
+
+/* Initial exec TLS relocations */
+#define BFR_AARCH64_TLSIE_MOVW_GOTTPREP_G1 bfscast(bfelf64_xword, 539)
+#define BFR_AARCH64_TLSIE_MOVW_GOTTPREL_G0_NC bfscast(bfelf64_xword, 540)
+#define BFR_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21 bfscast(bfelf64_xword, 541)
+#define BFR_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC bfscast(bfelf64_xword, 542)
+#define BFR_AARCH64_TLSIE_LD_GOTTPREL_PREL19 bfscast(bfelf64_xword, 543)
+
+/* Local exec TLS relocations */
+#define BFR_AARCH64_TLSLE_MOVW_TPREL_G2 bfscast(bfelf64_xword, 544)
+#define BFR_AARCH64_TLSLE_MOVW_TPREL_G1 bfscast(bfelf64_xword, 545)
+#define BFR_AARCH64_TLSLE_MOVW_TPREL_G1_NC bfscast(bfelf64_xword, 546)
+#define BFR_AARCH64_TLSLE_MOVW_TPREL_G0 bfscast(bfelf64_xword, 547)
+#define BFR_AARCH64_TLSLE_MOVW_TPREL_G0_NC bfscast(bfelf64_xword, 548)
+#define BFR_AARCH64_TLSLE_ADD_TPREL_HI12 bfscast(bfelf64_xword, 549)
+#define BFR_AARCH64_TLSLE_ADD_TPREL_LO12 bfscast(bfelf64_xword, 550)
+#define BFR_AARCH64_TLSLE_ADD_TPREL_LO12_NC bfscast(bfelf64_xword, 551)
+#define BFR_AARCH64_TLSLE_LDST8_TPREL_LO12 bfscast(bfelf64_xword, 552)
+#define BFR_AARCH64_TLSLE_LDST8_TPREL_LO12_NC bfscast(bfelf64_xword, 553)
+#define BFR_AARCH64_TLSLE_LDST16_TPREL_LO12 bfscast(bfelf64_xword, 554)
+#define BFR_AARCH64_TLSLE_LDST16_TPREL_LO12_NC bfscast(bfelf64_xword, 555)
+#define BFR_AARCH64_TLSLE_LDST32_TPREL_LO12 bfscast(bfelf64_xword, 556)
+#define BFR_AARCH64_TLSLE_LDST32_TPREL_LO12_NC bfscast(bfelf64_xword, 557)
+#define BFR_AARCH64_TLSLE_LDST64_TPREL_LO12 bfscast(bfelf64_xword, 558)
+#define BFR_AARCH64_TLSLE_LDST64_TPREL_LO12_NC bfscast(bfelf64_xword, 559)
+#define BFR_AARCH64_TLSLE_LDST128_TPREL_LO12 bfscast(bfelf64_xword, 570)
+#define BFR_AARCH64_TLSLE_LDST128_TPREL_LO12_NC bfscast(bfelf64_xword, 571)
+
+/* TLS descriptor relocations */
+#define BFR_AARCH64_TLSDESC_LD_PREL19 bfscast(bfelf64_xword, 560)
+#define BFR_AARCH64_TLSDESC_ADR_PREL21 bfscast(bfelf64_xword, 561)
+#define BFR_AARCH64_TLSDESC_ADR_PAGE21 bfscast(bfelf64_xword, 562)
+#define BFR_AARCH64_TLSDESC_LD64_LO12 bfscast(bfelf64_xword, 563)
+#define BFR_AARCH64_TLSDESC_ADD_LO12 bfscast(bfelf64_xword, 564)
+#define BFR_AARCH64_TLSDESC_OFF_G1 bfscast(bfelf64_xword, 656)
+#define BFR_AARCH64_TLSDESC_OFF_G0_NC bfscast(bfelf64_xword, 566)
+#define BFR_AARCH64_TLSDESC_LDR bfscast(bfelf64_xword, 567)
+#define BFR_AARCH64_TLSDESC_ADD bfscast(bfelf64_xword, 568)
+#define BFR_AARCH64_TLSDESC_CALL bfscast(bfelf64_xword, 569)
+
+/* ---------------------------------------------------------------------------------------------- */
+/* Dynamic relocations */
+/* ---------------------------------------------------------------------------------------------- */
+#define BFR_AARCH64_COPY bfscast(bfelf64_xword, 1024)
+#define BFR_AARCH64_GLOB_DAT bfscast(bfelf64_xword, 1025)
+#define BFR_AARCH64_JUMP_SLOT bfscast(bfelf64_xword, 1026)
+#define BFR_AARCH64_RELATIVE bfscast(bfelf64_xword, 1027)
+#define BFR_AARCH64_TLS_DTPREL64 bfscast(bfelf64_xword, 1028)
+#define BFR_AARCH64_TLS_DTPMOD64 bfscast(bfelf64_xword, 1029)
+#define BFR_AARCH64_TLS_TPREL64 bfscast(bfelf64_xword, 1030)
+#define BFR_AARCH64_TLSDESC bfscast(bfelf64_xword, 1031)
+#define BFR_AARCH64_IRELATIVE bfscast(bfelf64_xword, 1032)
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Relocations Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline int64_t
+private_relocate_symbol(
+ struct bfelf_loader_t *loader, struct bfelf_file_t *ef, const struct bfelf_rela *rela)
+{
+ const char *str = nullptr;
+ const struct bfelf_sym *found_sym = nullptr;
+ struct bfelf_file_t *found_ef = ef;
+ bfelf64_addr *ptr = bfrcast(bfelf64_addr *, ef->exec_addr + rela->r_offset - ef->start_addr);
+
+ if (BFELF_REL_TYPE(rela->r_info) == BFR_AARCH64_RELATIVE) {
+ *ptr = bfrcast(bfelf64_addr, ef->exec_virt + rela->r_addend);
+ return BFELF_SUCCESS;
+ }
+
+ found_sym = &(ef->symtab[BFELF_REL_SYM(rela->r_info)]);
+
+ if (BFELF_SYM_BIND(found_sym->st_info) == bfstb_weak) {
+ found_ef = nullptr;
+ }
+
+ if (found_sym->st_value == 0 || found_ef == nullptr) {
+ int64_t ret;
+
+ str = &(ef->strtab[found_sym->st_name]);
+ ret = private_get_sym_global(loader, str, &found_ef, &found_sym);
+
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ switch (BFELF_REL_TYPE(rela->r_info)) {
+ case BFR_AARCH64_GLOB_DAT:
+ case BFR_AARCH64_JUMP_SLOT:
+ case BFR_AARCH64_ABS64:
+ *ptr = bfrcast(bfelf64_addr, found_ef->exec_virt + found_sym->st_value);
+ break;
+
+ case BFR_AARCH64_ABS32:
+ *(uint32_t *) ptr = bfrcast(uint32_t, found_ef->exec_virt + found_sym->st_value);
+ break;
+
+ case BFR_AARCH64_ABS16:
+ *(uint16_t *) ptr = bfrcast(uint16_t, found_ef->exec_virt + found_sym->st_value);
+ break;
+
+ default:
+ return bfunsupported_rel(str);
+ }
+
+ return BFELF_SUCCESS;
+}
+
+/* @endcond */
diff --git a/payloads/bareflank/include/bfelf_loader_reloc_x64.h b/payloads/bareflank/include/bfelf_loader_reloc_x64.h
new file mode 100644
index 00000000000..5127762ff76
--- /dev/null
+++ b/payloads/bareflank/include/bfelf_loader_reloc_x64.h
@@ -0,0 +1,93 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2017 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+/**
+ * @file bfelf_loader_reloc_x64.h
+ */
+
+/*
+ * System V ABI 64bit Relocations
+ *
+ * The following is defined in the ELF 64bit file format specification:
+ * http://www.x86-64.org/documentation/abi.pdf, page 71
+ *
+ * @cond
+ */
+#define BFR_X86_64_64 bfscast(bfelf64_xword, 1)
+#define BFR_X86_64_GLOB_DAT bfscast(bfelf64_xword, 6)
+#define BFR_X86_64_JUMP_SLOT bfscast(bfelf64_xword, 7)
+#define BFR_X86_64_RELATIVE bfscast(bfelf64_xword, 8)
+
+/* @endcond */
+
+/* ---------------------------------------------------------------------------------------------- */
+/* ELF Relocations Implementation */
+/* ---------------------------------------------------------------------------------------------- */
+
+/* @cond */
+
+static inline int64_t
+private_relocate_symbol(
+ struct bfelf_loader_t *loader, struct bfelf_file_t *ef, const struct bfelf_rela *rela)
+{
+ const char *str = nullptr;
+ const struct bfelf_sym *found_sym = nullptr;
+ struct bfelf_file_t *found_ef = ef;
+ bfelf64_addr *ptr = bfrcast(bfelf64_addr *, ef->exec_addr + rela->r_offset - ef->start_addr);
+
+ if (BFELF_REL_TYPE(rela->r_info) == BFR_X86_64_RELATIVE) {
+ *ptr = bfrcast(bfelf64_addr, ef->exec_virt + rela->r_addend);
+ return BFELF_SUCCESS;
+ }
+
+ found_sym = &(ef->symtab[BFELF_REL_SYM(rela->r_info)]);
+
+ if (BFELF_SYM_BIND(found_sym->st_info) == bfstb_weak) {
+ found_ef = nullptr;
+ }
+
+ if (found_sym->st_value == 0 || found_ef == nullptr) {
+ int64_t ret = 0;
+ str = &(ef->strtab[found_sym->st_name]);
+
+ ret = private_get_sym_global(loader, str, &found_ef, &found_sym);
+ if (ret != BFELF_SUCCESS) {
+ return ret;
+ }
+ }
+
+ *ptr = bfrcast(bfelf64_addr, found_ef->exec_virt + found_sym->st_value);
+
+ switch (BFELF_REL_TYPE(rela->r_info)) {
+ case BFR_X86_64_64:
+ *ptr += bfscast(bfelf64_addr, rela->r_addend);
+ break;
+
+ case BFR_X86_64_GLOB_DAT:
+ case BFR_X86_64_JUMP_SLOT:
+ break;
+
+ default:
+ return bfunsupported_rel(str);
+ }
+
+ return BFELF_SUCCESS;
+}
+
+/* @endcond */
diff --git a/payloads/bareflank/include/bferrorcodes.h b/payloads/bareflank/include/bferrorcodes.h
new file mode 100644
index 00000000000..647a13a1d6b
--- /dev/null
+++ b/payloads/bareflank/include/bferrorcodes.h
@@ -0,0 +1,174 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFERROR_CODES_H
+#define BFERROR_CODES_H
+
+#include
+
+/* -------------------------------------------------------------------------- */
+/* Success */
+/* -------------------------------------------------------------------------- */
+
+#define SUCCESS 0
+
+/* -------------------------------------------------------------------------- */
+/* Entry Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define ENTRY_SUCCESS bfscast(int64_t, SUCCESS)
+#define ENTRY_ERROR_STACK_OVERFLOW bfscast(int64_t, 0x8000000000000010)
+#define ENTRY_ERROR_VMM_INIT_FAILED bfscast(int64_t, 0x8000000000000020)
+#define ENTRY_ERROR_VMM_START_FAILED bfscast(int64_t, 0x8000000000000030)
+#define ENTRY_ERROR_VMM_STOP_FAILED bfscast(int64_t, 0x8000000000000040)
+#define ENTRY_ERROR_UNKNOWN bfscast(int64_t, 0x8000000000000050)
+
+/* -------------------------------------------------------------------------- */
+/* C Runtime Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define CRT_SUCCESS bfscast(int64_t, SUCCESS)
+#define CRT_FAILURE bfscast(int64_t, 0x8000000000000100)
+
+/* -------------------------------------------------------------------------- */
+/* Unwinder Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define REGISTER_EH_FRAME_SUCCESS bfscast(int64_t, SUCCESS)
+#define REGISTER_EH_FRAME_FAILURE bfscast(int64_t, 0x8000000000001000)
+
+/* -------------------------------------------------------------------------- */
+/* Debug Ring Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define GET_DRR_SUCCESS bfscast(int64_t, SUCCESS)
+#define GET_DRR_FAILURE bfscast(int64_t, 0x8000000000010000)
+
+/* -------------------------------------------------------------------------- */
+/* ELF Loader Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define BFELF_SUCCESS bfscast(int64_t, SUCCESS)
+#define BFELF_ERROR_INVALID_ARG bfscast(int64_t, 0x8000000000100000)
+#define BFELF_ERROR_INVALID_FILE bfscast(int64_t, 0x8000000000200000)
+#define BFELF_ERROR_INVALID_INDEX bfscast(int64_t, 0x8000000000300000)
+#define BFELF_ERROR_INVALID_SIGNATURE bfscast(int64_t, 0x8000000000500000)
+#define BFELF_ERROR_UNSUPPORTED_FILE bfscast(int64_t, 0x8000000000600000)
+#define BFELF_ERROR_INVALID_SEGMENT bfscast(int64_t, 0x8000000000700000)
+#define BFELF_ERROR_INVALID_SECTION bfscast(int64_t, 0x8000000000800000)
+#define BFELF_ERROR_LOADER_FULL bfscast(int64_t, 0x8000000000900000)
+#define BFELF_ERROR_NO_SUCH_SYMBOL bfscast(int64_t, 0x8000000000A00000)
+#define BFELF_ERROR_MISMATCH bfscast(int64_t, 0x8000000000B00000)
+#define BFELF_ERROR_UNSUPPORTED_RELA bfscast(int64_t, 0x8000000000C00000)
+#define BFELF_ERROR_OUT_OF_ORDER bfscast(int64_t, 0x8000000000D00000)
+#define BFELF_ERROR_OUT_OF_MEMORY bfscast(int64_t, 0x8000000000E00000)
+
+/* -------------------------------------------------------------------------- */
+/* Memory Manager Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define MEMORY_MANAGER_SUCCESS bfscast(int64_t, SUCCESS)
+#define MEMORY_MANAGER_FAILURE bfscast(int64_t, 0x8000000001000000)
+
+/* -------------------------------------------------------------------------- */
+/* Common Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define BF_SUCCESS bfscast(int64_t, SUCCESS)
+#define BF_ERROR_INVALID_ARG bfscast(int64_t, 0x8000000010000000)
+#define BF_ERROR_INVALID_INDEX bfscast(int64_t, 0x8000000020000000)
+#define BF_ERROR_NO_MODULES_ADDED bfscast(int64_t, 0x8000000030000000)
+#define BF_ERROR_MAX_MODULES_REACHED bfscast(int64_t, 0x8000000040000000)
+#define BF_ERROR_VMM_INVALID_STATE bfscast(int64_t, 0x8000000050000000)
+#define BF_ERROR_FAILED_TO_ADD_FILE bfscast(int64_t, 0x8000000060000000)
+#define BF_ERROR_FAILED_TO_DUMP_DR bfscast(int64_t, 0x8000000070000000)
+#define BF_ERROR_OUT_OF_MEMORY bfscast(int64_t, 0x8000000080000000)
+#define BF_ERROR_VMM_CORRUPTED bfscast(int64_t, 0x8000000090000000)
+#define BF_ERROR_UNKNOWN bfscast(int64_t, 0x80000000A0000000)
+
+/* -------------------------------------------------------------------------- */
+/* IOCTL Error Codes */
+/* -------------------------------------------------------------------------- */
+
+#define BF_IOCTL_SUCCESS bfscast(int64_t, SUCCESS)
+#define BF_IOCTL_FAILURE bfscast(int64_t, -1)
+
+/* -------------------------------------------------------------------------- */
+/* Bad Alloc */
+/* -------------------------------------------------------------------------- */
+
+#define BF_BAD_ALLOC bfscast(int64_t, 0x8000000100000000)
+
+/* -------------------------------------------------------------------------- */
+/* VMCall */
+/* -------------------------------------------------------------------------- */
+
+#define BF_VMCALL_SUCCESS bfscast(int64_t, SUCCESS)
+#define BF_VMCALL_FAILURE bfscast(int64_t, 0x8000001000000000)
+
+/* -------------------------------------------------------------------------- */
+/* Stringify Error Codes */
+/* -------------------------------------------------------------------------- */
+
+static inline const char *
+ec_to_str(int64_t value)
+{
+ switch (value) {
+ case SUCCESS: return "SUCCESS";
+ case ENTRY_ERROR_STACK_OVERFLOW: return "ENTRY_ERROR_STACK_OVERFLOW";
+ case ENTRY_ERROR_VMM_INIT_FAILED: return "ENTRY_ERROR_VMM_INIT_FAILED";
+ case ENTRY_ERROR_VMM_START_FAILED: return "ENTRY_ERROR_VMM_START_FAILED";
+ case ENTRY_ERROR_VMM_STOP_FAILED: return "ENTRY_ERROR_VMM_STOP_FAILED";
+ case ENTRY_ERROR_UNKNOWN: return "ENTRY_ERROR_UNKNOWN";
+ case CRT_FAILURE: return "CRT_FAILURE";
+ case REGISTER_EH_FRAME_FAILURE: return "REGISTER_EH_FRAME_FAILURE";
+ case GET_DRR_FAILURE: return "GET_DRR_FAILURE";
+ case MEMORY_MANAGER_FAILURE: return "MEMORY_MANAGER_FAILURE";
+ case BFELF_ERROR_INVALID_ARG: return "BFELF_ERROR_INVALID_ARG";
+ case BFELF_ERROR_INVALID_FILE: return "BFELF_ERROR_INVALID_FILE";
+ case BFELF_ERROR_INVALID_INDEX: return "BFELF_ERROR_INVALID_INDEX";
+ case BFELF_ERROR_INVALID_SIGNATURE: return "BFELF_ERROR_INVALID_SIGNATURE";
+ case BFELF_ERROR_UNSUPPORTED_FILE: return "BFELF_ERROR_UNSUPPORTED_FILE";
+ case BFELF_ERROR_INVALID_SEGMENT: return "BFELF_ERROR_INVALID_SEGMENT";
+ case BFELF_ERROR_INVALID_SECTION: return "BFELF_ERROR_INVALID_SECTION";
+ case BFELF_ERROR_LOADER_FULL: return "BFELF_ERROR_LOADER_FULL";
+ case BFELF_ERROR_NO_SUCH_SYMBOL: return "BFELF_ERROR_NO_SUCH_SYMBOL";
+ case BFELF_ERROR_MISMATCH: return "BFELF_ERROR_MISMATCH";
+ case BFELF_ERROR_UNSUPPORTED_RELA: return "BFELF_ERROR_UNSUPPORTED_RELA";
+ case BFELF_ERROR_OUT_OF_ORDER: return "BFELF_ERROR_OUT_OF_ORDER";
+ case BFELF_ERROR_OUT_OF_MEMORY: return "BFELF_ERROR_OUT_OF_MEMORY";
+ case BF_ERROR_INVALID_ARG: return "BF_ERROR_INVALID_ARG";
+ case BF_ERROR_INVALID_INDEX: return "BF_ERROR_INVALID_INDEX";
+ case BF_ERROR_NO_MODULES_ADDED: return "BF_ERROR_NO_MODULES_ADDED";
+ case BF_ERROR_MAX_MODULES_REACHED: return "BF_ERROR_MAX_MODULES_REACHED";
+ case BF_ERROR_VMM_INVALID_STATE: return "BF_ERROR_VMM_INVALID_STATE";
+ case BF_ERROR_FAILED_TO_ADD_FILE: return "BF_ERROR_FAILED_TO_ADD_FILE";
+ case BF_ERROR_FAILED_TO_DUMP_DR: return "BF_ERROR_FAILED_TO_DUMP_DR";
+ case BF_ERROR_OUT_OF_MEMORY: return "BF_ERROR_OUT_OF_MEMORY";
+ case BF_ERROR_VMM_CORRUPTED: return "BF_ERROR_VMM_CORRUPTED";
+ case BF_ERROR_UNKNOWN: return "BF_ERROR_UNKNOWN";
+ case BF_BAD_ALLOC: return "BF_BAD_ALLOC";
+ case BF_IOCTL_FAILURE: return "BF_IOCTL_FAILURE";
+
+ default:
+ return "UNDEFINED_ERROR_CODE";
+ }
+}
+
+#endif
diff --git a/payloads/bareflank/include/bfexception.h b/payloads/bareflank/include/bfexception.h
new file mode 100755
index 00000000000..0e7f12794fc
--- /dev/null
+++ b/payloads/bareflank/include/bfexception.h
@@ -0,0 +1,144 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfexception.h
+///
+
+#ifndef BFEXCEPTION_H
+#define BFEXCEPTION_H
+
+#include
+#include
+
+#include
+#include
+#include
+
+/// Guard Exceptions
+///
+/// Catches all exceptions and prints the exception that occurred. The point of
+/// this function is to prevent any exception from bubbling beyond this point.
+///
+/// @expects
+/// @ensures
+///
+/// @param error_code an error code to return if an exception occurs
+/// @param func the function to run that is guarded
+/// @param error_func the function to run when an exception occurs
+/// @return error_code on failure, SUCCESS on success
+///
+template <
+ typename FUNC,
+ typename ERROR_FUNC,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+int64_t
+guard_exceptions(int64_t error_code, FUNC func, ERROR_FUNC error_func)
+{
+ try {
+ func();
+ return SUCCESS;
+ }
+ catch (std::bad_alloc &) {
+ error_func();
+ return BF_BAD_ALLOC;
+ }
+ catch (std::exception &e) {
+ bfdebug_transaction(0, [&](std::string * msg) {
+ bferror_lnbr(0, msg);
+ bferror_brk1(0, msg);
+ bferror_info(0, typeid(e).name(), msg);
+ bferror_brk1(0, msg);
+ bferror_info(0, e.what(), msg);
+ });
+ }
+ catch (...) {
+ bfdebug_transaction(0, [&](std::string * msg) {
+ bferror_lnbr(0, msg);
+ bferror_brk1(0, msg);
+ bferror_info(0, "unknown exception", msg);
+ bferror_brk1(0, msg);
+ });
+ }
+
+ error_func();
+ return error_code;
+}
+
+/// Guard Exceptions
+///
+/// Catches all exceptions and prints the exception that occurred. The point of
+/// this function is to prevent any exception from bubbling beyond this point.
+///
+/// @expects
+/// @ensures
+///
+/// @param error_code an error code to return if an exception occurs
+/// @param func the function to run that is guarded
+/// @return error_code on failure, SUCCESS on success
+///
+template <
+ typename FUNC,
+ typename = std::enable_if::value>
+ >
+int64_t
+guard_exceptions(int64_t error_code, FUNC && func)
+{ return guard_exceptions(error_code, std::forward(func), [] {}); }
+
+/// Guard Exceptions
+///
+/// Catches all exceptions and prints the exception that occurred. The point of
+/// this function is to prevent any exception from bubbling beyond this point.
+///
+/// @expects
+/// @ensures
+///
+/// @param func the function to run that is guarded
+///
+template <
+ typename FUNC,
+ typename = std::enable_if::value>
+ >
+void
+guard_exceptions(FUNC && func)
+{ guard_exceptions(0L, std::forward(func), [] {}); }
+
+/// Guard Exceptions
+///
+/// Catches all exceptions and prints the exception that occurred. The point of
+/// this function is to prevent any exception from bubbling beyond this point.
+///
+/// @expects
+/// @ensures
+///
+/// @param func the function to run that is guarded
+/// @param error_func the function to run when an exception occurs
+///
+template <
+ typename FUNC,
+ typename ERROR_FUNC,
+ typename = std::enable_if::value>,
+ typename = std::enable_if::value>
+ >
+void
+guard_exceptions(FUNC && func, ERROR_FUNC && error_func)
+{ guard_exceptions(0L, std::forward(func), std::forward(error_func)); }
+
+#endif
diff --git a/payloads/bareflank/include/bfexports.h b/payloads/bareflank/include/bfexports.h
new file mode 100644
index 00000000000..1cc48ccce0f
--- /dev/null
+++ b/payloads/bareflank/include/bfexports.h
@@ -0,0 +1,37 @@
+/*
+ * Bareflank Hypervisor
+ * Copyright (C) 2015 Assured Information Security, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef BFEXPORTS_H
+#define BFEXPORTS_H
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#define IMPORT_SYM __declspec(dllimport)
+#define EXPORT_SYM __declspec(dllexport)
+#else
+#define IMPORT_SYM
+#define EXPORT_SYM __attribute__ ((visibility ("default")))
+#endif
+
+#if defined(_WIN32) || defined(__CYGWIN__)
+#define WEAK_SYM
+#else
+#define WEAK_SYM __attribute__((weak))
+#endif
+
+#endif
diff --git a/payloads/bareflank/include/bffile.h b/payloads/bareflank/include/bffile.h
new file mode 100644
index 00000000000..57a9e0939de
--- /dev/null
+++ b/payloads/bareflank/include/bffile.h
@@ -0,0 +1,345 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bffile.h
+///
+
+#ifndef BFFILE_H
+#define BFFILE_H
+
+#include
+
+#include
+#include
+#include
+
+#include
+#include
+#include
+#include
+
+/// File
+///
+/// This class is responsible for working with a file. Specifically, this
+/// class wraps calls to ifstream and fstream to simplify their interface
+/// as well as provide an implementation for the rest of the Bareflank
+/// Manager, such that testing is easier.
+///
+class file
+{
+public:
+
+ using text_data = std::string; ///< File format for text data
+ using binary_data = bfn::buffer; ///< File format for binary data
+ using filename_type = std::string; ///< File name type
+ using extension_type = std::string; ///< Extension name type
+ using path_list_type = std::vector; ///< Find files path type
+ using filesize_type = std::size_t; ///< File size type
+
+ /// File Constructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// Creates a file class that can be used to working with files.
+ ///
+ file() noexcept = default;
+
+ /// File Destructor
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ VIRTUAL ~file() noexcept = default;
+
+ /// Read
+ ///
+ /// Reads the entire contents of a file, in text form
+ ///
+ /// @expects filename.empty() == false
+ /// @ensures none
+ ///
+ /// @param filename name of the file to read.
+ /// @return the contents of filename
+ ///
+ /// optimization notes:
+ /// - http://insanecoding.blogspot.it/2011/11/how-to-read-in-file-in-c.html
+ /// - since std::string has to initialize the backing array, reading in
+ /// a binary will always be faster. Thus, use read_binary if possible
+ ///
+ VIRTUAL text_data
+ read_text(const filename_type &filename) const
+ {
+ expects(!filename.empty());
+
+ std::fstream handle(filename, std::ios_base::in | std::ios_base::binary);
+ if (handle) {
+
+ handle.seekg(0, std::ios::end);
+ auto size = handle.tellg();
+
+ if (size <= 0) {
+ return text_data{};
+ }
+
+ handle.seekg(0, std::ios::beg);
+ text_data buffer(static_cast(size), 0);
+
+ handle.read(&buffer.front(), size);
+ return buffer;
+ }
+
+ throw std::runtime_error("invalid filename: " + filename);
+ }
+
+ /// Read
+ ///
+ /// Reads the entire contents of a file, in binary form
+ ///
+ /// @expects filename.empty() == false
+ /// @ensures none
+ ///
+ /// @param filename name of the file to read.
+ /// @return the contents of filename
+ ///
+ /// optimization notes:
+ /// - http://insanecoding.blogspot.it/2011/11/how-to-read-in-file-in-c.html
+ ///
+ VIRTUAL binary_data
+ read_binary(const filename_type &filename) const
+ {
+ expects(!filename.empty());
+
+ std::fstream handle(filename, std::ios_base::in | std::ios_base::binary);
+ if (handle) {
+
+ handle.seekg(0, std::ios::end);
+ auto size = handle.tellg();
+
+ if (size <= 0) {
+ return binary_data{};
+ }
+
+ handle.seekg(0, std::ios::beg);
+ binary_data buffer(static_cast(size));
+
+ handle.read(buffer.data(), size);
+ return buffer;
+ }
+
+ throw std::runtime_error("invalid filename: " + filename);
+ }
+
+ /// Write
+ ///
+ /// Writes text data to the file provided
+ ///
+ /// @expects filename.empty() == false
+ /// @expects buffer.empty() == false
+ /// @ensures none
+ ///
+ /// @param filename name of the file to write to.
+ /// @param buffer data to write
+ ///
+ VIRTUAL void
+ write_text(const filename_type &filename, const text_data &buffer) const
+ {
+ expects(!filename.empty());
+
+ std::fstream handle(filename, std::ios_base::out | std::ios_base::binary);
+ if (handle) {
+ handle.write(buffer.data(), static_cast(buffer.size()));
+ return;
+ }
+
+ throw std::runtime_error("invalid filename: " + filename);
+ }
+
+ /// Write
+ ///
+ /// Writes binary data to the file provided
+ ///
+ /// @expects filename.empty() == false
+ /// @expects buffer.empty() == false
+ /// @ensures none
+ ///
+ /// @param filename name of the file to write to.
+ /// @param buffer data to write
+ ///
+ VIRTUAL void
+ write_binary(const filename_type &filename, const binary_data &buffer) const
+ {
+ expects(!filename.empty());
+
+ std::fstream handle(filename, std::ios_base::out | std::ios_base::binary);
+ if (handle) {
+ handle.write(buffer.data(), static_cast(buffer.size()));
+ return;
+ }
+
+ throw std::runtime_error("invalid filename: " + filename);
+ }
+
+ /// Get File Extension
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param filename the file name to extract the extension
+ /// @return the filename's extension
+ ///
+ VIRTUAL extension_type
+ extension(const filename_type &filename) const
+ {
+ if (filename.empty()) {
+ return {};
+ }
+
+ auto index = filename.find_last_of('.');
+
+ if (index != filename_type::npos) {
+ return filename.substr(index);
+ }
+
+ return {};
+ }
+
+ /// File Exists
+ ///
+ /// @expects none
+ /// @ensures none
+ ///
+ /// @param filename the file name to check
+ /// @return true if the file exists, false otherwise
+ ///
+ VIRTUAL bool
+ exists(const filename_type &filename) const
+ {
+ std::ifstream handle{filename};
+ return handle.good();
+ }
+
+ /// File Size
+ ///
+ /// @expects filename.empty() == false
+ /// @ensures none
+ ///
+ /// @param filename to get the size of
+ /// @return size of filename
+ ///
+ VIRTUAL filesize_type
+ size(const filename_type &filename) const
+ {
+ expects(!filename.empty());
+
+ std::fstream handle(filename, std::ios_base::in | std::ios_base::binary);
+ if (handle) {
+ handle.seekg(0, std::ios::end);
+ return static_cast(handle.tellg());
+ }
+
+ throw std::runtime_error("invalid filename: " + filename);
+ }
+
+ /// Find Files
+ ///
+ /// Loops through all of the provided files and file paths and
+ /// returns a list of each filename combined with the path and the filename
+ /// that was first found. If a filename cannot be found, an exception is
+ /// thrown.
+ ///
+ /// @note we use the '/' separator on both Windows and POSIX. The reason
+ /// is both support '/' for the versions we support.
+ ///
+ /// @expects files.empty() == false
+ /// @expects paths.empty() == false
+ /// @ensures ret: path_list_type.size() == files.size()
+ ///
+ /// @param files list of files to locate in the list of provided paths
+ /// @param paths list of paths to search for the provided list of files
+ /// @return pull paths for each file located, throws otherwise
+ ///
+ VIRTUAL path_list_type
+ find_files(const path_list_type &files, const path_list_type &paths) const
+ {
+ expects(!paths.empty());
+ path_list_type results;
+
+ for (const auto &filename : files) {
+ auto found = false;
+
+ for (auto path : paths) {
+ path += '/';
+ path += filename;
+
+ if (exists(path)) {
+ results.push_back(path);
+
+ found = true;
+ break;
+ }
+ }
+
+ if (!found) {
+ throw std::runtime_error("unable to locate file: " + filename);
+ }
+ }
+
+ return results;
+ }
+
+ /// Get Home Directory
+ ///
+ /// @expects none
+ /// @expects none
+ ///
+ /// @return returns home directory
+ ///
+ VIRTUAL std::string
+ home() const
+ {
+ char *home;
+
+ home = std::getenv("HOME");
+ if (home != nullptr) {
+ return {home};
+ }
+
+ home = std::getenv("HOMEPATH");
+ if (home != nullptr) {
+ return {home};
+ }
+
+ throw std::runtime_error("HOME or HOMEPATH not set");
+ }
+
+public:
+
+ /// @cond
+
+ file(file &&) noexcept = default;
+ file &operator=(file &&) noexcept = default;
+
+ file(const file &) = default;
+ file &operator=(const file &) = default;
+
+ /// @endcond
+};
+
+#endif
diff --git a/payloads/bareflank/include/bfgsl.h b/payloads/bareflank/include/bfgsl.h
new file mode 100644
index 00000000000..4e8ee400ee2
--- /dev/null
+++ b/payloads/bareflank/include/bfgsl.h
@@ -0,0 +1,282 @@
+//
+// Bareflank Hypervisor
+// Copyright (C) 2015 Assured Information Security, Inc.
+//
+// This library is free software; you can redistribute it and/or
+// modify it under the terms of the GNU Lesser General Public
+// License as published by the Free Software Foundation; either
+// version 2.1 of the License, or (at your option) any later version.
+//
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// Lesser General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public
+// License along with this library; if not, write to the Free Software
+// Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+///
+/// @file bfgsl.h
+///
+
+#ifndef BFGSL_H
+#define BFGSL_H
+
+#if defined(__clang__) || defined(__GNUC__)
+#pragma GCC system_header
+#endif
+
+#include
+
+/// @cond
+
+#define concat1(a,b) a ## b
+#define concat2(a,b) concat1(a,b)
+#define ___ concat2(dont_care, __COUNTER__)
+
+/// @endcond
+
+#ifndef NEED_GSL_LITE
+
+#include
+
+namespace gsl
+{
+
+/// @cond
+
+#define expects(cond) Expects(cond)
+#define ensures(cond) Ensures(cond)
+
+template
+class final_act_success
+{
+public:
+ explicit final_act_success(F f) noexcept : f_(std::move(f)), invoke_(true) {}
+
+ final_act_success(final_act_success &&other) noexcept : f_(std::move(other.f_)), invoke_(other.invoke_)
+ {
+ other.invoke_ = false;
+ }
+
+ final_act_success(const final_act_success &) = delete;
+ final_act_success &operator=(const final_act_success &) = delete;
+
+ ~final_act_success() noexcept
+ {
+ if (std::uncaught_exception()) {
+ return;
+ }
+
+ if (invoke_) { f_(); }
+ }
+
+private:
+ F f_;
+ bool invoke_;
+};
+
+template
+class final_act_failure
+{
+public:
+ explicit final_act_failure(F f) noexcept : f_(std::move(f)), invoke_(true) {}
+
+ final_act_failure(final_act_failure &&other) noexcept : f_(std::move(other.f_)), invoke_(other.invoke_)
+ {
+ other.invoke_ = false;
+ }
+
+ final_act_failure(const final_act_failure &) = delete;
+ final_act_failure &operator=(const final_act_failure &) = delete;
+
+ ~final_act_failure() noexcept
+ {
+ if (!std::uncaught_exception()) {
+ return;
+ }
+
+ if (invoke_) { f_(); }
+ }
+
+private:
+ F f_;
+ bool invoke_;
+};
+
+template
+inline final_act_success on_success(const F &f) noexcept
+{
+ return final_act_success(f);
+}
+
+template
+inline final_act_success on_success(F &&f) noexcept
+{
+ return final_act_success(std::forward