223 lines
10 KiB
Python
223 lines
10 KiB
Python
|
# SPDX-License-Identifier: GPL-2.0-only
|
||
|
|
#
|
||
|
|
# gdb helper commands and functions for Linux kernel debugging
|
||
|
|
#
|
||
|
|
# routines to introspect page table
|
||
|
|
#
|
||
|
|
# Authors:
|
||
|
|
# Dmitrii Bundin <dmitrii.bundin.a@gmail.com>
|
||
|
|
#
|
||
|
|
|
||
|
|
import gdb
|
||
|
|
|
||
|
|
from linux import utils
|
||
|
|
|
||
|
|
PHYSICAL_ADDRESS_MASK = gdb.parse_and_eval('0xfffffffffffff')
|
||
|
|
|
||
|
|
|
||
|
|
def page_mask(level=1):
|
||
|
|
# 4KB
|
||
|
|
if level == 1:
|
||
|
|
return gdb.parse_and_eval('(u64) ~0xfff')
|
||
|
|
# 2MB
|
||
|
|
elif level == 2:
|
||
|
|
return gdb.parse_and_eval('(u64) ~0x1fffff')
|
||
|
|
# 1GB
|
||
|
|
elif level == 3:
|
||
|
|
return gdb.parse_and_eval('(u64) ~0x3fffffff')
|
||
|
|
else:
|
||
|
|
raise Exception(f'Unknown page level: {level}')
|
||
|
|
|
||
|
|
|
||
|
|
#page_offset_base in case CONFIG_DYNAMIC_MEMORY_LAYOUT is disabled
|
||
|
|
POB_NO_DYNAMIC_MEM_LAYOUT = '0xffff888000000000'
|
||
|
|
def _page_offset_base():
|
||
|
|
pob_symbol = gdb.lookup_global_symbol('page_offset_base')
|
||
|
|
pob = pob_symbol.name if pob_symbol else POB_NO_DYNAMIC_MEM_LAYOUT
|
||
|
|
return gdb.parse_and_eval(pob)
|
||
|
|
|
||
|
|
|
||
|
|
def is_bit_defined_tupled(data, offset):
|
||
|
|
return offset, bool(data >> offset & 1)
|
||
|
|
|
||
|
|
def content_tupled(data, bit_start, bit_end):
|
||
|
|
return (bit_start, bit_end), data >> bit_start & ((1 << (1 + bit_end - bit_start)) - 1)
|
||
|
|
|
||
|
|
def entry_va(level, phys_addr, translating_va):
|
||
|
|
def start_bit(level):
|
||
|
|
if level == 5:
|
||
|
|
return 48
|
||
|
|
elif level == 4:
|
||
|
|
return 39
|
||
|
|
elif level == 3:
|
||
|
|
return 30
|
||
|
|
elif level == 2:
|
||
|
|
return 21
|
||
|
|
elif level == 1:
|
||
|
|
return 12
|
||
|
|
else:
|
||
|
|
raise Exception(f'Unknown level {level}')
|
||
|
|
|
||
|
|
entry_offset = ((translating_va >> start_bit(level)) & 511) * 8
|
||
|
|
entry_va = _page_offset_base() + phys_addr + entry_offset
|
||
|
|
return entry_va
|
||
|
|
|
||
|
|
class Cr3():
|
||
|
|
def __init__(self, cr3, page_levels):
|
||
|
|
self.cr3 = cr3
|
||
|
|
self.page_levels = page_levels
|
||
|
|
self.page_level_write_through = is_bit_defined_tupled(cr3, 3)
|
||
|
|
self.page_level_cache_disabled = is_bit_defined_tupled(cr3, 4)
|
||
|
|
self.next_entry_physical_address = cr3 & PHYSICAL_ADDRESS_MASK & page_mask()
|
||
|
|
|
||
|
|
def next_entry(self, va):
|
||
|
|
next_level = self.page_levels
|
||
|
|
return PageHierarchyEntry(entry_va(next_level, self.next_entry_physical_address, va), next_level)
|
||
|
|
|
||
|
|
def mk_string(self):
|
||
|
|
return f"""\
|
||
|
|
cr3:
|
||
|
|
{'cr3 binary data': <30} {hex(self.cr3)}
|
||
|
|
{'next entry physical address': <30} {hex(self.next_entry_physical_address)}
|
||
|
|
---
|
||
|
|
{'bit' : <4} {self.page_level_write_through[0]: <10} {'page level write through': <30} {self.page_level_write_through[1]}
|
||
|
|
{'bit' : <4} {self.page_level_cache_disabled[0]: <10} {'page level cache disabled': <30} {self.page_level_cache_disabled[1]}
|
||
|
|
"""
|
||
|
|
|
||
|
|
|
||
|
|
class PageHierarchyEntry():
|
||
|
|
def __init__(self, address, level):
|
||
|
|
data = int.from_bytes(
|
||
|
|
memoryview(gdb.selected_inferior().read_memory(address, 8)),
|
||
|
|
"little"
|
||
|
|
)
|
||
|
|
if level == 1:
|
||
|
|
self.is_page = True
|
||
|
|
self.entry_present = is_bit_defined_tupled(data, 0)
|
||
|
|
self.read_write = is_bit_defined_tupled(data, 1)
|
||
|
|
self.user_access_allowed = is_bit_defined_tupled(data, 2)
|
||
|
|
self.page_level_write_through = is_bit_defined_tupled(data, 3)
|
||
|
|
self.page_level_cache_disabled = is_bit_defined_tupled(data, 4)
|
||
|
|
self.entry_was_accessed = is_bit_defined_tupled(data, 5)
|
||
|
|
self.dirty = is_bit_defined_tupled(data, 6)
|
||
|
|
self.pat = is_bit_defined_tupled(data, 7)
|
||
|
|
self.global_translation = is_bit_defined_tupled(data, 8)
|
||
|
|
self.page_physical_address = data & PHYSICAL_ADDRESS_MASK & page_mask(level)
|
||
|
|
self.next_entry_physical_address = None
|
||
|
|
self.hlat_restart_with_ordinary = is_bit_defined_tupled(data, 11)
|
||
|
|
self.protection_key = content_tupled(data, 59, 62)
|
||
|
|
self.executed_disable = is_bit_defined_tupled(data, 63)
|
||
|
|
else:
|
||
|
|
page_size = is_bit_defined_tupled(data, 7)
|
||
|
|
page_size_bit = page_size[1]
|
||
|
|
self.is_page = page_size_bit
|
||
|
|
self.entry_present = is_bit_defined_tupled(data, 0)
|
||
|
|
self.read_write = is_bit_defined_tupled(data, 1)
|
||
|
|
self.user_access_allowed = is_bit_defined_tupled(data, 2)
|
||
|
|
self.page_level_write_through = is_bit_defined_tupled(data, 3)
|
||
|
|
self.page_level_cache_disabled = is_bit_defined_tupled(data, 4)
|
||
|
|
self.entry_was_accessed = is_bit_defined_tupled(data, 5)
|
||
|
|
self.page_size = page_size
|
||
|
|
self.dirty = is_bit_defined_tupled(
|
||
|
|
data, 6) if page_size_bit else None
|
||
|
|
self.global_translation = is_bit_defined_tupled(
|
||
|
|
data, 8) if page_size_bit else None
|
||
|
|
self.pat = is_bit_defined_tupled(
|
||
|
|
data, 12) if page_size_bit else None
|
||
|
|
self.page_physical_address = data & PHYSICAL_ADDRESS_MASK & page_mask(level) if page_size_bit else None
|
||
|
|
self.next_entry_physical_address = None if page_size_bit else data & PHYSICAL_ADDRESS_MASK & page_mask()
|
||
|
|
self.hlat_restart_with_ordinary = is_bit_defined_tupled(data, 11)
|
||
|
|
self.protection_key = content_tupled(data, 59, 62) if page_size_bit else None
|
||
|
|
self.executed_disable = is_bit_defined_tupled(data, 63)
|
||
|
|
self.address = address
|
||
|
|
self.page_entry_binary_data = data
|
||
|
|
self.page_hierarchy_level = level
|
||
|
|
|
||
|
|
def next_entry(self, va):
|
||
|
|
if self.is_page or not self.entry_present[1]:
|
||
|
|
return None
|
||
|
|
|
||
|
|
next_level = self.page_hierarchy_level - 1
|
||
|
|
return PageHierarchyEntry(entry_va(next_level, self.next_entry_physical_address, va), next_level)
|
||
|
|
|
||
|
|
|
||
|
|
def mk_string(self):
|
||
|
|
if not self.entry_present[1]:
|
||
|
|
return f"""\
|
||
|
|
level {self.page_hierarchy_level}:
|
||
|
|
{'entry address': <30} {hex(self.address)}
|
||
|
|
{'page entry binary data': <30} {hex(self.page_entry_binary_data)}
|
||
|
|
---
|
||
|
|
PAGE ENTRY IS NOT PRESENT!
|
||
|
|
"""
|
||
|
|
elif self.is_page:
|
||
|
|
def page_size_line(ps_bit, ps, level):
|
||
|
|
return "" if level == 1 else f"{'bit': <3} {ps_bit: <5} {'page size': <30} {ps}"
|
||
|
|
|
||
|
|
return f"""\
|
||
|
|
level {self.page_hierarchy_level}:
|
||
|
|
{'entry address': <30} {hex(self.address)}
|
||
|
|
{'page entry binary data': <30} {hex(self.page_entry_binary_data)}
|
||
|
|
{'page size': <30} {'1GB' if self.page_hierarchy_level == 3 else '2MB' if self.page_hierarchy_level == 2 else '4KB' if self.page_hierarchy_level == 1 else 'Unknown page size for level:' + self.page_hierarchy_level}
|
||
|
|
{'page physical address': <30} {hex(self.page_physical_address)}
|
||
|
|
---
|
||
|
|
{'bit': <4} {self.entry_present[0]: <10} {'entry present': <30} {self.entry_present[1]}
|
||
|
|
{'bit': <4} {self.read_write[0]: <10} {'read/write access allowed': <30} {self.read_write[1]}
|
||
|
|
{'bit': <4} {self.user_access_allowed[0]: <10} {'user access allowed': <30} {self.user_access_allowed[1]}
|
||
|
|
{'bit': <4} {self.page_level_write_through[0]: <10} {'page level write through': <30} {self.page_level_write_through[1]}
|
||
|
|
{'bit': <4} {self.page_level_cache_disabled[0]: <10} {'page level cache disabled': <30} {self.page_level_cache_disabled[1]}
|
||
|
|
{'bit': <4} {self.entry_was_accessed[0]: <10} {'entry has been accessed': <30} {self.entry_was_accessed[1]}
|
||
|
|
{"" if self.page_hierarchy_level == 1 else f"{'bit': <4} {self.page_size[0]: <10} {'page size': <30} {self.page_size[1]}"}
|
||
|
|
{'bit': <4} {self.dirty[0]: <10} {'page dirty': <30} {self.dirty[1]}
|
||
|
|
{'bit': <4} {self.global_translation[0]: <10} {'global translation': <30} {self.global_translation[1]}
|
||
|
|
{'bit': <4} {self.hlat_restart_with_ordinary[0]: <10} {'restart to ordinary': <30} {self.hlat_restart_with_ordinary[1]}
|
||
|
|
{'bit': <4} {self.pat[0]: <10} {'pat': <30} {self.pat[1]}
|
||
|
|
{'bits': <4} {str(self.protection_key[0]): <10} {'protection key': <30} {self.protection_key[1]}
|
||
|
|
{'bit': <4} {self.executed_disable[0]: <10} {'execute disable': <30} {self.executed_disable[1]}
|
||
|
|
"""
|
||
|
|
else:
|
||
|
|
return f"""\
|
||
|
|
level {self.page_hierarchy_level}:
|
||
|
|
{'entry address': <30} {hex(self.address)}
|
||
|
|
{'page entry binary data': <30} {hex(self.page_entry_binary_data)}
|
||
|
|
{'next entry physical address': <30} {hex(self.next_entry_physical_address)}
|
||
|
|
---
|
||
|
|
{'bit': <4} {self.entry_present[0]: <10} {'entry present': <30} {self.entry_present[1]}
|
||
|
|
{'bit': <4} {self.read_write[0]: <10} {'read/write access allowed': <30} {self.read_write[1]}
|
||
|
|
{'bit': <4} {self.user_access_allowed[0]: <10} {'user access allowed': <30} {self.user_access_allowed[1]}
|
||
|
|
{'bit': <4} {self.page_level_write_through[0]: <10} {'page level write through': <30} {self.page_level_write_through[1]}
|
||
|
|
{'bit': <4} {self.page_level_cache_disabled[0]: <10} {'page level cache disabled': <30} {self.page_level_cache_disabled[1]}
|
||
|
|
{'bit': <4} {self.entry_was_accessed[0]: <10} {'entry has been accessed': <30} {self.entry_was_accessed[1]}
|
||
|
|
{'bit': <4} {self.page_size[0]: <10} {'page size': <30} {self.page_size[1]}
|
||
|
|
{'bit': <4} {self.hlat_restart_with_ordinary[0]: <10} {'restart to ordinary': <30} {self.hlat_restart_with_ordinary[1]}
|
||
|
|
{'bit': <4} {self.executed_disable[0]: <10} {'execute disable': <30} {self.executed_disable[1]}
|
||
|
|
"""
|
||
|
|
|
||
|
|
|
||
|
|
class TranslateVM(gdb.Command):
|
||
|
|
"""Prints the entire paging structure used to translate a given virtual address.
|
||
|
|
|
||
|
|
Having an address space of the currently executed process translates the virtual address
|
||
|
|
and prints detailed information of all paging structure levels used for the transaltion.
|
||
|
|
Currently supported arch: x86"""
|
||
|
|
|
||
|
|
def __init__(self):
|
||
|
|
super(TranslateVM, self).__init__('translate-vm', gdb.COMMAND_USER)
|
||
|
|
|
||
|
|
def invoke(self, arg, from_tty):
|
||
|
|
if utils.is_target_arch("x86"):
|
||
|
|
vm_address = gdb.parse_and_eval(f'{arg}')
|
||
|
|
cr3_data = gdb.parse_and_eval('$cr3')
|
||
|
|
cr4 = gdb.parse_and_eval('$cr4')
|
||
|
|
page_levels = 5 if cr4 & (1 << 12) else 4
|
||
|
|
page_entry = Cr3(cr3_data, page_levels)
|
||
|
|
while page_entry:
|
||
|
|
gdb.write(page_entry.mk_string())
|
||
|
|
page_entry = page_entry.next_entry(vm_address)
|
||
|
|
else:
|
||
|
|
gdb.GdbError("Virtual address translation is not"
|
||
|
|
"supported for this arch")
|
||
|
|
|
||
|
|
|
||
|
|
TranslateVM()
|