From 8bf08ebedcd22cf6ecfa5e890358586b05e7c4e7 Mon Sep 17 00:00:00 2001 From: "Bjoern B. Brandenburg" Date: Wed, 3 Feb 2010 13:47:35 -0500 Subject: start Linux flags decoding tool / library --- flags.py | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 flags.py diff --git a/flags.py b/flags.py new file mode 100644 index 0000000..6631480 --- /dev/null +++ b/flags.py @@ -0,0 +1,78 @@ +#!/usr/bin/env python + +# A small helper script to help decoding flag fields in various kernel +# data structures. VM flags only, for now. + +from functools import partial + +def get_flags(flag_defs, flag_word): + flags = [] + for (name, bit) in flag_defs: + if flag_word & bit: + flags.append(name) + return flags + +def format_flags(flag_defs, flag_word): + return " | ".join(get_flags(flag_defs, flag_word)) + +# Linux Kernel 2.6.32 +VM_FLAGS = [ + ("VM_READ", 0x00000001), + ("VM_WRITE", 0x00000002), + ("VM_EXEC", 0x00000004), + ("VM_SHARED", 0x00000008), + ("VM_MAYREAD", 0x00000010), + ("VM_MAYWRITE", 0x00000020), + ("VM_MAYEXEC", 0x00000040), + ("VM_MAYSHARE", 0x00000080), + ("VM_GROWSDOWN", 0x00000100), + ("VM_GROWSUP", 0x00000200), + ("VM_PFNMAP", 0x00000400), + ("VM_DENYWRITE", 0x00000800), + ("VM_EXECUTABLE", 0x00001000), + ("VM_LOCKED", 0x00002000), + ("VM_IO", 0x00004000), + ("VM_SEQ_READ", 0x00008000), + ("VM_RAND_READ", 0x00010000), + ("VM_DONTCOPY", 0x00020000), + ("VM_DONTEXPAND", 0x00040000), + ("VM_RESERVED", 0x00080000), + ("VM_ACCOUNT", 0x00100000), + ("VM_NORESERVE", 0x00200000), + ("VM_HUGETLB", 0x00400000), + ("VM_NONLINEAR", 0x00800000), + ("VM_MAPPED_COPY", 0x01000000), + ("VM_INSERTPAGE", 0x02000000), + ("VM_ALWAYSDUMP", 0x04000000), + ("VM_CAN_NONLINEAR", 0x08000000), + ("VM_MIXEDMAP", 0x10000000), + ("VM_SAO", 0x20000000), + ("VM_PFN_AT_MMAP", 0x40000000), + ("VM_MERGEABLE", 0x80000000) + ] + + +get_vm_flags = partial(get_flags, VM_FLAGS) +format_vm_flags = partial(format_flags, VM_FLAGS) + + +X86_PTE_FLAGS = [ + ("PAGE_BIT_PRESENT", 1 << 0), + ("PAGE_BIT_RW", 1 << 1), + ("PAGE_BIT_USER", 1 << 2), + ("PAGE_BIT_PWT", 1 << 3), + ("PAGE_BIT_PCD", 1 << 4), + ("PAGE_BIT_ACCESSED", 1 << 5), + ("PAGE_BIT_DIRTY", 1 << 6), + ("PAGE_BIT_PSE", 1 << 7), + ("PAGE_BIT_PAT", 1 << 7), + ("PAGE_BIT_GLOBAL", 1 << 8), + ("PAGE_BIT_UNUSED1", 1 << 9), + ("PAGE_BIT_IOMAP", 1 << 10), + ("PAGE_BIT_HIDDEN", 1 << 11), + ("PAGE_BIT_PAT_LARGE", 1 << 12), + ("PAGE_BIT_NX", 1 << 63), +] + +get_pte_flags = partial(get_flags, X86_PTE_FLAGS) +format_pte_flags = partial(format_flags, X86_PTE_FLAGS) -- cgit v1.2.2