1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
#!/usr/bin/env python
# A small helper script to help decoding flag fields in various kernel
# data structures. VM flags only, for now.
from functools import partial
def get_flags(flag_defs, flag_word):
flags = []
for (name, bit) in flag_defs:
if flag_word & bit:
flags.append(name)
return flags
def format_flags(flag_defs, flag_word):
return " | ".join(get_flags(flag_defs, flag_word))
# Linux Kernel 2.6.32
VM_FLAGS = [
("VM_READ", 0x00000001),
("VM_WRITE", 0x00000002),
("VM_EXEC", 0x00000004),
("VM_SHARED", 0x00000008),
("VM_MAYREAD", 0x00000010),
("VM_MAYWRITE", 0x00000020),
("VM_MAYEXEC", 0x00000040),
("VM_MAYSHARE", 0x00000080),
("VM_GROWSDOWN", 0x00000100),
("VM_GROWSUP", 0x00000200),
("VM_PFNMAP", 0x00000400),
("VM_DENYWRITE", 0x00000800),
("VM_EXECUTABLE", 0x00001000),
("VM_LOCKED", 0x00002000),
("VM_IO", 0x00004000),
("VM_SEQ_READ", 0x00008000),
("VM_RAND_READ", 0x00010000),
("VM_DONTCOPY", 0x00020000),
("VM_DONTEXPAND", 0x00040000),
("VM_RESERVED", 0x00080000),
("VM_ACCOUNT", 0x00100000),
("VM_NORESERVE", 0x00200000),
("VM_HUGETLB", 0x00400000),
("VM_NONLINEAR", 0x00800000),
("VM_MAPPED_COPY", 0x01000000),
("VM_INSERTPAGE", 0x02000000),
("VM_ALWAYSDUMP", 0x04000000),
("VM_CAN_NONLINEAR", 0x08000000),
("VM_MIXEDMAP", 0x10000000),
("VM_SAO", 0x20000000),
("VM_PFN_AT_MMAP", 0x40000000),
("VM_MERGEABLE", 0x80000000)
]
get_vm_flags = partial(get_flags, VM_FLAGS)
format_vm_flags = partial(format_flags, VM_FLAGS)
X86_PTE_FLAGS = [
("PAGE_BIT_PRESENT", 1 << 0),
("PAGE_BIT_RW", 1 << 1),
("PAGE_BIT_USER", 1 << 2),
("PAGE_BIT_PWT", 1 << 3),
("PAGE_BIT_PCD", 1 << 4),
("PAGE_BIT_ACCESSED", 1 << 5),
("PAGE_BIT_DIRTY", 1 << 6),
("PAGE_BIT_PSE", 1 << 7),
("PAGE_BIT_PAT", 1 << 7),
("PAGE_BIT_GLOBAL", 1 << 8),
("PAGE_BIT_UNUSED1", 1 << 9),
("PAGE_BIT_IOMAP", 1 << 10),
("PAGE_BIT_HIDDEN", 1 << 11),
("PAGE_BIT_PAT_LARGE", 1 << 12),
("PAGE_BIT_NX", 1 << 63),
]
get_pte_flags = partial(get_flags, X86_PTE_FLAGS)
format_pte_flags = partial(format_flags, X86_PTE_FLAGS)
|
