f2734ab022
Rather than stuffing various values in a uintptr_t based on type using casts, use a union for this instead. No functional difference, but the semantics of the data member are now much clearer to the casual observer since it is now formally defined by this union. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
606 lines
18 KiB
Python
606 lines
18 KiB
Python
#!/usr/bin/env python3
|
|
#
|
|
# Copyright (c) 2017-2018 Linaro
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
import sys
|
|
import os
|
|
import struct
|
|
from distutils.version import LooseVersion
|
|
|
|
from collections import OrderedDict
|
|
|
|
import elftools
|
|
from elftools.elf.elffile import ELFFile
|
|
from elftools.elf.sections import SymbolTableSection
|
|
|
|
if LooseVersion(elftools.__version__) < LooseVersion('0.24'):
|
|
sys.exit("pyelftools is out of date, need version 0.24 or later")
|
|
|
|
|
|
def subsystem_to_enum(subsys):
|
|
return "K_OBJ_DRIVER_" + subsys[:-11].upper()
|
|
|
|
|
|
def kobject_to_enum(kobj):
|
|
if kobj.startswith("k_") or kobj.startswith("_k_"):
|
|
name = kobj[2:]
|
|
else:
|
|
name = kobj
|
|
|
|
return "K_OBJ_%s" % name.upper()
|
|
|
|
|
|
DW_OP_addr = 0x3
|
|
DW_OP_fbreg = 0x91
|
|
STACK_TYPE = "_k_thread_stack_element"
|
|
thread_counter = 0
|
|
sys_mutex_counter = 0
|
|
futex_counter = 0
|
|
|
|
# Global type environment. Populated by pass 1.
|
|
type_env = {}
|
|
extern_env = {}
|
|
kobjects = {}
|
|
subsystems = {}
|
|
|
|
# --- debug stuff ---
|
|
|
|
scr = os.path.basename(sys.argv[0])
|
|
|
|
# --- type classes ----
|
|
|
|
|
|
class KobjectInstance:
|
|
def __init__(self, type_obj, addr):
|
|
global thread_counter
|
|
global sys_mutex_counter
|
|
global futex_counter
|
|
|
|
self.addr = addr
|
|
self.type_obj = type_obj
|
|
|
|
# Type name determined later since drivers needs to look at the
|
|
# API struct address
|
|
self.type_name = None
|
|
|
|
if self.type_obj.name == "k_thread":
|
|
# Assign an ID for this thread object, used to track its
|
|
# permissions to other kernel objects
|
|
self.data = thread_counter
|
|
thread_counter = thread_counter + 1
|
|
elif self.type_obj.name == "sys_mutex":
|
|
self.data = "&kernel_mutexes[%d]" % sys_mutex_counter
|
|
sys_mutex_counter += 1
|
|
elif self.type_obj.name == "k_futex":
|
|
self.data = "&futex_data[%d]" % futex_counter
|
|
futex_counter += 1
|
|
else:
|
|
self.data = 0
|
|
|
|
|
|
class KobjectType:
|
|
def __init__(self, offset, name, size, api=False):
|
|
self.name = name
|
|
self.size = size
|
|
self.offset = offset
|
|
self.api = api
|
|
|
|
def __repr__(self):
|
|
return "<kobject %s>" % self.name
|
|
|
|
@staticmethod
|
|
def has_kobject():
|
|
return True
|
|
|
|
def get_kobjects(self, addr):
|
|
return {addr: KobjectInstance(self, addr)}
|
|
|
|
|
|
class ArrayType:
|
|
def __init__(self, offset, elements, member_type):
|
|
self.elements = elements
|
|
self.member_type = member_type
|
|
self.offset = offset
|
|
|
|
def __repr__(self):
|
|
return "<array of %d>" % self.member_type
|
|
|
|
def has_kobject(self):
|
|
if self.member_type not in type_env:
|
|
return False
|
|
|
|
return type_env[self.member_type].has_kobject()
|
|
|
|
def get_kobjects(self, addr):
|
|
mt = type_env[self.member_type]
|
|
|
|
# Stacks are arrays of _k_stack_element_t but we want to treat
|
|
# the whole array as one kernel object (a thread stack)
|
|
# Data value gets set to size of entire region
|
|
if isinstance(mt, KobjectType) and mt.name == STACK_TYPE:
|
|
# An array of stacks appears as a multi-dimensional array.
|
|
# The last size is the size of each stack. We need to track
|
|
# each stack within the array, not as one huge stack object.
|
|
*dimensions, stacksize = self.elements
|
|
num_members = 1
|
|
for e in dimensions:
|
|
num_members = num_members * e
|
|
|
|
ret = {}
|
|
for i in range(num_members):
|
|
a = addr + (i * stacksize)
|
|
o = mt.get_kobjects(a)
|
|
o[a].data = stacksize
|
|
ret.update(o)
|
|
return ret
|
|
|
|
objs = {}
|
|
|
|
# Multidimensional array flattened out
|
|
num_members = 1
|
|
for e in self.elements:
|
|
num_members = num_members * e
|
|
|
|
for i in range(num_members):
|
|
objs.update(mt.get_kobjects(addr + (i * mt.size)))
|
|
return objs
|
|
|
|
|
|
class AggregateTypeMember:
|
|
def __init__(self, offset, member_name, member_type, member_offset):
|
|
self.member_name = member_name
|
|
self.member_type = member_type
|
|
if isinstance(member_offset, list):
|
|
# DWARF v2, location encoded as set of operations
|
|
# only "DW_OP_plus_uconst" with ULEB128 argument supported
|
|
if member_offset[0] == 0x23:
|
|
self.member_offset = member_offset[1] & 0x7f
|
|
for i in range(1, len(member_offset)-1):
|
|
if member_offset[i] & 0x80:
|
|
self.member_offset += (
|
|
member_offset[i+1] & 0x7f) << i*7
|
|
else:
|
|
raise Exception("not yet supported location operation (%s:%d:%d)" %
|
|
(self.member_name, self.member_type, member_offset[0]))
|
|
else:
|
|
self.member_offset = member_offset
|
|
|
|
def __repr__(self):
|
|
return "<member %s, type %d, offset %d>" % (
|
|
self.member_name, self.member_type, self.member_offset)
|
|
|
|
def has_kobject(self):
|
|
if self.member_type not in type_env:
|
|
return False
|
|
|
|
return type_env[self.member_type].has_kobject()
|
|
|
|
def get_kobjects(self, addr):
|
|
mt = type_env[self.member_type]
|
|
return mt.get_kobjects(addr + self.member_offset)
|
|
|
|
|
|
class ConstType:
|
|
def __init__(self, child_type):
|
|
self.child_type = child_type
|
|
|
|
def __repr__(self):
|
|
return "<const %d>" % self.child_type
|
|
|
|
def has_kobject(self):
|
|
if self.child_type not in type_env:
|
|
return False
|
|
|
|
return type_env[self.child_type].has_kobject()
|
|
|
|
def get_kobjects(self, addr):
|
|
return type_env[self.child_type].get_kobjects(addr)
|
|
|
|
|
|
class AggregateType:
|
|
def __init__(self, offset, name, size):
|
|
self.name = name
|
|
self.size = size
|
|
self.offset = offset
|
|
self.members = []
|
|
|
|
def add_member(self, member):
|
|
self.members.append(member)
|
|
|
|
def __repr__(self):
|
|
return "<struct %s, with %s>" % (self.name, self.members)
|
|
|
|
def has_kobject(self):
|
|
result = False
|
|
|
|
bad_members = []
|
|
|
|
for member in self.members:
|
|
if member.has_kobject():
|
|
result = True
|
|
else:
|
|
bad_members.append(member)
|
|
# Don't need to consider this again, just remove it
|
|
|
|
for bad_member in bad_members:
|
|
self.members.remove(bad_member)
|
|
|
|
return result
|
|
|
|
def get_kobjects(self, addr):
|
|
objs = {}
|
|
for member in self.members:
|
|
objs.update(member.get_kobjects(addr))
|
|
return objs
|
|
|
|
|
|
# --- helper functions for getting data from DIEs ---
|
|
|
|
def die_get_spec(die):
|
|
if 'DW_AT_specification' not in die.attributes:
|
|
return None
|
|
|
|
spec_val = die.attributes["DW_AT_specification"].value
|
|
|
|
# offset of the DW_TAG_variable for the extern declaration
|
|
offset = spec_val + die.cu.cu_offset
|
|
|
|
return extern_env.get(offset)
|
|
|
|
|
|
def die_get_name(die):
|
|
if 'DW_AT_name' not in die.attributes:
|
|
die = die_get_spec(die)
|
|
if not die:
|
|
return None
|
|
|
|
return die.attributes["DW_AT_name"].value.decode("utf-8")
|
|
|
|
|
|
def die_get_type_offset(die):
|
|
if 'DW_AT_type' not in die.attributes:
|
|
die = die_get_spec(die)
|
|
if not die:
|
|
return None
|
|
|
|
return die.attributes["DW_AT_type"].value + die.cu.cu_offset
|
|
|
|
|
|
def die_get_byte_size(die):
|
|
if 'DW_AT_byte_size' not in die.attributes:
|
|
return 0
|
|
|
|
return die.attributes["DW_AT_byte_size"].value
|
|
|
|
|
|
def analyze_die_struct(die):
|
|
name = die_get_name(die) or "<anon>"
|
|
offset = die.offset
|
|
size = die_get_byte_size(die)
|
|
|
|
# Incomplete type
|
|
if not size:
|
|
return
|
|
|
|
if name in kobjects:
|
|
type_env[offset] = KobjectType(offset, name, size)
|
|
elif name in subsystems:
|
|
type_env[offset] = KobjectType(offset, name, size, api=True)
|
|
else:
|
|
at = AggregateType(offset, name, size)
|
|
type_env[offset] = at
|
|
|
|
for child in die.iter_children():
|
|
if child.tag != "DW_TAG_member":
|
|
continue
|
|
data_member_location = child.attributes.get("DW_AT_data_member_location")
|
|
if not data_member_location:
|
|
continue
|
|
|
|
child_type = die_get_type_offset(child)
|
|
member_offset = data_member_location.value
|
|
cname = die_get_name(child) or "<anon>"
|
|
m = AggregateTypeMember(child.offset, cname, child_type,
|
|
member_offset)
|
|
at.add_member(m)
|
|
|
|
return
|
|
|
|
|
|
def analyze_die_const(die):
|
|
type_offset = die_get_type_offset(die)
|
|
if not type_offset:
|
|
return
|
|
|
|
type_env[die.offset] = ConstType(type_offset)
|
|
|
|
|
|
def analyze_die_array(die):
|
|
type_offset = die_get_type_offset(die)
|
|
elements = []
|
|
|
|
for child in die.iter_children():
|
|
if child.tag != "DW_TAG_subrange_type":
|
|
continue
|
|
if "DW_AT_upper_bound" not in child.attributes:
|
|
continue
|
|
|
|
ub = child.attributes["DW_AT_upper_bound"]
|
|
if not ub.form.startswith("DW_FORM_data"):
|
|
continue
|
|
|
|
elements.append(ub.value + 1)
|
|
|
|
if not elements:
|
|
if type_offset in type_env.keys():
|
|
mt = type_env[type_offset]
|
|
if mt.has_kobject():
|
|
if isinstance(mt, KobjectType) and mt.name == STACK_TYPE:
|
|
elements.append(1)
|
|
type_env[die.offset] = ArrayType(die.offset, elements, type_offset)
|
|
else:
|
|
type_env[die.offset] = ArrayType(die.offset, elements, type_offset)
|
|
|
|
|
|
def analyze_typedef(die):
|
|
type_offset = die_get_type_offset(die)
|
|
|
|
if type_offset not in type_env.keys():
|
|
return
|
|
|
|
type_env[die.offset] = type_env[type_offset]
|
|
|
|
|
|
def unpack_pointer(elf, data, offset):
|
|
endian_code = "<" if elf.little_endian else ">"
|
|
if elf.elfclass == 32:
|
|
size_code = "I"
|
|
size = 4
|
|
else:
|
|
size_code = "Q"
|
|
size = 8
|
|
|
|
return struct.unpack(endian_code + size_code,
|
|
data[offset:offset + size])[0]
|
|
|
|
|
|
def addr_deref(elf, addr):
|
|
for section in elf.iter_sections():
|
|
start = section['sh_addr']
|
|
end = start + section['sh_size']
|
|
|
|
if start <= addr < end:
|
|
data = section.data()
|
|
offset = addr - start
|
|
return unpack_pointer(elf, data, offset)
|
|
|
|
return 0
|
|
|
|
|
|
def device_get_api_addr(elf, addr):
|
|
# Read device->driver API
|
|
offset = 4 if elf.elfclass == 32 else 8
|
|
return addr_deref(elf, addr + offset)
|
|
|
|
|
|
def get_filename_lineno(die):
|
|
lp_header = die.dwarfinfo.line_program_for_CU(die.cu).header
|
|
files = lp_header["file_entry"]
|
|
includes = lp_header["include_directory"]
|
|
|
|
fileinfo = files[die.attributes["DW_AT_decl_file"].value - 1]
|
|
filename = fileinfo.name.decode("utf-8")
|
|
filedir = includes[fileinfo.dir_index - 1].decode("utf-8")
|
|
|
|
path = os.path.join(filedir, filename)
|
|
lineno = die.attributes["DW_AT_decl_line"].value
|
|
return (path, lineno)
|
|
|
|
|
|
class ElfHelper:
|
|
|
|
def __init__(self, filename, verbose, kobjs, subs):
|
|
self.verbose = verbose
|
|
self.fp = open(filename, "rb")
|
|
self.elf = ELFFile(self.fp)
|
|
self.little_endian = self.elf.little_endian
|
|
global kobjects
|
|
global subsystems
|
|
kobjects = kobjs
|
|
subsystems = subs
|
|
|
|
def find_kobjects(self, syms):
|
|
if not self.elf.has_dwarf_info():
|
|
sys.exit("ELF file has no DWARF information")
|
|
|
|
app_smem_start = syms["_app_smem_start"]
|
|
app_smem_end = syms["_app_smem_end"]
|
|
|
|
di = self.elf.get_dwarf_info()
|
|
|
|
variables = []
|
|
|
|
# Step 1: collect all type information.
|
|
for CU in di.iter_CUs():
|
|
for die in CU.iter_DIEs():
|
|
# Unions are disregarded, kernel objects should never be union
|
|
# members since the memory is not dedicated to that object and
|
|
# could be something else
|
|
if die.tag == "DW_TAG_structure_type":
|
|
analyze_die_struct(die)
|
|
elif die.tag == "DW_TAG_const_type":
|
|
analyze_die_const(die)
|
|
elif die.tag == "DW_TAG_array_type":
|
|
analyze_die_array(die)
|
|
elif die.tag == "DW_TAG_typedef":
|
|
analyze_typedef(die)
|
|
elif die.tag == "DW_TAG_variable":
|
|
variables.append(die)
|
|
|
|
# Step 2: filter type_env to only contain kernel objects, or structs
|
|
# and arrays of kernel objects
|
|
bad_offsets = []
|
|
for offset, type_object in type_env.items():
|
|
if not type_object.has_kobject():
|
|
bad_offsets.append(offset)
|
|
|
|
for offset in bad_offsets:
|
|
del type_env[offset]
|
|
|
|
# Step 3: Now that we know all the types we are looking for, examine
|
|
# all variables
|
|
all_objs = {}
|
|
|
|
for die in variables:
|
|
name = die_get_name(die)
|
|
if not name:
|
|
continue
|
|
|
|
if name.startswith("__device_sys_init"):
|
|
# Boot-time initialization function; not an actual device
|
|
continue
|
|
|
|
type_offset = die_get_type_offset(die)
|
|
|
|
# Is this a kernel object, or a structure containing kernel
|
|
# objects?
|
|
if type_offset not in type_env:
|
|
continue
|
|
|
|
if "DW_AT_declaration" in die.attributes:
|
|
# Extern declaration, only used indirectly
|
|
extern_env[die.offset] = die
|
|
continue
|
|
|
|
if "DW_AT_location" not in die.attributes:
|
|
self.debug_die(
|
|
die,
|
|
"No location information for object '%s'; possibly"
|
|
" stack allocated" % name)
|
|
continue
|
|
|
|
loc = die.attributes["DW_AT_location"]
|
|
if loc.form != "DW_FORM_exprloc" and \
|
|
loc.form != "DW_FORM_block1":
|
|
self.debug_die(
|
|
die,
|
|
"kernel object '%s' unexpected location format" %
|
|
name)
|
|
continue
|
|
|
|
opcode = loc.value[0]
|
|
if opcode != DW_OP_addr:
|
|
|
|
# Check if frame pointer offset DW_OP_fbreg
|
|
if opcode == DW_OP_fbreg:
|
|
self.debug_die(die, "kernel object '%s' found on stack" %
|
|
name)
|
|
else:
|
|
self.debug_die(
|
|
die,
|
|
"kernel object '%s' unexpected exprloc opcode %s" %
|
|
(name, hex(opcode)))
|
|
continue
|
|
|
|
addr = (loc.value[1] | (loc.value[2] << 8) |
|
|
(loc.value[3] << 16) | (loc.value[4] << 24))
|
|
|
|
if addr == 0:
|
|
# Never linked; gc-sections deleted it
|
|
continue
|
|
|
|
type_obj = type_env[type_offset]
|
|
objs = type_obj.get_kobjects(addr)
|
|
all_objs.update(objs)
|
|
|
|
self.debug("symbol '%s' at %s contains %d object(s)"
|
|
% (name, hex(addr), len(objs)))
|
|
|
|
# Step 4: objs is a dictionary mapping variable memory addresses to
|
|
# their associated type objects. Now that we have seen all variables
|
|
# and can properly look up API structs, convert this into a dictionary
|
|
# mapping variables to the C enumeration of what kernel object type it
|
|
# is.
|
|
ret = {}
|
|
for addr, ko in all_objs.items():
|
|
# API structs don't get into the gperf table
|
|
if ko.type_obj.api:
|
|
continue
|
|
|
|
_, user_ram_allowed = kobjects[ko.type_obj.name]
|
|
if not user_ram_allowed and app_smem_start <= addr < app_smem_end:
|
|
self.debug_die(die,
|
|
"object '%s' found in invalid location %s"
|
|
% (name, hex(addr)))
|
|
continue
|
|
|
|
if ko.type_obj.name != "device":
|
|
# Not a device struct so we immediately know its type
|
|
ko.type_name = kobject_to_enum(ko.type_obj.name)
|
|
ret[addr] = ko
|
|
continue
|
|
|
|
# Device struct. Need to get the address of its API struct,
|
|
# if it has one.
|
|
apiaddr = device_get_api_addr(self.elf, addr)
|
|
if apiaddr not in all_objs:
|
|
if apiaddr == 0:
|
|
self.debug("device instance at 0x%x has no associated subsystem"
|
|
% addr)
|
|
else:
|
|
self.debug("device instance at 0x%x has unknown API 0x%x"
|
|
% (addr, apiaddr))
|
|
# API struct does not correspond to a known subsystem, skip it
|
|
continue
|
|
|
|
apiobj = all_objs[apiaddr]
|
|
ko.type_name = subsystem_to_enum(apiobj.type_obj.name)
|
|
ret[addr] = ko
|
|
|
|
self.debug("found %d kernel object instances total" % len(ret))
|
|
|
|
# 1. Before python 3.7 dict order is not guaranteed. With Python
|
|
# 3.5 it doesn't seem random with *integer* keys but can't
|
|
# rely on that.
|
|
# 2. OrderedDict means _insertion_ order, so not enough because
|
|
# built from other (random!) dicts: need to _sort_ first.
|
|
# 3. Sorting memory address looks good.
|
|
return OrderedDict(sorted(ret.items()))
|
|
|
|
def get_symbols(self):
|
|
for section in self.elf.iter_sections():
|
|
if isinstance(section, SymbolTableSection):
|
|
return {sym.name: sym.entry.st_value
|
|
for sym in section.iter_symbols()}
|
|
|
|
raise LookupError("Could not find symbol table")
|
|
|
|
def debug(self, text):
|
|
if not self.verbose:
|
|
return
|
|
sys.stdout.write(scr + ": " + text + "\n")
|
|
|
|
@staticmethod
|
|
def error(text):
|
|
sys.exit("%s ERROR: %s" % (scr, text))
|
|
|
|
def debug_die(self, die, text):
|
|
fn, ln = get_filename_lineno(die)
|
|
|
|
self.debug(str(die))
|
|
self.debug("File '%s', line %d:" % (fn, ln))
|
|
self.debug(" %s" % text)
|
|
|
|
@staticmethod
|
|
def get_thread_counter():
|
|
return thread_counter
|
|
|
|
@staticmethod
|
|
def get_sys_mutex_counter():
|
|
return sys_mutex_counter
|
|
|
|
@staticmethod
|
|
def get_futex_counter():
|
|
return futex_counter
|