Fix smm_type detection to actually detect, and add a state_num_regs routine.

[netwatch.git] / lib / demap.c

/* demap.h
 * Paging lookup functions.
 * NetWatch system management mode administration console
 *
 * Copyright 2009, Google Inc.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above
 * copyright notice, this list of conditions and the following disclaimer
 * in the documentation and/or other materials provided with the
 * distribution.
 *     * Neither the name of Google Inc. nor the names of its
 * contributors may be used to endorse or promote products derived from
 * this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,           
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY           
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <state.h>
#include <msr.h>
#include <reg-k8-msr.h>
#include <reg-x86.h>
#include <paging.h>
#include <output.h>
#include <demap.h>

#define REG_CS_ATTRIB_L		(1<<9)
#define PTE_PRESENT		(1<<0)
#define PTE_LARGE		(1<<7)

#define PTE_FOR(x)      (((unsigned int)(x) >> 12) & 0x3FF)
#define PDE_FOR(x)      ((unsigned int)(x) >> 22)
#define ADDR_12_MASK(x) ((unsigned int)(x) & ~((1 << 12) - 1))

/* Keep a memoized copy of the operating mode the CPU was in when we
 * entered SMM, so we don't have to look it up every time.
 */

static enum operating_mode mode;

void reset_operating_mode_memo() {
	mode = UNKNOWN;
}

/* Check the saved state map to determine what mode we were in. */

void probe_operating_mode() {
	unsigned long cr0;

	if (state_get_type() == SMM_TYPE_64) {
		/* This is a 64-bit processor, so we may be in 64-bit
		 * full or compatibility mode. Check if we are. */

		uint64_t efer = state_get_reg(STATE_REG_EFER);

		if (efer & EFER_MSR_LMA) {
			/* We are in long mode. Is this full 64-bit, or
			 * comatibility mode? Check the "L" bit of the
			 * saved CS descriptor to be sure. */

			if (state_get_reg(STATE_REG_CS_ATTRIB)
			    & REG_CS_ATTRIB_L) {
				mode = LONG_64BIT;
			} else {
				mode = LONG_COMPAT;
			}

			return;
		}
		/* Otherwise, we are in legacy mode, so do the normal
		 * 32-bit probes. */
	}

	/* Either we are on a 32-bit processor, or we are on a 64-bit
	 * processor in legacy mode. */

	if (state_get_reg(STATE_REG_EFLAGS) & EFLAGS_VM) {
		mode = V8086;
		return;
	}

	cr0 = state_get_reg(STATE_REG_CR0);

	if (cr0 & CR0_PE)
		if (cr0 & CR0_PG)
			mode = PROTECTED_PAGING;
		else
			mode = PROTECTED_NOPAGING;
	else
		mode = REAL;
}

enum operating_mode get_operating_mode() {
	if (mode == UNKNOWN)
		probe_operating_mode();

	return mode;
}

#define LONG_ADDR_MASK	0x000FFFFFFFFFF000
#define PAGE_1G_MASK	0x000FFFFFC0000000
#define PAGE_2M_MASK	0x000FFFFFFFE00000

#define LONG_ADDR_SECTION(addr, offset)	((((addr) >> (offset)) & 0x1FF) * 8)

#define READ_PHYS_QWORD(pa)	({ uint64_t * p = p2v(pa); if (!p) return 0; *p; })

/* Given a virtual address from the current CPU context, determine what the
 * actual corresponding physical address would be, then convert that back
 * to a virtual address suitable for use within NetWatch.
 *
 * If the given address is not mapped in to RAM or is mapped to RAM which
 * cannot be accessed, returns null.
 *
 * XXX: This currently handles both long and 32-bit modes, but only knows
 * how to parse standard 4-kbyte pages. It assumes all segments span the full
 * 32-bit address space. Thus, it will return correct results for most
 * userspace environments in most sane OS kernels, but not necessarily kernel
 * space (likely to be mapped with large pages) or anything that plays tricks
 * with segmentation (like NaCl).
 */

uint64_t demap_phys (uint64_t vaddr) {

	uint64_t pa = state_get_reg(STATE_REG_CR3) & LONG_ADDR_MASK;
	uint64_t entry;

	if (mode == UNKNOWN)
		probe_operating_mode();

outputf("demapping %08x %08x m %d", (uint32_t)(vaddr>>32), (uint32_t)vaddr, mode);
	switch (mode) {
	case LONG_64BIT:
	case LONG_COMPAT: {
		/* Get PML4 entry */
		entry = READ_PHYS_QWORD(pa + LONG_ADDR_SECTION(vaddr, 39));
		if (!(entry & PTE_PRESENT)) return 0;
		pa = entry & LONG_ADDR_MASK;

		/* Get PDP entry */
		entry = READ_PHYS_QWORD(pa + LONG_ADDR_SECTION(vaddr, 30));
		if (!(entry & PTE_PRESENT)) return 0;
		pa = entry & LONG_ADDR_MASK;

		if (entry & PTE_LARGE)
			return (entry & PAGE_1G_MASK) + (vaddr & 0x3FFFFFFF);

		/* Get PDE */
		entry = READ_PHYS_QWORD(pa + LONG_ADDR_SECTION(vaddr, 21));
		if (!(entry & PTE_PRESENT)) return 0;
		pa = entry & LONG_ADDR_MASK;

		if (entry & PTE_LARGE)
			return (entry & PAGE_2M_MASK) + (vaddr & 0x1FFFFF);

		/* Get PTE */
		entry = READ_PHYS_QWORD(pa + LONG_ADDR_SECTION(vaddr, 12));
		if (!(entry & PTE_PRESENT)) return 0;
		pa = entry & LONG_ADDR_MASK;

		return pa + (vaddr & 0xFFF);
	}
	case PROTECTED_NOPAGING:
	case REAL:
		return vaddr;

	default: {
		unsigned long pde = ((unsigned long *)p2v(pa))[PDE_FOR(vaddr)];
		unsigned long pte;

		if (!(pde & PTE_PRESENT)) return 0; 
		pte = ((unsigned long *)p2v(ADDR_12_MASK(pde)))[PTE_FOR(vaddr)];
		if (!(pte & PTE_PRESENT)) return 0;

		return (pte & ~0xFFF) + (vaddr & 0xFFF);
	}
	}
}

void *demap(uint64_t vaddr) {
	uint64_t paddr = demap_phys(vaddr);
	outputf("demap: paddr 0x%08x %08x", (uint32_t)(paddr>>32), (uint32_t)paddr);
	if (!paddr) return 0;
	return p2v(paddr);
}