DBGPlugInLinux.cpp@ 106232

Last change on this file since 106232 was 106061, checked in by vboxsync, 3 months ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 124.0 KB

Line
1	/* $Id: DBGPlugInLinux.cpp 106061 2024-09-16 14:03:52Z vboxsync $ */
2	/** @file
3	* DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4	*/
5
6	/*
7	* Copyright (C) 2008-2024 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33	#include "DBGPlugIns.h"
34	#include "DBGPlugInCommonELF.h"
35	#include <VBox/vmm/vmmr3vtable.h>
36	#include <VBox/dis.h>
37	#include <iprt/ctype.h>
38	#include <iprt/file.h>
39	#include <iprt/err.h>
40	#include <iprt/mem.h>
41	#include <iprt/stream.h>
42	#include <iprt/string.h>
43	#include <iprt/vfs.h>
44	#include <iprt/zip.h>
45
46
47	/*********************************************************************************************************************************
48	* Structures and Typedefs *
49	*********************************************************************************************************************************/
50
51	/** @name InternalLinux structures
52	* @{ */
53
54
55	/** @} */
56
57
58	/**
59	* Config item type.
60	*/
61	typedef enum DBGDIGGERLINUXCFGITEMTYPE
62	{
63	/** Invalid type. */
64	DBGDIGGERLINUXCFGITEMTYPE_INVALID = 0,
65	/** String. */
66	DBGDIGGERLINUXCFGITEMTYPE_STRING,
67	/** Number. */
68	DBGDIGGERLINUXCFGITEMTYPE_NUMBER,
69	/** Flag whether this feature is included in the
70	* kernel or as a module. */
71	DBGDIGGERLINUXCFGITEMTYPE_FLAG
72	} DBGDIGGERLINUXCFGITEMTYPE;
73
74	/**
75	* Item in the config database.
76	*/
77	typedef struct DBGDIGGERLINUXCFGITEM
78	{
79	/** String space core. */
80	RTSTRSPACECORE Core;
81	/** Config item type. */
82	DBGDIGGERLINUXCFGITEMTYPE enmType;
83	/** Data based on the type. */
84	union
85	{
86	/** Number. */
87	int64_t i64Num;
88	/** Flag. */
89	bool fModule;
90	/** String - variable in size. */
91	char aszString[1];
92	} u;
93	} DBGDIGGERLINUXCFGITEM;
94	/** Pointer to a config database item. */
95	typedef DBGDIGGERLINUXCFGITEM *PDBGDIGGERLINUXCFGITEM;
96	/** Pointer to a const config database item. */
97	typedef const DBGDIGGERLINUXCFGITEM *PCDBGDIGGERLINUXCFGITEM;
98
99	/**
100	* Linux guest OS digger instance data.
101	*/
102	typedef struct DBGDIGGERLINUX
103	{
104	/** Whether the information is valid or not.
105	* (For fending off illegal interface method calls.) */
106	bool fValid;
107	/** Set if 64-bit, clear if 32-bit. */
108	bool f64Bit;
109	/** Set if the kallsyms table uses relative addressing, clear
110	* if absolute addresses are used. */
111	bool fRelKrnlAddr;
112	/** The relative base when kernel symbols use offsets rather than
113	* absolute addresses. */
114	RTGCUINTPTR uKernelRelativeBase;
115	/** The guest kernel version used for version comparisons. */
116	uint32_t uKrnlVer;
117	/** The guest kernel major version. */
118	uint32_t uKrnlVerMaj;
119	/** The guest kernel minor version. */
120	uint32_t uKrnlVerMin;
121	/** The guest kernel build version. */
122	uint32_t uKrnlVerBld;
123
124	/** The address of the linux banner.
125	* This is set during probing. */
126	DBGFADDRESS AddrLinuxBanner;
127	/** Kernel base address.
128	* This is set during probing, refined during kallsyms parsing. */
129	DBGFADDRESS AddrKernelBase;
130	/** The kernel size. */
131	uint32_t cbKernel;
132
133	/** The number of kernel symbols (kallsyms_num_syms).
134	* This is set during init. */
135	uint32_t cKernelSymbols;
136	/** The size of the kernel name table (sizeof(kallsyms_names)). */
137	uint32_t cbKernelNames;
138	/** Number of entries in the kernel_markers table. */
139	uint32_t cKernelNameMarkers;
140	/** The size of the kernel symbol token table. */
141	uint32_t cbKernelTokenTable;
142	/** The address of the encoded kernel symbol names (kallsyms_names). */
143	DBGFADDRESS AddrKernelNames;
144	/** The address of the kernel symbol addresses (kallsyms_addresses). */
145	DBGFADDRESS AddrKernelAddresses;
146	/** The address of the kernel symbol name markers (kallsyms_markers). */
147	DBGFADDRESS AddrKernelNameMarkers;
148	/** The address of the kernel symbol token table (kallsyms_token_table). */
149	DBGFADDRESS AddrKernelTokenTable;
150	/** The address of the kernel symbol token index table (kallsyms_token_index). */
151	DBGFADDRESS AddrKernelTokenIndex;
152
153	/** The kernel message log interface. */
154	DBGFOSIDMESG IDmesg;
155
156	/** The config database root. */
157	RTSTRSPACE hCfgDb;
158	} DBGDIGGERLINUX;
159	/** Pointer to the linux guest OS digger instance data. */
160	typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
161
162
163	/**
164	* The current printk_log structure.
165	*/
166	typedef struct LNXPRINTKHDR
167	{
168	/** Monotonic timestamp. */
169	uint64_t nsTimestamp;
170	/** The total size of this message record. */
171	uint16_t cbTotal;
172	/** The size of the text part (immediately follows the header). */
173	uint16_t cbText;
174	/** The size of the optional dictionary part (follows the text). */
175	uint16_t cbDict;
176	/** The syslog facility number. */
177	uint8_t bFacility;
178	/** First 5 bits are internal flags, next 3 bits are log level. */
179	uint8_t fFlagsAndLevel;
180	} LNXPRINTKHDR;
181	AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
182	/** Pointer to linux printk_log header. */
183	typedef LNXPRINTKHDR *PLNXPRINTKHDR;
184	/** Pointer to linux const printk_log header. */
185	typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
186
187
188	/*********************************************************************************************************************************
189	* Defined Constants And Macros *
190	*********************************************************************************************************************************/
191	/** First kernel map address for 32bit Linux hosts (__START_KERNEL_map). */
192	#define LNX32_KERNEL_ADDRESS_START UINT32_C(0xc0000000)
193	/** First kernel map address for 64bit Linux hosts (__START_KERNEL_map). */
194	#define LNX64_KERNEL_ADDRESS_START UINT64_C(0xffffffff80000000)
195	/** Validates a 32-bit linux kernel address */
196	#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
197	/** Validates a 64-bit linux kernel address */
198	#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
199
200	/** The max kernel size. */
201	#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
202	/** Maximum kernel log buffer size. */
203	#define LNX_MAX_KERNEL_LOG_SIZE (16 * _1M)
204
205	/** The maximum size we expect for kallsyms_names. */
206	#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
207	/** The maximum size we expect for kallsyms_token_table. */
208	#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
209	/** The minimum number of symbols we expect in kallsyms_num_syms. */
210	#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
211	/** The maximum number of symbols we expect in kallsyms_num_syms. */
212	#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
213	/** The min length an encoded symbol in kallsyms_names is expected to have. */
214	#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
215	/** The max length an encoded symbol in kallsyms_names is expected to have.
216	* @todo check real life here. */
217	#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
218	/** The approximate maximum length of a string token. */
219	#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
220	/** Maximum compressed config size expected. */
221	#define LNX_MAX_COMPRESSED_CFG_SIZE _1M
222
223	/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
224	#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
225	/** Macro for building a Linux kernel version which can be used for comparisons. */
226	#define LNX_MK_VER(major, minor, build) (((major) << 22) \| ((minor) << 12) \| (build))
227
228
229	/*********************************************************************************************************************************
230	* Internal Functions *
231	*********************************************************************************************************************************/
232	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
233
234
235	/*********************************************************************************************************************************
236	* Global Variables *
237	*********************************************************************************************************************************/
238	/** Table of common linux kernel addresses. */
239	static uint64_t g_au64LnxKernelAddresses[] =
240	{
241	UINT64_C(0xc0100000),
242	UINT64_C(0x90100000),
243	UINT64_C(0xffffffff80200000)
244	};
245
246	static const uint8_t g_abLinuxVersion[] = "Linux version ";
247	/** The needle for searching for the kernel log area (the value is observed in pretty much all 32bit and 64bit x86 kernels).
248	* This needle should appear only once in the memory due to the address being filled in by a format string. */
249	static const uint8_t g_abKrnlLogNeedle[] = "BIOS-e820: [mem 0x0000000000000000";
250
251
252	/**
253	* Tries to resolve the kernel log buffer start and end by searching for needle.
254	*
255	* @returns VBox status code.
256	* @param pThis The Linux digger data.
257	* @param pUVM The VM handle.
258	* @param pVMM The VMM function table.
259	* @param pGCPtrLogBuf Where to store the start of the kernel log buffer on success.
260	* @param pcbLogBuf Where to store the size of the kernel log buffer on success.
261	*/
262	static int dbgDiggerLinuxKrnlLogBufFindByNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
263	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
264	{
265	int rc = VINF_SUCCESS;
266
267	/* Try to find the needle, it should be very early in the kernel log buffer. */
268	DBGFADDRESS AddrScan;
269	DBGFADDRESS AddrHit;
270	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrScan, pThis->f64Bit ? LNX64_KERNEL_ADDRESS_START : LNX32_KERNEL_ADDRESS_START);
271
272	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &AddrScan, ~(RTGCUINTPTR)0, 1 /uAlign/,
273	g_abKrnlLogNeedle, sizeof(g_abKrnlLogNeedle) - 1, &AddrHit);
274	if (RT_SUCCESS(rc))
275	{
276	uint32_t cbLogBuf = 0;
277	uint64_t tsLastNs = 0;
278	DBGFADDRESS AddrCur;
279
280	pVMM->pfnDBGFR3AddrSub(&AddrHit, sizeof(LNXPRINTKHDR));
281	AddrCur = AddrHit;
282
283	/* Try to find the end of the kernel log buffer. */
284	for (;;)
285	{
286	if (cbLogBuf >= LNX_MAX_KERNEL_LOG_SIZE)
287	break;
288
289	LNXPRINTKHDR Hdr;
290	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrCur, &Hdr, sizeof(Hdr));
291	if (RT_SUCCESS(rc))
292	{
293	uint32_t const cbLogAlign = 4;
294
295	/*
296	* If the header does not look valid anymore we stop.
297	* Timestamps are monotonically increasing.
298	*/
299	if ( !Hdr.cbTotal /* Zero entry size means there is no record anymore, doesn't make sense to look futher. */
300	\|\| Hdr.cbText + Hdr.cbDict + sizeof(Hdr) > Hdr.cbTotal
301	\|\| (Hdr.cbTotal & (cbLogAlign - 1)) != 0
302	\|\| tsLastNs > Hdr.nsTimestamp)
303	break;
304
305	/** @todo Maybe read text part and verify it is all ASCII. */
306
307	cbLogBuf += Hdr.cbTotal;
308	pVMM->pfnDBGFR3AddrAdd(&AddrCur, Hdr.cbTotal);
309	}
310
311	if (RT_FAILURE(rc))
312	break;
313	}
314
315	/** @todo Go back to find the start address of the kernel log (or we loose potential kernel log messages). */
316
317	if ( RT_SUCCESS(rc)
318	&& cbLogBuf)
319	{
320	/* Align log buffer size to a power of two. */
321	uint32_t idxBitLast = ASMBitLastSetU32(cbLogBuf);
322	idxBitLast--; /* There is at least one bit set, see check above. */
323
324	if (cbLogBuf & (RT_BIT_32(idxBitLast) - 1))
325	idxBitLast++;
326
327	*pGCPtrLogBuf = AddrHit.FlatPtr;
328	*pcbLogBuf = RT_MIN(RT_BIT_32(idxBitLast), LNX_MAX_KERNEL_LOG_SIZE);
329	}
330	else if (RT_SUCCESS(rc))
331	rc = VERR_NOT_FOUND;
332	}
333
334	return rc;
335	}
336
337
338	/**
339	* Converts a given offset into an absolute address if relative kernel offsets are used for
340	* kallsyms.
341	*
342	* @returns The absolute kernel address.
343	* @param pThis The Linux digger data.
344	* @param uOffset The offset to convert.
345	*/
346	DECLINLINE(RTGCUINTPTR) dbgDiggerLinuxConvOffsetToAddr(PDBGDIGGERLINUX pThis, int32_t uOffset)
347	{
348	RTGCUINTPTR uAddr;
349
350	/*
351	* How the absolute address is calculated from the offset depends on the
352	* CONFIG_KALLSYMS_ABSOLUTE_PERCPU config which is only set for 64bit
353	* SMP kernels (we assume that all 64bit kernels always have SMP enabled too).
354	*/
355	if (pThis->f64Bit)
356	{
357	if (uOffset >= 0)
358	uAddr = uOffset;
359	else
360	uAddr = pThis->uKernelRelativeBase - 1 - uOffset;
361	}
362	else
363	uAddr = pThis->uKernelRelativeBase + (uint32_t)uOffset;
364
365	return uAddr;
366	}
367
368	/**
369	* Disassembles a simple getter returning the value for it.
370	*
371	* @returns VBox status code.
372	* @param pThis The Linux digger data.
373	* @param pUVM The VM handle.
374	* @param pVMM The VMM function table.
375	* @param hMod The module to use.
376	* @param pszSymbol The symbol of the getter.
377	* @param pvVal Where to store the value on success.
378	* @param cbVal Size of the value in bytes.
379	*/
380	static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
381	const char pszSymbol, void pvVal, uint32_t cbVal)
382	{
383	int rc = VINF_SUCCESS;
384
385	RTDBGSYMBOL SymInfo;
386	rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
387	if (RT_SUCCESS(rc))
388	{
389	/*
390	* Do the diassembling. Disassemble until a ret instruction is encountered
391	* or a limit is reached (don't want to disassemble for too long as the getter
392	* should be short).
393	* push and pop instructions are skipped as well as any mov instructions not
394	* touching the rax or eax register (depending on the size of the value).
395	*/
396	unsigned cInstrDisassembled = 0;
397	uint32_t offInstr = 0;
398	bool fRet = false;
399	DISSTATE DisState;
400	RT_ZERO(DisState);
401
402	do
403	{
404	DBGFADDRESS Addr;
405	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
406	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
407
408	/* Prefetch the instruction. */
409	uint8_t abInstr[32];
410	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
411	if (RT_SUCCESS(rc))
412	{
413	uint32_t cbInstr = 0;
414
415	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
416	if (RT_SUCCESS(rc))
417	{
418	switch (DisState.pCurInstr->uOpcode)
419	{
420	case OP_PUSH:
421	case OP_POP:
422	case OP_NOP:
423	case OP_LEA:
424	break;
425	case OP_RETN:
426	/* Getter returned, abort disassembling. */
427	fRet = true;
428	break;
429	case OP_MOV:
430	/*
431	* Check that the destination is either rax or eax depending on the
432	* value size.
433	*
434	* aParams[0] is the destination and aParams[1] the source.
435	*/
436	if ( ( ( (DisState.aParams[0].fUse & (DISUSE_BASE \| DISUSE_REG_GEN32))
437	&& cbVal == sizeof(uint32_t))
438	\|\| ( (DisState.aParams[0].fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
439	&& cbVal == sizeof(uint64_t)))
440	&& DisState.aParams[0].x86.Base.idxGenReg == DISGREG_RAX)
441	{
442	/* Parse the source. */
443	if (DisState.aParams[1].fUse & (DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
444	memcpy(pvVal, &DisState.aParams[1].uValue, cbVal);
445	else if (DisState.aParams[1].fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64))
446	{
447	RTGCPTR GCPtrVal = 0;
448
449	if (DisState.aParams[1].fUse & DISUSE_RIPDISPLACEMENT32)
450	GCPtrVal = GCPtrCur + DisState.aParams[1].x86.uDisp.i32 + cbInstr;
451	else if (DisState.aParams[1].fUse & DISUSE_DISPLACEMENT32)
452	GCPtrVal = (RTGCPTR)DisState.aParams[1].x86.uDisp.u32;
453	else if (DisState.aParams[1].fUse & DISUSE_DISPLACEMENT64)
454	GCPtrVal = (RTGCPTR)DisState.aParams[1].x86.uDisp.u64;
455	else
456	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
457
458	DBGFADDRESS AddrVal;
459	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
460	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
461	pvVal, cbVal);
462	}
463	}
464	break;
465	default:
466	/* All other instructions will cause an error for now (playing safe here). */
467	rc = VERR_INVALID_PARAMETER;
468	break;
469	}
470	cInstrDisassembled++;
471	offInstr += cbInstr;
472	}
473	}
474	} while ( RT_SUCCESS(rc)
475	&& cInstrDisassembled < 20
476	&& !fRet);
477	}
478
479	return rc;
480	}
481
482	/**
483	* Try to get at the log buffer starting address and size by disassembling emit_log_char.
484	*
485	* @returns VBox status code.
486	* @param pThis The Linux digger data.
487	* @param pUVM The VM handle.
488	* @param pVMM The VMM function table.
489	* @param hMod The module to use.
490	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
491	* @param pcbLogBuf Where to store the size of the log buffer on success.
492	*/
493	static int dbgDiggerLinuxQueryAsciiLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
494	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
495	{
496	int rc = VINF_SUCCESS;
497
498	/**
499	* We disassemble emit_log_char to get at the log buffer address and size.
500	* This is used in case the symbols are not exported in kallsyms.
501	*
502	* This is what it typically looks like:
503	* vmlinux!emit_log_char:
504	* %00000000c01204a1 56 push esi
505	* %00000000c01204a2 8b 35 d0 1c 34 c0 mov esi, dword [0c0341cd0h]
506	* %00000000c01204a8 53 push ebx
507	* %00000000c01204a9 8b 1d 74 3b 3e c0 mov ebx, dword [0c03e3b74h]
508	* %00000000c01204af 8b 0d d8 1c 34 c0 mov ecx, dword [0c0341cd8h]
509	* %00000000c01204b5 8d 56 ff lea edx, [esi-001h]
510	* %00000000c01204b8 21 da and edx, ebx
511	* %00000000c01204ba 88 04 11 mov byte [ecx+edx], al
512	* %00000000c01204bd 8d 53 01 lea edx, [ebx+001h]
513	* %00000000c01204c0 89 d0 mov eax, edx
514	* [...]
515	*/
516	RTDBGSYMBOL SymInfo;
517	rc = RTDbgModSymbolByName(hMod, "emit_log_char", &SymInfo);
518	if (RT_SUCCESS(rc))
519	{
520	/*
521	* Do the diassembling. Disassemble until a ret instruction is encountered
522	* or a limit is reached (don't want to disassemble for too long as the getter
523	* should be short). Certain instructions found are ignored (push, nop, etc.).
524	*/
525	unsigned cInstrDisassembled = 0;
526	uint32_t offInstr = 0;
527	bool fRet = false;
528	DISSTATE DisState;
529	unsigned cAddressesUsed = 0;
530	struct { size_t cb; RTGCPTR GCPtrOrigSrc; } aAddresses[5];
531	RT_ZERO(DisState);
532	RT_ZERO(aAddresses);
533
534	do
535	{
536	DBGFADDRESS Addr;
537	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
538	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
539
540	/* Prefetch the instruction. */
541	uint8_t abInstr[32];
542	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
543	if (RT_SUCCESS(rc))
544	{
545	uint32_t cbInstr = 0;
546
547	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
548	if (RT_SUCCESS(rc))
549	{
550	switch (DisState.pCurInstr->uOpcode)
551	{
552	case OP_PUSH:
553	case OP_POP:
554	case OP_NOP:
555	case OP_LEA:
556	case OP_AND:
557	case OP_CBW:
558	case OP_DEC:
559	break;
560	case OP_RETN:
561	/* emit_log_char returned, abort disassembling. */
562	rc = VERR_NOT_FOUND;
563	fRet = true;
564	break;
565	case OP_MOV:
566	case OP_MOVSXD:
567	/*
568	* If a mov is encountered writing to memory with al (or dil for amd64) being the source the
569	* character is stored and we can infer the base address and size of the log buffer from
570	* the source addresses.
571	*/
572	if ( (DisState.aParams[1].fUse & DISUSE_REG_GEN8)
573	&& ( (DisState.aParams[1].x86.Base.idxGenReg == DISGREG_AL && !pThis->f64Bit)
574	\|\| (DisState.aParams[1].x86.Base.idxGenReg == DISGREG_DIL && pThis->f64Bit))
575	&& DISUSE_IS_EFFECTIVE_ADDR(DisState.aParams[0].fUse))
576	{
577	RTGCPTR GCPtrLogBuf = 0;
578	uint32_t cbLogBuf = 0;
579
580	/*
581	* We can stop disassembling now and inspect all registers, look for a valid kernel address first.
582	* Only one of the accessed registers should hold a valid kernel address.
583	* For the log size look for the biggest non kernel address.
584	*/
585	for (unsigned i = 0; i < cAddressesUsed; i++)
586	{
587	DBGFADDRESS AddrVal;
588	union { uint8_t abVal[8]; uint32_t u32Val; uint64_t u64Val; } Val;
589
590	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
591	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal,
592	aAddresses[i].GCPtrOrigSrc),
593	&Val.abVal[0], aAddresses[i].cb);
594	if (RT_SUCCESS(rc))
595	{
596	if (pThis->f64Bit && aAddresses[i].cb == sizeof(uint64_t))
597	{
598	if (LNX64_VALID_ADDRESS(Val.u64Val))
599	{
600	if (GCPtrLogBuf == 0)
601	GCPtrLogBuf = Val.u64Val;
602	else
603	{
604	rc = VERR_NOT_FOUND;
605	break;
606	}
607	}
608	}
609	else
610	{
611	AssertMsgBreakStmt(aAddresses[i].cb == sizeof(uint32_t),
612	("Invalid value size\n"), rc = VERR_INVALID_STATE);
613
614	/* Might be a kernel address or a size indicator. */
615	if (!pThis->f64Bit && LNX32_VALID_ADDRESS(Val.u32Val))
616	{
617	if (GCPtrLogBuf == 0)
618	GCPtrLogBuf = Val.u32Val;
619	else
620	{
621	rc = VERR_NOT_FOUND;
622	break;
623	}
624	}
625	else
626	{
627	/*
628	* The highest value will be the log buffer because the other
629	* accessed variables are indexes into the buffer and hence
630	* always smaller than the size.
631	*/
632	if (cbLogBuf < Val.u32Val)
633	cbLogBuf = Val.u32Val;
634	}
635	}
636	}
637	}
638
639	if ( RT_SUCCESS(rc)
640	&& GCPtrLogBuf != 0
641	&& cbLogBuf != 0)
642	{
643	*pGCPtrLogBuf = GCPtrLogBuf;
644	*pcbLogBuf = cbLogBuf;
645	}
646	else if (RT_SUCCESS(rc))
647	rc = VERR_NOT_FOUND;
648
649	fRet = true;
650	break;
651	}
652	else
653	{
654	/*
655	* In case of a memory to register move store the destination register index and the
656	* source address in the relation table for later processing.
657	*/
658	if ( (DisState.aParams[0].fUse & (DISUSE_BASE \| DISUSE_REG_GEN32 \| DISUSE_REG_GEN64))
659	&& (DisState.aParams[1].x86.cb == sizeof(uint32_t) \|\| DisState.aParams[1].x86.cb == sizeof(uint64_t))
660	&& (DisState.aParams[1].fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64)))
661	{
662	RTGCPTR GCPtrVal = 0;
663
664	if (DisState.aParams[1].fUse & DISUSE_RIPDISPLACEMENT32)
665	GCPtrVal = GCPtrCur + DisState.aParams[1].x86.uDisp.i32 + cbInstr;
666	else if (DisState.aParams[1].fUse & DISUSE_DISPLACEMENT32)
667	GCPtrVal = (RTGCPTR)DisState.aParams[1].x86.uDisp.u32;
668	else if (DisState.aParams[1].fUse & DISUSE_DISPLACEMENT64)
669	GCPtrVal = (RTGCPTR)DisState.aParams[1].x86.uDisp.u64;
670	else
671	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
672
673	if (cAddressesUsed < RT_ELEMENTS(aAddresses))
674	{
675	/* movsxd reads always 32bits. */
676	if (DisState.pCurInstr->uOpcode == OP_MOVSXD)
677	aAddresses[cAddressesUsed].cb = sizeof(uint32_t);
678	else
679	aAddresses[cAddressesUsed].cb = DisState.aParams[1].x86.cb;
680	aAddresses[cAddressesUsed].GCPtrOrigSrc = GCPtrVal;
681	cAddressesUsed++;
682	}
683	else
684	{
685	rc = VERR_INVALID_PARAMETER;
686	break;
687	}
688	}
689	}
690	break;
691	default:
692	/* All other instructions will cause an error for now (playing safe here). */
693	rc = VERR_INVALID_PARAMETER;
694	break;
695	}
696	cInstrDisassembled++;
697	offInstr += cbInstr;
698	}
699	}
700	} while ( RT_SUCCESS(rc)
701	&& cInstrDisassembled < 20
702	&& !fRet);
703	}
704
705	return rc;
706	}
707
708	/**
709	* Try to get at the log buffer starting address and size by disassembling some exposed helpers.
710	*
711	* @returns VBox status code.
712	* @param pThis The Linux digger data.
713	* @param pUVM The VM handle.
714	* @param pVMM The VMM function table.
715	* @param hMod The module to use.
716	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
717	* @param pcbLogBuf Where to store the size of the log buffer on success.
718	*/
719	static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
720	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
721	{
722	int rc = VINF_SUCCESS;
723
724	struct { void pvVar; uint32_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
725	{
726	{ pGCPtrLogBuf, (uint32_t)sizeof(RTGCPTR), (uint32_t)(pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)), "log_buf_addr_get" },
727	{ pcbLogBuf, (uint32_t)sizeof(uint32_t), (uint32_t)sizeof(uint32_t), "log_buf_len_get" }
728	};
729	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
730	{
731	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
732	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
733	rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, pVMM, hMod, aSymbols[i].pszSymbol,
734	aSymbols[i].pvVar, aSymbols[i].cbGuest);
735	}
736
737	return rc;
738	}
739
740	/**
741	* Returns whether the log buffer is a simple ascii buffer or a record based implementation
742	* based on the kernel version found.
743	*
744	* @returns Flag whether the log buffer is the simple ascii buffer.
745	* @param pThis The Linux digger data.
746	* @param pUVM The user mode VM handle.
747	* @param pVMM The VMM function table.
748	*/
749	static bool dbgDiggerLinuxLogBufferIsAsciiBuffer(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
750	{
751	char szTmp[128];
752	char const *pszVer = &szTmp[sizeof(g_abLinuxVersion) - 1];
753
754	RT_ZERO(szTmp);
755	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, szTmp, sizeof(szTmp) - 1);
756	if ( RT_SUCCESS(rc)
757	&& RTStrVersionCompare(pszVer, "3.4") == -1)
758	return true;
759
760	return false;
761	}
762
763	/**
764	* Worker to get at the kernel log for pre 3.4 kernels where the log buffer was just a char buffer.
765	*
766	* @returns VBox status code.
767	* @param pThis The Linux digger data.
768	* @param pUVM The VM user mdoe handle.
769	* @param pVMM The VMM function table.
770	* @param hMod The debug module handle.
771	* @param fFlags Flags reserved for future use, MBZ.
772	* @param cMessages The number of messages to retrieve, counting from the
773	* end of the log (i.e. like tail), use UINT32_MAX for all.
774	* @param pszBuf The output buffer.
775	* @param cbBuf The buffer size.
776	* @param pcbActual Where to store the number of bytes actually returned,
777	* including zero terminator. On VERR_BUFFER_OVERFLOW this
778	* holds the necessary buffer size. Optional.
779	*/
780	static int dbgDiggerLinuxLogBufferQueryAscii(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
781	uint32_t fFlags, uint32_t cMessages,
782	char pszBuf, size_t cbBuf, size_t pcbActual)
783	{
784	RT_NOREF2(fFlags, cMessages);
785	int rc = VINF_SUCCESS;
786	RTGCPTR GCPtrLogBuf;
787	uint32_t cbLogBuf;
788
789	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
790	{
791	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
792	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
793	};
794	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
795	{
796	RTDBGSYMBOL SymInfo;
797	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
798	if (RT_SUCCESS(rc))
799	{
800	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
801	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
802	DBGFADDRESS Addr;
803	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
804	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
805	(RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
806	aSymbols[i].pvVar, aSymbols[i].cbGuest);
807	if (RT_SUCCESS(rc))
808	continue;
809	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
810	}
811	else
812	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
813	rc = VERR_NOT_FOUND;
814	break;
815	}
816
817	/*
818	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
819	* some public helpers to get at the addresses.
820	*
821	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
822	*/
823	if (rc == VERR_NOT_FOUND)
824	{
825	rc = dbgDiggerLinuxQueryAsciiLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
826	if (RT_FAILURE(rc))
827	return rc;
828	}
829
830	/*
831	* Check if the values make sense.
832	*/
833	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
834	{
835	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
836	return VERR_NOT_FOUND;
837	}
838	if ( cbLogBuf < 4096
839	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
840	\|\| cbLogBuf > 16*_1M)
841	{
842	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
843	return VERR_NOT_FOUND;
844	}
845
846	/*
847	* Read the whole log buffer.
848	*/
849	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
850	if (!pbLogBuf)
851	{
852	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
853	return VERR_NO_MEMORY;
854	}
855	DBGFADDRESS Addr;
856	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
857	if (RT_FAILURE(rc))
858	{
859	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
860	cbLogBuf, Addr.FlatPtr, rc));
861	RTMemFree(pbLogBuf);
862	return VERR_NOT_FOUND;
863	}
864
865	/** @todo Try to parse where the single messages start to make use of cMessages. */
866	size_t cchLength = RTStrNLen((const char *)pbLogBuf, cbLogBuf);
867	memcpy(&pszBuf[0], pbLogBuf, RT_MIN(cbBuf, cchLength));
868
869	/* Done with the buffer. */
870	RTMemFree(pbLogBuf);
871
872	/* Set return size value. */
873	if (pcbActual)
874	*pcbActual = RT_MIN(cbBuf, cchLength);
875
876	return cbBuf <= cchLength ? VERR_BUFFER_OVERFLOW : VINF_SUCCESS;
877	}
878
879
880	/**
881	* Worker to process a given record based kernel log.
882	*
883	* @returns VBox status code.
884	* @param pThis The Linux digger data.
885	* @param pUVM The VM user mode handle.
886	* @param pVMM The VMM function table.
887	* @param GCPtrLogBuf Flat guest address of the start of the log buffer.
888	* @param cbLogBuf Power of two aligned size of the log buffer.
889	* @param idxFirst Index in the log bfufer of the first message.
890	* @param idxNext Index where to write hte next message in the log buffer.
891	* @param fFlags Flags reserved for future use, MBZ.
892	* @param cMessages The number of messages to retrieve, counting from the
893	* end of the log (i.e. like tail), use UINT32_MAX for all.
894	* @param pszBuf The output buffer.
895	* @param cbBuf The buffer size.
896	* @param pcbActual Where to store the number of bytes actually returned,
897	* including zero terminator. On VERR_BUFFER_OVERFLOW this
898	* holds the necessary buffer size. Optional.
899	*/
900	static int dbgDiggerLinuxKrnLogBufferProcess(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTGCPTR GCPtrLogBuf,
901	uint32_t cbLogBuf, uint32_t idxFirst, uint32_t idxNext,
902	uint32_t fFlags, uint32_t cMessages, char *pszBuf, size_t cbBuf,
903	size_t *pcbActual)
904	{
905	RT_NOREF(fFlags);
906
907	/*
908	* Check if the values make sense.
909	*/
910	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
911	{
912	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
913	return VERR_NOT_FOUND;
914	}
915	if ( cbLogBuf < _4K
916	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
917	\|\| cbLogBuf > LNX_MAX_KERNEL_LOG_SIZE)
918	{
919	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
920	return VERR_NOT_FOUND;
921	}
922	uint32_t const cbLogAlign = 4;
923	if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
924	\|\| (idxFirst & (cbLogAlign - 1)) != 0)
925	{
926	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
927	return VERR_NOT_FOUND;
928	}
929	if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
930	\|\| (idxNext & (cbLogAlign - 1)) != 0)
931	{
932	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
933	return VERR_NOT_FOUND;
934	}
935
936	/*
937	* Read the whole log buffer.
938	*/
939	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
940	if (!pbLogBuf)
941	{
942	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
943	return VERR_NO_MEMORY;
944	}
945	DBGFADDRESS Addr;
946	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
947	if (RT_FAILURE(rc))
948	{
949	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
950	cbLogBuf, Addr.FlatPtr, rc));
951	RTMemFree(pbLogBuf);
952	return VERR_NOT_FOUND;
953	}
954
955	/*
956	* Count the messages in the buffer while doing some basic validation.
957	*/
958	uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
959	: idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
960	uint32_t cbLeft = cbUsed;
961	uint32_t offCur = idxFirst;
962	uint32_t cLogMsgs = 0;
963
964	while (cbLeft > 0)
965	{
966	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
967	if (!pHdr->cbTotal)
968	{
969	/* Wrap around packet, most likely... */
970	if (cbLogBuf - offCur >= cbLeft)
971	break;
972	offCur = 0;
973	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
974	}
975	if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
976	\|\| pHdr->cbTotal > cbLeft
977	\|\| (pHdr->cbTotal & (cbLogAlign - 1)) != 0
978	\|\| pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
979	{
980	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
981	offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
982	break;
983	}
984
985	if (pHdr->cbText > 0)
986	cLogMsgs++;
987
988	/* next */
989	offCur += pHdr->cbTotal;
990	cbLeft -= pHdr->cbTotal;
991	}
992	if (!cLogMsgs)
993	{
994	RTMemFree(pbLogBuf);
995	return VERR_NOT_FOUND;
996	}
997
998	/*
999	* Copy the messages into the output buffer.
1000	*/
1001	offCur = idxFirst;
1002	cbLeft = cbUsed - cbLeft;
1003
1004	/* Skip messages that the caller doesn't want. */
1005	if (cMessages < cLogMsgs)
1006	{
1007	uint32_t cToSkip = cLogMsgs - cMessages;
1008	cLogMsgs -= cToSkip;
1009
1010	while (cToSkip > 0)
1011	{
1012	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1013	if (!pHdr->cbTotal)
1014	{
1015	offCur = 0;
1016	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1017	}
1018	if (pHdr->cbText > 0)
1019	cToSkip--;
1020
1021	/* next */
1022	offCur += pHdr->cbTotal;
1023	cbLeft -= pHdr->cbTotal;
1024	}
1025	}
1026
1027	/* Now copy the messages. */
1028	size_t offDst = 0;
1029	while (cbLeft > 0)
1030	{
1031	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1032	if ( !pHdr->cbTotal
1033	\|\| !cLogMsgs)
1034	{
1035	if (cbLogBuf - offCur >= cbLeft)
1036	break;
1037	offCur = 0;
1038	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1039	}
1040
1041	if (pHdr->cbText > 0)
1042	{
1043	char pchText = (char )(pHdr + 1);
1044	size_t cchText = RTStrNLen(pchText, pHdr->cbText);
1045	if (offDst + cchText < cbBuf)
1046	{
1047	memcpy(&pszBuf[offDst], pHdr + 1, cchText);
1048	pszBuf[offDst + cchText] = '\n';
1049	}
1050	else if (offDst < cbBuf)
1051	memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
1052	offDst += cchText + 1;
1053	}
1054
1055	/* next */
1056	offCur += pHdr->cbTotal;
1057	cbLeft -= pHdr->cbTotal;
1058	}
1059
1060	/* Done with the buffer. */
1061	RTMemFree(pbLogBuf);
1062
1063	/* Make sure we've reserved a char for the terminator. */
1064	if (!offDst)
1065	offDst = 1;
1066
1067	/* Set return size value. */
1068	if (pcbActual)
1069	*pcbActual = offDst;
1070
1071	if (offDst <= cbBuf)
1072	return VINF_SUCCESS;
1073	return VERR_BUFFER_OVERFLOW;
1074	}
1075
1076
1077	/**
1078	* Worker to get at the kernel log for post 3.4 kernels where the log buffer contains records.
1079	*
1080	* @returns VBox status code.
1081	* @param pThis The Linux digger data.
1082	* @param pUVM The VM user mdoe handle.
1083	* @param pVMM The VMM function table.
1084	* @param hMod The debug module handle.
1085	* @param fFlags Flags reserved for future use, MBZ.
1086	* @param cMessages The number of messages to retrieve, counting from the
1087	* end of the log (i.e. like tail), use UINT32_MAX for all.
1088	* @param pszBuf The output buffer.
1089	* @param cbBuf The buffer size.
1090	* @param pcbActual Where to store the number of bytes actually returned,
1091	* including zero terminator. On VERR_BUFFER_OVERFLOW this
1092	* holds the necessary buffer size. Optional.
1093	*/
1094	static int dbgDiggerLinuxLogBufferQueryRecords(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
1095	uint32_t fFlags, uint32_t cMessages,
1096	char pszBuf, size_t cbBuf, size_t pcbActual)
1097	{
1098	int rc = VINF_SUCCESS;
1099	RTGCPTR GCPtrLogBuf;
1100	uint32_t cbLogBuf;
1101	uint32_t idxFirst;
1102	uint32_t idxNext;
1103
1104	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
1105	{
1106	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
1107	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
1108	{ &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
1109	{ &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
1110	};
1111	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
1112	{
1113	RTDBGSYMBOL SymInfo;
1114	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
1115	if (RT_SUCCESS(rc))
1116	{
1117	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
1118	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
1119	DBGFADDRESS Addr;
1120	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1121	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1122	(RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
1123	aSymbols[i].pvVar, aSymbols[i].cbGuest);
1124	if (RT_SUCCESS(rc))
1125	continue;
1126	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
1127	}
1128	else
1129	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
1130	rc = VERR_NOT_FOUND;
1131	break;
1132	}
1133
1134	/*
1135	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
1136	* some public helpers to get at the addresses.
1137	*
1138	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
1139	*/
1140	if (rc == VERR_NOT_FOUND)
1141	{
1142	idxFirst = 0;
1143	idxNext = 0;
1144	rc = dbgDiggerLinuxQueryLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
1145	if (RT_FAILURE(rc))
1146	{
1147	/*
1148	* Last resort, scan for a known value which should appear only once in the kernel log buffer
1149	* and try to deduce the boundaries from there.
1150	*/
1151	return dbgDiggerLinuxKrnlLogBufFindByNeedle(pThis, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1152	}
1153	}
1154
1155	return dbgDiggerLinuxKrnLogBufferProcess(pThis, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, idxFirst, idxNext,
1156	fFlags, cMessages, pszBuf, cbBuf, pcbActual);
1157	}
1158
1159	/**
1160	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
1161	*/
1162	static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, uint32_t fFlags,
1163	uint32_t cMessages, char pszBuf, size_t cbBuf, size_t pcbActual)
1164	{
1165	PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
1166
1167	if (cMessages < 1)
1168	return VERR_INVALID_PARAMETER;
1169
1170	/*
1171	* Resolve the symbols we need and read their values.
1172	*/
1173	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1174	RTDBGMOD hMod;
1175	int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
1176	RTDbgAsRelease(hAs);
1177
1178	size_t cbActual = 0;
1179	if (RT_SUCCESS(rc))
1180	{
1181	/*
1182	* Check whether the kernel log buffer is a simple char buffer or the newer
1183	* record based implementation.
1184	* The record based implementation was presumably introduced with kernel 3.4,
1185	* see: http://thread.gmane.org/gmane.linux.kernel/1284184
1186	*/
1187	if (dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1188	rc = dbgDiggerLinuxLogBufferQueryAscii(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1189	else
1190	rc = dbgDiggerLinuxLogBufferQueryRecords(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1191
1192	/* Release the module in any case. */
1193	RTDbgModRelease(hMod);
1194	}
1195	else
1196	{
1197	/*
1198	* For the record based kernel versions we have a last resort heuristic which doesn't
1199	* require any symbols, try that here.
1200	*/
1201	if (!dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1202	{
1203	RTGCPTR GCPtrLogBuf = 0;
1204	uint32_t cbLogBuf = 0;
1205
1206	rc = dbgDiggerLinuxKrnlLogBufFindByNeedle(pData, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1207	if (RT_SUCCESS(rc))
1208	rc = dbgDiggerLinuxKrnLogBufferProcess(pData, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, 0 /idxFirst/, 0 /idxNext/,
1209	fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1210	}
1211	else
1212	rc = VERR_NOT_FOUND;
1213	}
1214
1215	if (RT_FAILURE(rc) && rc != VERR_BUFFER_OVERFLOW)
1216	return rc;
1217
1218	if (pcbActual)
1219	*pcbActual = cbActual;
1220
1221	/*
1222	* All VBox strings are UTF-8 and bad things may in theory happen if we
1223	* pass bad UTF-8 to code which assumes it's all valid. So, we enforce
1224	* UTF-8 upon the guest kernel messages here even if they (probably) have
1225	* no defined code set in reality.
1226	*/
1227	if ( RT_SUCCESS(rc)
1228	&& cbActual <= cbBuf)
1229	{
1230	pszBuf[cbActual - 1] = '\0';
1231	RTStrPurgeEncoding(pszBuf);
1232	return VINF_SUCCESS;
1233	}
1234
1235	if (cbBuf)
1236	{
1237	pszBuf[cbBuf - 1] = '\0';
1238	RTStrPurgeEncoding(pszBuf);
1239	}
1240	return VERR_BUFFER_OVERFLOW;
1241	}
1242
1243
1244	/**
1245	* Worker destroying the config database.
1246	*/
1247	static DECLCALLBACK(int) dbgDiggerLinuxCfgDbDestroyWorker(PRTSTRSPACECORE pStr, void *pvUser)
1248	{
1249	PDBGDIGGERLINUXCFGITEM pCfgItem = (PDBGDIGGERLINUXCFGITEM)pStr;
1250	RTStrFree((char *)pCfgItem->Core.pszString);
1251	RTMemFree(pCfgItem);
1252	NOREF(pvUser);
1253	return 0;
1254	}
1255
1256
1257	/**
1258	* Destroy the config database.
1259	*
1260	* @param pThis The Linux digger data.
1261	*/
1262	static void dbgDiggerLinuxCfgDbDestroy(PDBGDIGGERLINUX pThis)
1263	{
1264	RTStrSpaceDestroy(&pThis->hCfgDb, dbgDiggerLinuxCfgDbDestroyWorker, NULL);
1265	}
1266
1267
1268	/**
1269	* @copydoc DBGFOSREG::pfnStackUnwindAssist
1270	*/
1271	static DECLCALLBACK(int) dbgDiggerLinuxStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
1272	PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
1273	RTDBGAS hAs, uint64_t *puScratch)
1274	{
1275	RT_NOREF(pUVM, pVMM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
1276	return VINF_SUCCESS;
1277	}
1278
1279
1280	/**
1281	* @copydoc DBGFOSREG::pfnQueryInterface
1282	*/
1283	static DECLCALLBACK(void ) dbgDiggerLinuxQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void pvData, DBGFOSINTERFACE enmIf)
1284	{
1285	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1286	RT_NOREF(pUVM, pVMM);
1287
1288	switch (enmIf)
1289	{
1290	case DBGFOSINTERFACE_DMESG:
1291	return &pThis->IDmesg;
1292
1293	default:
1294	return NULL;
1295	}
1296	}
1297
1298
1299	/**
1300	* @copydoc DBGFOSREG::pfnQueryVersion
1301	*/
1302	static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
1303	char *pszVersion, size_t cchVersion)
1304	{
1305	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1306	Assert(pThis->fValid);
1307
1308	/*
1309	* It's all in the linux banner.
1310	*/
1311	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
1312	if (RT_SUCCESS(rc))
1313	{
1314	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
1315	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
1316	while ( pszEnd > pszVersion
1317	&& RT_C_IS_SPACE(pszEnd[-1]))
1318	pszEnd--;
1319	*pszEnd = '\0';
1320	}
1321	else
1322	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
1323
1324	return rc;
1325	}
1326
1327
1328	/**
1329	* @copydoc DBGFOSREG::pfnTerm
1330	*/
1331	static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1332	{
1333	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1334	Assert(pThis->fValid);
1335
1336	/*
1337	* Destroy configuration database.
1338	*/
1339	dbgDiggerLinuxCfgDbDestroy(pThis);
1340
1341	/*
1342	* Unlink and release our modules.
1343	*/
1344	RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1345	if (hDbgAs != NIL_RTDBGAS)
1346	{
1347	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
1348	while (iMod-- > 0)
1349	{
1350	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
1351	if (hMod != NIL_RTDBGMOD)
1352	{
1353	if (RTDbgModGetTag(hMod) == DIG_LNX_MOD_TAG)
1354	{
1355	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
1356	AssertRC(rc);
1357	}
1358	RTDbgModRelease(hMod);
1359	}
1360	}
1361	RTDbgAsRelease(hDbgAs);
1362	}
1363
1364	pThis->fValid = false;
1365	}
1366
1367
1368	/**
1369	* @copydoc DBGFOSREG::pfnRefresh
1370	*/
1371	static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1372	{
1373	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1374	RT_NOREF(pThis);
1375	Assert(pThis->fValid);
1376
1377	/*
1378	* For now we'll flush and reload everything.
1379	*/
1380	dbgDiggerLinuxTerm(pUVM, pVMM, pvData);
1381	return dbgDiggerLinuxInit(pUVM, pVMM, pvData);
1382	}
1383
1384
1385	/**
1386	* Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
1387	* digger data.
1388	*
1389	* @returns VINF_SUCCESS.
1390	* @param pThis The Linux digger data to update.
1391	* @param pVMM The VMM function table.
1392	* @param pAddrKernelNames The kallsyms_names address.
1393	* @param cKernelSymbols The number of kernel symbol.
1394	* @param cbAddress The guest address size.
1395	*/
1396	static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pAddrKernelNames,
1397	uint32_t cKernelSymbols, uint32_t cbAddress)
1398	{
1399	pThis->cKernelSymbols = cKernelSymbols;
1400	pThis->AddrKernelNames = *pAddrKernelNames;
1401	pThis->AddrKernelAddresses = *pAddrKernelNames;
1402	uint32_t cbSymbolsSkip = (pThis->fRelKrnlAddr ? 2 : 1) * cbAddress; /* Relative addressing introduces kallsyms_relative_base. */
1403	uint32_t cbOffsets = pThis->fRelKrnlAddr ? sizeof(int32_t) : cbAddress; /* Offsets are always 32bits wide for relative addressing. */
1404	uint32_t cbAlign = 0;
1405
1406	/*
1407	* If the number of symbols is odd there is padding to align the following guest pointer
1408	* sized data properly on 64bit systems with relative addressing.
1409	*/
1410	if ( pThis->fRelKrnlAddr
1411	&& pThis->f64Bit
1412	&& (pThis->cKernelSymbols & 1))
1413	cbAlign = sizeof(int32_t);
1414	pVMM->pfnDBGFR3AddrSub(&pThis->AddrKernelAddresses, cKernelSymbols * cbOffsets + cbSymbolsSkip + cbAlign);
1415
1416	Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
1417	"dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
1418	"dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
1419	pThis->AddrKernelAddresses.FlatPtr,
1420	pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
1421	pThis->AddrKernelNames.FlatPtr));
1422	return VINF_SUCCESS;
1423	}
1424
1425
1426	/**
1427	* Tries to find the address of the kallsyms_names, kallsyms_num_syms and
1428	* kallsyms_addresses symbols.
1429	*
1430	* The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
1431	* addresses of the other two are stored as pThis->AddrKernelNames and
1432	* pThis->AddrKernelAddresses.
1433	*
1434	* @returns VBox status code, success indicating that all three variables have
1435	* been found and taken down.
1436	* @param pUVM The user mode VM handle.
1437	* @param pVMM The VMM function table.
1438	* @param pThis The Linux digger data.
1439	* @param pHitAddr An address we think is inside kallsyms_names.
1440	*/
1441	static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis,
1442	PCDBGFADDRESS pHitAddr)
1443	{
1444	/*
1445	* Search backwards in chunks.
1446	*/
1447	union
1448	{
1449	uint8_t ab[0x1000];
1450	uint32_t au32[0x1000 / sizeof(uint32_t)];
1451	uint64_t au64[0x1000 / sizeof(uint64_t)];
1452	} uBuf;
1453	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
1454	uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1455	DBGFADDRESS CurAddr = *pHitAddr;
1456	pVMM->pfnDBGFR3AddrSub(&CurAddr, cbBuf);
1457	cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
1458	for (;;)
1459	{
1460	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1461	if (RT_FAILURE(rc))
1462	return rc;
1463
1464	/*
1465	* Since Linux 4.6 there are two different methods to store the kallsyms addresses
1466	* in the image.
1467	*
1468	* The first and longer existing method is to store the absolute addresses in an
1469	* array starting at kallsyms_addresses followed by a field which stores the number
1470	* of kernel symbols called kallsyms_num_syms.
1471	* The newer method is to use offsets stored in kallsyms_offsets and have a base pointer
1472	* to relate the offsets to called kallsyms_relative_base. One entry in kallsyms_offsets is
1473	* always 32bit wide regardless of the guest pointer size (this halves the table on 64bit
1474	* systems) but means more work for us for the 64bit case.
1475	*
1476	* When absolute addresses are used the following assumptions hold:
1477	*
1478	* We assume that the three symbols are aligned on guest pointer boundary.
1479	*
1480	* The boundary between the two tables should be noticable as the number
1481	* is unlikely to be more than 16 millions, there will be at least one zero
1482	* byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
1483	* that common in the kallsyms_names table.
1484	*
1485	* Also the kallsyms_names table starts with a length byte, which means
1486	* we're likely to see a byte in the range 1..31.
1487	*
1488	* The kallsyms_addresses are mostly sorted (except for the start where the
1489	* absolute symbols are), so we'll spot a bunch of kernel addresses
1490	* immediately preceeding the kallsyms_num_syms field.
1491	*
1492	* Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
1493	* the check for kernel addresses preceeding it.
1494	*
1495	* For relative offsets most of the assumptions from above are true too
1496	* except that we have to distinguish between the relative base address and the offsets.
1497	* Every observed kernel has a valid kernel address fo the relative base and kallsyms_relative_base
1498	* always comes before kallsyms_num_syms and is aligned on a guest pointer boundary.
1499	* Offsets are stored before kallsyms_relative_base and don't contain valid kernel addresses.
1500	*
1501	* To distinguish between absolute and relative offsetting we check the data before a candidate
1502	* for kallsyms_num_syms. If all entries before the kallsyms_num_syms candidate are valid kernel
1503	* addresses absolute addresses are assumed. If this is not the case but the first entry before
1504	* kallsyms_num_syms is a valid kernel address we check whether the data before and the possible
1505	* relative base form a valid kernel address and assume relative offsets.
1506	*
1507	* Other notable changes between various Linux kernel versions:
1508	*
1509	* 4.20.0+: Commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a made kallsyms_num_syms 32bit
1510	* even on 64bit systems but the alignment of the variables makes the code below work for now
1511	* (tested with a 5.4 and 5.12 kernel) do we keep it that way to avoid making the code even
1512	* messy.
1513	*/
1514	if (pThis->f64Bit)
1515	{
1516	uint32_t i = cbBuf / sizeof(uint64_t) - 1;
1517	while (i-- > 0)
1518	if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1519	&& uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1520	{
1521	uint8_t pb = (uint8_t )&uBuf.au64[i + 1];
1522	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1523	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1524	{
1525	/*
1526	* Check whether we have a valid kernel address and try to distinguish
1527	* whether the kernel uses relative offsetting or absolute addresses.
1528	*/
1529	if ( (i >= 1 && LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1530	&& (i >= 2 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1531	&& (i >= 3 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1532	{
1533	RTGCUINTPTR uKrnlRelBase = uBuf.au64[i - 1];
1534	DBGFADDRESS RelAddr = CurAddr;
1535	int32_t aiRelOff[3];
1536	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1537	pVMM->pfnDBGFR3AddrAdd(&RelAddr,
1538	(i - 1) * sizeof(uint64_t) - sizeof(aiRelOff)),
1539	&aiRelOff[0], sizeof(aiRelOff));
1540	if ( RT_SUCCESS(rc)
1541	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[0])
1542	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[1])
1543	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[2]))
1544	{
1545	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1546	uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint64_t)));
1547	pThis->fRelKrnlAddr = true;
1548	pThis->uKernelRelativeBase = uKrnlRelBase;
1549	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1550	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1551	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
1552	}
1553	}
1554
1555	if ( (i <= 0 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1556	&& (i <= 1 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1557	&& (i <= 2 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1558	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1559	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1560	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
1561	}
1562	}
1563	}
1564	else
1565	{
1566	uint32_t i = cbBuf / sizeof(uint32_t) - 1;
1567	while (i-- > 0)
1568	if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1569	&& uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1570	{
1571	uint8_t pb = (uint8_t )&uBuf.au32[i + 1];
1572	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1573	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1574	{
1575	/* Check for relative base addressing. */
1576	if (i >= 1 && LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1577	{
1578	RTGCUINTPTR uKrnlRelBase = uBuf.au32[i - 1];
1579	if ( (i <= 1 \|\| LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 2]))
1580	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 3])))
1581	{
1582	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1583	uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint32_t)));
1584	pThis->fRelKrnlAddr = true;
1585	pThis->uKernelRelativeBase = uKrnlRelBase;
1586	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1587	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1588	uBuf.au32[i], sizeof(uint32_t));
1589	}
1590	}
1591
1592	if ( (i <= 0 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1593	&& (i <= 1 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
1594	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
1595	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1596	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1597	uBuf.au32[i], sizeof(uint32_t));
1598	}
1599	}
1600	}
1601
1602	/*
1603	* Advance
1604	*/
1605	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1606	{
1607	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1608	return VERR_NOT_FOUND;
1609	}
1610	cbLeft -= sizeof(uBuf);
1611	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uBuf));
1612	cbBuf = sizeof(uBuf);
1613	}
1614	}
1615
1616
1617	/**
1618	* Worker for dbgDiggerLinuxFindEndNames that records the findings.
1619	*
1620	* @returns VINF_SUCCESS
1621	* @param pThis The linux digger data to update.
1622	* @param pVMM The VMM function table.
1623	* @param pAddrMarkers The address of the marker (kallsyms_markers).
1624	* @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
1625	*/
1626	static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM,
1627	PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
1628	{
1629	pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
1630	pThis->AddrKernelNameMarkers = *pAddrMarkers;
1631	pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
1632	pThis->AddrKernelTokenTable = *pAddrMarkers;
1633	pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
1634
1635	Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
1636	"dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
1637	"dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
1638	pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
1639	pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
1640	pThis->AddrKernelTokenTable.FlatPtr));
1641	return VINF_SUCCESS;
1642	}
1643
1644
1645	/**
1646	* Tries to find the end of kallsyms_names and thereby the start of
1647	* kallsyms_markers and kallsyms_token_table.
1648	*
1649	* The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
1650	* the two other symbols in pThis->AddrKernelNameMarkers and
1651	* pThis->AddrKernelTokenTable. The number of marker entries is stored in
1652	* pThis->cKernelNameMarkers.
1653	*
1654	* @returns VBox status code, success indicating that all three variables have
1655	* been found and taken down.
1656	* @param pUVM The user mode VM handle.
1657	* @param pVMM The VMM function table.
1658	* @param pThis The Linux digger data.
1659	* @param pHitAddr An address we think is inside kallsyms_names.
1660	*/
1661	static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1662	{
1663	/*
1664	* Search forward in chunks.
1665	*/
1666	union
1667	{
1668	uint8_t ab[0x1000];
1669	uint32_t au32[0x1000 / sizeof(uint32_t)];
1670	uint64_t au64[0x1000 / sizeof(uint64_t)];
1671	} uBuf;
1672	bool fPendingZeroHit = false;
1673	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
1674	uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1675	DBGFADDRESS CurAddr = *pHitAddr;
1676	pVMM->pfnDBGFR3AddrSub(&CurAddr, offBuf);
1677	for (;;)
1678	{
1679	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1680	if (RT_FAILURE(rc))
1681	return rc;
1682
1683	/*
1684	* The kallsyms_names table is followed by kallsyms_markers we assume,
1685	* using sizeof(unsigned long) alignment like the preceeding symbols.
1686	*
1687	* The kallsyms_markers table has entried sizeof(unsigned long) and
1688	* contains offsets into kallsyms_names. The kallsyms_markers used to
1689	* index kallsyms_names and reduce seek time when looking up the name
1690	* of an address/symbol. Each entry in kallsyms_markers covers 256
1691	* symbol names.
1692	*
1693	* Because of this, the first entry is always zero and all the entries
1694	* are ascending. It also follows that the size of the table can be
1695	* calculated from kallsyms_num_syms.
1696	*
1697	* Note! We could also have walked kallsyms_names by skipping
1698	* kallsyms_num_syms names, but this is faster and we will
1699	* validate the encoded names later.
1700	*
1701	* git commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a (which became 4.20+) makes kallsyms_markers
1702	* and kallsyms_num_syms uint32_t, even on 64bit systems. Take that into account.
1703	*/
1704	if ( pThis->f64Bit
1705	&& pThis->uKrnlVer < LNX_MK_VER(4, 20, 0))
1706	{
1707	if ( RT_UNLIKELY(fPendingZeroHit)
1708	&& uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1709	&& uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1710	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1711	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
1712
1713	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
1714	for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
1715	if (uBuf.au64[i] == 0)
1716	{
1717	if (RT_UNLIKELY(i + 1 >= cEntries))
1718	{
1719	fPendingZeroHit = true;
1720	break;
1721	}
1722	if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1723	&& uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1724	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1725	pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
1726	}
1727	}
1728	else
1729	{
1730	if ( RT_UNLIKELY(fPendingZeroHit)
1731	&& uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1732	&& uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1733	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1734	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
1735
1736	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
1737	for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
1738	if (uBuf.au32[i] == 0)
1739	{
1740	if (RT_UNLIKELY(i + 1 >= cEntries))
1741	{
1742	fPendingZeroHit = true;
1743	break;
1744	}
1745	if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1746	&& uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1747	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1748	pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
1749	}
1750	}
1751
1752	/*
1753	* Advance
1754	*/
1755	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1756	{
1757	Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1758	return VERR_NOT_FOUND;
1759	}
1760	cbLeft -= sizeof(uBuf);
1761	pVMM->pfnDBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
1762	offBuf = 0;
1763	}
1764	}
1765
1766
1767	/**
1768	* Locates the kallsyms_token_index table.
1769	*
1770	* Storing the address in pThis->AddrKernelTokenIndex and the size of the token
1771	* table in pThis->cbKernelTokenTable.
1772	*
1773	* @returns VBox status code.
1774	* @param pUVM The user mode VM handle.
1775	* @param pVMM The VMM function table.
1776	* @param pThis The Linux digger data.
1777	*/
1778	static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1779	{
1780	/*
1781	* The kallsyms_token_table is very much like a string table. Due to the
1782	* nature of the compression algorithm it is reasonably short (one example
1783	* here is 853 bytes), so we'll not be reading it in chunks but in full.
1784	* To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
1785	* memory or any other nasty stuff...
1786	*/
1787	union
1788	{
1789	uint8_t ab[0x2000];
1790	uint16_t au16[0x2000 / sizeof(uint16_t)];
1791	} uBuf;
1792	DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
1793	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1794	if (RT_FAILURE(rc))
1795	return rc;
1796
1797	/*
1798	* We've got two choices here, either walk the string table or look for
1799	* the next structure, kallsyms_token_index.
1800	*
1801	* The token index is a table of 256 uint16_t entries (index by bytes
1802	* from kallsyms_names) that gives offsets in kallsyms_token_table. It
1803	* starts with a zero entry and the following entries are sorted in
1804	* ascending order. The range of the entries are reasonably small since
1805	* kallsyms_token_table is small.
1806	*
1807	* The alignment seems to be sizeof(unsigned long), just like
1808	* kallsyms_token_table.
1809	*
1810	* So, we start by looking for a zero 16-bit entry.
1811	*/
1812	uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
1813
1814	for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
1815	if ( uBuf.au16[i] == 0
1816	&& uBuf.au16[i + 1] > 0
1817	&& uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
1818	&& (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1819	&& (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1820	&& (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1821	&& (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1822	&& (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1823	)
1824	{
1825	pThis->AddrKernelTokenIndex = CurAddr;
1826	pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
1827	pThis->cbKernelTokenTable = i * sizeof(uint16_t);
1828	return VINF_SUCCESS;
1829	}
1830
1831	Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
1832	return VERR_NOT_FOUND;
1833	}
1834
1835
1836	/**
1837	* Loads the kernel symbols from the given kallsyms offset table decoding the symbol names
1838	* (worker common for dbgDiggerLinuxLoadKernelSymbolsAbsolute() and dbgDiggerLinuxLoadKernelSymbolsRelative()).
1839	*
1840	* @returns VBox status code.
1841	* @param pUVM The user mode VM handle.
1842	* @param pVMM The VMM function table.
1843	* @param pThis The Linux digger data.
1844	* @param uKernelStart Flat kernel start address.
1845	* @param cbKernel Size of the kernel in bytes.
1846	* @param pauSymOff Pointer to the array of symbol offsets in the kallsyms table
1847	* relative to the start of the kernel.
1848	*/
1849	static int dbgDiggerLinuxLoadKernelSymbolsWorker(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, RTGCUINTPTR uKernelStart,
1850	RTGCUINTPTR cbKernel, RTGCUINTPTR *pauSymOff)
1851	{
1852	uint8_t pbNames = (uint8_t )RTMemAllocZ(pThis->cbKernelNames);
1853	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1854	if (RT_SUCCESS(rc))
1855	{
1856	char pszzTokens = (char )RTMemAllocZ(pThis->cbKernelTokenTable);
1857	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1858	if (RT_SUCCESS(rc))
1859	{
1860	uint16_t paoffTokens = (uint16_t )RTMemAllocZ(256 * sizeof(uint16_t));
1861	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1862	if (RT_SUCCESS(rc))
1863	{
1864	/*
1865	* Create a module for the kernel.
1866	*/
1867	RTDBGMOD hMod;
1868	rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /fFlags/);
1869	if (RT_SUCCESS(rc))
1870	{
1871	rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1872	rc = VINF_SUCCESS;
1873
1874	/*
1875	* Enumerate the symbols.
1876	*/
1877	uint32_t offName = 0;
1878	uint32_t cLeft = pThis->cKernelSymbols;
1879	while (cLeft-- > 0 && RT_SUCCESS(rc))
1880	{
1881	/* Decode the symbol name first. */
1882	if (RT_LIKELY(offName < pThis->cbKernelNames))
1883	{
1884	uint8_t cbName = pbNames[offName++];
1885	if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1886	{
1887	char szSymbol[4096];
1888	uint32_t offSymbol = 0;
1889	while (cbName-- > 0)
1890	{
1891	uint8_t bEnc = pbNames[offName++];
1892	uint16_t offToken = paoffTokens[bEnc];
1893	if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1894	{
1895	const char *pszToken = &pszzTokens[offToken];
1896	char ch;
1897	while ((ch = *pszToken++) != '\0')
1898	if (offSymbol < sizeof(szSymbol) - 1)
1899	szSymbol[offSymbol++] = ch;
1900	}
1901	else
1902	{
1903	rc = VERR_INVALID_UTF8_ENCODING;
1904	break;
1905	}
1906	}
1907	szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1908
1909	/* The offset. */
1910	RTGCUINTPTR uSymOff = *pauSymOff;
1911	pauSymOff++;
1912
1913	/* Add it without the type char. */
1914	if (uSymOff <= cbKernel)
1915	{
1916	rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymOff,
1917	0 /cb/, 0 /fFlags/, NULL);
1918	if (RT_FAILURE(rc))
1919	{
1920	if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1921	\|\| rc == VERR_DBG_INVALID_RVA
1922	\|\| rc == VERR_DBG_ADDRESS_CONFLICT
1923	\|\| rc == VERR_DBG_DUPLICATE_SYMBOL)
1924	{
1925	Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1926	rc = VINF_SUCCESS;
1927	}
1928	else
1929	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1930	}
1931	}
1932	}
1933	else
1934	{
1935	rc = VERR_END_OF_STRING;
1936	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1937	offName, cLeft, cbName, pThis->cbKernelNames));
1938	}
1939	}
1940	else
1941	{
1942	rc = VERR_END_OF_STRING;
1943	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1944	offName, cLeft, pThis->cbKernelNames));
1945	}
1946	}
1947
1948	/*
1949	* Link the module into the address space.
1950	*/
1951	if (RT_SUCCESS(rc))
1952	{
1953	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1954	if (hAs != NIL_RTDBGAS)
1955	rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1956	else
1957	rc = VERR_INTERNAL_ERROR;
1958	RTDbgAsRelease(hAs);
1959	}
1960	else
1961	Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1962	RTDbgModRelease(hMod);
1963	}
1964	else
1965	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1966	}
1967	else
1968	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1969	pThis->AddrKernelTokenIndex.FlatPtr, rc));
1970	RTMemFree(paoffTokens);
1971	}
1972	else
1973	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1974	pThis->AddrKernelTokenTable.FlatPtr, rc));
1975	RTMemFree(pszzTokens);
1976	}
1977	else
1978	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1979	pThis->AddrKernelNames.FlatPtr, rc));
1980	RTMemFree(pbNames);
1981
1982	return rc;
1983	}
1984
1985	/**
1986	* Loads the kernel symbols from the kallsyms table if it contains absolute addresses
1987	*
1988	* @returns VBox status code.
1989	* @param pUVM The user mode VM handle.
1990	* @param pVMM The VMM function table.
1991	* @param pThis The Linux digger data.
1992	*/
1993	static int dbgDiggerLinuxLoadKernelSymbolsAbsolute(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1994	{
1995	/*
1996	* Allocate memory for temporary table copies, reading the tables as we go.
1997	*/
1998	uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
1999	void pvAddresses = RTMemAllocZ(pThis->cKernelSymbols cbGuestAddr);
2000	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses,
2001	pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
2002	if (RT_SUCCESS(rc))
2003	{
2004	/*
2005	* Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2006	*/
2007	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2008	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2009	RTGCUINTPTR pauSymOff = (RTGCUINTPTR )RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2010	uint32_t i;
2011	if (cbGuestAddr == sizeof(uint64_t))
2012	{
2013	uint64_t pauAddrs = (uint64_t )pvAddresses;
2014	for (i = 0; i < pThis->cKernelSymbols; i++)
2015	if ( pauAddrs[i] < uKernelStart
2016	&& LNX64_VALID_ADDRESS(pauAddrs[i])
2017	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2018	uKernelStart = pauAddrs[i];
2019
2020	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2021	if ( pauAddrs[i] > uKernelEnd
2022	&& LNX64_VALID_ADDRESS(pauAddrs[i])
2023	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2024	uKernelEnd = pauAddrs[i];
2025
2026	for (i = 0; i < pThis->cKernelSymbols; i++)
2027	pauSymOff[i] = pauAddrs[i] - uKernelStart;
2028	}
2029	else
2030	{
2031	uint32_t pauAddrs = (uint32_t )pvAddresses;
2032	for (i = 0; i < pThis->cKernelSymbols; i++)
2033	if ( pauAddrs[i] < uKernelStart
2034	&& LNX32_VALID_ADDRESS(pauAddrs[i])
2035	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2036	uKernelStart = pauAddrs[i];
2037
2038	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2039	if ( pauAddrs[i] > uKernelEnd
2040	&& LNX32_VALID_ADDRESS(pauAddrs[i])
2041	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2042	uKernelEnd = pauAddrs[i];
2043
2044	for (i = 0; i < pThis->cKernelSymbols; i++)
2045	pauSymOff[i] = pauAddrs[i] - uKernelStart;
2046	}
2047
2048	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2049	pThis->cbKernel = (uint32_t)cbKernel;
2050	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2051	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2052
2053	rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2054	if (RT_FAILURE(rc))
2055	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Loading symbols from given offset table failed: %Rrc\n", rc));
2056	RTMemTmpFree(pauSymOff);
2057	}
2058	else
2059	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Reading symbol addresses at %RGv failed: %Rrc\n",
2060	pThis->AddrKernelAddresses.FlatPtr, rc));
2061	RTMemFree(pvAddresses);
2062
2063	return rc;
2064	}
2065
2066
2067	/**
2068	* Loads the kernel symbols from the kallsyms table if it contains absolute addresses
2069	*
2070	* @returns VBox status code.
2071	* @param pUVM The user mode VM handle.
2072	* @param pVMM The VMM function table.
2073	* @param pThis The Linux digger data.
2074	*/
2075	static int dbgDiggerLinuxLoadKernelSymbolsRelative(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2076	{
2077	/*
2078	* Allocate memory for temporary table copies, reading the tables as we go.
2079	*/
2080	int32_t pai32Offsets = (int32_t )RTMemAllocZ(pThis->cKernelSymbols * sizeof(int32_t));
2081	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses,
2082	pai32Offsets, pThis->cKernelSymbols * sizeof(int32_t));
2083	if (RT_SUCCESS(rc))
2084	{
2085	/*
2086	* Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2087	*/
2088	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2089	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2090	RTGCUINTPTR pauSymOff = (RTGCUINTPTR )RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2091	uint32_t i;
2092
2093	for (i = 0; i < pThis->cKernelSymbols; i++)
2094	{
2095	RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2096
2097	if ( uSymAddr < uKernelStart
2098	&& (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2099	&& uKernelStart - uSymAddr < LNX_MAX_KERNEL_SIZE)
2100	uKernelStart = uSymAddr;
2101	}
2102
2103	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2104	{
2105	RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2106
2107	if ( uSymAddr > uKernelEnd
2108	&& (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2109	&& uSymAddr - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2110	uKernelEnd = uSymAddr;
2111
2112	/* Store the offset from the derived kernel start address. */
2113	pauSymOff[i] = uSymAddr - uKernelStart;
2114	}
2115
2116	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2117	pThis->cbKernel = (uint32_t)cbKernel;
2118	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2119	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2120
2121	rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2122	if (RT_FAILURE(rc))
2123	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Loading symbols from given offset table failed: %Rrc\n", rc));
2124	RTMemTmpFree(pauSymOff);
2125	}
2126	else
2127	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Reading symbol addresses at %RGv failed: %Rrc\n",
2128	pThis->AddrKernelAddresses.FlatPtr, rc));
2129	RTMemFree(pai32Offsets);
2130
2131	return rc;
2132	}
2133
2134
2135	/**
2136	* Loads the kernel symbols.
2137	*
2138	* @returns VBox status code.
2139	* @param pUVM The user mode VM handle.
2140	* @param pVMM The VMM function table.
2141	* @param pThis The Linux digger data.
2142	*/
2143	static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2144	{
2145	/*
2146	* First the kernel itself.
2147	*/
2148	if (pThis->fRelKrnlAddr)
2149	return dbgDiggerLinuxLoadKernelSymbolsRelative(pUVM, pVMM, pThis);
2150	return dbgDiggerLinuxLoadKernelSymbolsAbsolute(pUVM, pVMM, pThis);
2151	}
2152
2153
2154	/*
2155	* The module structure changed it was easier to produce different code for
2156	* each version of the structure. The C preprocessor rules!
2157	*/
2158	#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleCodeTmpl.cpp.h"
2159
2160	#define LNX_BIT_SUFFIX _amd64
2161	#define LNX_PTR_T uint64_t
2162	#define LNX_64BIT 1
2163	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2164
2165	#define LNX_BIT_SUFFIX _x86
2166	#define LNX_PTR_T uint32_t
2167	#define LNX_64BIT 0
2168	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2169
2170	#undef LNX_TEMPLATE_HEADER
2171
2172	static const struct
2173	{
2174	uint32_t uVersion;
2175	bool f64Bit;
2176	uint64_t (*pfnProcessModule)(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGFADDRESS pAddrModule);
2177	} g_aModVersions[] =
2178	{
2179	#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleTableEntryTmpl.cpp.h"
2180
2181	#define LNX_BIT_SUFFIX _amd64
2182	#define LNX_64BIT 1
2183	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2184
2185	#define LNX_BIT_SUFFIX _x86
2186	#define LNX_64BIT 0
2187	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2188
2189	#undef LNX_TEMPLATE_HEADER
2190	};
2191
2192
2193	/**
2194	* Tries to find and process the module list.
2195	*
2196	* @returns VBox status code.
2197	* @param pThis The Linux digger data.
2198	* @param pUVM The user mode VM handle.
2199	* @param pVMM The VMM function table.
2200	*/
2201	static int dbgDiggerLinuxLoadModules(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2202	{
2203	/*
2204	* Locate the list head.
2205	*/
2206	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
2207	RTDBGSYMBOL SymInfo;
2208	int rc = RTDbgAsSymbolByName(hAs, "vmlinux!modules", &SymInfo, NULL);
2209	RTDbgAsRelease(hAs);
2210	if (RT_FAILURE(rc))
2211	return VERR_NOT_FOUND;
2212
2213	if (RT_FAILURE(rc))
2214	{
2215	LogRel(("dbgDiggerLinuxLoadModules: Failed to locate the module list (%Rrc).\n", rc));
2216	return VERR_NOT_FOUND;
2217	}
2218
2219	/*
2220	* Read the list anchor.
2221	*/
2222	union
2223	{
2224	uint32_t volatile u32Pair[2];
2225	uint64_t u64Pair[2];
2226	} uListAnchor;
2227	DBGFADDRESS Addr;
2228	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value),
2229	&uListAnchor, pThis->f64Bit ? sizeof(uListAnchor.u64Pair) : sizeof(uListAnchor.u32Pair));
2230	if (RT_FAILURE(rc))
2231	{
2232	LogRel(("dbgDiggerLinuxLoadModules: Error reading list anchor at %RX64: %Rrc\n", SymInfo.Value, rc));
2233	return VERR_NOT_FOUND;
2234	}
2235	if (!pThis->f64Bit)
2236	{
2237	uListAnchor.u64Pair[1] = uListAnchor.u32Pair[1];
2238	ASMCompilerBarrier();
2239	uListAnchor.u64Pair[0] = uListAnchor.u32Pair[0];
2240	}
2241
2242	if (pThis->uKrnlVer == 0)
2243	{
2244	LogRel(("dbgDiggerLinuxLoadModules: No valid kernel version given: %#x\n", pThis->uKrnlVer));
2245	return VERR_NOT_FOUND;
2246	}
2247
2248	/*
2249	* Find the g_aModVersion entry that fits the best.
2250	* ASSUMES strict descending order by bitcount and version.
2251	*/
2252	Assert(g_aModVersions[0].f64Bit == true);
2253	unsigned i = 0;
2254	if (!pThis->f64Bit)
2255	while (i < RT_ELEMENTS(g_aModVersions) && g_aModVersions[i].f64Bit)
2256	i++;
2257	while ( i < RT_ELEMENTS(g_aModVersions)
2258	&& g_aModVersions[i].f64Bit == pThis->f64Bit
2259	&& pThis->uKrnlVer < g_aModVersions[i].uVersion)
2260	i++;
2261	if (i >= RT_ELEMENTS(g_aModVersions))
2262	{
2263	LogRel(("dbgDiggerLinuxLoadModules: Failed to find anything matching version: %u.%u.%u\n",
2264	pThis->uKrnlVerMaj, pThis->uKrnlVerMin, pThis->uKrnlVerBld));
2265	return VERR_NOT_FOUND;
2266	}
2267
2268	/*
2269	* Walk the list.
2270	*/
2271	uint64_t uModAddr = uListAnchor.u64Pair[0];
2272	for (size_t iModule = 0; iModule < 4096 && uModAddr != SymInfo.Value && uModAddr != 0; iModule++)
2273	uModAddr = g_aModVersions[i].pfnProcessModule(pThis, pUVM, pVMM, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uModAddr));
2274
2275	return VINF_SUCCESS;
2276	}
2277
2278
2279	/**
2280	* Checks if there is a likely kallsyms_names fragment at pHitAddr.
2281	*
2282	* @returns true if it's a likely fragment, false if not.
2283	* @param pUVM The user mode VM handle.
2284	* @param pVMM The VMM function table.
2285	* @param pHitAddr The address where paNeedle was found.
2286	* @param pabNeedle The fragment we've been searching for.
2287	* @param cbNeedle The length of the fragment.
2288	*/
2289	static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pHitAddr,
2290	uint8_t const *pabNeedle, uint8_t cbNeedle)
2291	{
2292	/*
2293	* Examples of lead and tail bytes of our choosen needle in a randomly
2294	* picked kernel:
2295	* k o b j
2296	* 22 6b 6f 62 6a aa
2297	* fc 6b 6f 62 6a aa
2298	* 82 6b 6f 62 6a 5f - ascii trail byte (_).
2299	* ee 6b 6f 62 6a aa
2300	* fc 6b 6f 62 6a 5f - ascii trail byte (_).
2301	* 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
2302	* 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
2303	* ... omitting 29 samples similar to the last two ...
2304	* d8 6b 6f 62 6a aa
2305	* d8 6b 6f 62 6a aa
2306	* d8 6b 6f 62 6a aa
2307	* d8 6b 6f 62 6a aa
2308	* f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
2309	* f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
2310	* fd 6b 6f 62 6a 0f
2311	* ... enough.
2312	*/
2313	uint8_t abBuf[32];
2314	DBGFADDRESS ReadAddr = *pHitAddr;
2315	pVMM->pfnDBGFR3AddrSub(&ReadAddr, 2);
2316	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
2317	if (RT_SUCCESS(rc))
2318	{
2319	if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
2320	{
2321	uint8_t const bLead = abBuf[1] == '_' \|\| abBuf[1] == 'T' \|\| abBuf[1] == 't' ? abBuf[0] : abBuf[1];
2322	uint8_t const offTail = 2 + cbNeedle;
2323	uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
2324	if ( bLead >= 1 && (bLead < 0x20 \|\| bLead >= 0x80)
2325	&& bTail >= 1 && (bTail < 0x20 \|\| bTail >= 0x80))
2326	return true;
2327	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
2328	pHitAddr->FlatPtr, bLead, bTail, offTail));
2329	}
2330	else
2331	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
2332	}
2333	else
2334	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
2335
2336	return false;
2337	}
2338
2339	/**
2340	* Tries to find and load the kernel symbol table with the given needle.
2341	*
2342	* @returns VBox status code.
2343	* @param pThis The Linux digger data.
2344	* @param pUVM The user mode VM handle.
2345	* @param pVMM The VMM function table.
2346	* @param pabNeedle The needle to use for searching.
2347	* @param cbNeedle Size of the needle in bytes.
2348	*/
2349	static int dbgDiggerLinuxFindSymbolTableFromNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2350	uint8_t const *pabNeedle, uint8_t cbNeedle)
2351	{
2352	/*
2353	* Go looking for the kallsyms table. If it's there, it will be somewhere
2354	* after the linux_banner symbol, so use it for starting the search.
2355	*/
2356	int rc = VINF_SUCCESS;
2357	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2358	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2359	while (cbLeft > 4096)
2360	{
2361	DBGFADDRESS HitAddr;
2362	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
2363	pabNeedle, cbNeedle, &HitAddr);
2364	if (RT_FAILURE(rc))
2365	break;
2366	if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2367	{
2368	/* There will be another hit near by. */
2369	pVMM->pfnDBGFR3AddrAdd(&HitAddr, 1);
2370	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /uAlign/,
2371	pabNeedle, cbNeedle, &HitAddr);
2372	if ( RT_SUCCESS(rc)
2373	&& dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2374	{
2375	/*
2376	* We've got a very likely candidate for a location inside kallsyms_names.
2377	* Try find the start of it, that is to say, try find kallsyms_num_syms.
2378	* kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
2379	*/
2380	rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pVMM, pThis, &HitAddr);
2381	if (RT_SUCCESS(rc))
2382	rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pVMM, pThis, &HitAddr);
2383	if (RT_SUCCESS(rc))
2384	rc = dbgDiggerLinuxFindTokenIndex(pUVM, pVMM, pThis);
2385	if (RT_SUCCESS(rc))
2386	rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pVMM, pThis);
2387	if (RT_SUCCESS(rc))
2388	{
2389	rc = dbgDiggerLinuxLoadModules(pThis, pUVM, pVMM);
2390	break;
2391	}
2392	}
2393	}
2394
2395	/*
2396	* Advance.
2397	*/
2398	RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + cbNeedle;
2399	if (RT_UNLIKELY(cbDistance >= cbLeft))
2400	{
2401	Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
2402	break;
2403	}
2404	cbLeft -= cbDistance;
2405	pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2406	}
2407
2408	return rc;
2409	}
2410
2411	/**
2412	* Skips whitespace and comments in the given config returning the pointer
2413	* to the first non whitespace character.
2414	*
2415	* @returns Pointer to the first non whitespace character or NULL if the end
2416	* of the string was reached.
2417	* @param pszCfg The config string.
2418	*/
2419	static const char dbgDiggerLinuxCfgSkipWhitespace(const char pszCfg)
2420	{
2421	do
2422	{
2423	while ( *pszCfg != '\0'
2424	&& ( RT_C_IS_SPACE(*pszCfg)
2425	\|\| *pszCfg == '\n'))
2426	pszCfg++;
2427
2428	/* Do we have a comment? Skip it. */
2429	if (*pszCfg == '#')
2430	{
2431	while ( *pszCfg != '\n'
2432	&& *pszCfg != '\0')
2433	pszCfg++;
2434	}
2435	} while ( *pszCfg != '\0'
2436	&& ( RT_C_IS_SPACE(*pszCfg)
2437	\|\| *pszCfg == '\n'
2438	\|\| *pszCfg == '#'));
2439
2440	return pszCfg;
2441	}
2442
2443	/**
2444	* Parses an identifier at the given position.
2445	*
2446	* @returns VBox status code.
2447	* @param pszCfg The config data.
2448	* @param ppszCfgNext Where to store the pointer to the data following the identifier.
2449	* @param ppszIde Where to store the pointer to the identifier on success.
2450	* Free with RTStrFree().
2451	*/
2452	static int dbgDiggerLinuxCfgParseIde(const char pszCfg, const char ppszCfgNext, char *ppszIde)
2453	{
2454	int rc = VINF_SUCCESS;
2455	size_t cchIde = 0;
2456
2457	while ( *pszCfg != '\0'
2458	&& ( RT_C_IS_ALNUM(*pszCfg)
2459	\|\| *pszCfg == '_'))
2460	{
2461	cchIde++;
2462	pszCfg++;
2463	}
2464
2465	if (cchIde)
2466	{
2467	*ppszIde = RTStrDupN(pszCfg - cchIde, cchIde);
2468	if (!*ppszIde)
2469	rc = VERR_NO_STR_MEMORY;
2470	}
2471
2472	*ppszCfgNext = pszCfg;
2473	return rc;
2474	}
2475
2476	/**
2477	* Parses a value for a config item.
2478	*
2479	* @returns VBox status code.
2480	* @param pszCfg The config data.
2481	* @param ppszCfgNext Where to store the pointer to the data following the identifier.
2482	* @param ppCfgItem Where to store the created config item on success.
2483	*/
2484	static int dbgDiggerLinuxCfgParseVal(const char pszCfg, const char *ppszCfgNext,
2485	PDBGDIGGERLINUXCFGITEM *ppCfgItem)
2486	{
2487	int rc = VINF_SUCCESS;
2488	PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2489
2490	if (RT_C_IS_DIGIT(pszCfg) \|\| pszCfg == '-')
2491	{
2492	/* Parse the number. */
2493	int64_t i64Num;
2494	rc = RTStrToInt64Ex(pszCfg, (char **)ppszCfgNext, 0, &i64Num);
2495	if ( RT_SUCCESS(rc)
2496	\|\| rc == VWRN_TRAILING_CHARS
2497	\|\| rc == VWRN_TRAILING_SPACES)
2498	{
2499	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2500	if (pCfgItem)
2501	{
2502	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_NUMBER;
2503	pCfgItem->u.i64Num = i64Num;
2504	}
2505	else
2506	rc = VERR_NO_MEMORY;
2507	}
2508	}
2509	else if (*pszCfg == '\"')
2510	{
2511	/* Parse a string. */
2512	const char *pszCfgCur = pszCfg + 1;
2513	while ( *pszCfgCur != '\0'
2514	&& *pszCfgCur != '\"')
2515	pszCfgCur++;
2516
2517	if (*pszCfgCur == '\"')
2518	{
2519	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGDIGGERLINUXCFGITEM,
2520	u.aszString[pszCfgCur - pszCfg + 1]));
2521	if (pCfgItem)
2522	{
2523	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_STRING;
2524	RTStrCopyEx(&pCfgItem->u.aszString[0], pszCfgCur - pszCfg + 1, pszCfg, pszCfgCur - pszCfg);
2525	*ppszCfgNext = pszCfgCur + 1;
2526	}
2527	else
2528	rc = VERR_NO_MEMORY;
2529	}
2530	else
2531	rc = VERR_INVALID_STATE;
2532	}
2533	else if ( *pszCfg == 'y'
2534	\|\| *pszCfg == 'm')
2535	{
2536	/* Included or module. */
2537	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2538	if (pCfgItem)
2539	{
2540	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_FLAG;
2541	pCfgItem->u.fModule = *pszCfg == 'm';
2542	}
2543	else
2544	rc = VERR_NO_MEMORY;
2545	pszCfg++;
2546	*ppszCfgNext = pszCfg;
2547	}
2548	else
2549	rc = VERR_INVALID_STATE;
2550
2551	if (RT_SUCCESS(rc))
2552	*ppCfgItem = pCfgItem;
2553	else if (pCfgItem)
2554	RTMemFree(pCfgItem);
2555
2556	return rc;
2557	}
2558
2559	/**
2560	* Parses the given kernel config and creates the config database.
2561	*
2562	* @returns VBox status code
2563	* @param pThis The Linux digger data.
2564	* @param pszCfg The config string.
2565	*/
2566	static int dbgDiggerLinuxCfgParse(PDBGDIGGERLINUX pThis, const char *pszCfg)
2567	{
2568	int rc = VINF_SUCCESS;
2569
2570	/*
2571	* The config is a text file with the following elements:
2572	* # starts a comment which goes till the end of the line
2573	* <Ide>=<val> where <Ide> is an identifier consisting of
2574	* alphanumerical characters (including _)
2575	* <val> denotes the value for the identifier and can have the following
2576	* formats:
2577	* (-)[0-9]* for numbers
2578	* "..." for a string value
2579	* m when a feature is enabled as a module
2580	* y when a feature is enabled
2581	* Newlines are used as a separator between values and mark the end
2582	* of a comment
2583	*/
2584	const char *pszCfgCur = pszCfg;
2585	while ( RT_SUCCESS(rc)
2586	&& *pszCfgCur != '\0')
2587	{
2588	/* Start skipping the whitespace. */
2589	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2590	if ( pszCfgCur
2591	&& *pszCfgCur != '\0')
2592	{
2593	char *pszIde = NULL;
2594	/* Must be an identifier, parse it. */
2595	rc = dbgDiggerLinuxCfgParseIde(pszCfgCur, &pszCfgCur, &pszIde);
2596	if (RT_SUCCESS(rc))
2597	{
2598	/*
2599	* Skip whitespace again (shouldn't be required because = follows immediately
2600	* in the observed configs).
2601	*/
2602	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2603	if ( pszCfgCur
2604	&& *pszCfgCur == '=')
2605	{
2606	pszCfgCur++;
2607	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2608	if ( pszCfgCur
2609	&& *pszCfgCur != '\0')
2610	{
2611	/* Get the value. */
2612	PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2613	rc = dbgDiggerLinuxCfgParseVal(pszCfgCur, &pszCfgCur, &pCfgItem);
2614	if (RT_SUCCESS(rc))
2615	{
2616	pCfgItem->Core.pszString = pszIde;
2617	bool fRc = RTStrSpaceInsert(&pThis->hCfgDb, &pCfgItem->Core);
2618	if (!fRc)
2619	{
2620	RTStrFree(pszIde);
2621	RTMemFree(pCfgItem);
2622	rc = VERR_INVALID_STATE;
2623	}
2624	}
2625	}
2626	else
2627	rc = VERR_EOF;
2628	}
2629	else
2630	rc = VERR_INVALID_STATE;
2631	}
2632
2633	if (RT_FAILURE(rc))
2634	RTStrFree(pszIde);
2635	}
2636	else
2637	break; /* Reached the end of the config. */
2638	}
2639
2640	if (RT_FAILURE(rc))
2641	dbgDiggerLinuxCfgDbDestroy(pThis);
2642
2643	return rc;
2644	}
2645
2646	/**
2647	* Decompresses the given config and validates the UTF-8 encoding.
2648	*
2649	* @returns VBox status code.
2650	* @param pbCfgComp The compressed config.
2651	* @param cbCfgComp Size of the compressed config.
2652	* @param ppszCfg Where to store the pointer to the decompressed config
2653	* on success.
2654	*/
2655	static int dbgDiggerLinuxCfgDecompress(const uint8_t pbCfgComp, size_t cbCfgComp, char *ppszCfg)
2656	{
2657	int rc = VINF_SUCCESS;
2658	RTVFSIOSTREAM hVfsIos = NIL_RTVFSIOSTREAM;
2659
2660	rc = RTVfsIoStrmFromBuffer(RTFILE_O_READ, pbCfgComp, cbCfgComp, &hVfsIos);
2661	if (RT_SUCCESS(rc))
2662	{
2663	RTVFSIOSTREAM hVfsIosDecomp = NIL_RTVFSIOSTREAM;
2664	rc = RTZipGzipDecompressIoStream(hVfsIos, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsIosDecomp);
2665	if (RT_SUCCESS(rc))
2666	{
2667	char *pszCfg = NULL;
2668	size_t cchCfg = 0;
2669	size_t cbRead = 0;
2670
2671	do
2672	{
2673	uint8_t abBuf[_64K];
2674	rc = RTVfsIoStrmRead(hVfsIosDecomp, abBuf, sizeof(abBuf), true /fBlocking/, &cbRead);
2675	if (rc == VINF_EOF && cbRead == 0)
2676	rc = VINF_SUCCESS;
2677	if ( RT_SUCCESS(rc)
2678	&& cbRead > 0)
2679	{
2680	/* Append data. */
2681	char *pszCfgNew = pszCfg;
2682	rc = RTStrRealloc(&pszCfgNew, cchCfg + cbRead + 1);
2683	if (RT_SUCCESS(rc))
2684	{
2685	pszCfg = pszCfgNew;
2686	memcpy(pszCfg + cchCfg, &abBuf[0], cbRead);
2687	cchCfg += cbRead;
2688	pszCfg[cchCfg] = '\0'; /* Enforce string termination. */
2689	}
2690	}
2691	} while (RT_SUCCESS(rc) && cbRead > 0);
2692
2693	if (RT_SUCCESS(rc))
2694	*ppszCfg = pszCfg;
2695	else if (RT_FAILURE(rc) && pszCfg)
2696	RTStrFree(pszCfg);
2697
2698	RTVfsIoStrmRelease(hVfsIosDecomp);
2699	}
2700	RTVfsIoStrmRelease(hVfsIos);
2701	}
2702
2703	return rc;
2704	}
2705
2706	/**
2707	* Reads and decodes the compressed kernel config.
2708	*
2709	* @returns VBox status code.
2710	* @param pThis The Linux digger data.
2711	* @param pUVM The user mode VM handle.
2712	* @param pVMM The VMM function table.
2713	* @param pAddrStart The start address of the compressed config.
2714	* @param cbCfgComp The size of the compressed config.
2715	*/
2716	static int dbgDiggerLinuxCfgDecode(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2717	PCDBGFADDRESS pAddrStart, size_t cbCfgComp)
2718	{
2719	int rc = VINF_SUCCESS;
2720	uint8_t pbCfgComp = (uint8_t )RTMemTmpAlloc(cbCfgComp);
2721	if (!pbCfgComp)
2722	return VERR_NO_MEMORY;
2723
2724	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pAddrStart, pbCfgComp, cbCfgComp);
2725	if (RT_SUCCESS(rc))
2726	{
2727	char *pszCfg = NULL;
2728	rc = dbgDiggerLinuxCfgDecompress(pbCfgComp, cbCfgComp, &pszCfg);
2729	if (RT_SUCCESS(rc))
2730	{
2731	if (RTStrIsValidEncoding(pszCfg))
2732	rc = dbgDiggerLinuxCfgParse(pThis, pszCfg);
2733	else
2734	rc = VERR_INVALID_UTF8_ENCODING;
2735	RTStrFree(pszCfg);
2736	}
2737	}
2738
2739	RTMemFree(pbCfgComp);
2740	return rc;
2741	}
2742
2743	/**
2744	* Tries to find the compressed kernel config in the kernel address space
2745	* and sets up the config database.
2746	*
2747	* @returns VBox status code.
2748	* @param pThis The Linux digger data.
2749	* @param pUVM The user mode VM handle.
2750	* @param pVMM The VMM function table.
2751	*/
2752	static int dbgDiggerLinuxCfgFind(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2753	{
2754	/*
2755	* Go looking for the IKCFG_ST string which indicates the start
2756	* of the compressed config file.
2757	*/
2758	static const uint8_t s_abCfgNeedleStart[] = "IKCFG_ST";
2759	static const uint8_t s_abCfgNeedleEnd[] = "IKCFG_ED";
2760	int rc = VINF_SUCCESS;
2761	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2762	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2763	while (cbLeft > 4096)
2764	{
2765	DBGFADDRESS HitAddrStart;
2766	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
2767	s_abCfgNeedleStart, sizeof(s_abCfgNeedleStart) - 1, &HitAddrStart);
2768	if (RT_FAILURE(rc))
2769	break;
2770
2771	/* Check for the end marker which shouldn't be that far away. */
2772	pVMM->pfnDBGFR3AddrAdd(&HitAddrStart, sizeof(s_abCfgNeedleStart) - 1);
2773	DBGFADDRESS HitAddrEnd;
2774	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /* idCpu */, &HitAddrStart, LNX_MAX_COMPRESSED_CFG_SIZE,
2775	1 /* uAlign */, s_abCfgNeedleEnd, sizeof(s_abCfgNeedleEnd) - 1, &HitAddrEnd);
2776	if (RT_SUCCESS(rc))
2777	{
2778	/* Allocate a buffer to hold the compressed data between the markers and fetch it. */
2779	RTGCUINTPTR cbCfg = HitAddrEnd.FlatPtr - HitAddrStart.FlatPtr;
2780	Assert(cbCfg == (size_t)cbCfg);
2781	rc = dbgDiggerLinuxCfgDecode(pThis, pUVM, pVMM, &HitAddrStart, cbCfg);
2782	if (RT_SUCCESS(rc))
2783	break;
2784	}
2785
2786	/*
2787	* Advance.
2788	*/
2789	RTGCUINTPTR cbDistance = HitAddrStart.FlatPtr - CurAddr.FlatPtr + sizeof(s_abCfgNeedleStart) - 1;
2790	if (RT_UNLIKELY(cbDistance >= cbLeft))
2791	{
2792	LogFunc(("Failed to find compressed kernel config\n"));
2793	break;
2794	}
2795	cbLeft -= cbDistance;
2796	pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2797	}
2798
2799	return rc;
2800	}
2801
2802	/**
2803	* Probes for a Linux kernel starting at the given address.
2804	*
2805	* @returns Flag whether something which looks like a valid Linux kernel was found.
2806	* @param pThis The Linux digger data.
2807	* @param pUVM The user mode VM handle.
2808	* @param pVMM The VMM function table.
2809	* @param uAddrStart The address to start scanning at.
2810	* @param cbScan How much to scan.
2811	*/
2812	static bool dbgDiggerLinuxProbeWithAddr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2813	RTGCUINTPTR uAddrStart, size_t cbScan)
2814	{
2815	/*
2816	* Look for "Linux version " at the start of the rodata segment.
2817	* Hope that this comes before any message buffer or other similar string.
2818	*/
2819	DBGFADDRESS KernelAddr;
2820	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uAddrStart);
2821	DBGFADDRESS HitAddr;
2822	int rc = pVMM->pfnDBGFR3MemScan(pUVM, 0, &KernelAddr, cbScan, 1,
2823	g_abLinuxVersion, sizeof(g_abLinuxVersion) - 1, &HitAddr);
2824	if (RT_SUCCESS(rc))
2825	{
2826	char szTmp[128];
2827	char const *pszX = &szTmp[sizeof(g_abLinuxVersion) - 1];
2828	rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
2829	if ( RT_SUCCESS(rc)
2830	&& ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
2831	&& pszX[1] == '.'
2832	&& pszX[2] >= '0'
2833	&& pszX[2] <= '6')
2834	\|\| ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
2835	&& pszX[0] <= '9'
2836	&& pszX[1] == '.'
2837	&& pszX[2] >= '0'
2838	&& pszX[2] <= '9')
2839	)
2840	)
2841	{
2842	pThis->AddrKernelBase = KernelAddr;
2843	pThis->AddrLinuxBanner = HitAddr;
2844	return true;
2845	}
2846	}
2847
2848	return false;
2849	}
2850
2851	/**
2852	* Probes for a Linux kernel which has KASLR enabled.
2853	*
2854	* @returns Flag whether a possible candidate location was found.
2855	* @param pThis The Linux digger data.
2856	* @param pUVM The user mode VM handle.
2857	* @param pVMM The VMM function table.
2858	*/
2859	static bool dbgDiggerLinuxProbeKaslr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2860	{
2861	/**
2862	* With KASLR the kernel is loaded at a different address at each boot making detection
2863	* more difficult for us.
2864	*
2865	* The randomization is done in arch/x86/boot/compressed/kaslr.c:choose_random_location() (as of Nov 2017).
2866	* At the end of the method a random offset is chosen using find_random_virt_addr() which is added to the
2867	* kernel map start in the caller (the start of the kernel depends on the bit size, see LNX32_KERNEL_ADDRESS_START
2868	* and LNX64_KERNEL_ADDRESS_START for 32bit and 64bit kernels respectively).
2869	* The lowest offset possible is LOAD_PHYSICAL_ADDR which is defined in arch/x86/include/asm/boot.h
2870	* using CONFIG_PHYSICAL_START aligned to CONFIG_PHYSICAL_ALIGN.
2871	* The default CONFIG_PHYSICAL_START and CONFIG_PHYSICAL_ALIGN are both 0x1000000 no matter whether a 32bit
2872	* or a 64bit kernel is used. So the lowest offset to the kernel start address is 0x1000000.
2873	* The find_random_virt_addr() the number of possible slots where the kernel can be placed based on the image size
2874	* is calculated using the following formula:
2875	* cSlots = ((KERNEL_IMAGE_SIZE - 0x1000000 (minimum) - image_size) / 0x1000000 (CONFIG_PHYSICAL_ALIGN)) + 1
2876	*
2877	* KERNEL_IMAGE_SIZE is 1GB for 64bit kernels and 512MB for 32bit kernels, so the maximum number of slots (resulting
2878	* in the largest possible offset) can be achieved when image_size (which contains the real size of the kernel image
2879	* which is unknown for us) goes to 0 and a 1GB KERNEL_IMAGE_SIZE is assumed. With that the biggest cSlots which can be
2880	* achieved is 64. The chosen random offset is taken from a random long integer using kaslr_get_random_long() modulo the
2881	* number of slots which selects a slot between 0 and 63. The final offset is calculated using:
2882	* offAddr = random_addr * 0x1000000 (CONFIG_PHYSICAL_ALIGN) + 0x1000000 (minimum)
2883	*
2884	* So the highest offset the kernel can start is 0x40000000 which is 1GB (plus the maximum kernel size we defined).
2885	*/
2886	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX64_KERNEL_ADDRESS_START, _1G + LNX_MAX_KERNEL_SIZE))
2887	return true;
2888
2889	/*
2890	* 32bit variant, makes sure we don't exceed the 4GB address space or DBGFR3MemScan() returns VERR_DBGF_MEM_NOT_FOUND immediately
2891	* without searching the remainder of the address space.
2892	*
2893	* The default split is 3GB userspace and 1GB kernel, so we just search the entire upper 1GB kernel space.
2894	*/
2895	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX32_KERNEL_ADDRESS_START, _4G - LNX32_KERNEL_ADDRESS_START))
2896	return true;
2897
2898	return false;
2899	}
2900
2901	/**
2902	* @copydoc DBGFOSREG::pfnInit
2903	*/
2904	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2905	{
2906	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2907	Assert(!pThis->fValid);
2908
2909	char szVersion[256] = "Linux version 4.19.0";
2910	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, &szVersion[0], sizeof(szVersion));
2911	if (RT_SUCCESS(rc))
2912	{
2913	/*
2914	* Get a numerical version number.
2915	*/
2916	const char *pszVersion = szVersion;
2917	while (pszVersion && !RT_C_IS_DIGIT(pszVersion))
2918	pszVersion++;
2919
2920	size_t offVersion = 0;
2921	uint32_t uMajor = 0;
2922	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2923	uMajor = uMajor * 10 + pszVersion[offVersion++] - '0';
2924
2925	if (pszVersion[offVersion] == '.')
2926	offVersion++;
2927
2928	uint32_t uMinor = 0;
2929	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2930	uMinor = uMinor * 10 + pszVersion[offVersion++] - '0';
2931
2932	if (pszVersion[offVersion] == '.')
2933	offVersion++;
2934
2935	uint32_t uBuild = 0;
2936	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2937	uBuild = uBuild * 10 + pszVersion[offVersion++] - '0';
2938
2939	pThis->uKrnlVer = LNX_MK_VER(uMajor, uMinor, uBuild);
2940	pThis->uKrnlVerMaj = uMajor;
2941	pThis->uKrnlVerMin = uMinor;
2942	pThis->uKrnlVerBld = uBuild;
2943	if (pThis->uKrnlVer == 0)
2944	LogRel(("dbgDiggerLinuxInit: Failed to parse version string: %s\n", pszVersion));
2945	}
2946
2947	/*
2948	* Assume 64-bit kernels all live way beyond 32-bit address space.
2949	*/
2950	pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
2951	pThis->fRelKrnlAddr = false;
2952
2953	pThis->hCfgDb = NULL;
2954
2955	/*
2956	* Try to find the compressed kernel config and parse it before we try
2957	* to get the symbol table, the config database is required to select
2958	* the method to use.
2959	*/
2960	rc = dbgDiggerLinuxCfgFind(pThis, pUVM, pVMM);
2961	if (RT_FAILURE(rc))
2962	LogFlowFunc(("Failed to find kernel config (%Rrc), no config database available\n", rc));
2963
2964	static const uint8_t s_abNeedle[] = "kobj";
2965	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedle, sizeof(s_abNeedle) - 1);
2966	if (RT_FAILURE(rc))
2967	{
2968	/* Try alternate needle (seen on older x86 Linux kernels). */
2969	static const uint8_t s_abNeedleAlt[] = "kobjec";
2970	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleAlt, sizeof(s_abNeedleAlt) - 1);
2971	if (RT_FAILURE(rc))
2972	{
2973	static const uint8_t s_abNeedleOSuseX86[] = "nmi"; /* OpenSuSe 10.2 x86 */
2974	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleOSuseX86, sizeof(s_abNeedleOSuseX86) - 1);
2975	if (RT_FAILURE(rc))
2976	LogRel(("dbgDiggerLinuxInit: Failed to find symbol table from needle kobj, kobjec or nmi -> %Rrc\n", rc));
2977	}
2978	}
2979
2980	pThis->fValid = true;
2981	return VINF_SUCCESS;
2982	}
2983
2984
2985	/**
2986	* @copydoc DBGFOSREG::pfnProbe
2987	*/
2988	static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2989	{
2990	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2991
2992	for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
2993	{
2994	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, g_au64LnxKernelAddresses[i], LNX_MAX_KERNEL_SIZE))
2995	return true;
2996	}
2997
2998	/* Maybe the kernel uses KASLR. */
2999	if (dbgDiggerLinuxProbeKaslr(pThis, pUVM, pVMM))
3000	return true;
3001
3002	return false;
3003	}
3004
3005
3006	/**
3007	* @copydoc DBGFOSREG::pfnDestruct
3008	*/
3009	static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3010	{
3011	RT_NOREF(pUVM, pVMM, pvData);
3012	}
3013
3014
3015	/**
3016	* @copydoc DBGFOSREG::pfnConstruct
3017	*/
3018	static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3019	{
3020	RT_NOREF(pUVM, pVMM);
3021	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
3022	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
3023	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
3024	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
3025
3026	return VINF_SUCCESS;
3027	}
3028
3029
3030	const DBGFOSREG g_DBGDiggerLinux =
3031	{
3032	/* .u32Magic = */ DBGFOSREG_MAGIC,
3033	/* .fFlags = */ 0,
3034	/* .cbData = */ sizeof(DBGDIGGERLINUX),
3035	/* .szName = */ "Linux",
3036	/* .pfnConstruct = */ dbgDiggerLinuxConstruct,
3037	/* .pfnDestruct = */ dbgDiggerLinuxDestruct,
3038	/* .pfnProbe = */ dbgDiggerLinuxProbe,
3039	/* .pfnInit = */ dbgDiggerLinuxInit,
3040	/* .pfnRefresh = */ dbgDiggerLinuxRefresh,
3041	/* .pfnTerm = */ dbgDiggerLinuxTerm,
3042	/* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
3043	/* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
3044	/* .pfnStackUnwindAssist = */ dbgDiggerLinuxStackUnwindAssist,
3045	/* .u32EndMagic = */ DBGFOSREG_MAGIC
3046	};
3047

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 106232

Download in other formats: