DBGPlugInLinux.cpp@ 61531

Last change on this file since 61531 was 61369, checked in by vboxsync, 9 years ago
Debugger/DBGPlugInLinux: Add support to get at the guest kernel log if the required symbols are not exposed in kallsyms by disassembling some public helpers to get at the log buffer address and size
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 56.8 KB

Line
1	/* $Id: DBGPlugInLinux.cpp 61369 2016-06-01 12:50:48Z vboxsync $ */
2	/** @file
3	* DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4	*/
5
6	/*
7	* Copyright (C) 2008-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include "DBGPlugInCommonELF.h"
25	#include <VBox/vmm/dbgf.h>
26	#include <VBox/dis.h>
27	#include <iprt/string.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/ctype.h>
31
32
33	/*********************************************************************************************************************************
34	* Structures and Typedefs *
35	*********************************************************************************************************************************/
36
37	/** @name InternalLinux structures
38	* @{ */
39
40
41	/** @} */
42
43
44	/**
45	* Linux guest OS digger instance data.
46	*/
47	typedef struct DBGDIGGERLINUX
48	{
49	/** Whether the information is valid or not.
50	* (For fending off illegal interface method calls.) */
51	bool fValid;
52	/** Set if 64-bit, clear if 32-bit. */
53	bool f64Bit;
54
55	/** The address of the linux banner.
56	* This is set during probing. */
57	DBGFADDRESS AddrLinuxBanner;
58	/** Kernel base address.
59	* This is set during probing, refined during kallsyms parsing. */
60	DBGFADDRESS AddrKernelBase;
61	/** The kernel size. */
62	uint32_t cbKernel;
63
64	/** The number of kernel symbols (kallsyms_num_syms).
65	* This is set during init. */
66	uint32_t cKernelSymbols;
67	/** The size of the kernel name table (sizeof(kallsyms_names)). */
68	uint32_t cbKernelNames;
69	/** Number of entries in the kernel_markers table. */
70	uint32_t cKernelNameMarkers;
71	/** The size of the kernel symbol token table. */
72	uint32_t cbKernelTokenTable;
73	/** The address of the encoded kernel symbol names (kallsyms_names). */
74	DBGFADDRESS AddrKernelNames;
75	/** The address of the kernel symbol addresses (kallsyms_addresses). */
76	DBGFADDRESS AddrKernelAddresses;
77	/** The address of the kernel symbol name markers (kallsyms_markers). */
78	DBGFADDRESS AddrKernelNameMarkers;
79	/** The address of the kernel symbol token table (kallsyms_token_table). */
80	DBGFADDRESS AddrKernelTokenTable;
81	/** The address of the kernel symbol token index table (kallsyms_token_index). */
82	DBGFADDRESS AddrKernelTokenIndex;
83
84	/** The kernel message log interface. */
85	DBGFOSIDMESG IDmesg;
86	} DBGDIGGERLINUX;
87	/** Pointer to the linux guest OS digger instance data. */
88	typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
89
90
91	/**
92	* The current printk_log structure.
93	*/
94	typedef struct LNXPRINTKHDR
95	{
96	/** Monotonic timestamp. */
97	uint64_t nsTimestamp;
98	/** The total size of this message record. */
99	uint16_t cbTotal;
100	/** The size of the text part (immediately follows the header). */
101	uint16_t cbText;
102	/** The size of the optional dictionary part (follows the text). */
103	uint16_t cbDict;
104	/** The syslog facility number. */
105	uint8_t bFacility;
106	/** First 5 bits are internal flags, next 3 bits are log level. */
107	uint8_t fFlagsAndLevel;
108	} LNXPRINTKHDR;
109	AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
110	/** Pointer to linux printk_log header. */
111	typedef LNXPRINTKHDR *PLNXPRINTKHDR;
112	/** Pointer to linux const printk_log header. */
113	typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
114
115
116	/*********************************************************************************************************************************
117	* Defined Constants And Macros *
118	*********************************************************************************************************************************/
119	/** Validates a 32-bit linux kernel address */
120	#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
121	/** Validates a 64-bit linux kernel address */
122	#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
123
124	/** The max kernel size. */
125	#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
126
127	/** The maximum size we expect for kallsyms_names. */
128	#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
129	/** The maximum size we expect for kallsyms_token_table. */
130	#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
131	/** The minimum number of symbols we expect in kallsyms_num_syms. */
132	#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
133	/** The maximum number of symbols we expect in kallsyms_num_syms. */
134	#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
135	/** The min length an encoded symbol in kallsyms_names is expected to have. */
136	#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
137	/** The max length an encoded symbol in kallsyms_names is expected to have.
138	* @todo check real life here. */
139	#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
140	/** The approximate maximum length of a string token. */
141	#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
142
143	/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
144	#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
145
146
147	/*********************************************************************************************************************************
148	* Internal Functions *
149	*********************************************************************************************************************************/
150	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData);
151
152
153	/*********************************************************************************************************************************
154	* Global Variables *
155	*********************************************************************************************************************************/
156	/** Table of common linux kernel addresses. */
157	static uint64_t g_au64LnxKernelAddresses[] =
158	{
159	UINT64_C(0xc0100000),
160	UINT64_C(0x90100000),
161	UINT64_C(0xffffffff80200000)
162	};
163
164
165	/**
166	* Disassembles a simple getter returning the value for it.
167	*
168	* @returns VBox status code.
169	* @param pThis The Linux digger data.
170	* @param pUVM The VM handle.
171	* @param hMod The module to use.
172	* @param pszSymbol The symbol of the getter.
173	* @param pvVal Where to store the value on success.
174	* @param cbVal Size of the value in bytes.
175	*/
176	static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
177	const char pszSymbol, void pvVal, uint32_t cbVal)
178	{
179	int rc = VINF_SUCCESS;
180
181	RTDBGSYMBOL SymInfo;
182	rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
183	if (RT_SUCCESS(rc))
184	{
185	/*
186	* Do the diassembling. Disassemble until a ret instruction is encountered
187	* or a limit is reached (don't want to disassemble for too long as the getter
188	* should be short).
189	* push and pop instructions are skipped as well as any mov instructions not
190	* touching the rax or eax register (depending on the size of the value).
191	*/
192	unsigned cInstrDisassembled = 0;
193	uint32_t offInstr = 0;
194	bool fRet = false;
195	DISSTATE DisState;
196	RT_ZERO(DisState);
197
198	do
199	{
200	DBGFADDRESS Addr;
201	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
202	DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
203
204	/* Prefetch the instruction. */
205	uint8_t abInstr[32];
206	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
207	if (RT_SUCCESS(rc))
208	{
209	uint32_t cbInstr = 0;
210
211	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
212	if (RT_SUCCESS(rc))
213	{
214	switch (DisState.pCurInstr->uOpcode)
215	{
216	case OP_PUSH:
217	case OP_POP:
218	case OP_NOP:
219	case OP_LEA:
220	break;
221	case OP_RETN:
222	/* Getter returned, abort disassembling. */
223	fRet = true;
224	break;
225	case OP_MOV:
226	/*
227	* Check that the destination is either rax or eax depending on the
228	* value size.
229	*
230	* Param1 is the destination and Param2 the source.
231	*/
232	if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN32))
233	&& cbVal == sizeof(uint32_t))
234	\|\| ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
235	&& cbVal == sizeof(uint64_t)))
236	&& DisState.Param1.Base.idxGenReg == DISGREG_RAX)
237	{
238	/* Parse the source. */
239	if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
240	memcpy(pvVal, &DisState.Param2.uValue, cbVal);
241	else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64))
242	{
243	RTGCPTR GCPtrVal = 0;
244
245	if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
246	GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
247	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
248	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
249	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
250	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
251	else
252	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
253
254	DBGFADDRESS AddrVal;
255	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
256	DBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
257	pvVal, cbVal);
258	}
259	}
260	break;
261	default:
262	/* All other instructions will cause an error for now (playing safe here). */
263	rc = VERR_INVALID_PARAMETER;
264	break;
265	}
266	cInstrDisassembled++;
267	offInstr += cbInstr;
268	}
269	}
270	} while ( RT_SUCCESS(rc)
271	&& cInstrDisassembled < 20
272	&& !fRet);
273	}
274
275	return rc;
276	}
277
278	/**
279	* Try to get at the log buffer starting address and size by disassembling some exposed helpers.
280	*
281	* @returns VBox status code.
282	* @param pThis The Linux digger data.
283	* @param pUVM The VM handle.
284	* @param hMod The module to use.
285	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
286	* @param pcbLogBuf Where to store the size of the log buffer on success.
287	*/
288	static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
289	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
290	{
291	int rc = VINF_SUCCESS;
292
293	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
294	{
295	{ pGCPtrLogBuf, sizeof(RTGCPTR), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf_addr_get" },
296	{ pcbLogBuf, sizeof(uint32_t), sizeof(uint32_t), "log_buf_len_get" }
297	};
298	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
299	{
300	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
301	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
302	rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, hMod, aSymbols[i].pszSymbol,
303	aSymbols[i].pvVar, aSymbols[i].cbGuest);
304	}
305
306	return rc;
307	}
308
309	/**
310	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
311	*/
312	static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
313	char pszBuf, size_t cbBuf, size_t pcbActual)
314	{
315	PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
316
317	if (cMessages < 1)
318	return VERR_INVALID_PARAMETER;
319
320	/*
321	* Resolve the symbols we need and read their values.
322	*/
323	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
324	RTDBGMOD hMod;
325	int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
326	if (RT_FAILURE(rc))
327	return VERR_NOT_FOUND;
328	RTDbgAsRelease(hAs);
329
330	RTGCPTR GCPtrLogBuf;
331	uint32_t cbLogBuf;
332	uint32_t idxFirst;
333	uint32_t idxNext;
334
335	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
336	{
337	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
338	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
339	{ &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
340	{ &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
341	};
342	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
343	{
344	RTDBGSYMBOL SymInfo;
345	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
346	if (RT_SUCCESS(rc))
347	{
348	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
349	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
350	DBGFADDRESS Addr;
351	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
352	DBGFR3AddrFromFlat(pUVM, &Addr, (RTGCPTR)SymInfo.Value + pData->AddrKernelBase.FlatPtr),
353	aSymbols[i].pvVar, aSymbols[i].cbGuest);
354	if (RT_SUCCESS(rc))
355	continue;
356	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
357	}
358	else
359	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
360	rc = VERR_NOT_FOUND;
361	break;
362	}
363
364	/*
365	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
366	* some public helpers to get at the addresses.
367	*
368	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
369	*/
370	if (rc == VERR_NOT_FOUND)
371	{
372	idxFirst = 0;
373	idxNext = 0;
374	rc = dbgDiggerLinuxQueryLogBufferPtrs(pData, pUVM, hMod, &GCPtrLogBuf, &cbLogBuf);
375
376	/* Release the module in any case. */
377	RTDbgModRelease(hMod);
378
379	if (RT_FAILURE(rc))
380	return rc;
381	}
382
383	/*
384	* Check if the values make sense.
385	*/
386	if (pData->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
387	{
388	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
389	return VERR_NOT_FOUND;
390	}
391	if ( cbLogBuf < 4096
392	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
393	\|\| cbLogBuf > 16*_1M)
394	{
395	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
396	return VERR_NOT_FOUND;
397	}
398	uint32_t const cbLogAlign = 4;
399	if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
400	\|\| (idxFirst & (cbLogAlign - 1)) != 0)
401	{
402	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
403	return VERR_NOT_FOUND;
404	}
405	if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
406	\|\| (idxNext & (cbLogAlign - 1)) != 0)
407	{
408	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
409	return VERR_NOT_FOUND;
410	}
411
412	/*
413	* Read the whole log buffer.
414	*/
415	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
416	if (!pbLogBuf)
417	{
418	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
419	return VERR_NO_MEMORY;
420	}
421	DBGFADDRESS Addr;
422	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
423	if (RT_FAILURE(rc))
424	{
425	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
426	cbLogBuf, Addr.FlatPtr, rc));
427	RTMemFree(pbLogBuf);
428	return VERR_NOT_FOUND;
429	}
430
431	/*
432	* Count the messages in the buffer while doing some basic validation.
433	*/
434	uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
435	: idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
436	uint32_t cbLeft = cbUsed;
437	uint32_t offCur = idxFirst;
438	uint32_t cLogMsgs = 0;
439
440	while (cbLeft > 0)
441	{
442	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
443	if (!pHdr->cbTotal)
444	{
445	/* Wrap around packet, most likely... */
446	if (cbLogBuf - offCur >= cbLeft)
447	break;
448	offCur = 0;
449	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
450	}
451	if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
452	\|\| pHdr->cbTotal > cbLeft
453	\|\| (pHdr->cbTotal & (cbLogAlign - 1)) != 0
454	\|\| pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
455	{
456	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
457	offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
458	rc = VERR_INVALID_STATE;
459	break;
460	}
461
462	if (pHdr->cbText > 0)
463	cLogMsgs++;
464
465	/* next */
466	offCur += pHdr->cbTotal;
467	cbLeft -= pHdr->cbTotal;
468	}
469	if (RT_FAILURE(rc))
470	{
471	RTMemFree(pbLogBuf);
472	return rc;
473	}
474
475	/*
476	* Copy the messages into the output buffer.
477	*/
478	offCur = idxFirst;
479	cbLeft = cbUsed;
480
481	/* Skip messages that the caller doesn't want. */
482	if (cMessages < cLogMsgs)
483	{
484	uint32_t cToSkip = cLogMsgs - cMessages;
485	while (cToSkip > 0)
486	{
487	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
488	if (!pHdr->cbTotal)
489	{
490	offCur = 0;
491	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
492	}
493	if (pHdr->cbText > 0)
494	cToSkip--;
495
496	/* next */
497	offCur += pHdr->cbTotal;
498	cbLeft -= pHdr->cbTotal;
499	}
500	}
501
502	/* Now copy the messages. */
503	size_t offDst = 0;
504	while (cbLeft > 0)
505	{
506	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
507	if (!pHdr->cbTotal)
508	{
509	if (cbLogBuf - offCur >= cbLeft)
510	break;
511	offCur = 0;
512	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
513	}
514
515	if (pHdr->cbText > 0)
516	{
517	char pchText = (char )(pHdr + 1);
518	size_t cchText = RTStrNLen(pchText, pHdr->cbText);
519	if (offDst + cchText < cbBuf)
520	{
521	memcpy(&pszBuf[offDst], pHdr + 1, cchText);
522	pszBuf[offDst + cchText] = '\n';
523	}
524	else if (offDst < cbBuf)
525	memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
526	offDst += cchText + 1;
527	}
528
529	/* next */
530	offCur += pHdr->cbTotal;
531	cbLeft -= pHdr->cbTotal;
532	}
533
534	/* Done with the buffer. */
535	RTMemFree(pbLogBuf);
536
537	/* Make sure we've reserved a char for the terminator. */
538	if (!offDst)
539	offDst = 1;
540
541	/* Set return size value. */
542	if (pcbActual)
543	*pcbActual = offDst;
544
545	/*
546	* All VBox strings are UTF-8 and bad things may in theory happen if we
547	* pass bad UTF-8 to code which assumes it's all valid. So, we enforce
548	* UTF-8 upon the guest kernel messages here even if they (probably) have
549	* no defined code set in reality.
550	*/
551	if (offDst <= cbBuf)
552	{
553	pszBuf[offDst - 1] = '\0';
554	RTStrPurgeEncoding(pszBuf);
555	return VINF_SUCCESS;
556	}
557
558	if (cbBuf)
559	{
560	pszBuf[cbBuf - 1] = '\0';
561	RTStrPurgeEncoding(pszBuf);
562	}
563	return VERR_BUFFER_OVERFLOW;
564	}
565
566
567	/**
568	* @copydoc DBGFOSREG::pfnQueryInterface
569	*/
570	static DECLCALLBACK(void ) dbgDiggerLinuxQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
571	{
572	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
573	switch (enmIf)
574	{
575	case DBGFOSINTERFACE_DMESG:
576	return &pThis->IDmesg;
577
578	default:
579	return NULL;
580	}
581	}
582
583
584	/**
585	* @copydoc DBGFOSREG::pfnQueryVersion
586	*/
587	static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
588	{
589	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
590	Assert(pThis->fValid);
591
592	/*
593	* It's all in the linux banner.
594	*/
595	int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
596	if (RT_SUCCESS(rc))
597	{
598	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
599	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
600	while ( pszEnd > pszVersion
601	&& RT_C_IS_SPACE(pszEnd[-1]))
602	pszEnd--;
603	*pszEnd = '\0';
604	}
605	else
606	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
607
608	return rc;
609	}
610
611
612	/**
613	* @copydoc DBGFOSREG::pfnTerm
614	*/
615	static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, void *pvData)
616	{
617	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
618	Assert(pThis->fValid);
619
620	pThis->fValid = false;
621	}
622
623
624	/**
625	* @copydoc DBGFOSREG::pfnRefresh
626	*/
627	static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, void *pvData)
628	{
629	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
630	NOREF(pThis);
631	Assert(pThis->fValid);
632
633	/*
634	* For now we'll flush and reload everything.
635	*/
636	dbgDiggerLinuxTerm(pUVM, pvData);
637	return dbgDiggerLinuxInit(pUVM, pvData);
638	}
639
640
641	/**
642	* Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
643	* digger data.
644	*
645	* @returns VINF_SUCCESS.
646	* @param pThis The Linux digger data to update.
647	* @param pAddrKernelNames The kallsyms_names address.
648	* @param cKernelSymbols The number of kernel symbol.
649	* @param cbAddress The guest address size.
650	*/
651	static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrKernelNames,
652	uint32_t cKernelSymbols, uint32_t cbAddress)
653	{
654	pThis->cKernelSymbols = cKernelSymbols;
655	pThis->AddrKernelNames = *pAddrKernelNames;
656	pThis->AddrKernelAddresses = *pAddrKernelNames;
657	DBGFR3AddrSub(&pThis->AddrKernelAddresses, (cKernelSymbols + 1) * cbAddress);
658
659	Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
660	"dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
661	"dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
662	pThis->AddrKernelAddresses.FlatPtr,
663	pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
664	pThis->AddrKernelNames.FlatPtr));
665	return VINF_SUCCESS;
666	}
667
668
669	/**
670	* Tries to find the address of the kallsyms_names, kallsyms_num_syms and
671	* kallsyms_addresses symbols.
672	*
673	* The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
674	* addresses of the other two are stored as pThis->AddrKernelNames and
675	* pThis->AddrKernelAddresses.
676	*
677	* @returns VBox status code, success indicating that all three variables have
678	* been found and taken down.
679	* @param pUVM The user mode VM handle.
680	* @param pThis The Linux digger data.
681	* @param pHitAddr An address we think is inside kallsyms_names.
682	*/
683	static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
684	{
685	/*
686	* Search backwards in chunks.
687	*/
688	union
689	{
690	uint8_t ab[0x1000];
691	uint32_t au32[0x1000 / sizeof(uint32_t)];
692	uint64_t au64[0x1000 / sizeof(uint64_t)];
693	} uBuf;
694	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
695	uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
696	DBGFADDRESS CurAddr = *pHitAddr;
697	DBGFR3AddrSub(&CurAddr, cbBuf);
698	cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
699	for (;;)
700	{
701	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
702	if (RT_FAILURE(rc))
703	return rc;
704
705	/*
706	* We assume that the three symbols are aligned on guest pointer boundrary.
707	*
708	* The boundrary between the two tables should be noticable as the number
709	* is unlikely to be more than 16 millions, there will be at least one zero
710	* byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
711	* that common in the kallsyms_names table.
712	*
713	* Also the kallsyms_names table starts with a length byte, which means
714	* we're likely to see a byte in the range 1..31.
715	*
716	* The kallsyms_addresses are mostly sorted (except for the start where the
717	* absolute symbols are), so we'll spot a bunch of kernel addresses
718	* immediately preceeding the kallsyms_num_syms field.
719	*
720	* Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
721	* the check for kernel addresses preceeding it.
722	*/
723	if (pThis->f64Bit)
724	{
725	uint32_t i = cbBuf / sizeof(uint64_t);
726	while (i-- > 0)
727	if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
728	&& uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
729	{
730	uint8_t pb = (uint8_t )&uBuf.au64[i + 1];
731	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
732	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
733	{
734	if ( (i <= 0 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
735	&& (i <= 1 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
736	&& (i <= 2 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
737	return dbgDiggerLinuxFoundStartOfNames(pThis,
738	DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
739	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
740	}
741	}
742	}
743	else
744	{
745	uint32_t i = cbBuf / sizeof(uint32_t);
746	while (i-- > 0)
747	if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
748	&& uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
749	{
750	uint8_t pb = (uint8_t )&uBuf.au32[i + 1];
751	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
752	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
753	{
754	if ( (i <= 0 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
755	&& (i <= 1 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
756	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
757	return dbgDiggerLinuxFoundStartOfNames(pThis,
758	DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
759	uBuf.au32[i], sizeof(uint32_t));
760	}
761	}
762	}
763
764	/*
765	* Advance
766	*/
767	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
768	{
769	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
770	return VERR_NOT_FOUND;
771	}
772	cbLeft -= sizeof(uBuf);
773	DBGFR3AddrSub(&CurAddr, sizeof(uBuf));
774	cbBuf = sizeof(uBuf);
775	}
776	}
777
778
779	/**
780	* Worker for dbgDiggerLinuxFindEndNames that records the findings.
781	*
782	* @returns VINF_SUCCESS
783	* @param pThis The linux digger data to update.
784	* @param pAddrMarkers The address of the marker (kallsyms_markers).
785	* @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
786	*/
787	static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
788	{
789	pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
790	pThis->AddrKernelNameMarkers = *pAddrMarkers;
791	pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
792	pThis->AddrKernelTokenTable = *pAddrMarkers;
793	DBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
794
795	Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
796	"dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
797	"dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
798	pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
799	pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
800	pThis->AddrKernelTokenTable.FlatPtr));
801	return VINF_SUCCESS;
802	}
803
804
805	/**
806	* Tries to find the end of kallsyms_names and thereby the start of
807	* kallsyms_markers and kallsyms_token_table.
808	*
809	* The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
810	* the two other symbols in pThis->AddrKernelNameMarkers and
811	* pThis->AddrKernelTokenTable. The number of marker entries is stored in
812	* pThis->cKernelNameMarkers.
813	*
814	* @returns VBox status code, success indicating that all three variables have
815	* been found and taken down.
816	* @param pUVM The user mode VM handle.
817	* @param pThis The Linux digger data.
818	* @param pHitAddr An address we think is inside kallsyms_names.
819	*/
820	static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
821	{
822	/*
823	* Search forward in chunks.
824	*/
825	union
826	{
827	uint8_t ab[0x1000];
828	uint32_t au32[0x1000 / sizeof(uint32_t)];
829	uint64_t au64[0x1000 / sizeof(uint64_t)];
830	} uBuf;
831	bool fPendingZeroHit = false;
832	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
833	uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
834	DBGFADDRESS CurAddr = *pHitAddr;
835	DBGFR3AddrSub(&CurAddr, offBuf);
836	for (;;)
837	{
838	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
839	if (RT_FAILURE(rc))
840	return rc;
841
842	/*
843	* The kallsyms_names table is followed by kallsyms_markers we assume,
844	* using sizeof(unsigned long) alignment like the preceeding symbols.
845	*
846	* The kallsyms_markers table has entried sizeof(unsigned long) and
847	* contains offsets into kallsyms_names. The kallsyms_markers used to
848	* index kallsyms_names and reduce seek time when looking up the name
849	* of an address/symbol. Each entry in kallsyms_markers covers 256
850	* symbol names.
851	*
852	* Because of this, the first entry is always zero and all the entries
853	* are ascending. It also follows that the size of the table can be
854	* calculated from kallsyms_num_syms.
855	*
856	* Note! We could also have walked kallsyms_names by skipping
857	* kallsyms_num_syms names, but this is faster and we will
858	* validate the encoded names later.
859	*/
860	if (pThis->f64Bit)
861	{
862	if ( RT_UNLIKELY(fPendingZeroHit)
863	&& uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
864	&& uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
865	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
866
867	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
868	for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
869	if (uBuf.au64[i] == 0)
870	{
871	if (RT_UNLIKELY(i + 1 >= cEntries))
872	{
873	fPendingZeroHit = true;
874	break;
875	}
876	if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
877	&& uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
878	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
879	}
880	}
881	else
882	{
883	if ( RT_UNLIKELY(fPendingZeroHit)
884	&& uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
885	&& uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
886	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
887
888	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
889	for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
890	if (uBuf.au32[i] == 0)
891	{
892	if (RT_UNLIKELY(i + 1 >= cEntries))
893	{
894	fPendingZeroHit = true;
895	break;
896	}
897	if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
898	&& uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
899	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
900	}
901	}
902
903	/*
904	* Advance
905	*/
906	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
907	{
908	Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
909	return VERR_NOT_FOUND;
910	}
911	cbLeft -= sizeof(uBuf);
912	DBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
913	offBuf = 0;
914	}
915	}
916
917
918	/**
919	* Locates the kallsyms_token_index table.
920	*
921	* Storing the address in pThis->AddrKernelTokenIndex and the size of the token
922	* table in pThis->cbKernelTokenTable.
923	*
924	* @returns VBox status code.
925	* @param pUVM The user mode VM handle.
926	* @param pThis The Linux digger data.
927	*/
928	static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PDBGDIGGERLINUX pThis)
929	{
930	/*
931	* The kallsyms_token_table is very much like a string table. Due to the
932	* nature of the compression algorithm it is reasonably short (one example
933	* here is 853 bytes), so we'll not be reading it in chunks but in full.
934	* To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
935	* memory or any other nasty stuff...
936	*/
937	union
938	{
939	uint8_t ab[0x2000];
940	uint16_t au16[0x2000 / sizeof(uint16_t)];
941	} uBuf;
942	DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
943	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
944	if (RT_FAILURE(rc))
945	return rc;
946
947	/*
948	* We've got two choices here, either walk the string table or look for
949	* the next structure, kallsyms_token_index.
950	*
951	* The token index is a table of 256 uint16_t entries (index by bytes
952	* from kallsyms_names) that gives offsets in kallsyms_token_table. It
953	* starts with a zero entry and the following entries are sorted in
954	* ascending order. The range of the entries are reasonably small since
955	* kallsyms_token_table is small.
956	*
957	* The alignment seems to be sizeof(unsigned long), just like
958	* kallsyms_token_table.
959	*
960	* So, we start by looking for a zero 16-bit entry.
961	*/
962	uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
963
964	for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
965	if ( uBuf.au16[i] == 0
966	&& uBuf.au16[i + 1] > 0
967	&& uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
968	&& (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
969	&& (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
970	&& (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
971	&& (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
972	&& (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
973	)
974	{
975	pThis->AddrKernelTokenIndex = CurAddr;
976	DBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
977	pThis->cbKernelTokenTable = i * sizeof(uint16_t);
978	return VINF_SUCCESS;
979	}
980
981	Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
982	return VERR_NOT_FOUND;
983	}
984
985
986	/**
987	* Loads the kernel symbols from the kallsyms tables.
988	*
989	* @returns VBox status code.
990	* @param pUVM The user mode VM handle.
991	* @param pThis The Linux digger data.
992	*/
993	static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PDBGDIGGERLINUX pThis)
994	{
995	/*
996	* Allocate memory for temporary table copies, reading the tables as we go.
997	*/
998	uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
999	void pvAddresses = RTMemAllocZ(pThis->cKernelSymbols cbGuestAddr);
1000	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses, pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
1001	if (RT_SUCCESS(rc))
1002	{
1003	uint8_t pbNames = (uint8_t )RTMemAllocZ(pThis->cbKernelNames);
1004	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1005	if (RT_SUCCESS(rc))
1006	{
1007	char pszzTokens = (char )RTMemAllocZ(pThis->cbKernelTokenTable);
1008	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1009	if (RT_SUCCESS(rc))
1010	{
1011	uint16_t paoffTokens = (uint16_t )RTMemAllocZ(256 * sizeof(uint16_t));
1012	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1013	if (RT_SUCCESS(rc))
1014	{
1015	/*
1016	* Figure out the kernel start and end.
1017	*/
1018	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
1019	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
1020	uint32_t i;
1021	if (cbGuestAddr == sizeof(uint64_t))
1022	{
1023	uint64_t pauAddrs = (uint64_t )pvAddresses;
1024	for (i = 0; i < pThis->cKernelSymbols; i++)
1025	if ( pauAddrs[i] < uKernelStart
1026	&& LNX64_VALID_ADDRESS(pauAddrs[i])
1027	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1028	uKernelStart = pauAddrs[i];
1029
1030	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1031	if ( pauAddrs[i] > uKernelEnd
1032	&& LNX64_VALID_ADDRESS(pauAddrs[i])
1033	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1034	uKernelEnd = pauAddrs[i];
1035	}
1036	else
1037	{
1038	uint32_t pauAddrs = (uint32_t )pvAddresses;
1039	for (i = 0; i < pThis->cKernelSymbols; i++)
1040	if ( pauAddrs[i] < uKernelStart
1041	&& LNX32_VALID_ADDRESS(pauAddrs[i])
1042	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1043	uKernelStart = pauAddrs[i];
1044
1045	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1046	if ( pauAddrs[i] > uKernelEnd
1047	&& LNX32_VALID_ADDRESS(pauAddrs[i])
1048	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1049	uKernelEnd = pauAddrs[i];
1050	}
1051
1052	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
1053	pThis->cbKernel = (uint32_t)cbKernel;
1054	DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
1055	Log(("dbgDiggerLinuxLoadKernelSymbols: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
1056
1057	/*
1058	* Create a module for the kernel.
1059	*/
1060	RTDBGMOD hMod;
1061	rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /fFlags/);
1062	if (RT_SUCCESS(rc))
1063	{
1064	rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1065	rc = VINF_SUCCESS;
1066
1067	/*
1068	* Enumerate the symbols.
1069	*/
1070	uint8_t const pbCurAddr = (uint8_t const )pvAddresses;
1071	uint32_t offName = 0;
1072	uint32_t cLeft = pThis->cKernelSymbols;
1073	while (cLeft-- > 0 && RT_SUCCESS(rc))
1074	{
1075	/* Decode the symbol name first. */
1076	if (RT_LIKELY(offName < pThis->cbKernelNames))
1077	{
1078	uint8_t cbName = pbNames[offName++];
1079	if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1080	{
1081	char szSymbol[4096];
1082	uint32_t offSymbol = 0;
1083	while (cbName-- > 0)
1084	{
1085	uint8_t bEnc = pbNames[offName++];
1086	uint16_t offToken = paoffTokens[bEnc];
1087	if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1088	{
1089	const char *pszToken = &pszzTokens[offToken];
1090	char ch;
1091	while ((ch = *pszToken++) != '\0')
1092	if (offSymbol < sizeof(szSymbol) - 1)
1093	szSymbol[offSymbol++] = ch;
1094	}
1095	else
1096	{
1097	rc = VERR_INVALID_UTF8_ENCODING;
1098	break;
1099	}
1100	}
1101	szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1102
1103	/* The address. */
1104	RTGCUINTPTR uSymAddr = cbGuestAddr == sizeof(uint64_t)
1105	? (uint64_t )pbCurAddr : (uint32_t )pbCurAddr;
1106	pbCurAddr += cbGuestAddr;
1107
1108	/* Add it without the type char. */
1109	if (uSymAddr - uKernelStart <= cbKernel)
1110	{
1111	rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymAddr - uKernelStart,
1112	0 /cb/, 0 /fFlags/, NULL);
1113	if (RT_FAILURE(rc))
1114	{
1115	if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1116	\|\| rc == VERR_DBG_INVALID_RVA
1117	\|\| rc == VERR_DBG_ADDRESS_CONFLICT
1118	\|\| rc == VERR_DBG_DUPLICATE_SYMBOL)
1119	{
1120	Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1121	rc = VINF_SUCCESS;
1122	}
1123	else
1124	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1125	}
1126	}
1127	}
1128	else
1129	{
1130	rc = VERR_END_OF_STRING;
1131	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1132	offName, cLeft, cbName, pThis->cbKernelNames));
1133	}
1134	}
1135	else
1136	{
1137	rc = VERR_END_OF_STRING;
1138	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1139	offName, cLeft, pThis->cbKernelNames));
1140	}
1141	}
1142
1143	/*
1144	* Link the module into the address space.
1145	*/
1146	if (RT_SUCCESS(rc))
1147	{
1148	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1149	if (hAs != NIL_RTDBGAS)
1150	rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1151	else
1152	rc = VERR_INTERNAL_ERROR;
1153	RTDbgAsRelease(hAs);
1154	}
1155	else
1156	Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1157	RTDbgModRelease(hMod);
1158	}
1159	else
1160	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1161	}
1162	else
1163	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1164	pThis->AddrKernelTokenIndex.FlatPtr, rc));
1165	RTMemFree(paoffTokens);
1166	}
1167	else
1168	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1169	pThis->AddrKernelTokenTable.FlatPtr, rc));
1170	RTMemFree(pszzTokens);
1171	}
1172	else
1173	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1174	pThis->AddrKernelNames.FlatPtr, rc));
1175	RTMemFree(pbNames);
1176	}
1177	else
1178	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading symbol addresses at %RGv failed: %Rrc\n",
1179	pThis->AddrKernelAddresses.FlatPtr, rc));
1180	RTMemFree(pvAddresses);
1181	return rc;
1182	}
1183
1184
1185	/**
1186	* Checks if there is a likely kallsyms_names fragment at pHitAddr.
1187	*
1188	* @returns true if it's a likely fragment, false if not.
1189	* @param pUVM The user mode VM handle.
1190	* @param pHitAddr The address where paNeedle was found.
1191	* @param pabNeedle The fragment we've been searching for.
1192	* @param cbNeedle The length of the fragment.
1193	*/
1194	static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCDBGFADDRESS pHitAddr, uint8_t const *pabNeedle, uint8_t cbNeedle)
1195	{
1196	/*
1197	* Examples of lead and tail bytes of our choosen needle in a randomly
1198	* picked kernel:
1199	* k o b j
1200	* 22 6b 6f 62 6a aa
1201	* fc 6b 6f 62 6a aa
1202	* 82 6b 6f 62 6a 5f - ascii trail byte (_).
1203	* ee 6b 6f 62 6a aa
1204	* fc 6b 6f 62 6a 5f - ascii trail byte (_).
1205	* 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
1206	* 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
1207	* ... omitting 29 samples similar to the last two ...
1208	* d8 6b 6f 62 6a aa
1209	* d8 6b 6f 62 6a aa
1210	* d8 6b 6f 62 6a aa
1211	* d8 6b 6f 62 6a aa
1212	* f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
1213	* f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
1214	* fd 6b 6f 62 6a 0f
1215	* ... enough.
1216	*/
1217	uint8_t abBuf[32];
1218	DBGFADDRESS ReadAddr = *pHitAddr;
1219	DBGFR3AddrSub(&ReadAddr, 2);
1220	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
1221	if (RT_SUCCESS(rc))
1222	{
1223	if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
1224	{
1225	uint8_t const bLead = abBuf[1] == '_' \|\| abBuf[1] == 'T' \|\| abBuf[1] == 't' ? abBuf[0] : abBuf[1];
1226	uint8_t const offTail = 2 + cbNeedle;
1227	uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
1228	if ( bLead >= 1 && (bLead < 0x20 \|\| bLead >= 0x80)
1229	&& bTail >= 1 && (bTail < 0x20 \|\| bTail >= 0x80))
1230	return true;
1231	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
1232	pHitAddr->FlatPtr, bLead, bTail, offTail));
1233	}
1234	else
1235	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
1236	}
1237	else
1238	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
1239
1240	return false;
1241	}
1242
1243
1244	/**
1245	* @copydoc DBGFOSREG::pfnInit
1246	*/
1247	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData)
1248	{
1249	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1250	Assert(!pThis->fValid);
1251
1252	/*
1253	* Assume 64-bit kernels all live way beyond 32-bit address space.
1254	*/
1255	pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
1256
1257	/*
1258	* Go looking for the kallsyms table. If it's there, it will be somewhere
1259	* after the linux_banner symbol, so use it for starting the search.
1260	*/
1261	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
1262	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
1263	while (cbLeft > 4096)
1264	{
1265	static const uint8_t s_abNeedle[] = "kobj";
1266	DBGFADDRESS HitAddr;
1267	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
1268	s_abNeedle, sizeof(s_abNeedle) - 1, &HitAddr);
1269	if (RT_FAILURE(rc))
1270	break;
1271	if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, s_abNeedle, sizeof(s_abNeedle) - 1))
1272	{
1273	/* There will be another hit near by. */
1274	DBGFR3AddrAdd(&HitAddr, 1);
1275	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /uAlign/,
1276	s_abNeedle, sizeof(s_abNeedle) - 1, &HitAddr);
1277	if ( RT_SUCCESS(rc)
1278	&& dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, s_abNeedle, sizeof(s_abNeedle) - 1))
1279	{
1280	/*
1281	* We've got a very likely candidate for a location inside kallsyms_names.
1282	* Try find the start of it, that is to say, try find kallsyms_num_syms.
1283	* kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
1284	*/
1285	rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pThis, &HitAddr);
1286	if (RT_SUCCESS(rc))
1287	rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pThis, &HitAddr);
1288	if (RT_SUCCESS(rc))
1289	rc = dbgDiggerLinuxFindTokenIndex(pUVM, pThis);
1290	if (RT_SUCCESS(rc))
1291	rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pThis);
1292	if (RT_SUCCESS(rc))
1293	break;
1294	}
1295	}
1296
1297	/*
1298	* Advance.
1299	*/
1300	RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + sizeof(s_abNeedle) - 1;
1301	if (RT_UNLIKELY(cbDistance >= cbLeft))
1302	{
1303	Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
1304	break;
1305	}
1306	cbLeft -= cbDistance;
1307	DBGFR3AddrAdd(&CurAddr, cbDistance);
1308
1309	}
1310
1311	pThis->fValid = true;
1312	return VINF_SUCCESS;
1313	}
1314
1315
1316	/**
1317	* @copydoc DBGFOSREG::pfnProbe
1318	*/
1319	static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, void *pvData)
1320	{
1321	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1322
1323	/*
1324	* Look for "Linux version " at the start of the rodata segment.
1325	* Hope that this comes before any message buffer or other similar string.
1326	*/
1327	for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
1328	{
1329	DBGFADDRESS KernelAddr;
1330	DBGFR3AddrFromFlat(pUVM, &KernelAddr, g_au64LnxKernelAddresses[i]);
1331	DBGFADDRESS HitAddr;
1332	static const uint8_t s_abLinuxVersion[] = "Linux version ";
1333	int rc = DBGFR3MemScan(pUVM, 0, &KernelAddr, LNX_MAX_KERNEL_SIZE, 1,
1334	s_abLinuxVersion, sizeof(s_abLinuxVersion) - 1, &HitAddr);
1335	if (RT_SUCCESS(rc))
1336	{
1337	char szTmp[128];
1338	char const *pszX = &szTmp[sizeof(s_abLinuxVersion) - 1];
1339	rc = DBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
1340	if ( RT_SUCCESS(rc)
1341	&& ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
1342	&& pszX[1] == '.'
1343	&& pszX[2] >= '0'
1344	&& pszX[2] <= '6')
1345	\|\| ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
1346	&& pszX[0] <= '9'
1347	&& pszX[1] == '.'
1348	&& pszX[2] >= '0'
1349	&& pszX[2] <= '9')
1350	)
1351	)
1352	{
1353	pThis->AddrKernelBase = KernelAddr;
1354	pThis->AddrLinuxBanner = HitAddr;
1355	return true;
1356	}
1357	}
1358	}
1359	return false;
1360	}
1361
1362
1363	/**
1364	* @copydoc DBGFOSREG::pfnDestruct
1365	*/
1366	static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, void *pvData)
1367	{
1368
1369	}
1370
1371
1372	/**
1373	* @copydoc DBGFOSREG::pfnConstruct
1374	*/
1375	static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, void *pvData)
1376	{
1377	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1378	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
1379	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
1380	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
1381
1382	return VINF_SUCCESS;
1383	}
1384
1385
1386	const DBGFOSREG g_DBGDiggerLinux =
1387	{
1388	/* .u32Magic = */ DBGFOSREG_MAGIC,
1389	/* .fFlags = */ 0,
1390	/* .cbData = */ sizeof(DBGDIGGERLINUX),
1391	/* .szName = */ "Linux",
1392	/* .pfnConstruct = */ dbgDiggerLinuxConstruct,
1393	/* .pfnDestruct = */ dbgDiggerLinuxDestruct,
1394	/* .pfnProbe = */ dbgDiggerLinuxProbe,
1395	/* .pfnInit = */ dbgDiggerLinuxInit,
1396	/* .pfnRefresh = */ dbgDiggerLinuxRefresh,
1397	/* .pfnTerm = */ dbgDiggerLinuxTerm,
1398	/* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
1399	/* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
1400	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1401	};
1402

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 61531

Download in other formats: