DBGPlugInLinux.cpp@ 61622

Last change on this file since 61622 was 61622, checked in by vboxsync, 8 years ago
Debugger/Digger/Linux: Another way to get at the log buffer for certain older kernels where log_buf and log_buf_len are not exposed. Disassemble emit_log_char and infer the log buffer address and sizes
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 76.5 KB

Line
1	/* $Id: DBGPlugInLinux.cpp 61622 2016-06-09 13:56:01Z vboxsync $ */
2	/** @file
3	* DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4	*/
5
6	/*
7	* Copyright (C) 2008-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include "DBGPlugInCommonELF.h"
25	#include <VBox/vmm/dbgf.h>
26	#include <VBox/dis.h>
27	#include <iprt/string.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/ctype.h>
31
32
33	/*********************************************************************************************************************************
34	* Structures and Typedefs *
35	*********************************************************************************************************************************/
36
37	/** @name InternalLinux structures
38	* @{ */
39
40
41	/** @} */
42
43
44	/**
45	* Linux guest OS digger instance data.
46	*/
47	typedef struct DBGDIGGERLINUX
48	{
49	/** Whether the information is valid or not.
50	* (For fending off illegal interface method calls.) */
51	bool fValid;
52	/** Set if 64-bit, clear if 32-bit. */
53	bool f64Bit;
54
55	/** The address of the linux banner.
56	* This is set during probing. */
57	DBGFADDRESS AddrLinuxBanner;
58	/** Kernel base address.
59	* This is set during probing, refined during kallsyms parsing. */
60	DBGFADDRESS AddrKernelBase;
61	/** The kernel size. */
62	uint32_t cbKernel;
63
64	/** The number of kernel symbols (kallsyms_num_syms).
65	* This is set during init. */
66	uint32_t cKernelSymbols;
67	/** The size of the kernel name table (sizeof(kallsyms_names)). */
68	uint32_t cbKernelNames;
69	/** Number of entries in the kernel_markers table. */
70	uint32_t cKernelNameMarkers;
71	/** The size of the kernel symbol token table. */
72	uint32_t cbKernelTokenTable;
73	/** The address of the encoded kernel symbol names (kallsyms_names). */
74	DBGFADDRESS AddrKernelNames;
75	/** The address of the kernel symbol addresses (kallsyms_addresses). */
76	DBGFADDRESS AddrKernelAddresses;
77	/** The address of the kernel symbol name markers (kallsyms_markers). */
78	DBGFADDRESS AddrKernelNameMarkers;
79	/** The address of the kernel symbol token table (kallsyms_token_table). */
80	DBGFADDRESS AddrKernelTokenTable;
81	/** The address of the kernel symbol token index table (kallsyms_token_index). */
82	DBGFADDRESS AddrKernelTokenIndex;
83
84	/** The kernel message log interface. */
85	DBGFOSIDMESG IDmesg;
86	} DBGDIGGERLINUX;
87	/** Pointer to the linux guest OS digger instance data. */
88	typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
89
90
91	/**
92	* The current printk_log structure.
93	*/
94	typedef struct LNXPRINTKHDR
95	{
96	/** Monotonic timestamp. */
97	uint64_t nsTimestamp;
98	/** The total size of this message record. */
99	uint16_t cbTotal;
100	/** The size of the text part (immediately follows the header). */
101	uint16_t cbText;
102	/** The size of the optional dictionary part (follows the text). */
103	uint16_t cbDict;
104	/** The syslog facility number. */
105	uint8_t bFacility;
106	/** First 5 bits are internal flags, next 3 bits are log level. */
107	uint8_t fFlagsAndLevel;
108	} LNXPRINTKHDR;
109	AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
110	/** Pointer to linux printk_log header. */
111	typedef LNXPRINTKHDR *PLNXPRINTKHDR;
112	/** Pointer to linux const printk_log header. */
113	typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
114
115
116	/*********************************************************************************************************************************
117	* Defined Constants And Macros *
118	*********************************************************************************************************************************/
119	/** Validates a 32-bit linux kernel address */
120	#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
121	/** Validates a 64-bit linux kernel address */
122	#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
123
124	/** The max kernel size. */
125	#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
126
127	/** The maximum size we expect for kallsyms_names. */
128	#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
129	/** The maximum size we expect for kallsyms_token_table. */
130	#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
131	/** The minimum number of symbols we expect in kallsyms_num_syms. */
132	#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
133	/** The maximum number of symbols we expect in kallsyms_num_syms. */
134	#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
135	/** The min length an encoded symbol in kallsyms_names is expected to have. */
136	#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
137	/** The max length an encoded symbol in kallsyms_names is expected to have.
138	* @todo check real life here. */
139	#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
140	/** The approximate maximum length of a string token. */
141	#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
142
143	/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
144	#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
145
146
147	/*********************************************************************************************************************************
148	* Internal Functions *
149	*********************************************************************************************************************************/
150	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData);
151
152
153	/*********************************************************************************************************************************
154	* Global Variables *
155	*********************************************************************************************************************************/
156	/** Table of common linux kernel addresses. */
157	static uint64_t g_au64LnxKernelAddresses[] =
158	{
159	UINT64_C(0xc0100000),
160	UINT64_C(0x90100000),
161	UINT64_C(0xffffffff80200000)
162	};
163
164	static const uint8_t g_abLinuxVersion[] = "Linux version ";
165
166	/**
167	* Disassembles a simple getter returning the value for it.
168	*
169	* @returns VBox status code.
170	* @param pThis The Linux digger data.
171	* @param pUVM The VM handle.
172	* @param hMod The module to use.
173	* @param pszSymbol The symbol of the getter.
174	* @param pvVal Where to store the value on success.
175	* @param cbVal Size of the value in bytes.
176	*/
177	static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
178	const char pszSymbol, void pvVal, uint32_t cbVal)
179	{
180	int rc = VINF_SUCCESS;
181
182	RTDBGSYMBOL SymInfo;
183	rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
184	if (RT_SUCCESS(rc))
185	{
186	/*
187	* Do the diassembling. Disassemble until a ret instruction is encountered
188	* or a limit is reached (don't want to disassemble for too long as the getter
189	* should be short).
190	* push and pop instructions are skipped as well as any mov instructions not
191	* touching the rax or eax register (depending on the size of the value).
192	*/
193	unsigned cInstrDisassembled = 0;
194	uint32_t offInstr = 0;
195	bool fRet = false;
196	DISSTATE DisState;
197	RT_ZERO(DisState);
198
199	do
200	{
201	DBGFADDRESS Addr;
202	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
203	DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
204
205	/* Prefetch the instruction. */
206	uint8_t abInstr[32];
207	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
208	if (RT_SUCCESS(rc))
209	{
210	uint32_t cbInstr = 0;
211
212	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
213	if (RT_SUCCESS(rc))
214	{
215	switch (DisState.pCurInstr->uOpcode)
216	{
217	case OP_PUSH:
218	case OP_POP:
219	case OP_NOP:
220	case OP_LEA:
221	break;
222	case OP_RETN:
223	/* Getter returned, abort disassembling. */
224	fRet = true;
225	break;
226	case OP_MOV:
227	/*
228	* Check that the destination is either rax or eax depending on the
229	* value size.
230	*
231	* Param1 is the destination and Param2 the source.
232	*/
233	if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN32))
234	&& cbVal == sizeof(uint32_t))
235	\|\| ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
236	&& cbVal == sizeof(uint64_t)))
237	&& DisState.Param1.Base.idxGenReg == DISGREG_RAX)
238	{
239	/* Parse the source. */
240	if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
241	memcpy(pvVal, &DisState.Param2.uValue, cbVal);
242	else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64))
243	{
244	RTGCPTR GCPtrVal = 0;
245
246	if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
247	GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
248	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
249	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
250	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
251	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
252	else
253	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
254
255	DBGFADDRESS AddrVal;
256	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
257	DBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
258	pvVal, cbVal);
259	}
260	}
261	break;
262	default:
263	/* All other instructions will cause an error for now (playing safe here). */
264	rc = VERR_INVALID_PARAMETER;
265	break;
266	}
267	cInstrDisassembled++;
268	offInstr += cbInstr;
269	}
270	}
271	} while ( RT_SUCCESS(rc)
272	&& cInstrDisassembled < 20
273	&& !fRet);
274	}
275
276	return rc;
277	}
278
279	/**
280	* Try to get at the log buffer starting address and size by disassembling emit_log_char.
281	*
282	* @returns VBox status code.
283	* @param pThis The Linux digger data.
284	* @param pUVM The VM handle.
285	* @param hMod The module to use.
286	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
287	* @param pcbLogBuf Where to store the size of the log buffer on success.
288	*/
289	static int dbgDiggerLinuxQueryAsciiLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
290	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
291	{
292	int rc = VINF_SUCCESS;
293
294	/**
295	* We disassemble emit_log_char to get at the log buffer address and size.
296	* This is used in case the symbols are not exported in kallsyms.
297	*
298	* This is what it typically looks like:
299	* vmlinux!emit_log_char:
300	* %00000000c01204a1 56 push esi
301	* %00000000c01204a2 8b 35 d0 1c 34 c0 mov esi, dword [0c0341cd0h]
302	* %00000000c01204a8 53 push ebx
303	* %00000000c01204a9 8b 1d 74 3b 3e c0 mov ebx, dword [0c03e3b74h]
304	* %00000000c01204af 8b 0d d8 1c 34 c0 mov ecx, dword [0c0341cd8h]
305	* %00000000c01204b5 8d 56 ff lea edx, [esi-001h]
306	* %00000000c01204b8 21 da and edx, ebx
307	* %00000000c01204ba 88 04 11 mov byte [ecx+edx], al
308	* %00000000c01204bd 8d 53 01 lea edx, [ebx+001h]
309	* %00000000c01204c0 89 d0 mov eax, edx
310	* [...]
311	*/
312	RTDBGSYMBOL SymInfo;
313	rc = RTDbgModSymbolByName(hMod, "emit_log_char", &SymInfo);
314	if (RT_SUCCESS(rc))
315	{
316	/*
317	* Do the diassembling. Disassemble until a ret instruction is encountered
318	* or a limit is reached (don't want to disassemble for too long as the getter
319	* should be short). Certain instructions found are ignored (push, nop, etc.).
320	*/
321	unsigned cInstrDisassembled = 0;
322	uint32_t offInstr = 0;
323	bool fRet = false;
324	DISSTATE DisState;
325	unsigned idxAddressesUsed = 0;
326	struct { size_t cb; RTGCPTR GCPtrOrigSrc; } aAddresses[5];
327	RT_ZERO(DisState);
328	RT_ZERO(aAddresses);
329
330	do
331	{
332	DBGFADDRESS Addr;
333	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
334	DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
335
336	/* Prefetch the instruction. */
337	uint8_t abInstr[32];
338	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
339	if (RT_SUCCESS(rc))
340	{
341	uint32_t cbInstr = 0;
342
343	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
344	if (RT_SUCCESS(rc))
345	{
346	switch (DisState.pCurInstr->uOpcode)
347	{
348	case OP_PUSH:
349	case OP_POP:
350	case OP_NOP:
351	case OP_LEA:
352	case OP_AND:
353	case OP_CBW:
354	break;
355	case OP_RETN:
356	/* emit_log_char returned, abort disassembling. */
357	rc = VERR_NOT_FOUND;
358	fRet = true;
359	break;
360	case OP_MOV:
361	case OP_MOVSXD:
362	/*
363	* If a mov is encountered writing to memory with al (or dil for amd64) being the source the
364	* character is stored and we can infer the base address and size of the log buffer from
365	* the source addresses.
366	*/
367	if ( (DisState.Param2.fUse & DISUSE_REG_GEN8)
368	&& ( (DisState.Param2.Base.idxGenReg == DISGREG_AL && !pThis->f64Bit)
369	\|\| (DisState.Param2.Base.idxGenReg == DISGREG_DIL && pThis->f64Bit))
370	&& DISUSE_IS_EFFECTIVE_ADDR(DisState.Param1.fUse))
371	{
372	RTGCPTR GCPtrLogBuf = 0;
373	size_t cbLogBuf = 0;
374
375	/*
376	* We can stop disassembling now and inspect all registers, look for a valid kernel address first.
377	* Only one of the accessed registers should hold a valid kernel address.
378	* For the log size look for the biggest non kernel address.
379	*/
380	for (unsigned i = 0; i < idxAddressesUsed; i++)
381	{
382	DBGFADDRESS AddrVal;
383	union { uint8_t abVal[8]; uint32_t u32Val; uint64_t u64Val; } Val;
384
385	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
386	DBGFR3AddrFromFlat(pUVM, &AddrVal, aAddresses[i].GCPtrOrigSrc),
387	&Val.abVal[0], aAddresses[i].cb);
388	if (RT_SUCCESS(rc))
389	{
390	if (pThis->f64Bit && aAddresses[i].cb == sizeof(uint64_t))
391	{
392	if (LNX64_VALID_ADDRESS(Val.u64Val))
393	{
394	if (GCPtrLogBuf == 0)
395	GCPtrLogBuf = Val.u64Val;
396	else
397	{
398	rc = VERR_NOT_FOUND;
399	break;
400	}
401	}
402	}
403	else
404	{
405	AssertMsgBreakStmt(aAddresses[i].cb == sizeof(uint32_t),
406	("Invalid value size\n"), rc = VERR_INVALID_STATE);
407
408	/* Might be a kernel address or a size indicator. */
409	if (!pThis->f64Bit && LNX32_VALID_ADDRESS(Val.u32Val))
410	{
411	if (GCPtrLogBuf == 0)
412	GCPtrLogBuf = Val.u32Val;
413	else
414	{
415	rc = VERR_NOT_FOUND;
416	break;
417	}
418	}
419	else
420	{
421	/*
422	* The highest value will be the log buffer because the other
423	* accessed variables are indexes into the buffer and hence
424	* always smaller than the size.
425	*/
426	if (cbLogBuf < Val.u32Val)
427	cbLogBuf = Val.u32Val;
428	}
429	}
430	}
431	}
432
433	if ( RT_SUCCESS(rc)
434	&& GCPtrLogBuf != 0
435	&& cbLogBuf != 0)
436	{
437	*pGCPtrLogBuf = GCPtrLogBuf;
438	*pcbLogBuf = cbLogBuf;
439	}
440	else if (RT_SUCCESS(rc))
441	rc = VERR_NOT_FOUND;
442
443	fRet = true;
444	break;
445	}
446	else
447	{
448	/*
449	* In case of a memory to register move store the destination register index and the
450	* source address in the relation table for later processing.
451	*/
452	if ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN32 \| DISUSE_REG_GEN64))
453	&& (DisState.Param2.cb == sizeof(uint32_t) \|\| DisState.Param2.cb == sizeof(uint64_t))
454	&& (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64)))
455	{
456	RTGCPTR GCPtrVal = 0;
457
458	if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
459	GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
460	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
461	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
462	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
463	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
464	else
465	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
466
467	if (idxAddressesUsed < RT_ELEMENTS(aAddresses))
468	{
469	/* movsxd reads always 32bits. */
470	if (DisState.pCurInstr->uOpcode == OP_MOVSXD)
471	aAddresses[idxAddressesUsed].cb = sizeof(uint32_t);
472	else
473	aAddresses[idxAddressesUsed].cb = DisState.Param2.cb;
474	aAddresses[idxAddressesUsed].GCPtrOrigSrc = GCPtrVal;
475	idxAddressesUsed++;
476	}
477	else
478	{
479	rc = VERR_INVALID_PARAMETER;
480	break;
481	}
482	}
483	}
484	break;
485	default:
486	/* All other instructions will cause an error for now (playing safe here). */
487	rc = VERR_INVALID_PARAMETER;
488	break;
489	}
490	cInstrDisassembled++;
491	offInstr += cbInstr;
492	}
493	}
494	} while ( RT_SUCCESS(rc)
495	&& cInstrDisassembled < 20
496	&& !fRet);
497	}
498
499	return rc;
500	}
501
502	/**
503	* Try to get at the log buffer starting address and size by disassembling some exposed helpers.
504	*
505	* @returns VBox status code.
506	* @param pThis The Linux digger data.
507	* @param pUVM The VM handle.
508	* @param hMod The module to use.
509	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
510	* @param pcbLogBuf Where to store the size of the log buffer on success.
511	*/
512	static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
513	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
514	{
515	int rc = VINF_SUCCESS;
516
517	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
518	{
519	{ pGCPtrLogBuf, sizeof(RTGCPTR), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf_addr_get" },
520	{ pcbLogBuf, sizeof(uint32_t), sizeof(uint32_t), "log_buf_len_get" }
521	};
522	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
523	{
524	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
525	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
526	rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, hMod, aSymbols[i].pszSymbol,
527	aSymbols[i].pvVar, aSymbols[i].cbGuest);
528	}
529
530	return rc;
531	}
532
533	/**
534	* Returns whether the log buffer is a simple ascii buffer or a record based implementation
535	* based on the kernel version found.
536	*
537	* @returns Flag whether the log buffer is the simple ascii buffer.
538	* @param pThis The Linux digger data.
539	* @param pUVM The user mode VM handle.
540	*/
541	static bool dbgDiggerLinuxLogBufferIsAsciiBuffer(PDBGDIGGERLINUX pThis, PUVM pUVM)
542	{
543	char szTmp[128];
544	char const *pszVer = &szTmp[sizeof(g_abLinuxVersion) - 1];
545
546	RT_ZERO(szTmp);
547	int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, szTmp, sizeof(szTmp) - 1);
548	if ( RT_SUCCESS(rc)
549	&& RTStrVersionCompare(pszVer, "3.4") == -1)
550	return true;
551
552	return false;
553	}
554
555	/**
556	* Worker to get at the kernel log for pre 3.4 kernels where the log buffer was just a char buffer.
557	*
558	* @returns VBox status code.
559	* @param pThis The Linux digger data.
560	* @param pUVM The VM user mdoe handle.
561	* @param hMod The debug module handle.
562	* @param fFlags Flags reserved for future use, MBZ.
563	* @param cMessages The number of messages to retrieve, counting from the
564	* end of the log (i.e. like tail), use UINT32_MAX for all.
565	* @param pszBuf The output buffer.
566	* @param cbBuf The buffer size.
567	* @param pcbActual Where to store the number of bytes actually returned,
568	* including zero terminator. On VERR_BUFFER_OVERFLOW this
569	* holds the necessary buffer size. Optional.
570	*/
571	static int dbgDiggerLinuxLogBufferQueryAscii(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
572	uint32_t fFlags, uint32_t cMessages,
573	char pszBuf, size_t cbBuf, size_t pcbActual)
574	{
575	int rc = VINF_SUCCESS;
576	RTGCPTR GCPtrLogBuf;
577	uint32_t cbLogBuf;
578
579	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
580	{
581	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
582	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
583	};
584	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
585	{
586	RTDBGSYMBOL SymInfo;
587	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
588	if (RT_SUCCESS(rc))
589	{
590	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
591	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
592	DBGFADDRESS Addr;
593	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
594	DBGFR3AddrFromFlat(pUVM, &Addr, (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
595	aSymbols[i].pvVar, aSymbols[i].cbGuest);
596	if (RT_SUCCESS(rc))
597	continue;
598	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
599	}
600	else
601	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
602	rc = VERR_NOT_FOUND;
603	break;
604	}
605
606	/*
607	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
608	* some public helpers to get at the addresses.
609	*
610	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
611	*/
612	if (rc == VERR_NOT_FOUND)
613	{
614	rc = dbgDiggerLinuxQueryAsciiLogBufferPtrs(pThis, pUVM, hMod, &GCPtrLogBuf, &cbLogBuf);
615	if (RT_FAILURE(rc))
616	return rc;
617	}
618
619	/*
620	* Check if the values make sense.
621	*/
622	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
623	{
624	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
625	return VERR_NOT_FOUND;
626	}
627	if ( cbLogBuf < 4096
628	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
629	\|\| cbLogBuf > 16*_1M)
630	{
631	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
632	return VERR_NOT_FOUND;
633	}
634
635	/*
636	* Read the whole log buffer.
637	*/
638	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
639	if (!pbLogBuf)
640	{
641	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
642	return VERR_NO_MEMORY;
643	}
644	DBGFADDRESS Addr;
645	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
646	if (RT_FAILURE(rc))
647	{
648	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
649	cbLogBuf, Addr.FlatPtr, rc));
650	RTMemFree(pbLogBuf);
651	return VERR_NOT_FOUND;
652	}
653
654	/** @todo: Try to parse where the single messages start to make use of cMessages. */
655	size_t cchLength = RTStrNLen((const char *)pbLogBuf, cbLogBuf);
656	memcpy(&pszBuf[0], pbLogBuf, RT_MIN(cbBuf, cchLength));
657
658	/* Done with the buffer. */
659	RTMemFree(pbLogBuf);
660
661	/* Set return size value. */
662	if (pcbActual)
663	*pcbActual = RT_MIN(cbBuf, cchLength);
664
665	return cbBuf <= cchLength ? VERR_BUFFER_OVERFLOW : VINF_SUCCESS;
666	}
667
668	/**
669	* Worker to get at the kernel log for post 3.4 kernels where the log buffer contains records.
670	*
671	* @returns VBox status code.
672	* @param pThis The Linux digger data.
673	* @param pUVM The VM user mdoe handle.
674	* @param hMod The debug module handle.
675	* @param fFlags Flags reserved for future use, MBZ.
676	* @param cMessages The number of messages to retrieve, counting from the
677	* end of the log (i.e. like tail), use UINT32_MAX for all.
678	* @param pszBuf The output buffer.
679	* @param cbBuf The buffer size.
680	* @param pcbActual Where to store the number of bytes actually returned,
681	* including zero terminator. On VERR_BUFFER_OVERFLOW this
682	* holds the necessary buffer size. Optional.
683	*/
684	static int dbgDiggerLinuxLogBufferQueryRecords(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
685	uint32_t fFlags, uint32_t cMessages,
686	char pszBuf, size_t cbBuf, size_t pcbActual)
687	{
688	int rc = VINF_SUCCESS;
689	RTGCPTR GCPtrLogBuf;
690	uint32_t cbLogBuf;
691	uint32_t idxFirst;
692	uint32_t idxNext;
693
694	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
695	{
696	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
697	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
698	{ &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
699	{ &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
700	};
701	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
702	{
703	RTDBGSYMBOL SymInfo;
704	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
705	if (RT_SUCCESS(rc))
706	{
707	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
708	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
709	DBGFADDRESS Addr;
710	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
711	DBGFR3AddrFromFlat(pUVM, &Addr, (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
712	aSymbols[i].pvVar, aSymbols[i].cbGuest);
713	if (RT_SUCCESS(rc))
714	continue;
715	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
716	}
717	else
718	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
719	rc = VERR_NOT_FOUND;
720	break;
721	}
722
723	/*
724	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
725	* some public helpers to get at the addresses.
726	*
727	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
728	*/
729	if (rc == VERR_NOT_FOUND)
730	{
731	idxFirst = 0;
732	idxNext = 0;
733	rc = dbgDiggerLinuxQueryLogBufferPtrs(pThis, pUVM, hMod, &GCPtrLogBuf, &cbLogBuf);
734	if (RT_FAILURE(rc))
735	return rc;
736	}
737
738	/*
739	* Check if the values make sense.
740	*/
741	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
742	{
743	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
744	return VERR_NOT_FOUND;
745	}
746	if ( cbLogBuf < 4096
747	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
748	\|\| cbLogBuf > 16*_1M)
749	{
750	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
751	return VERR_NOT_FOUND;
752	}
753	uint32_t const cbLogAlign = 4;
754	if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
755	\|\| (idxFirst & (cbLogAlign - 1)) != 0)
756	{
757	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
758	return VERR_NOT_FOUND;
759	}
760	if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
761	\|\| (idxNext & (cbLogAlign - 1)) != 0)
762	{
763	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
764	return VERR_NOT_FOUND;
765	}
766
767	/*
768	* Read the whole log buffer.
769	*/
770	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
771	if (!pbLogBuf)
772	{
773	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
774	return VERR_NO_MEMORY;
775	}
776	DBGFADDRESS Addr;
777	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
778	if (RT_FAILURE(rc))
779	{
780	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
781	cbLogBuf, Addr.FlatPtr, rc));
782	RTMemFree(pbLogBuf);
783	return VERR_NOT_FOUND;
784	}
785
786	/*
787	* Count the messages in the buffer while doing some basic validation.
788	*/
789	uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
790	: idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
791	uint32_t cbLeft = cbUsed;
792	uint32_t offCur = idxFirst;
793	uint32_t cLogMsgs = 0;
794
795	while (cbLeft > 0)
796	{
797	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
798	if (!pHdr->cbTotal)
799	{
800	/* Wrap around packet, most likely... */
801	if (cbLogBuf - offCur >= cbLeft)
802	break;
803	offCur = 0;
804	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
805	}
806	if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
807	\|\| pHdr->cbTotal > cbLeft
808	\|\| (pHdr->cbTotal & (cbLogAlign - 1)) != 0
809	\|\| pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
810	{
811	Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
812	offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
813	rc = VERR_INVALID_STATE;
814	break;
815	}
816
817	if (pHdr->cbText > 0)
818	cLogMsgs++;
819
820	/* next */
821	offCur += pHdr->cbTotal;
822	cbLeft -= pHdr->cbTotal;
823	}
824	if (RT_FAILURE(rc))
825	{
826	RTMemFree(pbLogBuf);
827	return rc;
828	}
829
830	/*
831	* Copy the messages into the output buffer.
832	*/
833	offCur = idxFirst;
834	cbLeft = cbUsed;
835
836	/* Skip messages that the caller doesn't want. */
837	if (cMessages < cLogMsgs)
838	{
839	uint32_t cToSkip = cLogMsgs - cMessages;
840	while (cToSkip > 0)
841	{
842	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
843	if (!pHdr->cbTotal)
844	{
845	offCur = 0;
846	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
847	}
848	if (pHdr->cbText > 0)
849	cToSkip--;
850
851	/* next */
852	offCur += pHdr->cbTotal;
853	cbLeft -= pHdr->cbTotal;
854	}
855	}
856
857	/* Now copy the messages. */
858	size_t offDst = 0;
859	while (cbLeft > 0)
860	{
861	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
862	if (!pHdr->cbTotal)
863	{
864	if (cbLogBuf - offCur >= cbLeft)
865	break;
866	offCur = 0;
867	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
868	}
869
870	if (pHdr->cbText > 0)
871	{
872	char pchText = (char )(pHdr + 1);
873	size_t cchText = RTStrNLen(pchText, pHdr->cbText);
874	if (offDst + cchText < cbBuf)
875	{
876	memcpy(&pszBuf[offDst], pHdr + 1, cchText);
877	pszBuf[offDst + cchText] = '\n';
878	}
879	else if (offDst < cbBuf)
880	memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
881	offDst += cchText + 1;
882	}
883
884	/* next */
885	offCur += pHdr->cbTotal;
886	cbLeft -= pHdr->cbTotal;
887	}
888
889	/* Done with the buffer. */
890	RTMemFree(pbLogBuf);
891
892	/* Make sure we've reserved a char for the terminator. */
893	if (!offDst)
894	offDst = 1;
895
896	/* Set return size value. */
897	if (pcbActual)
898	*pcbActual = offDst;
899
900	if (offDst <= cbBuf)
901	return VINF_SUCCESS;
902	else
903	return VERR_BUFFER_OVERFLOW;
904	}
905
906	/**
907	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
908	*/
909	static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
910	char pszBuf, size_t cbBuf, size_t pcbActual)
911	{
912	PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
913
914	if (cMessages < 1)
915	return VERR_INVALID_PARAMETER;
916
917	/*
918	* Resolve the symbols we need and read their values.
919	*/
920	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
921	RTDBGMOD hMod;
922	int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
923	if (RT_FAILURE(rc))
924	return VERR_NOT_FOUND;
925	RTDbgAsRelease(hAs);
926
927	size_t cbActual;
928	/*
929	* Check whether the kernel log buffer is a simple char buffer or the newer
930	* record based implementation.
931	* The record based implementation was presumably introduced with kernel 3.4,
932	* see: http://thread.gmane.org/gmane.linux.kernel/1284184
933	*/
934	if (dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM))
935	rc = dbgDiggerLinuxLogBufferQueryAscii(pData, pUVM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
936	else
937	rc = dbgDiggerLinuxLogBufferQueryRecords(pData, pUVM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
938
939	/* Release the module in any case. */
940	RTDbgModRelease(hMod);
941
942	if (RT_FAILURE(rc) && rc != VERR_BUFFER_OVERFLOW)
943	return rc;
944
945	if (pcbActual)
946	*pcbActual = cbActual;
947
948	/*
949	* All VBox strings are UTF-8 and bad things may in theory happen if we
950	* pass bad UTF-8 to code which assumes it's all valid. So, we enforce
951	* UTF-8 upon the guest kernel messages here even if they (probably) have
952	* no defined code set in reality.
953	*/
954	if ( RT_SUCCESS(rc)
955	&& cbActual <= cbBuf)
956	{
957	pszBuf[cbActual - 1] = '\0';
958	RTStrPurgeEncoding(pszBuf);
959	return VINF_SUCCESS;
960	}
961
962	if (cbBuf)
963	{
964	pszBuf[cbBuf - 1] = '\0';
965	RTStrPurgeEncoding(pszBuf);
966	}
967	return VERR_BUFFER_OVERFLOW;
968	}
969
970
971	/**
972	* @copydoc DBGFOSREG::pfnQueryInterface
973	*/
974	static DECLCALLBACK(void ) dbgDiggerLinuxQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
975	{
976	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
977	switch (enmIf)
978	{
979	case DBGFOSINTERFACE_DMESG:
980	return &pThis->IDmesg;
981
982	default:
983	return NULL;
984	}
985	}
986
987
988	/**
989	* @copydoc DBGFOSREG::pfnQueryVersion
990	*/
991	static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
992	{
993	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
994	Assert(pThis->fValid);
995
996	/*
997	* It's all in the linux banner.
998	*/
999	int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
1000	if (RT_SUCCESS(rc))
1001	{
1002	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
1003	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
1004	while ( pszEnd > pszVersion
1005	&& RT_C_IS_SPACE(pszEnd[-1]))
1006	pszEnd--;
1007	*pszEnd = '\0';
1008	}
1009	else
1010	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
1011
1012	return rc;
1013	}
1014
1015
1016	/**
1017	* @copydoc DBGFOSREG::pfnTerm
1018	*/
1019	static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, void *pvData)
1020	{
1021	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1022	Assert(pThis->fValid);
1023
1024	pThis->fValid = false;
1025	}
1026
1027
1028	/**
1029	* @copydoc DBGFOSREG::pfnRefresh
1030	*/
1031	static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, void *pvData)
1032	{
1033	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1034	NOREF(pThis);
1035	Assert(pThis->fValid);
1036
1037	/*
1038	* For now we'll flush and reload everything.
1039	*/
1040	dbgDiggerLinuxTerm(pUVM, pvData);
1041	return dbgDiggerLinuxInit(pUVM, pvData);
1042	}
1043
1044
1045	/**
1046	* Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
1047	* digger data.
1048	*
1049	* @returns VINF_SUCCESS.
1050	* @param pThis The Linux digger data to update.
1051	* @param pAddrKernelNames The kallsyms_names address.
1052	* @param cKernelSymbols The number of kernel symbol.
1053	* @param cbAddress The guest address size.
1054	*/
1055	static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrKernelNames,
1056	uint32_t cKernelSymbols, uint32_t cbAddress)
1057	{
1058	pThis->cKernelSymbols = cKernelSymbols;
1059	pThis->AddrKernelNames = *pAddrKernelNames;
1060	pThis->AddrKernelAddresses = *pAddrKernelNames;
1061	DBGFR3AddrSub(&pThis->AddrKernelAddresses, (cKernelSymbols + 1) * cbAddress);
1062
1063	Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
1064	"dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
1065	"dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
1066	pThis->AddrKernelAddresses.FlatPtr,
1067	pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
1068	pThis->AddrKernelNames.FlatPtr));
1069	return VINF_SUCCESS;
1070	}
1071
1072
1073	/**
1074	* Tries to find the address of the kallsyms_names, kallsyms_num_syms and
1075	* kallsyms_addresses symbols.
1076	*
1077	* The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
1078	* addresses of the other two are stored as pThis->AddrKernelNames and
1079	* pThis->AddrKernelAddresses.
1080	*
1081	* @returns VBox status code, success indicating that all three variables have
1082	* been found and taken down.
1083	* @param pUVM The user mode VM handle.
1084	* @param pThis The Linux digger data.
1085	* @param pHitAddr An address we think is inside kallsyms_names.
1086	*/
1087	static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1088	{
1089	/*
1090	* Search backwards in chunks.
1091	*/
1092	union
1093	{
1094	uint8_t ab[0x1000];
1095	uint32_t au32[0x1000 / sizeof(uint32_t)];
1096	uint64_t au64[0x1000 / sizeof(uint64_t)];
1097	} uBuf;
1098	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
1099	uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1100	DBGFADDRESS CurAddr = *pHitAddr;
1101	DBGFR3AddrSub(&CurAddr, cbBuf);
1102	cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
1103	for (;;)
1104	{
1105	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1106	if (RT_FAILURE(rc))
1107	return rc;
1108
1109	/*
1110	* We assume that the three symbols are aligned on guest pointer boundrary.
1111	*
1112	* The boundrary between the two tables should be noticable as the number
1113	* is unlikely to be more than 16 millions, there will be at least one zero
1114	* byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
1115	* that common in the kallsyms_names table.
1116	*
1117	* Also the kallsyms_names table starts with a length byte, which means
1118	* we're likely to see a byte in the range 1..31.
1119	*
1120	* The kallsyms_addresses are mostly sorted (except for the start where the
1121	* absolute symbols are), so we'll spot a bunch of kernel addresses
1122	* immediately preceeding the kallsyms_num_syms field.
1123	*
1124	* Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
1125	* the check for kernel addresses preceeding it.
1126	*/
1127	if (pThis->f64Bit)
1128	{
1129	uint32_t i = cbBuf / sizeof(uint64_t);
1130	while (i-- > 0)
1131	if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1132	&& uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1133	{
1134	uint8_t pb = (uint8_t )&uBuf.au64[i + 1];
1135	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1136	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1137	{
1138	if ( (i <= 0 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1139	&& (i <= 1 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1140	&& (i <= 2 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1141	return dbgDiggerLinuxFoundStartOfNames(pThis,
1142	DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1143	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
1144	}
1145	}
1146	}
1147	else
1148	{
1149	uint32_t i = cbBuf / sizeof(uint32_t);
1150	while (i-- > 0)
1151	if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1152	&& uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1153	{
1154	uint8_t pb = (uint8_t )&uBuf.au32[i + 1];
1155	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1156	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1157	{
1158	if ( (i <= 0 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1159	&& (i <= 1 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
1160	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
1161	return dbgDiggerLinuxFoundStartOfNames(pThis,
1162	DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1163	uBuf.au32[i], sizeof(uint32_t));
1164	}
1165	}
1166	}
1167
1168	/*
1169	* Advance
1170	*/
1171	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1172	{
1173	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1174	return VERR_NOT_FOUND;
1175	}
1176	cbLeft -= sizeof(uBuf);
1177	DBGFR3AddrSub(&CurAddr, sizeof(uBuf));
1178	cbBuf = sizeof(uBuf);
1179	}
1180	}
1181
1182
1183	/**
1184	* Worker for dbgDiggerLinuxFindEndNames that records the findings.
1185	*
1186	* @returns VINF_SUCCESS
1187	* @param pThis The linux digger data to update.
1188	* @param pAddrMarkers The address of the marker (kallsyms_markers).
1189	* @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
1190	*/
1191	static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
1192	{
1193	pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
1194	pThis->AddrKernelNameMarkers = *pAddrMarkers;
1195	pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
1196	pThis->AddrKernelTokenTable = *pAddrMarkers;
1197	DBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
1198
1199	Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
1200	"dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
1201	"dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
1202	pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
1203	pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
1204	pThis->AddrKernelTokenTable.FlatPtr));
1205	return VINF_SUCCESS;
1206	}
1207
1208
1209	/**
1210	* Tries to find the end of kallsyms_names and thereby the start of
1211	* kallsyms_markers and kallsyms_token_table.
1212	*
1213	* The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
1214	* the two other symbols in pThis->AddrKernelNameMarkers and
1215	* pThis->AddrKernelTokenTable. The number of marker entries is stored in
1216	* pThis->cKernelNameMarkers.
1217	*
1218	* @returns VBox status code, success indicating that all three variables have
1219	* been found and taken down.
1220	* @param pUVM The user mode VM handle.
1221	* @param pThis The Linux digger data.
1222	* @param pHitAddr An address we think is inside kallsyms_names.
1223	*/
1224	static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1225	{
1226	/*
1227	* Search forward in chunks.
1228	*/
1229	union
1230	{
1231	uint8_t ab[0x1000];
1232	uint32_t au32[0x1000 / sizeof(uint32_t)];
1233	uint64_t au64[0x1000 / sizeof(uint64_t)];
1234	} uBuf;
1235	bool fPendingZeroHit = false;
1236	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
1237	uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1238	DBGFADDRESS CurAddr = *pHitAddr;
1239	DBGFR3AddrSub(&CurAddr, offBuf);
1240	for (;;)
1241	{
1242	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1243	if (RT_FAILURE(rc))
1244	return rc;
1245
1246	/*
1247	* The kallsyms_names table is followed by kallsyms_markers we assume,
1248	* using sizeof(unsigned long) alignment like the preceeding symbols.
1249	*
1250	* The kallsyms_markers table has entried sizeof(unsigned long) and
1251	* contains offsets into kallsyms_names. The kallsyms_markers used to
1252	* index kallsyms_names and reduce seek time when looking up the name
1253	* of an address/symbol. Each entry in kallsyms_markers covers 256
1254	* symbol names.
1255	*
1256	* Because of this, the first entry is always zero and all the entries
1257	* are ascending. It also follows that the size of the table can be
1258	* calculated from kallsyms_num_syms.
1259	*
1260	* Note! We could also have walked kallsyms_names by skipping
1261	* kallsyms_num_syms names, but this is faster and we will
1262	* validate the encoded names later.
1263	*/
1264	if (pThis->f64Bit)
1265	{
1266	if ( RT_UNLIKELY(fPendingZeroHit)
1267	&& uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1268	&& uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1269	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
1270
1271	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
1272	for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
1273	if (uBuf.au64[i] == 0)
1274	{
1275	if (RT_UNLIKELY(i + 1 >= cEntries))
1276	{
1277	fPendingZeroHit = true;
1278	break;
1279	}
1280	if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1281	&& uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1282	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
1283	}
1284	}
1285	else
1286	{
1287	if ( RT_UNLIKELY(fPendingZeroHit)
1288	&& uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1289	&& uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1290	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
1291
1292	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
1293	for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
1294	if (uBuf.au32[i] == 0)
1295	{
1296	if (RT_UNLIKELY(i + 1 >= cEntries))
1297	{
1298	fPendingZeroHit = true;
1299	break;
1300	}
1301	if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1302	&& uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1303	return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
1304	}
1305	}
1306
1307	/*
1308	* Advance
1309	*/
1310	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1311	{
1312	Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1313	return VERR_NOT_FOUND;
1314	}
1315	cbLeft -= sizeof(uBuf);
1316	DBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
1317	offBuf = 0;
1318	}
1319	}
1320
1321
1322	/**
1323	* Locates the kallsyms_token_index table.
1324	*
1325	* Storing the address in pThis->AddrKernelTokenIndex and the size of the token
1326	* table in pThis->cbKernelTokenTable.
1327	*
1328	* @returns VBox status code.
1329	* @param pUVM The user mode VM handle.
1330	* @param pThis The Linux digger data.
1331	*/
1332	static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PDBGDIGGERLINUX pThis)
1333	{
1334	/*
1335	* The kallsyms_token_table is very much like a string table. Due to the
1336	* nature of the compression algorithm it is reasonably short (one example
1337	* here is 853 bytes), so we'll not be reading it in chunks but in full.
1338	* To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
1339	* memory or any other nasty stuff...
1340	*/
1341	union
1342	{
1343	uint8_t ab[0x2000];
1344	uint16_t au16[0x2000 / sizeof(uint16_t)];
1345	} uBuf;
1346	DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
1347	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1348	if (RT_FAILURE(rc))
1349	return rc;
1350
1351	/*
1352	* We've got two choices here, either walk the string table or look for
1353	* the next structure, kallsyms_token_index.
1354	*
1355	* The token index is a table of 256 uint16_t entries (index by bytes
1356	* from kallsyms_names) that gives offsets in kallsyms_token_table. It
1357	* starts with a zero entry and the following entries are sorted in
1358	* ascending order. The range of the entries are reasonably small since
1359	* kallsyms_token_table is small.
1360	*
1361	* The alignment seems to be sizeof(unsigned long), just like
1362	* kallsyms_token_table.
1363	*
1364	* So, we start by looking for a zero 16-bit entry.
1365	*/
1366	uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
1367
1368	for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
1369	if ( uBuf.au16[i] == 0
1370	&& uBuf.au16[i + 1] > 0
1371	&& uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
1372	&& (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1373	&& (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1374	&& (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1375	&& (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1376	&& (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1377	)
1378	{
1379	pThis->AddrKernelTokenIndex = CurAddr;
1380	DBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
1381	pThis->cbKernelTokenTable = i * sizeof(uint16_t);
1382	return VINF_SUCCESS;
1383	}
1384
1385	Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
1386	return VERR_NOT_FOUND;
1387	}
1388
1389
1390	/**
1391	* Loads the kernel symbols from the kallsyms tables.
1392	*
1393	* @returns VBox status code.
1394	* @param pUVM The user mode VM handle.
1395	* @param pThis The Linux digger data.
1396	*/
1397	static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PDBGDIGGERLINUX pThis)
1398	{
1399	/*
1400	* Allocate memory for temporary table copies, reading the tables as we go.
1401	*/
1402	uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
1403	void pvAddresses = RTMemAllocZ(pThis->cKernelSymbols cbGuestAddr);
1404	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses, pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
1405	if (RT_SUCCESS(rc))
1406	{
1407	uint8_t pbNames = (uint8_t )RTMemAllocZ(pThis->cbKernelNames);
1408	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1409	if (RT_SUCCESS(rc))
1410	{
1411	char pszzTokens = (char )RTMemAllocZ(pThis->cbKernelTokenTable);
1412	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1413	if (RT_SUCCESS(rc))
1414	{
1415	uint16_t paoffTokens = (uint16_t )RTMemAllocZ(256 * sizeof(uint16_t));
1416	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1417	if (RT_SUCCESS(rc))
1418	{
1419	/*
1420	* Figure out the kernel start and end.
1421	*/
1422	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
1423	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
1424	uint32_t i;
1425	if (cbGuestAddr == sizeof(uint64_t))
1426	{
1427	uint64_t pauAddrs = (uint64_t )pvAddresses;
1428	for (i = 0; i < pThis->cKernelSymbols; i++)
1429	if ( pauAddrs[i] < uKernelStart
1430	&& LNX64_VALID_ADDRESS(pauAddrs[i])
1431	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1432	uKernelStart = pauAddrs[i];
1433
1434	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1435	if ( pauAddrs[i] > uKernelEnd
1436	&& LNX64_VALID_ADDRESS(pauAddrs[i])
1437	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1438	uKernelEnd = pauAddrs[i];
1439	}
1440	else
1441	{
1442	uint32_t pauAddrs = (uint32_t )pvAddresses;
1443	for (i = 0; i < pThis->cKernelSymbols; i++)
1444	if ( pauAddrs[i] < uKernelStart
1445	&& LNX32_VALID_ADDRESS(pauAddrs[i])
1446	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1447	uKernelStart = pauAddrs[i];
1448
1449	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1450	if ( pauAddrs[i] > uKernelEnd
1451	&& LNX32_VALID_ADDRESS(pauAddrs[i])
1452	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1453	uKernelEnd = pauAddrs[i];
1454	}
1455
1456	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
1457	pThis->cbKernel = (uint32_t)cbKernel;
1458	DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
1459	Log(("dbgDiggerLinuxLoadKernelSymbols: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
1460
1461	/*
1462	* Create a module for the kernel.
1463	*/
1464	RTDBGMOD hMod;
1465	rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /fFlags/);
1466	if (RT_SUCCESS(rc))
1467	{
1468	rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1469	rc = VINF_SUCCESS;
1470
1471	/*
1472	* Enumerate the symbols.
1473	*/
1474	uint8_t const pbCurAddr = (uint8_t const )pvAddresses;
1475	uint32_t offName = 0;
1476	uint32_t cLeft = pThis->cKernelSymbols;
1477	while (cLeft-- > 0 && RT_SUCCESS(rc))
1478	{
1479	/* Decode the symbol name first. */
1480	if (RT_LIKELY(offName < pThis->cbKernelNames))
1481	{
1482	uint8_t cbName = pbNames[offName++];
1483	if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1484	{
1485	char szSymbol[4096];
1486	uint32_t offSymbol = 0;
1487	while (cbName-- > 0)
1488	{
1489	uint8_t bEnc = pbNames[offName++];
1490	uint16_t offToken = paoffTokens[bEnc];
1491	if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1492	{
1493	const char *pszToken = &pszzTokens[offToken];
1494	char ch;
1495	while ((ch = *pszToken++) != '\0')
1496	if (offSymbol < sizeof(szSymbol) - 1)
1497	szSymbol[offSymbol++] = ch;
1498	}
1499	else
1500	{
1501	rc = VERR_INVALID_UTF8_ENCODING;
1502	break;
1503	}
1504	}
1505	szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1506
1507	/* The address. */
1508	RTGCUINTPTR uSymAddr = cbGuestAddr == sizeof(uint64_t)
1509	? (uint64_t )pbCurAddr : (uint32_t )pbCurAddr;
1510	pbCurAddr += cbGuestAddr;
1511
1512	/* Add it without the type char. */
1513	if (uSymAddr - uKernelStart <= cbKernel)
1514	{
1515	rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymAddr - uKernelStart,
1516	0 /cb/, 0 /fFlags/, NULL);
1517	if (RT_FAILURE(rc))
1518	{
1519	if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1520	\|\| rc == VERR_DBG_INVALID_RVA
1521	\|\| rc == VERR_DBG_ADDRESS_CONFLICT
1522	\|\| rc == VERR_DBG_DUPLICATE_SYMBOL)
1523	{
1524	Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1525	rc = VINF_SUCCESS;
1526	}
1527	else
1528	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1529	}
1530	}
1531	}
1532	else
1533	{
1534	rc = VERR_END_OF_STRING;
1535	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1536	offName, cLeft, cbName, pThis->cbKernelNames));
1537	}
1538	}
1539	else
1540	{
1541	rc = VERR_END_OF_STRING;
1542	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1543	offName, cLeft, pThis->cbKernelNames));
1544	}
1545	}
1546
1547	/*
1548	* Link the module into the address space.
1549	*/
1550	if (RT_SUCCESS(rc))
1551	{
1552	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1553	if (hAs != NIL_RTDBGAS)
1554	rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1555	else
1556	rc = VERR_INTERNAL_ERROR;
1557	RTDbgAsRelease(hAs);
1558	}
1559	else
1560	Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1561	RTDbgModRelease(hMod);
1562	}
1563	else
1564	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1565	}
1566	else
1567	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1568	pThis->AddrKernelTokenIndex.FlatPtr, rc));
1569	RTMemFree(paoffTokens);
1570	}
1571	else
1572	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1573	pThis->AddrKernelTokenTable.FlatPtr, rc));
1574	RTMemFree(pszzTokens);
1575	}
1576	else
1577	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1578	pThis->AddrKernelNames.FlatPtr, rc));
1579	RTMemFree(pbNames);
1580	}
1581	else
1582	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading symbol addresses at %RGv failed: %Rrc\n",
1583	pThis->AddrKernelAddresses.FlatPtr, rc));
1584	RTMemFree(pvAddresses);
1585	return rc;
1586	}
1587
1588
1589	/**
1590	* Checks if there is a likely kallsyms_names fragment at pHitAddr.
1591	*
1592	* @returns true if it's a likely fragment, false if not.
1593	* @param pUVM The user mode VM handle.
1594	* @param pHitAddr The address where paNeedle was found.
1595	* @param pabNeedle The fragment we've been searching for.
1596	* @param cbNeedle The length of the fragment.
1597	*/
1598	static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCDBGFADDRESS pHitAddr, uint8_t const *pabNeedle, uint8_t cbNeedle)
1599	{
1600	/*
1601	* Examples of lead and tail bytes of our choosen needle in a randomly
1602	* picked kernel:
1603	* k o b j
1604	* 22 6b 6f 62 6a aa
1605	* fc 6b 6f 62 6a aa
1606	* 82 6b 6f 62 6a 5f - ascii trail byte (_).
1607	* ee 6b 6f 62 6a aa
1608	* fc 6b 6f 62 6a 5f - ascii trail byte (_).
1609	* 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
1610	* 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
1611	* ... omitting 29 samples similar to the last two ...
1612	* d8 6b 6f 62 6a aa
1613	* d8 6b 6f 62 6a aa
1614	* d8 6b 6f 62 6a aa
1615	* d8 6b 6f 62 6a aa
1616	* f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
1617	* f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
1618	* fd 6b 6f 62 6a 0f
1619	* ... enough.
1620	*/
1621	uint8_t abBuf[32];
1622	DBGFADDRESS ReadAddr = *pHitAddr;
1623	DBGFR3AddrSub(&ReadAddr, 2);
1624	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
1625	if (RT_SUCCESS(rc))
1626	{
1627	if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
1628	{
1629	uint8_t const bLead = abBuf[1] == '_' \|\| abBuf[1] == 'T' \|\| abBuf[1] == 't' ? abBuf[0] : abBuf[1];
1630	uint8_t const offTail = 2 + cbNeedle;
1631	uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
1632	if ( bLead >= 1 && (bLead < 0x20 \|\| bLead >= 0x80)
1633	&& bTail >= 1 && (bTail < 0x20 \|\| bTail >= 0x80))
1634	return true;
1635	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
1636	pHitAddr->FlatPtr, bLead, bTail, offTail));
1637	}
1638	else
1639	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
1640	}
1641	else
1642	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
1643
1644	return false;
1645	}
1646
1647	/**
1648	* Tries to find and load the kernel symbol table with the given needle.
1649	*
1650	* @returns VBox status code.
1651	* @param pThis The Linux digger data.
1652	* @param pUVM The user mode VM handle.
1653	* @param pabNeedle The needle to use for searching.
1654	* @param cbNeedle Size of the needle in bytes.
1655	*/
1656	static int dbgDiggerLinuxFindSymbolTableFromNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, uint8_t const *pabNeedle, size_t cbNeedle)
1657	{
1658	int rc = VINF_SUCCESS;
1659
1660	/*
1661	* Go looking for the kallsyms table. If it's there, it will be somewhere
1662	* after the linux_banner symbol, so use it for starting the search.
1663	*/
1664	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
1665	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
1666	while (cbLeft > 4096)
1667	{
1668	DBGFADDRESS HitAddr;
1669	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
1670	pabNeedle, cbNeedle, &HitAddr);
1671	if (RT_FAILURE(rc))
1672	break;
1673	if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, pabNeedle, cbNeedle))
1674	{
1675	/* There will be another hit near by. */
1676	DBGFR3AddrAdd(&HitAddr, 1);
1677	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /uAlign/,
1678	pabNeedle, cbNeedle, &HitAddr);
1679	if ( RT_SUCCESS(rc)
1680	&& dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, pabNeedle, cbNeedle))
1681	{
1682	/*
1683	* We've got a very likely candidate for a location inside kallsyms_names.
1684	* Try find the start of it, that is to say, try find kallsyms_num_syms.
1685	* kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
1686	*/
1687	rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pThis, &HitAddr);
1688	if (RT_SUCCESS(rc))
1689	rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pThis, &HitAddr);
1690	if (RT_SUCCESS(rc))
1691	rc = dbgDiggerLinuxFindTokenIndex(pUVM, pThis);
1692	if (RT_SUCCESS(rc))
1693	rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pThis);
1694	if (RT_SUCCESS(rc))
1695	break;
1696	}
1697	}
1698
1699	/*
1700	* Advance.
1701	*/
1702	RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + cbNeedle;
1703	if (RT_UNLIKELY(cbDistance >= cbLeft))
1704	{
1705	Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
1706	break;
1707	}
1708	cbLeft -= cbDistance;
1709	DBGFR3AddrAdd(&CurAddr, cbDistance);
1710
1711	}
1712
1713	return rc;
1714	}
1715	/**
1716	* @copydoc DBGFOSREG::pfnInit
1717	*/
1718	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData)
1719	{
1720	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1721	Assert(!pThis->fValid);
1722
1723	/*
1724	* Assume 64-bit kernels all live way beyond 32-bit address space.
1725	*/
1726	pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
1727
1728	static const uint8_t s_abNeedle[] = "kobj";
1729	int rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, s_abNeedle, sizeof(s_abNeedle) - 1);
1730	if (RT_FAILURE(rc))
1731	{
1732	/* Try alternate needle (seen on older x86 Linux kernels). */
1733	static const uint8_t s_abNeedleAlt[] = "kobjec";
1734	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, s_abNeedleAlt, sizeof(s_abNeedleAlt) - 1);
1735	if (RT_FAILURE(rc))
1736	{
1737	static const uint8_t s_abNeedleOSuseX86[] = "nmi"; /* OpenSuSe 10.2 x86 */
1738	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, s_abNeedleOSuseX86, sizeof(s_abNeedleOSuseX86) - 1);
1739	}
1740	}
1741
1742	pThis->fValid = true;
1743	return VINF_SUCCESS;
1744	}
1745
1746
1747	/**
1748	* @copydoc DBGFOSREG::pfnProbe
1749	*/
1750	static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, void *pvData)
1751	{
1752	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1753
1754	/*
1755	* Look for "Linux version " at the start of the rodata segment.
1756	* Hope that this comes before any message buffer or other similar string.
1757	*/
1758	for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
1759	{
1760	DBGFADDRESS KernelAddr;
1761	DBGFR3AddrFromFlat(pUVM, &KernelAddr, g_au64LnxKernelAddresses[i]);
1762	DBGFADDRESS HitAddr;
1763	int rc = DBGFR3MemScan(pUVM, 0, &KernelAddr, LNX_MAX_KERNEL_SIZE, 1,
1764	g_abLinuxVersion, sizeof(g_abLinuxVersion) - 1, &HitAddr);
1765	if (RT_SUCCESS(rc))
1766	{
1767	char szTmp[128];
1768	char const *pszX = &szTmp[sizeof(g_abLinuxVersion) - 1];
1769	rc = DBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
1770	if ( RT_SUCCESS(rc)
1771	&& ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
1772	&& pszX[1] == '.'
1773	&& pszX[2] >= '0'
1774	&& pszX[2] <= '6')
1775	\|\| ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
1776	&& pszX[0] <= '9'
1777	&& pszX[1] == '.'
1778	&& pszX[2] >= '0'
1779	&& pszX[2] <= '9')
1780	)
1781	)
1782	{
1783	pThis->AddrKernelBase = KernelAddr;
1784	pThis->AddrLinuxBanner = HitAddr;
1785	return true;
1786	}
1787	}
1788	}
1789	return false;
1790	}
1791
1792
1793	/**
1794	* @copydoc DBGFOSREG::pfnDestruct
1795	*/
1796	static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, void *pvData)
1797	{
1798
1799	}
1800
1801
1802	/**
1803	* @copydoc DBGFOSREG::pfnConstruct
1804	*/
1805	static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, void *pvData)
1806	{
1807	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1808	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
1809	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
1810	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
1811
1812	return VINF_SUCCESS;
1813	}
1814
1815
1816	const DBGFOSREG g_DBGDiggerLinux =
1817	{
1818	/* .u32Magic = */ DBGFOSREG_MAGIC,
1819	/* .fFlags = */ 0,
1820	/* .cbData = */ sizeof(DBGDIGGERLINUX),
1821	/* .szName = */ "Linux",
1822	/* .pfnConstruct = */ dbgDiggerLinuxConstruct,
1823	/* .pfnDestruct = */ dbgDiggerLinuxDestruct,
1824	/* .pfnProbe = */ dbgDiggerLinuxProbe,
1825	/* .pfnInit = */ dbgDiggerLinuxInit,
1826	/* .pfnRefresh = */ dbgDiggerLinuxRefresh,
1827	/* .pfnTerm = */ dbgDiggerLinuxTerm,
1828	/* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
1829	/* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
1830	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1831	};
1832

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 61622

Download in other formats: