VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 103914

Last change on this file since 103914 was 101539, checked in by vboxsync, 12 months ago

DIS,VMM,DBGC,IPRT,++: Some disassembler tweaks and TB disassembly work. bugref:10371 bugref:9898

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 123.8 KB
Line 
1/* $Id: DBGPlugInLinux.cpp 101539 2023-10-22 02:43:09Z vboxsync $ */
2/** @file
3 * DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4 */
5
6/*
7 * Copyright (C) 2008-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33#include "DBGPlugIns.h"
34#include "DBGPlugInCommonELF.h"
35#include <VBox/vmm/vmmr3vtable.h>
36#include <VBox/dis.h>
37#include <iprt/ctype.h>
38#include <iprt/file.h>
39#include <iprt/err.h>
40#include <iprt/mem.h>
41#include <iprt/stream.h>
42#include <iprt/string.h>
43#include <iprt/vfs.h>
44#include <iprt/zip.h>
45
46
47/*********************************************************************************************************************************
48* Structures and Typedefs *
49*********************************************************************************************************************************/
50
51/** @name InternalLinux structures
52 * @{ */
53
54
55/** @} */
56
57
58/**
59 * Config item type.
60 */
61typedef enum DBGDIGGERLINUXCFGITEMTYPE
62{
63 /** Invalid type. */
64 DBGDIGGERLINUXCFGITEMTYPE_INVALID = 0,
65 /** String. */
66 DBGDIGGERLINUXCFGITEMTYPE_STRING,
67 /** Number. */
68 DBGDIGGERLINUXCFGITEMTYPE_NUMBER,
69 /** Flag whether this feature is included in the
70 * kernel or as a module. */
71 DBGDIGGERLINUXCFGITEMTYPE_FLAG
72} DBGDIGGERLINUXCFGITEMTYPE;
73
74/**
75 * Item in the config database.
76 */
77typedef struct DBGDIGGERLINUXCFGITEM
78{
79 /** String space core. */
80 RTSTRSPACECORE Core;
81 /** Config item type. */
82 DBGDIGGERLINUXCFGITEMTYPE enmType;
83 /** Data based on the type. */
84 union
85 {
86 /** Number. */
87 int64_t i64Num;
88 /** Flag. */
89 bool fModule;
90 /** String - variable in size. */
91 char aszString[1];
92 } u;
93} DBGDIGGERLINUXCFGITEM;
94/** Pointer to a config database item. */
95typedef DBGDIGGERLINUXCFGITEM *PDBGDIGGERLINUXCFGITEM;
96/** Pointer to a const config database item. */
97typedef const DBGDIGGERLINUXCFGITEM *PCDBGDIGGERLINUXCFGITEM;
98
99/**
100 * Linux guest OS digger instance data.
101 */
102typedef struct DBGDIGGERLINUX
103{
104 /** Whether the information is valid or not.
105 * (For fending off illegal interface method calls.) */
106 bool fValid;
107 /** Set if 64-bit, clear if 32-bit. */
108 bool f64Bit;
109 /** Set if the kallsyms table uses relative addressing, clear
110 * if absolute addresses are used. */
111 bool fRelKrnlAddr;
112 /** The relative base when kernel symbols use offsets rather than
113 * absolute addresses. */
114 RTGCUINTPTR uKernelRelativeBase;
115 /** The guest kernel version used for version comparisons. */
116 uint32_t uKrnlVer;
117 /** The guest kernel major version. */
118 uint32_t uKrnlVerMaj;
119 /** The guest kernel minor version. */
120 uint32_t uKrnlVerMin;
121 /** The guest kernel build version. */
122 uint32_t uKrnlVerBld;
123
124 /** The address of the linux banner.
125 * This is set during probing. */
126 DBGFADDRESS AddrLinuxBanner;
127 /** Kernel base address.
128 * This is set during probing, refined during kallsyms parsing. */
129 DBGFADDRESS AddrKernelBase;
130 /** The kernel size. */
131 uint32_t cbKernel;
132
133 /** The number of kernel symbols (kallsyms_num_syms).
134 * This is set during init. */
135 uint32_t cKernelSymbols;
136 /** The size of the kernel name table (sizeof(kallsyms_names)). */
137 uint32_t cbKernelNames;
138 /** Number of entries in the kernel_markers table. */
139 uint32_t cKernelNameMarkers;
140 /** The size of the kernel symbol token table. */
141 uint32_t cbKernelTokenTable;
142 /** The address of the encoded kernel symbol names (kallsyms_names). */
143 DBGFADDRESS AddrKernelNames;
144 /** The address of the kernel symbol addresses (kallsyms_addresses). */
145 DBGFADDRESS AddrKernelAddresses;
146 /** The address of the kernel symbol name markers (kallsyms_markers). */
147 DBGFADDRESS AddrKernelNameMarkers;
148 /** The address of the kernel symbol token table (kallsyms_token_table). */
149 DBGFADDRESS AddrKernelTokenTable;
150 /** The address of the kernel symbol token index table (kallsyms_token_index). */
151 DBGFADDRESS AddrKernelTokenIndex;
152
153 /** The kernel message log interface. */
154 DBGFOSIDMESG IDmesg;
155
156 /** The config database root. */
157 RTSTRSPACE hCfgDb;
158} DBGDIGGERLINUX;
159/** Pointer to the linux guest OS digger instance data. */
160typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
161
162
163/**
164 * The current printk_log structure.
165 */
166typedef struct LNXPRINTKHDR
167{
168 /** Monotonic timestamp. */
169 uint64_t nsTimestamp;
170 /** The total size of this message record. */
171 uint16_t cbTotal;
172 /** The size of the text part (immediately follows the header). */
173 uint16_t cbText;
174 /** The size of the optional dictionary part (follows the text). */
175 uint16_t cbDict;
176 /** The syslog facility number. */
177 uint8_t bFacility;
178 /** First 5 bits are internal flags, next 3 bits are log level. */
179 uint8_t fFlagsAndLevel;
180} LNXPRINTKHDR;
181AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
182/** Pointer to linux printk_log header. */
183typedef LNXPRINTKHDR *PLNXPRINTKHDR;
184/** Pointer to linux const printk_log header. */
185typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
186
187
188/*********************************************************************************************************************************
189* Defined Constants And Macros *
190*********************************************************************************************************************************/
191/** First kernel map address for 32bit Linux hosts (__START_KERNEL_map). */
192#define LNX32_KERNEL_ADDRESS_START UINT32_C(0xc0000000)
193/** First kernel map address for 64bit Linux hosts (__START_KERNEL_map). */
194#define LNX64_KERNEL_ADDRESS_START UINT64_C(0xffffffff80000000)
195/** Validates a 32-bit linux kernel address */
196#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
197/** Validates a 64-bit linux kernel address */
198#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
199
200/** The max kernel size. */
201#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
202/** Maximum kernel log buffer size. */
203#define LNX_MAX_KERNEL_LOG_SIZE (16 * _1M)
204
205/** The maximum size we expect for kallsyms_names. */
206#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
207/** The maximum size we expect for kallsyms_token_table. */
208#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
209/** The minimum number of symbols we expect in kallsyms_num_syms. */
210#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
211/** The maximum number of symbols we expect in kallsyms_num_syms. */
212#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
213/** The min length an encoded symbol in kallsyms_names is expected to have. */
214#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
215/** The max length an encoded symbol in kallsyms_names is expected to have.
216 * @todo check real life here. */
217#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
218/** The approximate maximum length of a string token. */
219#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
220/** Maximum compressed config size expected. */
221#define LNX_MAX_COMPRESSED_CFG_SIZE _1M
222
223/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
224#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
225/** Macro for building a Linux kernel version which can be used for comparisons. */
226#define LNX_MK_VER(major, minor, build) (((major) << 22) | ((minor) << 12) | (build))
227
228
229/*********************************************************************************************************************************
230* Internal Functions *
231*********************************************************************************************************************************/
232static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
233
234
235/*********************************************************************************************************************************
236* Global Variables *
237*********************************************************************************************************************************/
238/** Table of common linux kernel addresses. */
239static uint64_t g_au64LnxKernelAddresses[] =
240{
241 UINT64_C(0xc0100000),
242 UINT64_C(0x90100000),
243 UINT64_C(0xffffffff80200000)
244};
245
246static const uint8_t g_abLinuxVersion[] = "Linux version ";
247/** The needle for searching for the kernel log area (the value is observed in pretty much all 32bit and 64bit x86 kernels).
248 * This needle should appear only once in the memory due to the address being filled in by a format string. */
249static const uint8_t g_abKrnlLogNeedle[] = "BIOS-e820: [mem 0x0000000000000000";
250
251
252/**
253 * Tries to resolve the kernel log buffer start and end by searching for needle.
254 *
255 * @returns VBox status code.
256 * @param pThis The Linux digger data.
257 * @param pUVM The VM handle.
258 * @param pVMM The VMM function table.
259 * @param pGCPtrLogBuf Where to store the start of the kernel log buffer on success.
260 * @param pcbLogBuf Where to store the size of the kernel log buffer on success.
261 */
262static int dbgDiggerLinuxKrnlLogBufFindByNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
263 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
264{
265 int rc = VINF_SUCCESS;
266
267 /* Try to find the needle, it should be very early in the kernel log buffer. */
268 DBGFADDRESS AddrScan;
269 DBGFADDRESS AddrHit;
270 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrScan, pThis->f64Bit ? LNX64_KERNEL_ADDRESS_START : LNX32_KERNEL_ADDRESS_START);
271
272 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &AddrScan, ~(RTGCUINTPTR)0, 1 /*uAlign*/,
273 g_abKrnlLogNeedle, sizeof(g_abKrnlLogNeedle) - 1, &AddrHit);
274 if (RT_SUCCESS(rc))
275 {
276 uint32_t cbLogBuf = 0;
277 uint64_t tsLastNs = 0;
278 DBGFADDRESS AddrCur;
279
280 pVMM->pfnDBGFR3AddrSub(&AddrHit, sizeof(LNXPRINTKHDR));
281 AddrCur = AddrHit;
282
283 /* Try to find the end of the kernel log buffer. */
284 for (;;)
285 {
286 if (cbLogBuf >= LNX_MAX_KERNEL_LOG_SIZE)
287 break;
288
289 LNXPRINTKHDR Hdr;
290 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrCur, &Hdr, sizeof(Hdr));
291 if (RT_SUCCESS(rc))
292 {
293 uint32_t const cbLogAlign = 4;
294
295 /*
296 * If the header does not look valid anymore we stop.
297 * Timestamps are monotonically increasing.
298 */
299 if ( !Hdr.cbTotal /* Zero entry size means there is no record anymore, doesn't make sense to look futher. */
300 || Hdr.cbText + Hdr.cbDict + sizeof(Hdr) > Hdr.cbTotal
301 || (Hdr.cbTotal & (cbLogAlign - 1)) != 0
302 || tsLastNs > Hdr.nsTimestamp)
303 break;
304
305 /** @todo Maybe read text part and verify it is all ASCII. */
306
307 cbLogBuf += Hdr.cbTotal;
308 pVMM->pfnDBGFR3AddrAdd(&AddrCur, Hdr.cbTotal);
309 }
310
311 if (RT_FAILURE(rc))
312 break;
313 }
314
315 /** @todo Go back to find the start address of the kernel log (or we loose potential kernel log messages). */
316
317 if ( RT_SUCCESS(rc)
318 && cbLogBuf)
319 {
320 /* Align log buffer size to a power of two. */
321 uint32_t idxBitLast = ASMBitLastSetU32(cbLogBuf);
322 idxBitLast--; /* There is at least one bit set, see check above. */
323
324 if (cbLogBuf & (RT_BIT_32(idxBitLast) - 1))
325 idxBitLast++;
326
327 *pGCPtrLogBuf = AddrHit.FlatPtr;
328 *pcbLogBuf = RT_MIN(RT_BIT_32(idxBitLast), LNX_MAX_KERNEL_LOG_SIZE);
329 }
330 else if (RT_SUCCESS(rc))
331 rc = VERR_NOT_FOUND;
332 }
333
334 return rc;
335}
336
337
338/**
339 * Converts a given offset into an absolute address if relative kernel offsets are used for
340 * kallsyms.
341 *
342 * @returns The absolute kernel address.
343 * @param pThis The Linux digger data.
344 * @param uOffset The offset to convert.
345 */
346DECLINLINE(RTGCUINTPTR) dbgDiggerLinuxConvOffsetToAddr(PDBGDIGGERLINUX pThis, int32_t uOffset)
347{
348 RTGCUINTPTR uAddr;
349
350 /*
351 * How the absolute address is calculated from the offset depends on the
352 * CONFIG_KALLSYMS_ABSOLUTE_PERCPU config which is only set for 64bit
353 * SMP kernels (we assume that all 64bit kernels always have SMP enabled too).
354 */
355 if (pThis->f64Bit)
356 {
357 if (uOffset >= 0)
358 uAddr = uOffset;
359 else
360 uAddr = pThis->uKernelRelativeBase - 1 - uOffset;
361 }
362 else
363 uAddr = pThis->uKernelRelativeBase + (uint32_t)uOffset;
364
365 return uAddr;
366}
367
368/**
369 * Disassembles a simple getter returning the value for it.
370 *
371 * @returns VBox status code.
372 * @param pThis The Linux digger data.
373 * @param pUVM The VM handle.
374 * @param pVMM The VMM function table.
375 * @param hMod The module to use.
376 * @param pszSymbol The symbol of the getter.
377 * @param pvVal Where to store the value on success.
378 * @param cbVal Size of the value in bytes.
379 */
380static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
381 const char *pszSymbol, void *pvVal, uint32_t cbVal)
382{
383 int rc = VINF_SUCCESS;
384
385 RTDBGSYMBOL SymInfo;
386 rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
387 if (RT_SUCCESS(rc))
388 {
389 /*
390 * Do the diassembling. Disassemble until a ret instruction is encountered
391 * or a limit is reached (don't want to disassemble for too long as the getter
392 * should be short).
393 * push and pop instructions are skipped as well as any mov instructions not
394 * touching the rax or eax register (depending on the size of the value).
395 */
396 unsigned cInstrDisassembled = 0;
397 uint32_t offInstr = 0;
398 bool fRet = false;
399 DISSTATE DisState;
400 RT_ZERO(DisState);
401
402 do
403 {
404 DBGFADDRESS Addr;
405 RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
406 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
407
408 /* Prefetch the instruction. */
409 uint8_t abInstr[32];
410 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &abInstr[0], sizeof(abInstr));
411 if (RT_SUCCESS(rc))
412 {
413 uint32_t cbInstr = 0;
414
415 rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
416 if (RT_SUCCESS(rc))
417 {
418 switch (DisState.pCurInstr->uOpcode)
419 {
420 case OP_PUSH:
421 case OP_POP:
422 case OP_NOP:
423 case OP_LEA:
424 break;
425 case OP_RETN:
426 /* Getter returned, abort disassembling. */
427 fRet = true;
428 break;
429 case OP_MOV:
430 /*
431 * Check that the destination is either rax or eax depending on the
432 * value size.
433 *
434 * Param1 is the destination and Param2 the source.
435 */
436 if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN32))
437 && cbVal == sizeof(uint32_t))
438 || ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN64))
439 && cbVal == sizeof(uint64_t)))
440 && DisState.Param1.x86.Base.idxGenReg == DISGREG_RAX)
441 {
442 /* Parse the source. */
443 if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 | DISUSE_IMMEDIATE64))
444 memcpy(pvVal, &DisState.Param2.uValue, cbVal);
445 else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32|DISUSE_DISPLACEMENT32|DISUSE_DISPLACEMENT64))
446 {
447 RTGCPTR GCPtrVal = 0;
448
449 if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
450 GCPtrVal = GCPtrCur + DisState.Param2.x86.uDisp.i32 + cbInstr;
451 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
452 GCPtrVal = (RTGCPTR)DisState.Param2.x86.uDisp.u32;
453 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
454 GCPtrVal = (RTGCPTR)DisState.Param2.x86.uDisp.u64;
455 else
456 AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
457
458 DBGFADDRESS AddrVal;
459 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
460 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
461 pvVal, cbVal);
462 }
463 }
464 break;
465 default:
466 /* All other instructions will cause an error for now (playing safe here). */
467 rc = VERR_INVALID_PARAMETER;
468 break;
469 }
470 cInstrDisassembled++;
471 offInstr += cbInstr;
472 }
473 }
474 } while ( RT_SUCCESS(rc)
475 && cInstrDisassembled < 20
476 && !fRet);
477 }
478
479 return rc;
480}
481
482/**
483 * Try to get at the log buffer starting address and size by disassembling emit_log_char.
484 *
485 * @returns VBox status code.
486 * @param pThis The Linux digger data.
487 * @param pUVM The VM handle.
488 * @param pVMM The VMM function table.
489 * @param hMod The module to use.
490 * @param pGCPtrLogBuf Where to store the log buffer pointer on success.
491 * @param pcbLogBuf Where to store the size of the log buffer on success.
492 */
493static int dbgDiggerLinuxQueryAsciiLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
494 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
495{
496 int rc = VINF_SUCCESS;
497
498 /**
499 * We disassemble emit_log_char to get at the log buffer address and size.
500 * This is used in case the symbols are not exported in kallsyms.
501 *
502 * This is what it typically looks like:
503 * vmlinux!emit_log_char:
504 * %00000000c01204a1 56 push esi
505 * %00000000c01204a2 8b 35 d0 1c 34 c0 mov esi, dword [0c0341cd0h]
506 * %00000000c01204a8 53 push ebx
507 * %00000000c01204a9 8b 1d 74 3b 3e c0 mov ebx, dword [0c03e3b74h]
508 * %00000000c01204af 8b 0d d8 1c 34 c0 mov ecx, dword [0c0341cd8h]
509 * %00000000c01204b5 8d 56 ff lea edx, [esi-001h]
510 * %00000000c01204b8 21 da and edx, ebx
511 * %00000000c01204ba 88 04 11 mov byte [ecx+edx], al
512 * %00000000c01204bd 8d 53 01 lea edx, [ebx+001h]
513 * %00000000c01204c0 89 d0 mov eax, edx
514 * [...]
515 */
516 RTDBGSYMBOL SymInfo;
517 rc = RTDbgModSymbolByName(hMod, "emit_log_char", &SymInfo);
518 if (RT_SUCCESS(rc))
519 {
520 /*
521 * Do the diassembling. Disassemble until a ret instruction is encountered
522 * or a limit is reached (don't want to disassemble for too long as the getter
523 * should be short). Certain instructions found are ignored (push, nop, etc.).
524 */
525 unsigned cInstrDisassembled = 0;
526 uint32_t offInstr = 0;
527 bool fRet = false;
528 DISSTATE DisState;
529 unsigned cAddressesUsed = 0;
530 struct { size_t cb; RTGCPTR GCPtrOrigSrc; } aAddresses[5];
531 RT_ZERO(DisState);
532 RT_ZERO(aAddresses);
533
534 do
535 {
536 DBGFADDRESS Addr;
537 RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
538 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
539
540 /* Prefetch the instruction. */
541 uint8_t abInstr[32];
542 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &abInstr[0], sizeof(abInstr));
543 if (RT_SUCCESS(rc))
544 {
545 uint32_t cbInstr = 0;
546
547 rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
548 if (RT_SUCCESS(rc))
549 {
550 switch (DisState.pCurInstr->uOpcode)
551 {
552 case OP_PUSH:
553 case OP_POP:
554 case OP_NOP:
555 case OP_LEA:
556 case OP_AND:
557 case OP_CBW:
558 case OP_DEC:
559 break;
560 case OP_RETN:
561 /* emit_log_char returned, abort disassembling. */
562 rc = VERR_NOT_FOUND;
563 fRet = true;
564 break;
565 case OP_MOV:
566 case OP_MOVSXD:
567 /*
568 * If a mov is encountered writing to memory with al (or dil for amd64) being the source the
569 * character is stored and we can infer the base address and size of the log buffer from
570 * the source addresses.
571 */
572 if ( (DisState.Param2.fUse & DISUSE_REG_GEN8)
573 && ( (DisState.Param2.x86.Base.idxGenReg == DISGREG_AL && !pThis->f64Bit)
574 || (DisState.Param2.x86.Base.idxGenReg == DISGREG_DIL && pThis->f64Bit))
575 && DISUSE_IS_EFFECTIVE_ADDR(DisState.Param1.fUse))
576 {
577 RTGCPTR GCPtrLogBuf = 0;
578 uint32_t cbLogBuf = 0;
579
580 /*
581 * We can stop disassembling now and inspect all registers, look for a valid kernel address first.
582 * Only one of the accessed registers should hold a valid kernel address.
583 * For the log size look for the biggest non kernel address.
584 */
585 for (unsigned i = 0; i < cAddressesUsed; i++)
586 {
587 DBGFADDRESS AddrVal;
588 union { uint8_t abVal[8]; uint32_t u32Val; uint64_t u64Val; } Val;
589
590 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
591 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal,
592 aAddresses[i].GCPtrOrigSrc),
593 &Val.abVal[0], aAddresses[i].cb);
594 if (RT_SUCCESS(rc))
595 {
596 if (pThis->f64Bit && aAddresses[i].cb == sizeof(uint64_t))
597 {
598 if (LNX64_VALID_ADDRESS(Val.u64Val))
599 {
600 if (GCPtrLogBuf == 0)
601 GCPtrLogBuf = Val.u64Val;
602 else
603 {
604 rc = VERR_NOT_FOUND;
605 break;
606 }
607 }
608 }
609 else
610 {
611 AssertMsgBreakStmt(aAddresses[i].cb == sizeof(uint32_t),
612 ("Invalid value size\n"), rc = VERR_INVALID_STATE);
613
614 /* Might be a kernel address or a size indicator. */
615 if (!pThis->f64Bit && LNX32_VALID_ADDRESS(Val.u32Val))
616 {
617 if (GCPtrLogBuf == 0)
618 GCPtrLogBuf = Val.u32Val;
619 else
620 {
621 rc = VERR_NOT_FOUND;
622 break;
623 }
624 }
625 else
626 {
627 /*
628 * The highest value will be the log buffer because the other
629 * accessed variables are indexes into the buffer and hence
630 * always smaller than the size.
631 */
632 if (cbLogBuf < Val.u32Val)
633 cbLogBuf = Val.u32Val;
634 }
635 }
636 }
637 }
638
639 if ( RT_SUCCESS(rc)
640 && GCPtrLogBuf != 0
641 && cbLogBuf != 0)
642 {
643 *pGCPtrLogBuf = GCPtrLogBuf;
644 *pcbLogBuf = cbLogBuf;
645 }
646 else if (RT_SUCCESS(rc))
647 rc = VERR_NOT_FOUND;
648
649 fRet = true;
650 break;
651 }
652 else
653 {
654 /*
655 * In case of a memory to register move store the destination register index and the
656 * source address in the relation table for later processing.
657 */
658 if ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN32 | DISUSE_REG_GEN64))
659 && (DisState.Param2.x86.cb == sizeof(uint32_t) || DisState.Param2.x86.cb == sizeof(uint64_t))
660 && (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32|DISUSE_DISPLACEMENT32|DISUSE_DISPLACEMENT64)))
661 {
662 RTGCPTR GCPtrVal = 0;
663
664 if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
665 GCPtrVal = GCPtrCur + DisState.Param2.x86.uDisp.i32 + cbInstr;
666 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
667 GCPtrVal = (RTGCPTR)DisState.Param2.x86.uDisp.u32;
668 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
669 GCPtrVal = (RTGCPTR)DisState.Param2.x86.uDisp.u64;
670 else
671 AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
672
673 if (cAddressesUsed < RT_ELEMENTS(aAddresses))
674 {
675 /* movsxd reads always 32bits. */
676 if (DisState.pCurInstr->uOpcode == OP_MOVSXD)
677 aAddresses[cAddressesUsed].cb = sizeof(uint32_t);
678 else
679 aAddresses[cAddressesUsed].cb = DisState.Param2.x86.cb;
680 aAddresses[cAddressesUsed].GCPtrOrigSrc = GCPtrVal;
681 cAddressesUsed++;
682 }
683 else
684 {
685 rc = VERR_INVALID_PARAMETER;
686 break;
687 }
688 }
689 }
690 break;
691 default:
692 /* All other instructions will cause an error for now (playing safe here). */
693 rc = VERR_INVALID_PARAMETER;
694 break;
695 }
696 cInstrDisassembled++;
697 offInstr += cbInstr;
698 }
699 }
700 } while ( RT_SUCCESS(rc)
701 && cInstrDisassembled < 20
702 && !fRet);
703 }
704
705 return rc;
706}
707
708/**
709 * Try to get at the log buffer starting address and size by disassembling some exposed helpers.
710 *
711 * @returns VBox status code.
712 * @param pThis The Linux digger data.
713 * @param pUVM The VM handle.
714 * @param pVMM The VMM function table.
715 * @param hMod The module to use.
716 * @param pGCPtrLogBuf Where to store the log buffer pointer on success.
717 * @param pcbLogBuf Where to store the size of the log buffer on success.
718 */
719static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
720 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
721{
722 int rc = VINF_SUCCESS;
723
724 struct { void *pvVar; uint32_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
725 {
726 { pGCPtrLogBuf, (uint32_t)sizeof(RTGCPTR), (uint32_t)(pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)), "log_buf_addr_get" },
727 { pcbLogBuf, (uint32_t)sizeof(uint32_t), (uint32_t)sizeof(uint32_t), "log_buf_len_get" }
728 };
729 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
730 {
731 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
732 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
733 rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, pVMM, hMod, aSymbols[i].pszSymbol,
734 aSymbols[i].pvVar, aSymbols[i].cbGuest);
735 }
736
737 return rc;
738}
739
740/**
741 * Returns whether the log buffer is a simple ascii buffer or a record based implementation
742 * based on the kernel version found.
743 *
744 * @returns Flag whether the log buffer is the simple ascii buffer.
745 * @param pThis The Linux digger data.
746 * @param pUVM The user mode VM handle.
747 * @param pVMM The VMM function table.
748 */
749static bool dbgDiggerLinuxLogBufferIsAsciiBuffer(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
750{
751 char szTmp[128];
752 char const *pszVer = &szTmp[sizeof(g_abLinuxVersion) - 1];
753
754 RT_ZERO(szTmp);
755 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, szTmp, sizeof(szTmp) - 1);
756 if ( RT_SUCCESS(rc)
757 && RTStrVersionCompare(pszVer, "3.4") == -1)
758 return true;
759
760 return false;
761}
762
763/**
764 * Worker to get at the kernel log for pre 3.4 kernels where the log buffer was just a char buffer.
765 *
766 * @returns VBox status code.
767 * @param pThis The Linux digger data.
768 * @param pUVM The VM user mdoe handle.
769 * @param pVMM The VMM function table.
770 * @param hMod The debug module handle.
771 * @param fFlags Flags reserved for future use, MBZ.
772 * @param cMessages The number of messages to retrieve, counting from the
773 * end of the log (i.e. like tail), use UINT32_MAX for all.
774 * @param pszBuf The output buffer.
775 * @param cbBuf The buffer size.
776 * @param pcbActual Where to store the number of bytes actually returned,
777 * including zero terminator. On VERR_BUFFER_OVERFLOW this
778 * holds the necessary buffer size. Optional.
779 */
780static int dbgDiggerLinuxLogBufferQueryAscii(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
781 uint32_t fFlags, uint32_t cMessages,
782 char *pszBuf, size_t cbBuf, size_t *pcbActual)
783{
784 RT_NOREF2(fFlags, cMessages);
785 int rc = VINF_SUCCESS;
786 RTGCPTR GCPtrLogBuf;
787 uint32_t cbLogBuf;
788
789 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
790 {
791 { &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
792 { &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
793 };
794 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
795 {
796 RTDBGSYMBOL SymInfo;
797 rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
798 if (RT_SUCCESS(rc))
799 {
800 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
801 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
802 DBGFADDRESS Addr;
803 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
804 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
805 (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
806 aSymbols[i].pvVar, aSymbols[i].cbGuest);
807 if (RT_SUCCESS(rc))
808 continue;
809 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
810 }
811 else
812 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
813 rc = VERR_NOT_FOUND;
814 break;
815 }
816
817 /*
818 * Some kernels don't expose the variables in kallsyms so we have to try disassemble
819 * some public helpers to get at the addresses.
820 *
821 * @todo: Maybe cache those values so we don't have to do the heavy work every time?
822 */
823 if (rc == VERR_NOT_FOUND)
824 {
825 rc = dbgDiggerLinuxQueryAsciiLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
826 if (RT_FAILURE(rc))
827 return rc;
828 }
829
830 /*
831 * Check if the values make sense.
832 */
833 if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
834 {
835 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
836 return VERR_NOT_FOUND;
837 }
838 if ( cbLogBuf < 4096
839 || !RT_IS_POWER_OF_TWO(cbLogBuf)
840 || cbLogBuf > 16*_1M)
841 {
842 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
843 return VERR_NOT_FOUND;
844 }
845
846 /*
847 * Read the whole log buffer.
848 */
849 uint8_t *pbLogBuf = (uint8_t *)RTMemAlloc(cbLogBuf);
850 if (!pbLogBuf)
851 {
852 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
853 return VERR_NO_MEMORY;
854 }
855 DBGFADDRESS Addr;
856 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
857 if (RT_FAILURE(rc))
858 {
859 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
860 cbLogBuf, Addr.FlatPtr, rc));
861 RTMemFree(pbLogBuf);
862 return VERR_NOT_FOUND;
863 }
864
865 /** @todo Try to parse where the single messages start to make use of cMessages. */
866 size_t cchLength = RTStrNLen((const char *)pbLogBuf, cbLogBuf);
867 memcpy(&pszBuf[0], pbLogBuf, RT_MIN(cbBuf, cchLength));
868
869 /* Done with the buffer. */
870 RTMemFree(pbLogBuf);
871
872 /* Set return size value. */
873 if (pcbActual)
874 *pcbActual = RT_MIN(cbBuf, cchLength);
875
876 return cbBuf <= cchLength ? VERR_BUFFER_OVERFLOW : VINF_SUCCESS;
877}
878
879
880/**
881 * Worker to process a given record based kernel log.
882 *
883 * @returns VBox status code.
884 * @param pThis The Linux digger data.
885 * @param pUVM The VM user mode handle.
886 * @param pVMM The VMM function table.
887 * @param GCPtrLogBuf Flat guest address of the start of the log buffer.
888 * @param cbLogBuf Power of two aligned size of the log buffer.
889 * @param idxFirst Index in the log bfufer of the first message.
890 * @param idxNext Index where to write hte next message in the log buffer.
891 * @param fFlags Flags reserved for future use, MBZ.
892 * @param cMessages The number of messages to retrieve, counting from the
893 * end of the log (i.e. like tail), use UINT32_MAX for all.
894 * @param pszBuf The output buffer.
895 * @param cbBuf The buffer size.
896 * @param pcbActual Where to store the number of bytes actually returned,
897 * including zero terminator. On VERR_BUFFER_OVERFLOW this
898 * holds the necessary buffer size. Optional.
899 */
900static int dbgDiggerLinuxKrnLogBufferProcess(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTGCPTR GCPtrLogBuf,
901 uint32_t cbLogBuf, uint32_t idxFirst, uint32_t idxNext,
902 uint32_t fFlags, uint32_t cMessages, char *pszBuf, size_t cbBuf,
903 size_t *pcbActual)
904{
905 RT_NOREF(fFlags);
906
907 /*
908 * Check if the values make sense.
909 */
910 if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
911 {
912 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
913 return VERR_NOT_FOUND;
914 }
915 if ( cbLogBuf < _4K
916 || !RT_IS_POWER_OF_TWO(cbLogBuf)
917 || cbLogBuf > LNX_MAX_KERNEL_LOG_SIZE)
918 {
919 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
920 return VERR_NOT_FOUND;
921 }
922 uint32_t const cbLogAlign = 4;
923 if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
924 || (idxFirst & (cbLogAlign - 1)) != 0)
925 {
926 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
927 return VERR_NOT_FOUND;
928 }
929 if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
930 || (idxNext & (cbLogAlign - 1)) != 0)
931 {
932 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
933 return VERR_NOT_FOUND;
934 }
935
936 /*
937 * Read the whole log buffer.
938 */
939 uint8_t *pbLogBuf = (uint8_t *)RTMemAlloc(cbLogBuf);
940 if (!pbLogBuf)
941 {
942 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
943 return VERR_NO_MEMORY;
944 }
945 DBGFADDRESS Addr;
946 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
947 if (RT_FAILURE(rc))
948 {
949 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
950 cbLogBuf, Addr.FlatPtr, rc));
951 RTMemFree(pbLogBuf);
952 return VERR_NOT_FOUND;
953 }
954
955 /*
956 * Count the messages in the buffer while doing some basic validation.
957 */
958 uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
959 : idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
960 uint32_t cbLeft = cbUsed;
961 uint32_t offCur = idxFirst;
962 uint32_t cLogMsgs = 0;
963
964 while (cbLeft > 0)
965 {
966 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
967 if (!pHdr->cbTotal)
968 {
969 /* Wrap around packet, most likely... */
970 if (cbLogBuf - offCur >= cbLeft)
971 break;
972 offCur = 0;
973 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
974 }
975 if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
976 || pHdr->cbTotal > cbLeft
977 || (pHdr->cbTotal & (cbLogAlign - 1)) != 0
978 || pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
979 {
980 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
981 offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
982 break;
983 }
984
985 if (pHdr->cbText > 0)
986 cLogMsgs++;
987
988 /* next */
989 offCur += pHdr->cbTotal;
990 cbLeft -= pHdr->cbTotal;
991 }
992 if (!cLogMsgs)
993 {
994 RTMemFree(pbLogBuf);
995 return VERR_NOT_FOUND;
996 }
997
998 /*
999 * Copy the messages into the output buffer.
1000 */
1001 offCur = idxFirst;
1002 cbLeft = cbUsed - cbLeft;
1003
1004 /* Skip messages that the caller doesn't want. */
1005 if (cMessages < cLogMsgs)
1006 {
1007 uint32_t cToSkip = cLogMsgs - cMessages;
1008 cLogMsgs -= cToSkip;
1009
1010 while (cToSkip > 0)
1011 {
1012 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1013 if (!pHdr->cbTotal)
1014 {
1015 offCur = 0;
1016 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1017 }
1018 if (pHdr->cbText > 0)
1019 cToSkip--;
1020
1021 /* next */
1022 offCur += pHdr->cbTotal;
1023 cbLeft -= pHdr->cbTotal;
1024 }
1025 }
1026
1027 /* Now copy the messages. */
1028 size_t offDst = 0;
1029 while (cbLeft > 0)
1030 {
1031 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1032 if ( !pHdr->cbTotal
1033 || !cLogMsgs)
1034 {
1035 if (cbLogBuf - offCur >= cbLeft)
1036 break;
1037 offCur = 0;
1038 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1039 }
1040
1041 if (pHdr->cbText > 0)
1042 {
1043 char *pchText = (char *)(pHdr + 1);
1044 size_t cchText = RTStrNLen(pchText, pHdr->cbText);
1045 if (offDst + cchText < cbBuf)
1046 {
1047 memcpy(&pszBuf[offDst], pHdr + 1, cchText);
1048 pszBuf[offDst + cchText] = '\n';
1049 }
1050 else if (offDst < cbBuf)
1051 memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
1052 offDst += cchText + 1;
1053 }
1054
1055 /* next */
1056 offCur += pHdr->cbTotal;
1057 cbLeft -= pHdr->cbTotal;
1058 }
1059
1060 /* Done with the buffer. */
1061 RTMemFree(pbLogBuf);
1062
1063 /* Make sure we've reserved a char for the terminator. */
1064 if (!offDst)
1065 offDst = 1;
1066
1067 /* Set return size value. */
1068 if (pcbActual)
1069 *pcbActual = offDst;
1070
1071 if (offDst <= cbBuf)
1072 return VINF_SUCCESS;
1073 return VERR_BUFFER_OVERFLOW;
1074}
1075
1076
1077/**
1078 * Worker to get at the kernel log for post 3.4 kernels where the log buffer contains records.
1079 *
1080 * @returns VBox status code.
1081 * @param pThis The Linux digger data.
1082 * @param pUVM The VM user mdoe handle.
1083 * @param pVMM The VMM function table.
1084 * @param hMod The debug module handle.
1085 * @param fFlags Flags reserved for future use, MBZ.
1086 * @param cMessages The number of messages to retrieve, counting from the
1087 * end of the log (i.e. like tail), use UINT32_MAX for all.
1088 * @param pszBuf The output buffer.
1089 * @param cbBuf The buffer size.
1090 * @param pcbActual Where to store the number of bytes actually returned,
1091 * including zero terminator. On VERR_BUFFER_OVERFLOW this
1092 * holds the necessary buffer size. Optional.
1093 */
1094static int dbgDiggerLinuxLogBufferQueryRecords(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
1095 uint32_t fFlags, uint32_t cMessages,
1096 char *pszBuf, size_t cbBuf, size_t *pcbActual)
1097{
1098 int rc = VINF_SUCCESS;
1099 RTGCPTR GCPtrLogBuf;
1100 uint32_t cbLogBuf;
1101 uint32_t idxFirst;
1102 uint32_t idxNext;
1103
1104 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
1105 {
1106 { &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
1107 { &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
1108 { &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
1109 { &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
1110 };
1111 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
1112 {
1113 RTDBGSYMBOL SymInfo;
1114 rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
1115 if (RT_SUCCESS(rc))
1116 {
1117 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
1118 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
1119 DBGFADDRESS Addr;
1120 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1121 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1122 (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
1123 aSymbols[i].pvVar, aSymbols[i].cbGuest);
1124 if (RT_SUCCESS(rc))
1125 continue;
1126 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
1127 }
1128 else
1129 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
1130 rc = VERR_NOT_FOUND;
1131 break;
1132 }
1133
1134 /*
1135 * Some kernels don't expose the variables in kallsyms so we have to try disassemble
1136 * some public helpers to get at the addresses.
1137 *
1138 * @todo: Maybe cache those values so we don't have to do the heavy work every time?
1139 */
1140 if (rc == VERR_NOT_FOUND)
1141 {
1142 idxFirst = 0;
1143 idxNext = 0;
1144 rc = dbgDiggerLinuxQueryLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
1145 if (RT_FAILURE(rc))
1146 {
1147 /*
1148 * Last resort, scan for a known value which should appear only once in the kernel log buffer
1149 * and try to deduce the boundaries from there.
1150 */
1151 return dbgDiggerLinuxKrnlLogBufFindByNeedle(pThis, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1152 }
1153 }
1154
1155 return dbgDiggerLinuxKrnLogBufferProcess(pThis, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, idxFirst, idxNext,
1156 fFlags, cMessages, pszBuf, cbBuf, pcbActual);
1157}
1158
1159/**
1160 * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
1161 */
1162static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, uint32_t fFlags,
1163 uint32_t cMessages, char *pszBuf, size_t cbBuf, size_t *pcbActual)
1164{
1165 PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
1166
1167 if (cMessages < 1)
1168 return VERR_INVALID_PARAMETER;
1169
1170 /*
1171 * Resolve the symbols we need and read their values.
1172 */
1173 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1174 RTDBGMOD hMod;
1175 int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
1176 RTDbgAsRelease(hAs);
1177
1178 size_t cbActual = 0;
1179 if (RT_SUCCESS(rc))
1180 {
1181 /*
1182 * Check whether the kernel log buffer is a simple char buffer or the newer
1183 * record based implementation.
1184 * The record based implementation was presumably introduced with kernel 3.4,
1185 * see: http://thread.gmane.org/gmane.linux.kernel/1284184
1186 */
1187 if (dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1188 rc = dbgDiggerLinuxLogBufferQueryAscii(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1189 else
1190 rc = dbgDiggerLinuxLogBufferQueryRecords(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1191
1192 /* Release the module in any case. */
1193 RTDbgModRelease(hMod);
1194 }
1195 else
1196 {
1197 /*
1198 * For the record based kernel versions we have a last resort heuristic which doesn't
1199 * require any symbols, try that here.
1200 */
1201 if (!dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1202 {
1203 RTGCPTR GCPtrLogBuf = 0;
1204 uint32_t cbLogBuf = 0;
1205
1206 rc = dbgDiggerLinuxKrnlLogBufFindByNeedle(pData, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1207 if (RT_SUCCESS(rc))
1208 rc = dbgDiggerLinuxKrnLogBufferProcess(pData, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, 0 /*idxFirst*/, 0 /*idxNext*/,
1209 fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1210 }
1211 else
1212 rc = VERR_NOT_FOUND;
1213 }
1214
1215 if (RT_FAILURE(rc) && rc != VERR_BUFFER_OVERFLOW)
1216 return rc;
1217
1218 if (pcbActual)
1219 *pcbActual = cbActual;
1220
1221 /*
1222 * All VBox strings are UTF-8 and bad things may in theory happen if we
1223 * pass bad UTF-8 to code which assumes it's all valid. So, we enforce
1224 * UTF-8 upon the guest kernel messages here even if they (probably) have
1225 * no defined code set in reality.
1226 */
1227 if ( RT_SUCCESS(rc)
1228 && cbActual <= cbBuf)
1229 {
1230 pszBuf[cbActual - 1] = '\0';
1231 RTStrPurgeEncoding(pszBuf);
1232 return VINF_SUCCESS;
1233 }
1234
1235 if (cbBuf)
1236 {
1237 pszBuf[cbBuf - 1] = '\0';
1238 RTStrPurgeEncoding(pszBuf);
1239 }
1240 return VERR_BUFFER_OVERFLOW;
1241}
1242
1243
1244/**
1245 * Worker destroying the config database.
1246 */
1247static DECLCALLBACK(int) dbgDiggerLinuxCfgDbDestroyWorker(PRTSTRSPACECORE pStr, void *pvUser)
1248{
1249 PDBGDIGGERLINUXCFGITEM pCfgItem = (PDBGDIGGERLINUXCFGITEM)pStr;
1250 RTStrFree((char *)pCfgItem->Core.pszString);
1251 RTMemFree(pCfgItem);
1252 NOREF(pvUser);
1253 return 0;
1254}
1255
1256
1257/**
1258 * Destroy the config database.
1259 *
1260 * @param pThis The Linux digger data.
1261 */
1262static void dbgDiggerLinuxCfgDbDestroy(PDBGDIGGERLINUX pThis)
1263{
1264 RTStrSpaceDestroy(&pThis->hCfgDb, dbgDiggerLinuxCfgDbDestroyWorker, NULL);
1265}
1266
1267
1268/**
1269 * @copydoc DBGFOSREG::pfnStackUnwindAssist
1270 */
1271static DECLCALLBACK(int) dbgDiggerLinuxStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
1272 PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
1273 RTDBGAS hAs, uint64_t *puScratch)
1274{
1275 RT_NOREF(pUVM, pVMM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
1276 return VINF_SUCCESS;
1277}
1278
1279
1280/**
1281 * @copydoc DBGFOSREG::pfnQueryInterface
1282 */
1283static DECLCALLBACK(void *) dbgDiggerLinuxQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, DBGFOSINTERFACE enmIf)
1284{
1285 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1286 RT_NOREF(pUVM, pVMM);
1287
1288 switch (enmIf)
1289 {
1290 case DBGFOSINTERFACE_DMESG:
1291 return &pThis->IDmesg;
1292
1293 default:
1294 return NULL;
1295 }
1296}
1297
1298
1299/**
1300 * @copydoc DBGFOSREG::pfnQueryVersion
1301 */
1302static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
1303 char *pszVersion, size_t cchVersion)
1304{
1305 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1306 Assert(pThis->fValid);
1307
1308 /*
1309 * It's all in the linux banner.
1310 */
1311 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
1312 if (RT_SUCCESS(rc))
1313 {
1314 char *pszEnd = RTStrEnd(pszVersion, cchVersion);
1315 AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
1316 while ( pszEnd > pszVersion
1317 && RT_C_IS_SPACE(pszEnd[-1]))
1318 pszEnd--;
1319 *pszEnd = '\0';
1320 }
1321 else
1322 RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
1323
1324 return rc;
1325}
1326
1327
1328/**
1329 * @copydoc DBGFOSREG::pfnTerm
1330 */
1331static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1332{
1333 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1334 Assert(pThis->fValid);
1335
1336 /*
1337 * Destroy configuration database.
1338 */
1339 dbgDiggerLinuxCfgDbDestroy(pThis);
1340
1341 /*
1342 * Unlink and release our modules.
1343 */
1344 RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1345 if (hDbgAs != NIL_RTDBGAS)
1346 {
1347 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
1348 while (iMod-- > 0)
1349 {
1350 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
1351 if (hMod != NIL_RTDBGMOD)
1352 {
1353 if (RTDbgModGetTag(hMod) == DIG_LNX_MOD_TAG)
1354 {
1355 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
1356 AssertRC(rc);
1357 }
1358 RTDbgModRelease(hMod);
1359 }
1360 }
1361 RTDbgAsRelease(hDbgAs);
1362 }
1363
1364 pThis->fValid = false;
1365}
1366
1367
1368/**
1369 * @copydoc DBGFOSREG::pfnRefresh
1370 */
1371static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1372{
1373 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1374 RT_NOREF(pThis);
1375 Assert(pThis->fValid);
1376
1377 /*
1378 * For now we'll flush and reload everything.
1379 */
1380 dbgDiggerLinuxTerm(pUVM, pVMM, pvData);
1381 return dbgDiggerLinuxInit(pUVM, pVMM, pvData);
1382}
1383
1384
1385/**
1386 * Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
1387 * digger data.
1388 *
1389 * @returns VINF_SUCCESS.
1390 * @param pThis The Linux digger data to update.
1391 * @param pVMM The VMM function table.
1392 * @param pAddrKernelNames The kallsyms_names address.
1393 * @param cKernelSymbols The number of kernel symbol.
1394 * @param cbAddress The guest address size.
1395 */
1396static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pAddrKernelNames,
1397 uint32_t cKernelSymbols, uint32_t cbAddress)
1398{
1399 pThis->cKernelSymbols = cKernelSymbols;
1400 pThis->AddrKernelNames = *pAddrKernelNames;
1401 pThis->AddrKernelAddresses = *pAddrKernelNames;
1402 uint32_t cbSymbolsSkip = (pThis->fRelKrnlAddr ? 2 : 1) * cbAddress; /* Relative addressing introduces kallsyms_relative_base. */
1403 uint32_t cbOffsets = pThis->fRelKrnlAddr ? sizeof(int32_t) : cbAddress; /* Offsets are always 32bits wide for relative addressing. */
1404 uint32_t cbAlign = 0;
1405
1406 /*
1407 * If the number of symbols is odd there is padding to align the following guest pointer
1408 * sized data properly on 64bit systems with relative addressing.
1409 */
1410 if ( pThis->fRelKrnlAddr
1411 && pThis->f64Bit
1412 && (pThis->cKernelSymbols & 1))
1413 cbAlign = sizeof(int32_t);
1414 pVMM->pfnDBGFR3AddrSub(&pThis->AddrKernelAddresses, cKernelSymbols * cbOffsets + cbSymbolsSkip + cbAlign);
1415
1416 Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
1417 "dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
1418 "dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
1419 pThis->AddrKernelAddresses.FlatPtr,
1420 pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
1421 pThis->AddrKernelNames.FlatPtr));
1422 return VINF_SUCCESS;
1423}
1424
1425
1426/**
1427 * Tries to find the address of the kallsyms_names, kallsyms_num_syms and
1428 * kallsyms_addresses symbols.
1429 *
1430 * The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
1431 * addresses of the other two are stored as pThis->AddrKernelNames and
1432 * pThis->AddrKernelAddresses.
1433 *
1434 * @returns VBox status code, success indicating that all three variables have
1435 * been found and taken down.
1436 * @param pUVM The user mode VM handle.
1437 * @param pVMM The VMM function table.
1438 * @param pThis The Linux digger data.
1439 * @param pHitAddr An address we think is inside kallsyms_names.
1440 */
1441static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis,
1442 PCDBGFADDRESS pHitAddr)
1443{
1444 /*
1445 * Search backwards in chunks.
1446 */
1447 union
1448 {
1449 uint8_t ab[0x1000];
1450 uint32_t au32[0x1000 / sizeof(uint32_t)];
1451 uint64_t au64[0x1000 / sizeof(uint64_t)];
1452 } uBuf;
1453 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
1454 uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1455 DBGFADDRESS CurAddr = *pHitAddr;
1456 pVMM->pfnDBGFR3AddrSub(&CurAddr, cbBuf);
1457 cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
1458 for (;;)
1459 {
1460 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1461 if (RT_FAILURE(rc))
1462 return rc;
1463
1464 /*
1465 * Since Linux 4.6 there are two different methods to store the kallsyms addresses
1466 * in the image.
1467 *
1468 * The first and longer existing method is to store the absolute addresses in an
1469 * array starting at kallsyms_addresses followed by a field which stores the number
1470 * of kernel symbols called kallsyms_num_syms.
1471 * The newer method is to use offsets stored in kallsyms_offsets and have a base pointer
1472 * to relate the offsets to called kallsyms_relative_base. One entry in kallsyms_offsets is
1473 * always 32bit wide regardless of the guest pointer size (this halves the table on 64bit
1474 * systems) but means more work for us for the 64bit case.
1475 *
1476 * When absolute addresses are used the following assumptions hold:
1477 *
1478 * We assume that the three symbols are aligned on guest pointer boundary.
1479 *
1480 * The boundary between the two tables should be noticable as the number
1481 * is unlikely to be more than 16 millions, there will be at least one zero
1482 * byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
1483 * that common in the kallsyms_names table.
1484 *
1485 * Also the kallsyms_names table starts with a length byte, which means
1486 * we're likely to see a byte in the range 1..31.
1487 *
1488 * The kallsyms_addresses are mostly sorted (except for the start where the
1489 * absolute symbols are), so we'll spot a bunch of kernel addresses
1490 * immediately preceeding the kallsyms_num_syms field.
1491 *
1492 * Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
1493 * the check for kernel addresses preceeding it.
1494 *
1495 * For relative offsets most of the assumptions from above are true too
1496 * except that we have to distinguish between the relative base address and the offsets.
1497 * Every observed kernel has a valid kernel address fo the relative base and kallsyms_relative_base
1498 * always comes before kallsyms_num_syms and is aligned on a guest pointer boundary.
1499 * Offsets are stored before kallsyms_relative_base and don't contain valid kernel addresses.
1500 *
1501 * To distinguish between absolute and relative offsetting we check the data before a candidate
1502 * for kallsyms_num_syms. If all entries before the kallsyms_num_syms candidate are valid kernel
1503 * addresses absolute addresses are assumed. If this is not the case but the first entry before
1504 * kallsyms_num_syms is a valid kernel address we check whether the data before and the possible
1505 * relative base form a valid kernel address and assume relative offsets.
1506 *
1507 * Other notable changes between various Linux kernel versions:
1508 *
1509 * 4.20.0+: Commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a made kallsyms_num_syms 32bit
1510 * even on 64bit systems but the alignment of the variables makes the code below work for now
1511 * (tested with a 5.4 and 5.12 kernel) do we keep it that way to avoid making the code even
1512 * messy.
1513 */
1514 if (pThis->f64Bit)
1515 {
1516 uint32_t i = cbBuf / sizeof(uint64_t) - 1;
1517 while (i-- > 0)
1518 if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1519 && uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1520 {
1521 uint8_t *pb = (uint8_t *)&uBuf.au64[i + 1];
1522 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1523 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1524 {
1525 /*
1526 * Check whether we have a valid kernel address and try to distinguish
1527 * whether the kernel uses relative offsetting or absolute addresses.
1528 */
1529 if ( (i >= 1 && LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1530 && (i >= 2 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1531 && (i >= 3 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1532 {
1533 RTGCUINTPTR uKrnlRelBase = uBuf.au64[i - 1];
1534 DBGFADDRESS RelAddr = CurAddr;
1535 int32_t aiRelOff[3];
1536 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1537 pVMM->pfnDBGFR3AddrAdd(&RelAddr,
1538 (i - 1) * sizeof(uint64_t) - sizeof(aiRelOff)),
1539 &aiRelOff[0], sizeof(aiRelOff));
1540 if ( RT_SUCCESS(rc)
1541 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[0])
1542 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[1])
1543 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[2]))
1544 {
1545 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1546 uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint64_t)));
1547 pThis->fRelKrnlAddr = true;
1548 pThis->uKernelRelativeBase = uKrnlRelBase;
1549 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1550 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1551 (uint32_t)uBuf.au64[i], sizeof(uint64_t));
1552 }
1553 }
1554
1555 if ( (i <= 0 || LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1556 && (i <= 1 || LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1557 && (i <= 2 || LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1558 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1559 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1560 (uint32_t)uBuf.au64[i], sizeof(uint64_t));
1561 }
1562 }
1563 }
1564 else
1565 {
1566 uint32_t i = cbBuf / sizeof(uint32_t) - 1;
1567 while (i-- > 0)
1568 if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1569 && uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1570 {
1571 uint8_t *pb = (uint8_t *)&uBuf.au32[i + 1];
1572 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1573 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1574 {
1575 /* Check for relative base addressing. */
1576 if (i >= 1 && LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1577 {
1578 RTGCUINTPTR uKrnlRelBase = uBuf.au32[i - 1];
1579 if ( (i <= 1 || LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 2]))
1580 && (i <= 2 || LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 3])))
1581 {
1582 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1583 uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint32_t)));
1584 pThis->fRelKrnlAddr = true;
1585 pThis->uKernelRelativeBase = uKrnlRelBase;
1586 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1587 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1588 uBuf.au32[i], sizeof(uint32_t));
1589 }
1590 }
1591
1592 if ( (i <= 0 || LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1593 && (i <= 1 || LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
1594 && (i <= 2 || LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
1595 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1596 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1597 uBuf.au32[i], sizeof(uint32_t));
1598 }
1599 }
1600 }
1601
1602 /*
1603 * Advance
1604 */
1605 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1606 {
1607 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1608 return VERR_NOT_FOUND;
1609 }
1610 cbLeft -= sizeof(uBuf);
1611 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uBuf));
1612 cbBuf = sizeof(uBuf);
1613 }
1614}
1615
1616
1617/**
1618 * Worker for dbgDiggerLinuxFindEndNames that records the findings.
1619 *
1620 * @returns VINF_SUCCESS
1621 * @param pThis The linux digger data to update.
1622 * @param pVMM The VMM function table.
1623 * @param pAddrMarkers The address of the marker (kallsyms_markers).
1624 * @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
1625 */
1626static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM,
1627 PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
1628{
1629 pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
1630 pThis->AddrKernelNameMarkers = *pAddrMarkers;
1631 pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
1632 pThis->AddrKernelTokenTable = *pAddrMarkers;
1633 pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
1634
1635 Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
1636 "dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
1637 "dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
1638 pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
1639 pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
1640 pThis->AddrKernelTokenTable.FlatPtr));
1641 return VINF_SUCCESS;
1642}
1643
1644
1645/**
1646 * Tries to find the end of kallsyms_names and thereby the start of
1647 * kallsyms_markers and kallsyms_token_table.
1648 *
1649 * The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
1650 * the two other symbols in pThis->AddrKernelNameMarkers and
1651 * pThis->AddrKernelTokenTable. The number of marker entries is stored in
1652 * pThis->cKernelNameMarkers.
1653 *
1654 * @returns VBox status code, success indicating that all three variables have
1655 * been found and taken down.
1656 * @param pUVM The user mode VM handle.
1657 * @param pVMM The VMM function table.
1658 * @param pThis The Linux digger data.
1659 * @param pHitAddr An address we think is inside kallsyms_names.
1660 */
1661static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1662{
1663 /*
1664 * Search forward in chunks.
1665 */
1666 union
1667 {
1668 uint8_t ab[0x1000];
1669 uint32_t au32[0x1000 / sizeof(uint32_t)];
1670 uint64_t au64[0x1000 / sizeof(uint64_t)];
1671 } uBuf;
1672 bool fPendingZeroHit = false;
1673 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
1674 uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1675 DBGFADDRESS CurAddr = *pHitAddr;
1676 pVMM->pfnDBGFR3AddrSub(&CurAddr, offBuf);
1677 for (;;)
1678 {
1679 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1680 if (RT_FAILURE(rc))
1681 return rc;
1682
1683 /*
1684 * The kallsyms_names table is followed by kallsyms_markers we assume,
1685 * using sizeof(unsigned long) alignment like the preceeding symbols.
1686 *
1687 * The kallsyms_markers table has entried sizeof(unsigned long) and
1688 * contains offsets into kallsyms_names. The kallsyms_markers used to
1689 * index kallsyms_names and reduce seek time when looking up the name
1690 * of an address/symbol. Each entry in kallsyms_markers covers 256
1691 * symbol names.
1692 *
1693 * Because of this, the first entry is always zero and all the entries
1694 * are ascending. It also follows that the size of the table can be
1695 * calculated from kallsyms_num_syms.
1696 *
1697 * Note! We could also have walked kallsyms_names by skipping
1698 * kallsyms_num_syms names, but this is faster and we will
1699 * validate the encoded names later.
1700 *
1701 * git commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a (which became 4.20+) makes kallsyms_markers
1702 * and kallsyms_num_syms uint32_t, even on 64bit systems. Take that into account.
1703 */
1704 if ( pThis->f64Bit
1705 && pThis->uKrnlVer < LNX_MK_VER(4, 20, 0))
1706 {
1707 if ( RT_UNLIKELY(fPendingZeroHit)
1708 && uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1709 && uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1710 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1711 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
1712
1713 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
1714 for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
1715 if (uBuf.au64[i] == 0)
1716 {
1717 if (RT_UNLIKELY(i + 1 >= cEntries))
1718 {
1719 fPendingZeroHit = true;
1720 break;
1721 }
1722 if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1723 && uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1724 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1725 pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
1726 }
1727 }
1728 else
1729 {
1730 if ( RT_UNLIKELY(fPendingZeroHit)
1731 && uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1732 && uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1733 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1734 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
1735
1736 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
1737 for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
1738 if (uBuf.au32[i] == 0)
1739 {
1740 if (RT_UNLIKELY(i + 1 >= cEntries))
1741 {
1742 fPendingZeroHit = true;
1743 break;
1744 }
1745 if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1746 && uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1747 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1748 pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
1749 }
1750 }
1751
1752 /*
1753 * Advance
1754 */
1755 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1756 {
1757 Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1758 return VERR_NOT_FOUND;
1759 }
1760 cbLeft -= sizeof(uBuf);
1761 pVMM->pfnDBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
1762 offBuf = 0;
1763 }
1764}
1765
1766
1767/**
1768 * Locates the kallsyms_token_index table.
1769 *
1770 * Storing the address in pThis->AddrKernelTokenIndex and the size of the token
1771 * table in pThis->cbKernelTokenTable.
1772 *
1773 * @returns VBox status code.
1774 * @param pUVM The user mode VM handle.
1775 * @param pVMM The VMM function table.
1776 * @param pThis The Linux digger data.
1777 */
1778static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1779{
1780 /*
1781 * The kallsyms_token_table is very much like a string table. Due to the
1782 * nature of the compression algorithm it is reasonably short (one example
1783 * here is 853 bytes), so we'll not be reading it in chunks but in full.
1784 * To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
1785 * memory or any other nasty stuff...
1786 */
1787 union
1788 {
1789 uint8_t ab[0x2000];
1790 uint16_t au16[0x2000 / sizeof(uint16_t)];
1791 } uBuf;
1792 DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
1793 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1794 if (RT_FAILURE(rc))
1795 return rc;
1796
1797 /*
1798 * We've got two choices here, either walk the string table or look for
1799 * the next structure, kallsyms_token_index.
1800 *
1801 * The token index is a table of 256 uint16_t entries (index by bytes
1802 * from kallsyms_names) that gives offsets in kallsyms_token_table. It
1803 * starts with a zero entry and the following entries are sorted in
1804 * ascending order. The range of the entries are reasonably small since
1805 * kallsyms_token_table is small.
1806 *
1807 * The alignment seems to be sizeof(unsigned long), just like
1808 * kallsyms_token_table.
1809 *
1810 * So, we start by looking for a zero 16-bit entry.
1811 */
1812 uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
1813
1814 for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
1815 if ( uBuf.au16[i] == 0
1816 && uBuf.au16[i + 1] > 0
1817 && uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
1818 && (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1819 && (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1820 && (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1821 && (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1822 && (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1823 )
1824 {
1825 pThis->AddrKernelTokenIndex = CurAddr;
1826 pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
1827 pThis->cbKernelTokenTable = i * sizeof(uint16_t);
1828 return VINF_SUCCESS;
1829 }
1830
1831 Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
1832 return VERR_NOT_FOUND;
1833}
1834
1835
1836/**
1837 * Loads the kernel symbols from the given kallsyms offset table decoding the symbol names
1838 * (worker common for dbgDiggerLinuxLoadKernelSymbolsAbsolute() and dbgDiggerLinuxLoadKernelSymbolsRelative()).
1839 *
1840 * @returns VBox status code.
1841 * @param pUVM The user mode VM handle.
1842 * @param pVMM The VMM function table.
1843 * @param pThis The Linux digger data.
1844 * @param uKernelStart Flat kernel start address.
1845 * @param cbKernel Size of the kernel in bytes.
1846 * @param pauSymOff Pointer to the array of symbol offsets in the kallsyms table
1847 * relative to the start of the kernel.
1848 */
1849static int dbgDiggerLinuxLoadKernelSymbolsWorker(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, RTGCUINTPTR uKernelStart,
1850 RTGCUINTPTR cbKernel, RTGCUINTPTR *pauSymOff)
1851{
1852 uint8_t *pbNames = (uint8_t *)RTMemAllocZ(pThis->cbKernelNames);
1853 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1854 if (RT_SUCCESS(rc))
1855 {
1856 char *pszzTokens = (char *)RTMemAllocZ(pThis->cbKernelTokenTable);
1857 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1858 if (RT_SUCCESS(rc))
1859 {
1860 uint16_t *paoffTokens = (uint16_t *)RTMemAllocZ(256 * sizeof(uint16_t));
1861 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1862 if (RT_SUCCESS(rc))
1863 {
1864 /*
1865 * Create a module for the kernel.
1866 */
1867 RTDBGMOD hMod;
1868 rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /*fFlags*/);
1869 if (RT_SUCCESS(rc))
1870 {
1871 rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1872 rc = VINF_SUCCESS;
1873
1874 /*
1875 * Enumerate the symbols.
1876 */
1877 uint32_t offName = 0;
1878 uint32_t cLeft = pThis->cKernelSymbols;
1879 while (cLeft-- > 0 && RT_SUCCESS(rc))
1880 {
1881 /* Decode the symbol name first. */
1882 if (RT_LIKELY(offName < pThis->cbKernelNames))
1883 {
1884 uint8_t cbName = pbNames[offName++];
1885 if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1886 {
1887 char szSymbol[4096];
1888 uint32_t offSymbol = 0;
1889 while (cbName-- > 0)
1890 {
1891 uint8_t bEnc = pbNames[offName++];
1892 uint16_t offToken = paoffTokens[bEnc];
1893 if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1894 {
1895 const char *pszToken = &pszzTokens[offToken];
1896 char ch;
1897 while ((ch = *pszToken++) != '\0')
1898 if (offSymbol < sizeof(szSymbol) - 1)
1899 szSymbol[offSymbol++] = ch;
1900 }
1901 else
1902 {
1903 rc = VERR_INVALID_UTF8_ENCODING;
1904 break;
1905 }
1906 }
1907 szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1908
1909 /* The offset. */
1910 RTGCUINTPTR uSymOff = *pauSymOff;
1911 pauSymOff++;
1912
1913 /* Add it without the type char. */
1914 if (uSymOff <= cbKernel)
1915 {
1916 rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymOff,
1917 0 /*cb*/, 0 /*fFlags*/, NULL);
1918 if (RT_FAILURE(rc))
1919 {
1920 if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1921 || rc == VERR_DBG_INVALID_RVA
1922 || rc == VERR_DBG_ADDRESS_CONFLICT
1923 || rc == VERR_DBG_DUPLICATE_SYMBOL)
1924 {
1925 Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1926 rc = VINF_SUCCESS;
1927 }
1928 else
1929 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1930 }
1931 }
1932 }
1933 else
1934 {
1935 rc = VERR_END_OF_STRING;
1936 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1937 offName, cLeft, cbName, pThis->cbKernelNames));
1938 }
1939 }
1940 else
1941 {
1942 rc = VERR_END_OF_STRING;
1943 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1944 offName, cLeft, pThis->cbKernelNames));
1945 }
1946 }
1947
1948 /*
1949 * Link the module into the address space.
1950 */
1951 if (RT_SUCCESS(rc))
1952 {
1953 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1954 if (hAs != NIL_RTDBGAS)
1955 rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1956 else
1957 rc = VERR_INTERNAL_ERROR;
1958 RTDbgAsRelease(hAs);
1959 }
1960 else
1961 Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1962 RTDbgModRelease(hMod);
1963 }
1964 else
1965 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1966 }
1967 else
1968 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1969 pThis->AddrKernelTokenIndex.FlatPtr, rc));
1970 RTMemFree(paoffTokens);
1971 }
1972 else
1973 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1974 pThis->AddrKernelTokenTable.FlatPtr, rc));
1975 RTMemFree(pszzTokens);
1976 }
1977 else
1978 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1979 pThis->AddrKernelNames.FlatPtr, rc));
1980 RTMemFree(pbNames);
1981
1982 return rc;
1983}
1984
1985/**
1986 * Loads the kernel symbols from the kallsyms table if it contains absolute addresses
1987 *
1988 * @returns VBox status code.
1989 * @param pUVM The user mode VM handle.
1990 * @param pVMM The VMM function table.
1991 * @param pThis The Linux digger data.
1992 */
1993static int dbgDiggerLinuxLoadKernelSymbolsAbsolute(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1994{
1995 /*
1996 * Allocate memory for temporary table copies, reading the tables as we go.
1997 */
1998 uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
1999 void *pvAddresses = RTMemAllocZ(pThis->cKernelSymbols * cbGuestAddr);
2000 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelAddresses,
2001 pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
2002 if (RT_SUCCESS(rc))
2003 {
2004 /*
2005 * Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2006 */
2007 RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2008 RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2009 RTGCUINTPTR *pauSymOff = (RTGCUINTPTR *)RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2010 uint32_t i;
2011 if (cbGuestAddr == sizeof(uint64_t))
2012 {
2013 uint64_t *pauAddrs = (uint64_t *)pvAddresses;
2014 for (i = 0; i < pThis->cKernelSymbols; i++)
2015 if ( pauAddrs[i] < uKernelStart
2016 && LNX64_VALID_ADDRESS(pauAddrs[i])
2017 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2018 uKernelStart = pauAddrs[i];
2019
2020 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2021 if ( pauAddrs[i] > uKernelEnd
2022 && LNX64_VALID_ADDRESS(pauAddrs[i])
2023 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2024 uKernelEnd = pauAddrs[i];
2025
2026 for (i = 0; i < pThis->cKernelSymbols; i++)
2027 pauSymOff[i] = pauAddrs[i] - uKernelStart;
2028 }
2029 else
2030 {
2031 uint32_t *pauAddrs = (uint32_t *)pvAddresses;
2032 for (i = 0; i < pThis->cKernelSymbols; i++)
2033 if ( pauAddrs[i] < uKernelStart
2034 && LNX32_VALID_ADDRESS(pauAddrs[i])
2035 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2036 uKernelStart = pauAddrs[i];
2037
2038 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2039 if ( pauAddrs[i] > uKernelEnd
2040 && LNX32_VALID_ADDRESS(pauAddrs[i])
2041 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2042 uKernelEnd = pauAddrs[i];
2043
2044 for (i = 0; i < pThis->cKernelSymbols; i++)
2045 pauSymOff[i] = pauAddrs[i] - uKernelStart;
2046 }
2047
2048 RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2049 pThis->cbKernel = (uint32_t)cbKernel;
2050 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2051 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2052
2053 rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2054 if (RT_FAILURE(rc))
2055 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Loading symbols from given offset table failed: %Rrc\n", rc));
2056 RTMemTmpFree(pauSymOff);
2057 }
2058 else
2059 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Reading symbol addresses at %RGv failed: %Rrc\n",
2060 pThis->AddrKernelAddresses.FlatPtr, rc));
2061 RTMemFree(pvAddresses);
2062
2063 return rc;
2064}
2065
2066
2067/**
2068 * Loads the kernel symbols from the kallsyms table if it contains absolute addresses
2069 *
2070 * @returns VBox status code.
2071 * @param pUVM The user mode VM handle.
2072 * @param pVMM The VMM function table.
2073 * @param pThis The Linux digger data.
2074 */
2075static int dbgDiggerLinuxLoadKernelSymbolsRelative(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2076{
2077 /*
2078 * Allocate memory for temporary table copies, reading the tables as we go.
2079 */
2080 int32_t *pai32Offsets = (int32_t *)RTMemAllocZ(pThis->cKernelSymbols * sizeof(int32_t));
2081 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelAddresses,
2082 pai32Offsets, pThis->cKernelSymbols * sizeof(int32_t));
2083 if (RT_SUCCESS(rc))
2084 {
2085 /*
2086 * Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2087 */
2088 RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2089 RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2090 RTGCUINTPTR *pauSymOff = (RTGCUINTPTR *)RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2091 uint32_t i;
2092
2093 for (i = 0; i < pThis->cKernelSymbols; i++)
2094 {
2095 RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2096
2097 if ( uSymAddr < uKernelStart
2098 && (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2099 && uKernelStart - uSymAddr < LNX_MAX_KERNEL_SIZE)
2100 uKernelStart = uSymAddr;
2101 }
2102
2103 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2104 {
2105 RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2106
2107 if ( uSymAddr > uKernelEnd
2108 && (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2109 && uSymAddr - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2110 uKernelEnd = uSymAddr;
2111
2112 /* Store the offset from the derived kernel start address. */
2113 pauSymOff[i] = uSymAddr - uKernelStart;
2114 }
2115
2116 RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2117 pThis->cbKernel = (uint32_t)cbKernel;
2118 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2119 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2120
2121 rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2122 if (RT_FAILURE(rc))
2123 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Loading symbols from given offset table failed: %Rrc\n", rc));
2124 RTMemTmpFree(pauSymOff);
2125 }
2126 else
2127 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Reading symbol addresses at %RGv failed: %Rrc\n",
2128 pThis->AddrKernelAddresses.FlatPtr, rc));
2129 RTMemFree(pai32Offsets);
2130
2131 return rc;
2132}
2133
2134
2135/**
2136 * Loads the kernel symbols.
2137 *
2138 * @returns VBox status code.
2139 * @param pUVM The user mode VM handle.
2140 * @param pVMM The VMM function table.
2141 * @param pThis The Linux digger data.
2142 */
2143static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2144{
2145 /*
2146 * First the kernel itself.
2147 */
2148 if (pThis->fRelKrnlAddr)
2149 return dbgDiggerLinuxLoadKernelSymbolsRelative(pUVM, pVMM, pThis);
2150 return dbgDiggerLinuxLoadKernelSymbolsAbsolute(pUVM, pVMM, pThis);
2151}
2152
2153
2154/*
2155 * The module structure changed it was easier to produce different code for
2156 * each version of the structure. The C preprocessor rules!
2157 */
2158#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleCodeTmpl.cpp.h"
2159
2160#define LNX_BIT_SUFFIX _amd64
2161#define LNX_PTR_T uint64_t
2162#define LNX_64BIT 1
2163#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2164
2165#define LNX_BIT_SUFFIX _x86
2166#define LNX_PTR_T uint32_t
2167#define LNX_64BIT 0
2168#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2169
2170#undef LNX_TEMPLATE_HEADER
2171
2172static const struct
2173{
2174 uint32_t uVersion;
2175 bool f64Bit;
2176 uint64_t (*pfnProcessModule)(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGFADDRESS pAddrModule);
2177} g_aModVersions[] =
2178{
2179#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleTableEntryTmpl.cpp.h"
2180
2181#define LNX_BIT_SUFFIX _amd64
2182#define LNX_64BIT 1
2183#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2184
2185#define LNX_BIT_SUFFIX _x86
2186#define LNX_64BIT 0
2187#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2188
2189#undef LNX_TEMPLATE_HEADER
2190};
2191
2192
2193/**
2194 * Tries to find and process the module list.
2195 *
2196 * @returns VBox status code.
2197 * @param pThis The Linux digger data.
2198 * @param pUVM The user mode VM handle.
2199 * @param pVMM The VMM function table.
2200 */
2201static int dbgDiggerLinuxLoadModules(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2202{
2203 /*
2204 * Locate the list head.
2205 */
2206 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
2207 RTDBGSYMBOL SymInfo;
2208 int rc = RTDbgAsSymbolByName(hAs, "vmlinux!modules", &SymInfo, NULL);
2209 RTDbgAsRelease(hAs);
2210 if (RT_FAILURE(rc))
2211 return VERR_NOT_FOUND;
2212
2213 if (RT_FAILURE(rc))
2214 {
2215 LogRel(("dbgDiggerLinuxLoadModules: Failed to locate the module list (%Rrc).\n", rc));
2216 return VERR_NOT_FOUND;
2217 }
2218
2219 /*
2220 * Read the list anchor.
2221 */
2222 union
2223 {
2224 uint32_t volatile u32Pair[2];
2225 uint64_t u64Pair[2];
2226 } uListAnchor;
2227 DBGFADDRESS Addr;
2228 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value),
2229 &uListAnchor, pThis->f64Bit ? sizeof(uListAnchor.u64Pair) : sizeof(uListAnchor.u32Pair));
2230 if (RT_FAILURE(rc))
2231 {
2232 LogRel(("dbgDiggerLinuxLoadModules: Error reading list anchor at %RX64: %Rrc\n", SymInfo.Value, rc));
2233 return VERR_NOT_FOUND;
2234 }
2235 if (!pThis->f64Bit)
2236 {
2237 uListAnchor.u64Pair[1] = uListAnchor.u32Pair[1];
2238 ASMCompilerBarrier();
2239 uListAnchor.u64Pair[0] = uListAnchor.u32Pair[0];
2240 }
2241
2242 if (pThis->uKrnlVer == 0)
2243 {
2244 LogRel(("dbgDiggerLinuxLoadModules: No valid kernel version given: %#x\n", pThis->uKrnlVer));
2245 return VERR_NOT_FOUND;
2246 }
2247
2248 /*
2249 * Find the g_aModVersion entry that fits the best.
2250 * ASSUMES strict descending order by bitcount and version.
2251 */
2252 Assert(g_aModVersions[0].f64Bit == true);
2253 unsigned i = 0;
2254 if (!pThis->f64Bit)
2255 while (i < RT_ELEMENTS(g_aModVersions) && g_aModVersions[i].f64Bit)
2256 i++;
2257 while ( i < RT_ELEMENTS(g_aModVersions)
2258 && g_aModVersions[i].f64Bit == pThis->f64Bit
2259 && pThis->uKrnlVer < g_aModVersions[i].uVersion)
2260 i++;
2261 if (i >= RT_ELEMENTS(g_aModVersions))
2262 {
2263 LogRel(("dbgDiggerLinuxLoadModules: Failed to find anything matching version: %u.%u.%u\n",
2264 pThis->uKrnlVerMaj, pThis->uKrnlVerMin, pThis->uKrnlVerBld));
2265 return VERR_NOT_FOUND;
2266 }
2267
2268 /*
2269 * Walk the list.
2270 */
2271 uint64_t uModAddr = uListAnchor.u64Pair[0];
2272 for (size_t iModule = 0; iModule < 4096 && uModAddr != SymInfo.Value && uModAddr != 0; iModule++)
2273 uModAddr = g_aModVersions[i].pfnProcessModule(pThis, pUVM, pVMM, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uModAddr));
2274
2275 return VINF_SUCCESS;
2276}
2277
2278
2279/**
2280 * Checks if there is a likely kallsyms_names fragment at pHitAddr.
2281 *
2282 * @returns true if it's a likely fragment, false if not.
2283 * @param pUVM The user mode VM handle.
2284 * @param pVMM The VMM function table.
2285 * @param pHitAddr The address where paNeedle was found.
2286 * @param pabNeedle The fragment we've been searching for.
2287 * @param cbNeedle The length of the fragment.
2288 */
2289static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pHitAddr,
2290 uint8_t const *pabNeedle, uint8_t cbNeedle)
2291{
2292 /*
2293 * Examples of lead and tail bytes of our choosen needle in a randomly
2294 * picked kernel:
2295 * k o b j
2296 * 22 6b 6f 62 6a aa
2297 * fc 6b 6f 62 6a aa
2298 * 82 6b 6f 62 6a 5f - ascii trail byte (_).
2299 * ee 6b 6f 62 6a aa
2300 * fc 6b 6f 62 6a 5f - ascii trail byte (_).
2301 * 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
2302 * 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
2303 * ... omitting 29 samples similar to the last two ...
2304 * d8 6b 6f 62 6a aa
2305 * d8 6b 6f 62 6a aa
2306 * d8 6b 6f 62 6a aa
2307 * d8 6b 6f 62 6a aa
2308 * f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
2309 * f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
2310 * fd 6b 6f 62 6a 0f
2311 * ... enough.
2312 */
2313 uint8_t abBuf[32];
2314 DBGFADDRESS ReadAddr = *pHitAddr;
2315 pVMM->pfnDBGFR3AddrSub(&ReadAddr, 2);
2316 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
2317 if (RT_SUCCESS(rc))
2318 {
2319 if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
2320 {
2321 uint8_t const bLead = abBuf[1] == '_' || abBuf[1] == 'T' || abBuf[1] == 't' ? abBuf[0] : abBuf[1];
2322 uint8_t const offTail = 2 + cbNeedle;
2323 uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
2324 if ( bLead >= 1 && (bLead < 0x20 || bLead >= 0x80)
2325 && bTail >= 1 && (bTail < 0x20 || bTail >= 0x80))
2326 return true;
2327 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
2328 pHitAddr->FlatPtr, bLead, bTail, offTail));
2329 }
2330 else
2331 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
2332 }
2333 else
2334 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
2335
2336 return false;
2337}
2338
2339/**
2340 * Tries to find and load the kernel symbol table with the given needle.
2341 *
2342 * @returns VBox status code.
2343 * @param pThis The Linux digger data.
2344 * @param pUVM The user mode VM handle.
2345 * @param pVMM The VMM function table.
2346 * @param pabNeedle The needle to use for searching.
2347 * @param cbNeedle Size of the needle in bytes.
2348 */
2349static int dbgDiggerLinuxFindSymbolTableFromNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2350 uint8_t const *pabNeedle, uint8_t cbNeedle)
2351{
2352 /*
2353 * Go looking for the kallsyms table. If it's there, it will be somewhere
2354 * after the linux_banner symbol, so use it for starting the search.
2355 */
2356 int rc = VINF_SUCCESS;
2357 DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2358 uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2359 while (cbLeft > 4096)
2360 {
2361 DBGFADDRESS HitAddr;
2362 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &CurAddr, cbLeft, 1 /*uAlign*/,
2363 pabNeedle, cbNeedle, &HitAddr);
2364 if (RT_FAILURE(rc))
2365 break;
2366 if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2367 {
2368 /* There will be another hit near by. */
2369 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 1);
2370 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /*uAlign*/,
2371 pabNeedle, cbNeedle, &HitAddr);
2372 if ( RT_SUCCESS(rc)
2373 && dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2374 {
2375 /*
2376 * We've got a very likely candidate for a location inside kallsyms_names.
2377 * Try find the start of it, that is to say, try find kallsyms_num_syms.
2378 * kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
2379 */
2380 rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pVMM, pThis, &HitAddr);
2381 if (RT_SUCCESS(rc))
2382 rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pVMM, pThis, &HitAddr);
2383 if (RT_SUCCESS(rc))
2384 rc = dbgDiggerLinuxFindTokenIndex(pUVM, pVMM, pThis);
2385 if (RT_SUCCESS(rc))
2386 rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pVMM, pThis);
2387 if (RT_SUCCESS(rc))
2388 {
2389 rc = dbgDiggerLinuxLoadModules(pThis, pUVM, pVMM);
2390 break;
2391 }
2392 }
2393 }
2394
2395 /*
2396 * Advance.
2397 */
2398 RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + cbNeedle;
2399 if (RT_UNLIKELY(cbDistance >= cbLeft))
2400 {
2401 Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
2402 break;
2403 }
2404 cbLeft -= cbDistance;
2405 pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2406 }
2407
2408 return rc;
2409}
2410
2411/**
2412 * Skips whitespace and comments in the given config returning the pointer
2413 * to the first non whitespace character.
2414 *
2415 * @returns Pointer to the first non whitespace character or NULL if the end
2416 * of the string was reached.
2417 * @param pszCfg The config string.
2418 */
2419static const char *dbgDiggerLinuxCfgSkipWhitespace(const char *pszCfg)
2420{
2421 do
2422 {
2423 while ( *pszCfg != '\0'
2424 && ( RT_C_IS_SPACE(*pszCfg)
2425 || *pszCfg == '\n'))
2426 pszCfg++;
2427
2428 /* Do we have a comment? Skip it. */
2429 if (*pszCfg == '#')
2430 {
2431 while ( *pszCfg != '\n'
2432 && *pszCfg != '\0')
2433 pszCfg++;
2434 }
2435 } while ( *pszCfg != '\0'
2436 && ( RT_C_IS_SPACE(*pszCfg)
2437 || *pszCfg == '\n'
2438 || *pszCfg == '#'));
2439
2440 return pszCfg;
2441}
2442
2443/**
2444 * Parses an identifier at the given position.
2445 *
2446 * @returns VBox status code.
2447 * @param pszCfg The config data.
2448 * @param ppszCfgNext Where to store the pointer to the data following the identifier.
2449 * @param ppszIde Where to store the pointer to the identifier on success.
2450 * Free with RTStrFree().
2451 */
2452static int dbgDiggerLinuxCfgParseIde(const char *pszCfg, const char **ppszCfgNext, char **ppszIde)
2453{
2454 int rc = VINF_SUCCESS;
2455 size_t cchIde = 0;
2456
2457 while ( *pszCfg != '\0'
2458 && ( RT_C_IS_ALNUM(*pszCfg)
2459 || *pszCfg == '_'))
2460 {
2461 cchIde++;
2462 pszCfg++;
2463 }
2464
2465 if (cchIde)
2466 {
2467 *ppszIde = RTStrDupN(pszCfg - cchIde, cchIde);
2468 if (!*ppszIde)
2469 rc = VERR_NO_STR_MEMORY;
2470 }
2471
2472 *ppszCfgNext = pszCfg;
2473 return rc;
2474}
2475
2476/**
2477 * Parses a value for a config item.
2478 *
2479 * @returns VBox status code.
2480 * @param pszCfg The config data.
2481 * @param ppszCfgNext Where to store the pointer to the data following the identifier.
2482 * @param ppCfgItem Where to store the created config item on success.
2483 */
2484static int dbgDiggerLinuxCfgParseVal(const char *pszCfg, const char **ppszCfgNext,
2485 PDBGDIGGERLINUXCFGITEM *ppCfgItem)
2486{
2487 int rc = VINF_SUCCESS;
2488 PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2489
2490 if (RT_C_IS_DIGIT(*pszCfg) || *pszCfg == '-')
2491 {
2492 /* Parse the number. */
2493 int64_t i64Num;
2494 rc = RTStrToInt64Ex(pszCfg, (char **)ppszCfgNext, 0, &i64Num);
2495 if ( RT_SUCCESS(rc)
2496 || rc == VWRN_TRAILING_CHARS
2497 || rc == VWRN_TRAILING_SPACES)
2498 {
2499 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2500 if (pCfgItem)
2501 {
2502 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_NUMBER;
2503 pCfgItem->u.i64Num = i64Num;
2504 }
2505 else
2506 rc = VERR_NO_MEMORY;
2507 }
2508 }
2509 else if (*pszCfg == '\"')
2510 {
2511 /* Parse a string. */
2512 const char *pszCfgCur = pszCfg + 1;
2513 while ( *pszCfgCur != '\0'
2514 && *pszCfgCur != '\"')
2515 pszCfgCur++;
2516
2517 if (*pszCfgCur == '\"')
2518 {
2519 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGDIGGERLINUXCFGITEM,
2520 u.aszString[pszCfgCur - pszCfg + 1]));
2521 if (pCfgItem)
2522 {
2523 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_STRING;
2524 RTStrCopyEx(&pCfgItem->u.aszString[0], pszCfgCur - pszCfg + 1, pszCfg, pszCfgCur - pszCfg);
2525 *ppszCfgNext = pszCfgCur + 1;
2526 }
2527 else
2528 rc = VERR_NO_MEMORY;
2529 }
2530 else
2531 rc = VERR_INVALID_STATE;
2532 }
2533 else if ( *pszCfg == 'y'
2534 || *pszCfg == 'm')
2535 {
2536 /* Included or module. */
2537 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2538 if (pCfgItem)
2539 {
2540 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_FLAG;
2541 pCfgItem->u.fModule = *pszCfg == 'm';
2542 }
2543 else
2544 rc = VERR_NO_MEMORY;
2545 pszCfg++;
2546 *ppszCfgNext = pszCfg;
2547 }
2548 else
2549 rc = VERR_INVALID_STATE;
2550
2551 if (RT_SUCCESS(rc))
2552 *ppCfgItem = pCfgItem;
2553 else if (pCfgItem)
2554 RTMemFree(pCfgItem);
2555
2556 return rc;
2557}
2558
2559/**
2560 * Parses the given kernel config and creates the config database.
2561 *
2562 * @returns VBox status code
2563 * @param pThis The Linux digger data.
2564 * @param pszCfg The config string.
2565 */
2566static int dbgDiggerLinuxCfgParse(PDBGDIGGERLINUX pThis, const char *pszCfg)
2567{
2568 int rc = VINF_SUCCESS;
2569
2570 /*
2571 * The config is a text file with the following elements:
2572 * # starts a comment which goes till the end of the line
2573 * <Ide>=<val> where <Ide> is an identifier consisting of
2574 * alphanumerical characters (including _)
2575 * <val> denotes the value for the identifier and can have the following
2576 * formats:
2577 * (-)[0-9]* for numbers
2578 * "..." for a string value
2579 * m when a feature is enabled as a module
2580 * y when a feature is enabled
2581 * Newlines are used as a separator between values and mark the end
2582 * of a comment
2583 */
2584 const char *pszCfgCur = pszCfg;
2585 while ( RT_SUCCESS(rc)
2586 && *pszCfgCur != '\0')
2587 {
2588 /* Start skipping the whitespace. */
2589 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2590 if ( pszCfgCur
2591 && *pszCfgCur != '\0')
2592 {
2593 char *pszIde = NULL;
2594 /* Must be an identifier, parse it. */
2595 rc = dbgDiggerLinuxCfgParseIde(pszCfgCur, &pszCfgCur, &pszIde);
2596 if (RT_SUCCESS(rc))
2597 {
2598 /*
2599 * Skip whitespace again (shouldn't be required because = follows immediately
2600 * in the observed configs).
2601 */
2602 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2603 if ( pszCfgCur
2604 && *pszCfgCur == '=')
2605 {
2606 pszCfgCur++;
2607 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2608 if ( pszCfgCur
2609 && *pszCfgCur != '\0')
2610 {
2611 /* Get the value. */
2612 PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2613 rc = dbgDiggerLinuxCfgParseVal(pszCfgCur, &pszCfgCur, &pCfgItem);
2614 if (RT_SUCCESS(rc))
2615 {
2616 pCfgItem->Core.pszString = pszIde;
2617 bool fRc = RTStrSpaceInsert(&pThis->hCfgDb, &pCfgItem->Core);
2618 if (!fRc)
2619 {
2620 RTStrFree(pszIde);
2621 RTMemFree(pCfgItem);
2622 rc = VERR_INVALID_STATE;
2623 }
2624 }
2625 }
2626 else
2627 rc = VERR_EOF;
2628 }
2629 else
2630 rc = VERR_INVALID_STATE;
2631 }
2632
2633 if (RT_FAILURE(rc))
2634 RTStrFree(pszIde);
2635 }
2636 else
2637 break; /* Reached the end of the config. */
2638 }
2639
2640 if (RT_FAILURE(rc))
2641 dbgDiggerLinuxCfgDbDestroy(pThis);
2642
2643 return rc;
2644}
2645
2646/**
2647 * Decompresses the given config and validates the UTF-8 encoding.
2648 *
2649 * @returns VBox status code.
2650 * @param pbCfgComp The compressed config.
2651 * @param cbCfgComp Size of the compressed config.
2652 * @param ppszCfg Where to store the pointer to the decompressed config
2653 * on success.
2654 */
2655static int dbgDiggerLinuxCfgDecompress(const uint8_t *pbCfgComp, size_t cbCfgComp, char **ppszCfg)
2656{
2657 int rc = VINF_SUCCESS;
2658 RTVFSIOSTREAM hVfsIos = NIL_RTVFSIOSTREAM;
2659
2660 rc = RTVfsIoStrmFromBuffer(RTFILE_O_READ, pbCfgComp, cbCfgComp, &hVfsIos);
2661 if (RT_SUCCESS(rc))
2662 {
2663 RTVFSIOSTREAM hVfsIosDecomp = NIL_RTVFSIOSTREAM;
2664 rc = RTZipGzipDecompressIoStream(hVfsIos, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsIosDecomp);
2665 if (RT_SUCCESS(rc))
2666 {
2667 char *pszCfg = NULL;
2668 size_t cchCfg = 0;
2669 size_t cbRead = 0;
2670
2671 do
2672 {
2673 uint8_t abBuf[_64K];
2674 rc = RTVfsIoStrmRead(hVfsIosDecomp, abBuf, sizeof(abBuf), true /*fBlocking*/, &cbRead);
2675 if (rc == VINF_EOF && cbRead == 0)
2676 rc = VINF_SUCCESS;
2677 if ( RT_SUCCESS(rc)
2678 && cbRead > 0)
2679 {
2680 /* Append data. */
2681 char *pszCfgNew = pszCfg;
2682 rc = RTStrRealloc(&pszCfgNew, cchCfg + cbRead + 1);
2683 if (RT_SUCCESS(rc))
2684 {
2685 pszCfg = pszCfgNew;
2686 memcpy(pszCfg + cchCfg, &abBuf[0], cbRead);
2687 cchCfg += cbRead;
2688 pszCfg[cchCfg] = '\0'; /* Enforce string termination. */
2689 }
2690 }
2691 } while (RT_SUCCESS(rc) && cbRead > 0);
2692
2693 if (RT_SUCCESS(rc))
2694 *ppszCfg = pszCfg;
2695 else if (RT_FAILURE(rc) && pszCfg)
2696 RTStrFree(pszCfg);
2697
2698 RTVfsIoStrmRelease(hVfsIosDecomp);
2699 }
2700 RTVfsIoStrmRelease(hVfsIos);
2701 }
2702
2703 return rc;
2704}
2705
2706/**
2707 * Reads and decodes the compressed kernel config.
2708 *
2709 * @returns VBox status code.
2710 * @param pThis The Linux digger data.
2711 * @param pUVM The user mode VM handle.
2712 * @param pVMM The VMM function table.
2713 * @param pAddrStart The start address of the compressed config.
2714 * @param cbCfgComp The size of the compressed config.
2715 */
2716static int dbgDiggerLinuxCfgDecode(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2717 PCDBGFADDRESS pAddrStart, size_t cbCfgComp)
2718{
2719 int rc = VINF_SUCCESS;
2720 uint8_t *pbCfgComp = (uint8_t *)RTMemTmpAlloc(cbCfgComp);
2721 if (!pbCfgComp)
2722 return VERR_NO_MEMORY;
2723
2724 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pAddrStart, pbCfgComp, cbCfgComp);
2725 if (RT_SUCCESS(rc))
2726 {
2727 char *pszCfg = NULL;
2728 rc = dbgDiggerLinuxCfgDecompress(pbCfgComp, cbCfgComp, &pszCfg);
2729 if (RT_SUCCESS(rc))
2730 {
2731 if (RTStrIsValidEncoding(pszCfg))
2732 rc = dbgDiggerLinuxCfgParse(pThis, pszCfg);
2733 else
2734 rc = VERR_INVALID_UTF8_ENCODING;
2735 RTStrFree(pszCfg);
2736 }
2737 }
2738
2739 RTMemFree(pbCfgComp);
2740 return rc;
2741}
2742
2743/**
2744 * Tries to find the compressed kernel config in the kernel address space
2745 * and sets up the config database.
2746 *
2747 * @returns VBox status code.
2748 * @param pThis The Linux digger data.
2749 * @param pUVM The user mode VM handle.
2750 * @param pVMM The VMM function table.
2751 */
2752static int dbgDiggerLinuxCfgFind(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2753{
2754 /*
2755 * Go looking for the IKCFG_ST string which indicates the start
2756 * of the compressed config file.
2757 */
2758 static const uint8_t s_abCfgNeedleStart[] = "IKCFG_ST";
2759 static const uint8_t s_abCfgNeedleEnd[] = "IKCFG_ED";
2760 int rc = VINF_SUCCESS;
2761 DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2762 uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2763 while (cbLeft > 4096)
2764 {
2765 DBGFADDRESS HitAddrStart;
2766 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &CurAddr, cbLeft, 1 /*uAlign*/,
2767 s_abCfgNeedleStart, sizeof(s_abCfgNeedleStart) - 1, &HitAddrStart);
2768 if (RT_FAILURE(rc))
2769 break;
2770
2771 /* Check for the end marker which shouldn't be that far away. */
2772 pVMM->pfnDBGFR3AddrAdd(&HitAddrStart, sizeof(s_abCfgNeedleStart) - 1);
2773 DBGFADDRESS HitAddrEnd;
2774 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /* idCpu */, &HitAddrStart, LNX_MAX_COMPRESSED_CFG_SIZE,
2775 1 /* uAlign */, s_abCfgNeedleEnd, sizeof(s_abCfgNeedleEnd) - 1, &HitAddrEnd);
2776 if (RT_SUCCESS(rc))
2777 {
2778 /* Allocate a buffer to hold the compressed data between the markers and fetch it. */
2779 RTGCUINTPTR cbCfg = HitAddrEnd.FlatPtr - HitAddrStart.FlatPtr;
2780 Assert(cbCfg == (size_t)cbCfg);
2781 rc = dbgDiggerLinuxCfgDecode(pThis, pUVM, pVMM, &HitAddrStart, cbCfg);
2782 if (RT_SUCCESS(rc))
2783 break;
2784 }
2785
2786 /*
2787 * Advance.
2788 */
2789 RTGCUINTPTR cbDistance = HitAddrStart.FlatPtr - CurAddr.FlatPtr + sizeof(s_abCfgNeedleStart) - 1;
2790 if (RT_UNLIKELY(cbDistance >= cbLeft))
2791 {
2792 LogFunc(("Failed to find compressed kernel config\n"));
2793 break;
2794 }
2795 cbLeft -= cbDistance;
2796 pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2797 }
2798
2799 return rc;
2800}
2801
2802/**
2803 * Probes for a Linux kernel starting at the given address.
2804 *
2805 * @returns Flag whether something which looks like a valid Linux kernel was found.
2806 * @param pThis The Linux digger data.
2807 * @param pUVM The user mode VM handle.
2808 * @param pVMM The VMM function table.
2809 * @param uAddrStart The address to start scanning at.
2810 * @param cbScan How much to scan.
2811 */
2812static bool dbgDiggerLinuxProbeWithAddr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2813 RTGCUINTPTR uAddrStart, size_t cbScan)
2814{
2815 /*
2816 * Look for "Linux version " at the start of the rodata segment.
2817 * Hope that this comes before any message buffer or other similar string.
2818 */
2819 DBGFADDRESS KernelAddr;
2820 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uAddrStart);
2821 DBGFADDRESS HitAddr;
2822 int rc = pVMM->pfnDBGFR3MemScan(pUVM, 0, &KernelAddr, cbScan, 1,
2823 g_abLinuxVersion, sizeof(g_abLinuxVersion) - 1, &HitAddr);
2824 if (RT_SUCCESS(rc))
2825 {
2826 char szTmp[128];
2827 char const *pszX = &szTmp[sizeof(g_abLinuxVersion) - 1];
2828 rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
2829 if ( RT_SUCCESS(rc)
2830 && ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
2831 && pszX[1] == '.'
2832 && pszX[2] >= '0'
2833 && pszX[2] <= '6')
2834 || ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
2835 && pszX[0] <= '9'
2836 && pszX[1] == '.'
2837 && pszX[2] >= '0'
2838 && pszX[2] <= '9')
2839 )
2840 )
2841 {
2842 pThis->AddrKernelBase = KernelAddr;
2843 pThis->AddrLinuxBanner = HitAddr;
2844 return true;
2845 }
2846 }
2847
2848 return false;
2849}
2850
2851/**
2852 * Probes for a Linux kernel which has KASLR enabled.
2853 *
2854 * @returns Flag whether a possible candidate location was found.
2855 * @param pThis The Linux digger data.
2856 * @param pUVM The user mode VM handle.
2857 * @param pVMM The VMM function table.
2858 */
2859static bool dbgDiggerLinuxProbeKaslr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2860{
2861 /**
2862 * With KASLR the kernel is loaded at a different address at each boot making detection
2863 * more difficult for us.
2864 *
2865 * The randomization is done in arch/x86/boot/compressed/kaslr.c:choose_random_location() (as of Nov 2017).
2866 * At the end of the method a random offset is chosen using find_random_virt_addr() which is added to the
2867 * kernel map start in the caller (the start of the kernel depends on the bit size, see LNX32_KERNEL_ADDRESS_START
2868 * and LNX64_KERNEL_ADDRESS_START for 32bit and 64bit kernels respectively).
2869 * The lowest offset possible is LOAD_PHYSICAL_ADDR which is defined in arch/x86/include/asm/boot.h
2870 * using CONFIG_PHYSICAL_START aligned to CONFIG_PHYSICAL_ALIGN.
2871 * The default CONFIG_PHYSICAL_START and CONFIG_PHYSICAL_ALIGN are both 0x1000000 no matter whether a 32bit
2872 * or a 64bit kernel is used. So the lowest offset to the kernel start address is 0x1000000.
2873 * The find_random_virt_addr() the number of possible slots where the kernel can be placed based on the image size
2874 * is calculated using the following formula:
2875 * cSlots = ((KERNEL_IMAGE_SIZE - 0x1000000 (minimum) - image_size) / 0x1000000 (CONFIG_PHYSICAL_ALIGN)) + 1
2876 *
2877 * KERNEL_IMAGE_SIZE is 1GB for 64bit kernels and 512MB for 32bit kernels, so the maximum number of slots (resulting
2878 * in the largest possible offset) can be achieved when image_size (which contains the real size of the kernel image
2879 * which is unknown for us) goes to 0 and a 1GB KERNEL_IMAGE_SIZE is assumed. With that the biggest cSlots which can be
2880 * achieved is 64. The chosen random offset is taken from a random long integer using kaslr_get_random_long() modulo the
2881 * number of slots which selects a slot between 0 and 63. The final offset is calculated using:
2882 * offAddr = random_addr * 0x1000000 (CONFIG_PHYSICAL_ALIGN) + 0x1000000 (minimum)
2883 *
2884 * So the highest offset the kernel can start is 0x40000000 which is 1GB (plus the maximum kernel size we defined).
2885 */
2886 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX64_KERNEL_ADDRESS_START, _1G + LNX_MAX_KERNEL_SIZE))
2887 return true;
2888
2889 /*
2890 * 32bit variant, makes sure we don't exceed the 4GB address space or DBGFR3MemScan() returns VERR_DBGF_MEM_NOT_FOUND immediately
2891 * without searching the remainder of the address space.
2892 *
2893 * The default split is 3GB userspace and 1GB kernel, so we just search the entire upper 1GB kernel space.
2894 */
2895 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX32_KERNEL_ADDRESS_START, _4G - LNX32_KERNEL_ADDRESS_START))
2896 return true;
2897
2898 return false;
2899}
2900
2901/**
2902 * @copydoc DBGFOSREG::pfnInit
2903 */
2904static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2905{
2906 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2907 Assert(!pThis->fValid);
2908
2909 char szVersion[256] = "Linux version 4.19.0";
2910 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, &szVersion[0], sizeof(szVersion));
2911 if (RT_SUCCESS(rc))
2912 {
2913 /*
2914 * Get a numerical version number.
2915 */
2916 const char *pszVersion = szVersion;
2917 while (*pszVersion && !RT_C_IS_DIGIT(*pszVersion))
2918 pszVersion++;
2919
2920 size_t offVersion = 0;
2921 uint32_t uMajor = 0;
2922 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2923 uMajor = uMajor * 10 + pszVersion[offVersion++] - '0';
2924
2925 if (pszVersion[offVersion] == '.')
2926 offVersion++;
2927
2928 uint32_t uMinor = 0;
2929 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2930 uMinor = uMinor * 10 + pszVersion[offVersion++] - '0';
2931
2932 if (pszVersion[offVersion] == '.')
2933 offVersion++;
2934
2935 uint32_t uBuild = 0;
2936 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2937 uBuild = uBuild * 10 + pszVersion[offVersion++] - '0';
2938
2939 pThis->uKrnlVer = LNX_MK_VER(uMajor, uMinor, uBuild);
2940 pThis->uKrnlVerMaj = uMajor;
2941 pThis->uKrnlVerMin = uMinor;
2942 pThis->uKrnlVerBld = uBuild;
2943 if (pThis->uKrnlVer == 0)
2944 LogRel(("dbgDiggerLinuxInit: Failed to parse version string: %s\n", pszVersion));
2945 }
2946
2947 /*
2948 * Assume 64-bit kernels all live way beyond 32-bit address space.
2949 */
2950 pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
2951 pThis->fRelKrnlAddr = false;
2952
2953 pThis->hCfgDb = NULL;
2954
2955 /*
2956 * Try to find the compressed kernel config and parse it before we try
2957 * to get the symbol table, the config database is required to select
2958 * the method to use.
2959 */
2960 rc = dbgDiggerLinuxCfgFind(pThis, pUVM, pVMM);
2961 if (RT_FAILURE(rc))
2962 LogFlowFunc(("Failed to find kernel config (%Rrc), no config database available\n", rc));
2963
2964 static const uint8_t s_abNeedle[] = "kobj";
2965 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedle, sizeof(s_abNeedle) - 1);
2966 if (RT_FAILURE(rc))
2967 {
2968 /* Try alternate needle (seen on older x86 Linux kernels). */
2969 static const uint8_t s_abNeedleAlt[] = "kobjec";
2970 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleAlt, sizeof(s_abNeedleAlt) - 1);
2971 if (RT_FAILURE(rc))
2972 {
2973 static const uint8_t s_abNeedleOSuseX86[] = "nmi"; /* OpenSuSe 10.2 x86 */
2974 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleOSuseX86, sizeof(s_abNeedleOSuseX86) - 1);
2975 }
2976 }
2977
2978 pThis->fValid = true;
2979 return VINF_SUCCESS;
2980}
2981
2982
2983/**
2984 * @copydoc DBGFOSREG::pfnProbe
2985 */
2986static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2987{
2988 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2989
2990 for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
2991 {
2992 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, g_au64LnxKernelAddresses[i], LNX_MAX_KERNEL_SIZE))
2993 return true;
2994 }
2995
2996 /* Maybe the kernel uses KASLR. */
2997 if (dbgDiggerLinuxProbeKaslr(pThis, pUVM, pVMM))
2998 return true;
2999
3000 return false;
3001}
3002
3003
3004/**
3005 * @copydoc DBGFOSREG::pfnDestruct
3006 */
3007static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3008{
3009 RT_NOREF(pUVM, pVMM, pvData);
3010}
3011
3012
3013/**
3014 * @copydoc DBGFOSREG::pfnConstruct
3015 */
3016static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3017{
3018 RT_NOREF(pUVM, pVMM);
3019 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
3020 pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
3021 pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
3022 pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
3023
3024 return VINF_SUCCESS;
3025}
3026
3027
3028const DBGFOSREG g_DBGDiggerLinux =
3029{
3030 /* .u32Magic = */ DBGFOSREG_MAGIC,
3031 /* .fFlags = */ 0,
3032 /* .cbData = */ sizeof(DBGDIGGERLINUX),
3033 /* .szName = */ "Linux",
3034 /* .pfnConstruct = */ dbgDiggerLinuxConstruct,
3035 /* .pfnDestruct = */ dbgDiggerLinuxDestruct,
3036 /* .pfnProbe = */ dbgDiggerLinuxProbe,
3037 /* .pfnInit = */ dbgDiggerLinuxInit,
3038 /* .pfnRefresh = */ dbgDiggerLinuxRefresh,
3039 /* .pfnTerm = */ dbgDiggerLinuxTerm,
3040 /* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
3041 /* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
3042 /* .pfnStackUnwindAssist = */ dbgDiggerLinuxStackUnwindAssist,
3043 /* .u32EndMagic = */ DBGFOSREG_MAGIC
3044};
3045
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette