VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 61369

Last change on this file since 61369 was 61369, checked in by vboxsync, 9 years ago

Debugger/DBGPlugInLinux: Add support to get at the guest kernel log if the required symbols are not exposed in kallsyms by disassembling some public helpers to get at the log buffer address and size

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 56.8 KB
Line 
1/* $Id: DBGPlugInLinux.cpp 61369 2016-06-01 12:50:48Z vboxsync $ */
2/** @file
3 * DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4 */
5
6/*
7 * Copyright (C) 2008-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23#include "DBGPlugIns.h"
24#include "DBGPlugInCommonELF.h"
25#include <VBox/vmm/dbgf.h>
26#include <VBox/dis.h>
27#include <iprt/string.h>
28#include <iprt/mem.h>
29#include <iprt/stream.h>
30#include <iprt/ctype.h>
31
32
33/*********************************************************************************************************************************
34* Structures and Typedefs *
35*********************************************************************************************************************************/
36
37/** @name InternalLinux structures
38 * @{ */
39
40
41/** @} */
42
43
44/**
45 * Linux guest OS digger instance data.
46 */
47typedef struct DBGDIGGERLINUX
48{
49 /** Whether the information is valid or not.
50 * (For fending off illegal interface method calls.) */
51 bool fValid;
52 /** Set if 64-bit, clear if 32-bit. */
53 bool f64Bit;
54
55 /** The address of the linux banner.
56 * This is set during probing. */
57 DBGFADDRESS AddrLinuxBanner;
58 /** Kernel base address.
59 * This is set during probing, refined during kallsyms parsing. */
60 DBGFADDRESS AddrKernelBase;
61 /** The kernel size. */
62 uint32_t cbKernel;
63
64 /** The number of kernel symbols (kallsyms_num_syms).
65 * This is set during init. */
66 uint32_t cKernelSymbols;
67 /** The size of the kernel name table (sizeof(kallsyms_names)). */
68 uint32_t cbKernelNames;
69 /** Number of entries in the kernel_markers table. */
70 uint32_t cKernelNameMarkers;
71 /** The size of the kernel symbol token table. */
72 uint32_t cbKernelTokenTable;
73 /** The address of the encoded kernel symbol names (kallsyms_names). */
74 DBGFADDRESS AddrKernelNames;
75 /** The address of the kernel symbol addresses (kallsyms_addresses). */
76 DBGFADDRESS AddrKernelAddresses;
77 /** The address of the kernel symbol name markers (kallsyms_markers). */
78 DBGFADDRESS AddrKernelNameMarkers;
79 /** The address of the kernel symbol token table (kallsyms_token_table). */
80 DBGFADDRESS AddrKernelTokenTable;
81 /** The address of the kernel symbol token index table (kallsyms_token_index). */
82 DBGFADDRESS AddrKernelTokenIndex;
83
84 /** The kernel message log interface. */
85 DBGFOSIDMESG IDmesg;
86} DBGDIGGERLINUX;
87/** Pointer to the linux guest OS digger instance data. */
88typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
89
90
91/**
92 * The current printk_log structure.
93 */
94typedef struct LNXPRINTKHDR
95{
96 /** Monotonic timestamp. */
97 uint64_t nsTimestamp;
98 /** The total size of this message record. */
99 uint16_t cbTotal;
100 /** The size of the text part (immediately follows the header). */
101 uint16_t cbText;
102 /** The size of the optional dictionary part (follows the text). */
103 uint16_t cbDict;
104 /** The syslog facility number. */
105 uint8_t bFacility;
106 /** First 5 bits are internal flags, next 3 bits are log level. */
107 uint8_t fFlagsAndLevel;
108} LNXPRINTKHDR;
109AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
110/** Pointer to linux printk_log header. */
111typedef LNXPRINTKHDR *PLNXPRINTKHDR;
112/** Pointer to linux const printk_log header. */
113typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
114
115
116/*********************************************************************************************************************************
117* Defined Constants And Macros *
118*********************************************************************************************************************************/
119/** Validates a 32-bit linux kernel address */
120#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
121/** Validates a 64-bit linux kernel address */
122#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
123
124/** The max kernel size. */
125#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
126
127/** The maximum size we expect for kallsyms_names. */
128#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
129/** The maximum size we expect for kallsyms_token_table. */
130#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
131/** The minimum number of symbols we expect in kallsyms_num_syms. */
132#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
133/** The maximum number of symbols we expect in kallsyms_num_syms. */
134#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
135/** The min length an encoded symbol in kallsyms_names is expected to have. */
136#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
137/** The max length an encoded symbol in kallsyms_names is expected to have.
138 * @todo check real life here. */
139#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
140/** The approximate maximum length of a string token. */
141#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
142
143/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
144#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
145
146
147/*********************************************************************************************************************************
148* Internal Functions *
149*********************************************************************************************************************************/
150static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData);
151
152
153/*********************************************************************************************************************************
154* Global Variables *
155*********************************************************************************************************************************/
156/** Table of common linux kernel addresses. */
157static uint64_t g_au64LnxKernelAddresses[] =
158{
159 UINT64_C(0xc0100000),
160 UINT64_C(0x90100000),
161 UINT64_C(0xffffffff80200000)
162};
163
164
165/**
166 * Disassembles a simple getter returning the value for it.
167 *
168 * @returns VBox status code.
169 * @param pThis The Linux digger data.
170 * @param pUVM The VM handle.
171 * @param hMod The module to use.
172 * @param pszSymbol The symbol of the getter.
173 * @param pvVal Where to store the value on success.
174 * @param cbVal Size of the value in bytes.
175 */
176static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
177 const char *pszSymbol, void *pvVal, uint32_t cbVal)
178{
179 int rc = VINF_SUCCESS;
180
181 RTDBGSYMBOL SymInfo;
182 rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
183 if (RT_SUCCESS(rc))
184 {
185 /*
186 * Do the diassembling. Disassemble until a ret instruction is encountered
187 * or a limit is reached (don't want to disassemble for too long as the getter
188 * should be short).
189 * push and pop instructions are skipped as well as any mov instructions not
190 * touching the rax or eax register (depending on the size of the value).
191 */
192 unsigned cInstrDisassembled = 0;
193 uint32_t offInstr = 0;
194 bool fRet = false;
195 DISSTATE DisState;
196 RT_ZERO(DisState);
197
198 do
199 {
200 DBGFADDRESS Addr;
201 RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
202 DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
203
204 /* Prefetch the instruction. */
205 uint8_t abInstr[32];
206 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &abInstr[0], sizeof(abInstr));
207 if (RT_SUCCESS(rc))
208 {
209 uint32_t cbInstr = 0;
210
211 rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
212 if (RT_SUCCESS(rc))
213 {
214 switch (DisState.pCurInstr->uOpcode)
215 {
216 case OP_PUSH:
217 case OP_POP:
218 case OP_NOP:
219 case OP_LEA:
220 break;
221 case OP_RETN:
222 /* Getter returned, abort disassembling. */
223 fRet = true;
224 break;
225 case OP_MOV:
226 /*
227 * Check that the destination is either rax or eax depending on the
228 * value size.
229 *
230 * Param1 is the destination and Param2 the source.
231 */
232 if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN32))
233 && cbVal == sizeof(uint32_t))
234 || ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN64))
235 && cbVal == sizeof(uint64_t)))
236 && DisState.Param1.Base.idxGenReg == DISGREG_RAX)
237 {
238 /* Parse the source. */
239 if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 | DISUSE_IMMEDIATE64))
240 memcpy(pvVal, &DisState.Param2.uValue, cbVal);
241 else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32|DISUSE_DISPLACEMENT32|DISUSE_DISPLACEMENT64))
242 {
243 RTGCPTR GCPtrVal = 0;
244
245 if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
246 GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
247 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
248 GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
249 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
250 GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
251 else
252 AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
253
254 DBGFADDRESS AddrVal;
255 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
256 DBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
257 pvVal, cbVal);
258 }
259 }
260 break;
261 default:
262 /* All other instructions will cause an error for now (playing safe here). */
263 rc = VERR_INVALID_PARAMETER;
264 break;
265 }
266 cInstrDisassembled++;
267 offInstr += cbInstr;
268 }
269 }
270 } while ( RT_SUCCESS(rc)
271 && cInstrDisassembled < 20
272 && !fRet);
273 }
274
275 return rc;
276}
277
278/**
279 * Try to get at the log buffer starting address and size by disassembling some exposed helpers.
280 *
281 * @returns VBox status code.
282 * @param pThis The Linux digger data.
283 * @param pUVM The VM handle.
284 * @param hMod The module to use.
285 * @param pGCPtrLogBuf Where to store the log buffer pointer on success.
286 * @param pcbLogBuf Where to store the size of the log buffer on success.
287 */
288static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, RTDBGMOD hMod,
289 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
290{
291 int rc = VINF_SUCCESS;
292
293 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
294 {
295 { pGCPtrLogBuf, sizeof(RTGCPTR), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf_addr_get" },
296 { pcbLogBuf, sizeof(uint32_t), sizeof(uint32_t), "log_buf_len_get" }
297 };
298 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
299 {
300 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
301 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
302 rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, hMod, aSymbols[i].pszSymbol,
303 aSymbols[i].pvVar, aSymbols[i].cbGuest);
304 }
305
306 return rc;
307}
308
309/**
310 * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
311 */
312static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
313 char *pszBuf, size_t cbBuf, size_t *pcbActual)
314{
315 PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
316
317 if (cMessages < 1)
318 return VERR_INVALID_PARAMETER;
319
320 /*
321 * Resolve the symbols we need and read their values.
322 */
323 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
324 RTDBGMOD hMod;
325 int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
326 if (RT_FAILURE(rc))
327 return VERR_NOT_FOUND;
328 RTDbgAsRelease(hAs);
329
330 RTGCPTR GCPtrLogBuf;
331 uint32_t cbLogBuf;
332 uint32_t idxFirst;
333 uint32_t idxNext;
334
335 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
336 {
337 { &GCPtrLogBuf, sizeof(GCPtrLogBuf), pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
338 { &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
339 { &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
340 { &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
341 };
342 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
343 {
344 RTDBGSYMBOL SymInfo;
345 rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
346 if (RT_SUCCESS(rc))
347 {
348 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
349 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
350 DBGFADDRESS Addr;
351 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
352 DBGFR3AddrFromFlat(pUVM, &Addr, (RTGCPTR)SymInfo.Value + pData->AddrKernelBase.FlatPtr),
353 aSymbols[i].pvVar, aSymbols[i].cbGuest);
354 if (RT_SUCCESS(rc))
355 continue;
356 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
357 }
358 else
359 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
360 rc = VERR_NOT_FOUND;
361 break;
362 }
363
364 /*
365 * Some kernels don't expose the variables in kallsyms so we have to try disassemble
366 * some public helpers to get at the addresses.
367 *
368 * @todo: Maybe cache those values so we don't have to do the heavy work every time?
369 */
370 if (rc == VERR_NOT_FOUND)
371 {
372 idxFirst = 0;
373 idxNext = 0;
374 rc = dbgDiggerLinuxQueryLogBufferPtrs(pData, pUVM, hMod, &GCPtrLogBuf, &cbLogBuf);
375
376 /* Release the module in any case. */
377 RTDbgModRelease(hMod);
378
379 if (RT_FAILURE(rc))
380 return rc;
381 }
382
383 /*
384 * Check if the values make sense.
385 */
386 if (pData->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
387 {
388 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
389 return VERR_NOT_FOUND;
390 }
391 if ( cbLogBuf < 4096
392 || !RT_IS_POWER_OF_TWO(cbLogBuf)
393 || cbLogBuf > 16*_1M)
394 {
395 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
396 return VERR_NOT_FOUND;
397 }
398 uint32_t const cbLogAlign = 4;
399 if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
400 || (idxFirst & (cbLogAlign - 1)) != 0)
401 {
402 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
403 return VERR_NOT_FOUND;
404 }
405 if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
406 || (idxNext & (cbLogAlign - 1)) != 0)
407 {
408 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
409 return VERR_NOT_FOUND;
410 }
411
412 /*
413 * Read the whole log buffer.
414 */
415 uint8_t *pbLogBuf = (uint8_t *)RTMemAlloc(cbLogBuf);
416 if (!pbLogBuf)
417 {
418 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
419 return VERR_NO_MEMORY;
420 }
421 DBGFADDRESS Addr;
422 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
423 if (RT_FAILURE(rc))
424 {
425 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
426 cbLogBuf, Addr.FlatPtr, rc));
427 RTMemFree(pbLogBuf);
428 return VERR_NOT_FOUND;
429 }
430
431 /*
432 * Count the messages in the buffer while doing some basic validation.
433 */
434 uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
435 : idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
436 uint32_t cbLeft = cbUsed;
437 uint32_t offCur = idxFirst;
438 uint32_t cLogMsgs = 0;
439
440 while (cbLeft > 0)
441 {
442 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
443 if (!pHdr->cbTotal)
444 {
445 /* Wrap around packet, most likely... */
446 if (cbLogBuf - offCur >= cbLeft)
447 break;
448 offCur = 0;
449 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
450 }
451 if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
452 || pHdr->cbTotal > cbLeft
453 || (pHdr->cbTotal & (cbLogAlign - 1)) != 0
454 || pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
455 {
456 Log(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
457 offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
458 rc = VERR_INVALID_STATE;
459 break;
460 }
461
462 if (pHdr->cbText > 0)
463 cLogMsgs++;
464
465 /* next */
466 offCur += pHdr->cbTotal;
467 cbLeft -= pHdr->cbTotal;
468 }
469 if (RT_FAILURE(rc))
470 {
471 RTMemFree(pbLogBuf);
472 return rc;
473 }
474
475 /*
476 * Copy the messages into the output buffer.
477 */
478 offCur = idxFirst;
479 cbLeft = cbUsed;
480
481 /* Skip messages that the caller doesn't want. */
482 if (cMessages < cLogMsgs)
483 {
484 uint32_t cToSkip = cLogMsgs - cMessages;
485 while (cToSkip > 0)
486 {
487 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
488 if (!pHdr->cbTotal)
489 {
490 offCur = 0;
491 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
492 }
493 if (pHdr->cbText > 0)
494 cToSkip--;
495
496 /* next */
497 offCur += pHdr->cbTotal;
498 cbLeft -= pHdr->cbTotal;
499 }
500 }
501
502 /* Now copy the messages. */
503 size_t offDst = 0;
504 while (cbLeft > 0)
505 {
506 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
507 if (!pHdr->cbTotal)
508 {
509 if (cbLogBuf - offCur >= cbLeft)
510 break;
511 offCur = 0;
512 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
513 }
514
515 if (pHdr->cbText > 0)
516 {
517 char *pchText = (char *)(pHdr + 1);
518 size_t cchText = RTStrNLen(pchText, pHdr->cbText);
519 if (offDst + cchText < cbBuf)
520 {
521 memcpy(&pszBuf[offDst], pHdr + 1, cchText);
522 pszBuf[offDst + cchText] = '\n';
523 }
524 else if (offDst < cbBuf)
525 memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
526 offDst += cchText + 1;
527 }
528
529 /* next */
530 offCur += pHdr->cbTotal;
531 cbLeft -= pHdr->cbTotal;
532 }
533
534 /* Done with the buffer. */
535 RTMemFree(pbLogBuf);
536
537 /* Make sure we've reserved a char for the terminator. */
538 if (!offDst)
539 offDst = 1;
540
541 /* Set return size value. */
542 if (pcbActual)
543 *pcbActual = offDst;
544
545 /*
546 * All VBox strings are UTF-8 and bad things may in theory happen if we
547 * pass bad UTF-8 to code which assumes it's all valid. So, we enforce
548 * UTF-8 upon the guest kernel messages here even if they (probably) have
549 * no defined code set in reality.
550 */
551 if (offDst <= cbBuf)
552 {
553 pszBuf[offDst - 1] = '\0';
554 RTStrPurgeEncoding(pszBuf);
555 return VINF_SUCCESS;
556 }
557
558 if (cbBuf)
559 {
560 pszBuf[cbBuf - 1] = '\0';
561 RTStrPurgeEncoding(pszBuf);
562 }
563 return VERR_BUFFER_OVERFLOW;
564}
565
566
567/**
568 * @copydoc DBGFOSREG::pfnQueryInterface
569 */
570static DECLCALLBACK(void *) dbgDiggerLinuxQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
571{
572 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
573 switch (enmIf)
574 {
575 case DBGFOSINTERFACE_DMESG:
576 return &pThis->IDmesg;
577
578 default:
579 return NULL;
580 }
581}
582
583
584/**
585 * @copydoc DBGFOSREG::pfnQueryVersion
586 */
587static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
588{
589 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
590 Assert(pThis->fValid);
591
592 /*
593 * It's all in the linux banner.
594 */
595 int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
596 if (RT_SUCCESS(rc))
597 {
598 char *pszEnd = RTStrEnd(pszVersion, cchVersion);
599 AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
600 while ( pszEnd > pszVersion
601 && RT_C_IS_SPACE(pszEnd[-1]))
602 pszEnd--;
603 *pszEnd = '\0';
604 }
605 else
606 RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
607
608 return rc;
609}
610
611
612/**
613 * @copydoc DBGFOSREG::pfnTerm
614 */
615static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, void *pvData)
616{
617 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
618 Assert(pThis->fValid);
619
620 pThis->fValid = false;
621}
622
623
624/**
625 * @copydoc DBGFOSREG::pfnRefresh
626 */
627static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, void *pvData)
628{
629 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
630 NOREF(pThis);
631 Assert(pThis->fValid);
632
633 /*
634 * For now we'll flush and reload everything.
635 */
636 dbgDiggerLinuxTerm(pUVM, pvData);
637 return dbgDiggerLinuxInit(pUVM, pvData);
638}
639
640
641/**
642 * Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
643 * digger data.
644 *
645 * @returns VINF_SUCCESS.
646 * @param pThis The Linux digger data to update.
647 * @param pAddrKernelNames The kallsyms_names address.
648 * @param cKernelSymbols The number of kernel symbol.
649 * @param cbAddress The guest address size.
650 */
651static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrKernelNames,
652 uint32_t cKernelSymbols, uint32_t cbAddress)
653{
654 pThis->cKernelSymbols = cKernelSymbols;
655 pThis->AddrKernelNames = *pAddrKernelNames;
656 pThis->AddrKernelAddresses = *pAddrKernelNames;
657 DBGFR3AddrSub(&pThis->AddrKernelAddresses, (cKernelSymbols + 1) * cbAddress);
658
659 Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
660 "dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
661 "dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
662 pThis->AddrKernelAddresses.FlatPtr,
663 pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
664 pThis->AddrKernelNames.FlatPtr));
665 return VINF_SUCCESS;
666}
667
668
669/**
670 * Tries to find the address of the kallsyms_names, kallsyms_num_syms and
671 * kallsyms_addresses symbols.
672 *
673 * The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
674 * addresses of the other two are stored as pThis->AddrKernelNames and
675 * pThis->AddrKernelAddresses.
676 *
677 * @returns VBox status code, success indicating that all three variables have
678 * been found and taken down.
679 * @param pUVM The user mode VM handle.
680 * @param pThis The Linux digger data.
681 * @param pHitAddr An address we think is inside kallsyms_names.
682 */
683static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
684{
685 /*
686 * Search backwards in chunks.
687 */
688 union
689 {
690 uint8_t ab[0x1000];
691 uint32_t au32[0x1000 / sizeof(uint32_t)];
692 uint64_t au64[0x1000 / sizeof(uint64_t)];
693 } uBuf;
694 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
695 uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
696 DBGFADDRESS CurAddr = *pHitAddr;
697 DBGFR3AddrSub(&CurAddr, cbBuf);
698 cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
699 for (;;)
700 {
701 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
702 if (RT_FAILURE(rc))
703 return rc;
704
705 /*
706 * We assume that the three symbols are aligned on guest pointer boundrary.
707 *
708 * The boundrary between the two tables should be noticable as the number
709 * is unlikely to be more than 16 millions, there will be at least one zero
710 * byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
711 * that common in the kallsyms_names table.
712 *
713 * Also the kallsyms_names table starts with a length byte, which means
714 * we're likely to see a byte in the range 1..31.
715 *
716 * The kallsyms_addresses are mostly sorted (except for the start where the
717 * absolute symbols are), so we'll spot a bunch of kernel addresses
718 * immediately preceeding the kallsyms_num_syms field.
719 *
720 * Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
721 * the check for kernel addresses preceeding it.
722 */
723 if (pThis->f64Bit)
724 {
725 uint32_t i = cbBuf / sizeof(uint64_t);
726 while (i-- > 0)
727 if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
728 && uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
729 {
730 uint8_t *pb = (uint8_t *)&uBuf.au64[i + 1];
731 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
732 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
733 {
734 if ( (i <= 0 || LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
735 && (i <= 1 || LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
736 && (i <= 2 || LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
737 return dbgDiggerLinuxFoundStartOfNames(pThis,
738 DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
739 (uint32_t)uBuf.au64[i], sizeof(uint64_t));
740 }
741 }
742 }
743 else
744 {
745 uint32_t i = cbBuf / sizeof(uint32_t);
746 while (i-- > 0)
747 if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
748 && uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
749 {
750 uint8_t *pb = (uint8_t *)&uBuf.au32[i + 1];
751 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
752 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
753 {
754 if ( (i <= 0 || LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
755 && (i <= 1 || LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
756 && (i <= 2 || LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
757 return dbgDiggerLinuxFoundStartOfNames(pThis,
758 DBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
759 uBuf.au32[i], sizeof(uint32_t));
760 }
761 }
762 }
763
764 /*
765 * Advance
766 */
767 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
768 {
769 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
770 return VERR_NOT_FOUND;
771 }
772 cbLeft -= sizeof(uBuf);
773 DBGFR3AddrSub(&CurAddr, sizeof(uBuf));
774 cbBuf = sizeof(uBuf);
775 }
776}
777
778
779/**
780 * Worker for dbgDiggerLinuxFindEndNames that records the findings.
781 *
782 * @returns VINF_SUCCESS
783 * @param pThis The linux digger data to update.
784 * @param pAddrMarkers The address of the marker (kallsyms_markers).
785 * @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
786 */
787static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
788{
789 pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
790 pThis->AddrKernelNameMarkers = *pAddrMarkers;
791 pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
792 pThis->AddrKernelTokenTable = *pAddrMarkers;
793 DBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
794
795 Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
796 "dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
797 "dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
798 pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
799 pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
800 pThis->AddrKernelTokenTable.FlatPtr));
801 return VINF_SUCCESS;
802}
803
804
805/**
806 * Tries to find the end of kallsyms_names and thereby the start of
807 * kallsyms_markers and kallsyms_token_table.
808 *
809 * The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
810 * the two other symbols in pThis->AddrKernelNameMarkers and
811 * pThis->AddrKernelTokenTable. The number of marker entries is stored in
812 * pThis->cKernelNameMarkers.
813 *
814 * @returns VBox status code, success indicating that all three variables have
815 * been found and taken down.
816 * @param pUVM The user mode VM handle.
817 * @param pThis The Linux digger data.
818 * @param pHitAddr An address we think is inside kallsyms_names.
819 */
820static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
821{
822 /*
823 * Search forward in chunks.
824 */
825 union
826 {
827 uint8_t ab[0x1000];
828 uint32_t au32[0x1000 / sizeof(uint32_t)];
829 uint64_t au64[0x1000 / sizeof(uint64_t)];
830 } uBuf;
831 bool fPendingZeroHit = false;
832 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
833 uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
834 DBGFADDRESS CurAddr = *pHitAddr;
835 DBGFR3AddrSub(&CurAddr, offBuf);
836 for (;;)
837 {
838 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
839 if (RT_FAILURE(rc))
840 return rc;
841
842 /*
843 * The kallsyms_names table is followed by kallsyms_markers we assume,
844 * using sizeof(unsigned long) alignment like the preceeding symbols.
845 *
846 * The kallsyms_markers table has entried sizeof(unsigned long) and
847 * contains offsets into kallsyms_names. The kallsyms_markers used to
848 * index kallsyms_names and reduce seek time when looking up the name
849 * of an address/symbol. Each entry in kallsyms_markers covers 256
850 * symbol names.
851 *
852 * Because of this, the first entry is always zero and all the entries
853 * are ascending. It also follows that the size of the table can be
854 * calculated from kallsyms_num_syms.
855 *
856 * Note! We could also have walked kallsyms_names by skipping
857 * kallsyms_num_syms names, but this is faster and we will
858 * validate the encoded names later.
859 */
860 if (pThis->f64Bit)
861 {
862 if ( RT_UNLIKELY(fPendingZeroHit)
863 && uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
864 && uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
865 return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
866
867 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
868 for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
869 if (uBuf.au64[i] == 0)
870 {
871 if (RT_UNLIKELY(i + 1 >= cEntries))
872 {
873 fPendingZeroHit = true;
874 break;
875 }
876 if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
877 && uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
878 return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
879 }
880 }
881 else
882 {
883 if ( RT_UNLIKELY(fPendingZeroHit)
884 && uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
885 && uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
886 return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
887
888 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
889 for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
890 if (uBuf.au32[i] == 0)
891 {
892 if (RT_UNLIKELY(i + 1 >= cEntries))
893 {
894 fPendingZeroHit = true;
895 break;
896 }
897 if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
898 && uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
899 return dbgDiggerLinuxFoundMarkers(pThis, DBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
900 }
901 }
902
903 /*
904 * Advance
905 */
906 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
907 {
908 Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
909 return VERR_NOT_FOUND;
910 }
911 cbLeft -= sizeof(uBuf);
912 DBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
913 offBuf = 0;
914 }
915}
916
917
918/**
919 * Locates the kallsyms_token_index table.
920 *
921 * Storing the address in pThis->AddrKernelTokenIndex and the size of the token
922 * table in pThis->cbKernelTokenTable.
923 *
924 * @returns VBox status code.
925 * @param pUVM The user mode VM handle.
926 * @param pThis The Linux digger data.
927 */
928static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PDBGDIGGERLINUX pThis)
929{
930 /*
931 * The kallsyms_token_table is very much like a string table. Due to the
932 * nature of the compression algorithm it is reasonably short (one example
933 * here is 853 bytes), so we'll not be reading it in chunks but in full.
934 * To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
935 * memory or any other nasty stuff...
936 */
937 union
938 {
939 uint8_t ab[0x2000];
940 uint16_t au16[0x2000 / sizeof(uint16_t)];
941 } uBuf;
942 DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
943 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
944 if (RT_FAILURE(rc))
945 return rc;
946
947 /*
948 * We've got two choices here, either walk the string table or look for
949 * the next structure, kallsyms_token_index.
950 *
951 * The token index is a table of 256 uint16_t entries (index by bytes
952 * from kallsyms_names) that gives offsets in kallsyms_token_table. It
953 * starts with a zero entry and the following entries are sorted in
954 * ascending order. The range of the entries are reasonably small since
955 * kallsyms_token_table is small.
956 *
957 * The alignment seems to be sizeof(unsigned long), just like
958 * kallsyms_token_table.
959 *
960 * So, we start by looking for a zero 16-bit entry.
961 */
962 uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
963
964 for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
965 if ( uBuf.au16[i] == 0
966 && uBuf.au16[i + 1] > 0
967 && uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
968 && (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
969 && (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
970 && (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
971 && (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
972 && (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
973 )
974 {
975 pThis->AddrKernelTokenIndex = CurAddr;
976 DBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
977 pThis->cbKernelTokenTable = i * sizeof(uint16_t);
978 return VINF_SUCCESS;
979 }
980
981 Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
982 return VERR_NOT_FOUND;
983}
984
985
986/**
987 * Loads the kernel symbols from the kallsyms tables.
988 *
989 * @returns VBox status code.
990 * @param pUVM The user mode VM handle.
991 * @param pThis The Linux digger data.
992 */
993static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PDBGDIGGERLINUX pThis)
994{
995 /*
996 * Allocate memory for temporary table copies, reading the tables as we go.
997 */
998 uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
999 void *pvAddresses = RTMemAllocZ(pThis->cKernelSymbols * cbGuestAddr);
1000 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelAddresses, pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
1001 if (RT_SUCCESS(rc))
1002 {
1003 uint8_t *pbNames = (uint8_t *)RTMemAllocZ(pThis->cbKernelNames);
1004 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1005 if (RT_SUCCESS(rc))
1006 {
1007 char *pszzTokens = (char *)RTMemAllocZ(pThis->cbKernelTokenTable);
1008 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1009 if (RT_SUCCESS(rc))
1010 {
1011 uint16_t *paoffTokens = (uint16_t *)RTMemAllocZ(256 * sizeof(uint16_t));
1012 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1013 if (RT_SUCCESS(rc))
1014 {
1015 /*
1016 * Figure out the kernel start and end.
1017 */
1018 RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
1019 RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
1020 uint32_t i;
1021 if (cbGuestAddr == sizeof(uint64_t))
1022 {
1023 uint64_t *pauAddrs = (uint64_t *)pvAddresses;
1024 for (i = 0; i < pThis->cKernelSymbols; i++)
1025 if ( pauAddrs[i] < uKernelStart
1026 && LNX64_VALID_ADDRESS(pauAddrs[i])
1027 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1028 uKernelStart = pauAddrs[i];
1029
1030 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1031 if ( pauAddrs[i] > uKernelEnd
1032 && LNX64_VALID_ADDRESS(pauAddrs[i])
1033 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1034 uKernelEnd = pauAddrs[i];
1035 }
1036 else
1037 {
1038 uint32_t *pauAddrs = (uint32_t *)pvAddresses;
1039 for (i = 0; i < pThis->cKernelSymbols; i++)
1040 if ( pauAddrs[i] < uKernelStart
1041 && LNX32_VALID_ADDRESS(pauAddrs[i])
1042 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
1043 uKernelStart = pauAddrs[i];
1044
1045 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
1046 if ( pauAddrs[i] > uKernelEnd
1047 && LNX32_VALID_ADDRESS(pauAddrs[i])
1048 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
1049 uKernelEnd = pauAddrs[i];
1050 }
1051
1052 RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
1053 pThis->cbKernel = (uint32_t)cbKernel;
1054 DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
1055 Log(("dbgDiggerLinuxLoadKernelSymbols: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
1056
1057 /*
1058 * Create a module for the kernel.
1059 */
1060 RTDBGMOD hMod;
1061 rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /*fFlags*/);
1062 if (RT_SUCCESS(rc))
1063 {
1064 rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1065 rc = VINF_SUCCESS;
1066
1067 /*
1068 * Enumerate the symbols.
1069 */
1070 uint8_t const *pbCurAddr = (uint8_t const *)pvAddresses;
1071 uint32_t offName = 0;
1072 uint32_t cLeft = pThis->cKernelSymbols;
1073 while (cLeft-- > 0 && RT_SUCCESS(rc))
1074 {
1075 /* Decode the symbol name first. */
1076 if (RT_LIKELY(offName < pThis->cbKernelNames))
1077 {
1078 uint8_t cbName = pbNames[offName++];
1079 if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1080 {
1081 char szSymbol[4096];
1082 uint32_t offSymbol = 0;
1083 while (cbName-- > 0)
1084 {
1085 uint8_t bEnc = pbNames[offName++];
1086 uint16_t offToken = paoffTokens[bEnc];
1087 if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1088 {
1089 const char *pszToken = &pszzTokens[offToken];
1090 char ch;
1091 while ((ch = *pszToken++) != '\0')
1092 if (offSymbol < sizeof(szSymbol) - 1)
1093 szSymbol[offSymbol++] = ch;
1094 }
1095 else
1096 {
1097 rc = VERR_INVALID_UTF8_ENCODING;
1098 break;
1099 }
1100 }
1101 szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1102
1103 /* The address. */
1104 RTGCUINTPTR uSymAddr = cbGuestAddr == sizeof(uint64_t)
1105 ? *(uint64_t *)pbCurAddr : *(uint32_t *)pbCurAddr;
1106 pbCurAddr += cbGuestAddr;
1107
1108 /* Add it without the type char. */
1109 if (uSymAddr - uKernelStart <= cbKernel)
1110 {
1111 rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymAddr - uKernelStart,
1112 0 /*cb*/, 0 /*fFlags*/, NULL);
1113 if (RT_FAILURE(rc))
1114 {
1115 if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1116 || rc == VERR_DBG_INVALID_RVA
1117 || rc == VERR_DBG_ADDRESS_CONFLICT
1118 || rc == VERR_DBG_DUPLICATE_SYMBOL)
1119 {
1120 Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1121 rc = VINF_SUCCESS;
1122 }
1123 else
1124 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1125 }
1126 }
1127 }
1128 else
1129 {
1130 rc = VERR_END_OF_STRING;
1131 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1132 offName, cLeft, cbName, pThis->cbKernelNames));
1133 }
1134 }
1135 else
1136 {
1137 rc = VERR_END_OF_STRING;
1138 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1139 offName, cLeft, pThis->cbKernelNames));
1140 }
1141 }
1142
1143 /*
1144 * Link the module into the address space.
1145 */
1146 if (RT_SUCCESS(rc))
1147 {
1148 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1149 if (hAs != NIL_RTDBGAS)
1150 rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1151 else
1152 rc = VERR_INTERNAL_ERROR;
1153 RTDbgAsRelease(hAs);
1154 }
1155 else
1156 Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1157 RTDbgModRelease(hMod);
1158 }
1159 else
1160 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1161 }
1162 else
1163 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1164 pThis->AddrKernelTokenIndex.FlatPtr, rc));
1165 RTMemFree(paoffTokens);
1166 }
1167 else
1168 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1169 pThis->AddrKernelTokenTable.FlatPtr, rc));
1170 RTMemFree(pszzTokens);
1171 }
1172 else
1173 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1174 pThis->AddrKernelNames.FlatPtr, rc));
1175 RTMemFree(pbNames);
1176 }
1177 else
1178 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading symbol addresses at %RGv failed: %Rrc\n",
1179 pThis->AddrKernelAddresses.FlatPtr, rc));
1180 RTMemFree(pvAddresses);
1181 return rc;
1182}
1183
1184
1185/**
1186 * Checks if there is a likely kallsyms_names fragment at pHitAddr.
1187 *
1188 * @returns true if it's a likely fragment, false if not.
1189 * @param pUVM The user mode VM handle.
1190 * @param pHitAddr The address where paNeedle was found.
1191 * @param pabNeedle The fragment we've been searching for.
1192 * @param cbNeedle The length of the fragment.
1193 */
1194static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCDBGFADDRESS pHitAddr, uint8_t const *pabNeedle, uint8_t cbNeedle)
1195{
1196 /*
1197 * Examples of lead and tail bytes of our choosen needle in a randomly
1198 * picked kernel:
1199 * k o b j
1200 * 22 6b 6f 62 6a aa
1201 * fc 6b 6f 62 6a aa
1202 * 82 6b 6f 62 6a 5f - ascii trail byte (_).
1203 * ee 6b 6f 62 6a aa
1204 * fc 6b 6f 62 6a 5f - ascii trail byte (_).
1205 * 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
1206 * 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
1207 * ... omitting 29 samples similar to the last two ...
1208 * d8 6b 6f 62 6a aa
1209 * d8 6b 6f 62 6a aa
1210 * d8 6b 6f 62 6a aa
1211 * d8 6b 6f 62 6a aa
1212 * f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
1213 * f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
1214 * fd 6b 6f 62 6a 0f
1215 * ... enough.
1216 */
1217 uint8_t abBuf[32];
1218 DBGFADDRESS ReadAddr = *pHitAddr;
1219 DBGFR3AddrSub(&ReadAddr, 2);
1220 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
1221 if (RT_SUCCESS(rc))
1222 {
1223 if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
1224 {
1225 uint8_t const bLead = abBuf[1] == '_' || abBuf[1] == 'T' || abBuf[1] == 't' ? abBuf[0] : abBuf[1];
1226 uint8_t const offTail = 2 + cbNeedle;
1227 uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
1228 if ( bLead >= 1 && (bLead < 0x20 || bLead >= 0x80)
1229 && bTail >= 1 && (bTail < 0x20 || bTail >= 0x80))
1230 return true;
1231 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
1232 pHitAddr->FlatPtr, bLead, bTail, offTail));
1233 }
1234 else
1235 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
1236 }
1237 else
1238 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
1239
1240 return false;
1241}
1242
1243
1244/**
1245 * @copydoc DBGFOSREG::pfnInit
1246 */
1247static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, void *pvData)
1248{
1249 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1250 Assert(!pThis->fValid);
1251
1252 /*
1253 * Assume 64-bit kernels all live way beyond 32-bit address space.
1254 */
1255 pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
1256
1257 /*
1258 * Go looking for the kallsyms table. If it's there, it will be somewhere
1259 * after the linux_banner symbol, so use it for starting the search.
1260 */
1261 DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
1262 uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
1263 while (cbLeft > 4096)
1264 {
1265 static const uint8_t s_abNeedle[] = "kobj";
1266 DBGFADDRESS HitAddr;
1267 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &CurAddr, cbLeft, 1 /*uAlign*/,
1268 s_abNeedle, sizeof(s_abNeedle) - 1, &HitAddr);
1269 if (RT_FAILURE(rc))
1270 break;
1271 if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, s_abNeedle, sizeof(s_abNeedle) - 1))
1272 {
1273 /* There will be another hit near by. */
1274 DBGFR3AddrAdd(&HitAddr, 1);
1275 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /*uAlign*/,
1276 s_abNeedle, sizeof(s_abNeedle) - 1, &HitAddr);
1277 if ( RT_SUCCESS(rc)
1278 && dbgDiggerLinuxIsLikelyNameFragment(pUVM, &HitAddr, s_abNeedle, sizeof(s_abNeedle) - 1))
1279 {
1280 /*
1281 * We've got a very likely candidate for a location inside kallsyms_names.
1282 * Try find the start of it, that is to say, try find kallsyms_num_syms.
1283 * kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
1284 */
1285 rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pThis, &HitAddr);
1286 if (RT_SUCCESS(rc))
1287 rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pThis, &HitAddr);
1288 if (RT_SUCCESS(rc))
1289 rc = dbgDiggerLinuxFindTokenIndex(pUVM, pThis);
1290 if (RT_SUCCESS(rc))
1291 rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pThis);
1292 if (RT_SUCCESS(rc))
1293 break;
1294 }
1295 }
1296
1297 /*
1298 * Advance.
1299 */
1300 RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + sizeof(s_abNeedle) - 1;
1301 if (RT_UNLIKELY(cbDistance >= cbLeft))
1302 {
1303 Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
1304 break;
1305 }
1306 cbLeft -= cbDistance;
1307 DBGFR3AddrAdd(&CurAddr, cbDistance);
1308
1309 }
1310
1311 pThis->fValid = true;
1312 return VINF_SUCCESS;
1313}
1314
1315
1316/**
1317 * @copydoc DBGFOSREG::pfnProbe
1318 */
1319static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, void *pvData)
1320{
1321 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1322
1323 /*
1324 * Look for "Linux version " at the start of the rodata segment.
1325 * Hope that this comes before any message buffer or other similar string.
1326 */
1327 for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
1328 {
1329 DBGFADDRESS KernelAddr;
1330 DBGFR3AddrFromFlat(pUVM, &KernelAddr, g_au64LnxKernelAddresses[i]);
1331 DBGFADDRESS HitAddr;
1332 static const uint8_t s_abLinuxVersion[] = "Linux version ";
1333 int rc = DBGFR3MemScan(pUVM, 0, &KernelAddr, LNX_MAX_KERNEL_SIZE, 1,
1334 s_abLinuxVersion, sizeof(s_abLinuxVersion) - 1, &HitAddr);
1335 if (RT_SUCCESS(rc))
1336 {
1337 char szTmp[128];
1338 char const *pszX = &szTmp[sizeof(s_abLinuxVersion) - 1];
1339 rc = DBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
1340 if ( RT_SUCCESS(rc)
1341 && ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
1342 && pszX[1] == '.'
1343 && pszX[2] >= '0'
1344 && pszX[2] <= '6')
1345 || ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
1346 && pszX[0] <= '9'
1347 && pszX[1] == '.'
1348 && pszX[2] >= '0'
1349 && pszX[2] <= '9')
1350 )
1351 )
1352 {
1353 pThis->AddrKernelBase = KernelAddr;
1354 pThis->AddrLinuxBanner = HitAddr;
1355 return true;
1356 }
1357 }
1358 }
1359 return false;
1360}
1361
1362
1363/**
1364 * @copydoc DBGFOSREG::pfnDestruct
1365 */
1366static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, void *pvData)
1367{
1368
1369}
1370
1371
1372/**
1373 * @copydoc DBGFOSREG::pfnConstruct
1374 */
1375static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, void *pvData)
1376{
1377 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1378 pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
1379 pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
1380 pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
1381
1382 return VINF_SUCCESS;
1383}
1384
1385
1386const DBGFOSREG g_DBGDiggerLinux =
1387{
1388 /* .u32Magic = */ DBGFOSREG_MAGIC,
1389 /* .fFlags = */ 0,
1390 /* .cbData = */ sizeof(DBGDIGGERLINUX),
1391 /* .szName = */ "Linux",
1392 /* .pfnConstruct = */ dbgDiggerLinuxConstruct,
1393 /* .pfnDestruct = */ dbgDiggerLinuxDestruct,
1394 /* .pfnProbe = */ dbgDiggerLinuxProbe,
1395 /* .pfnInit = */ dbgDiggerLinuxInit,
1396 /* .pfnRefresh = */ dbgDiggerLinuxRefresh,
1397 /* .pfnTerm = */ dbgDiggerLinuxTerm,
1398 /* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
1399 /* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
1400 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1401};
1402
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette