VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 99220

Last change on this file since 99220 was 99220, checked in by vboxsync, 21 months ago

Disassember,*: Start separating the disassembler into a architecture specific and common part, bugref:10394

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 123.9 KB
Line 
1/* $Id: DBGPlugInLinux.cpp 99220 2023-03-30 12:40:46Z vboxsync $ */
2/** @file
3 * DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4 */
5
6/*
7 * Copyright (C) 2008-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33#include "DBGPlugIns.h"
34#include "DBGPlugInCommonELF.h"
35#include <VBox/vmm/vmmr3vtable.h>
36#include <VBox/dis.h>
37#include <iprt/ctype.h>
38#include <iprt/file.h>
39#include <iprt/err.h>
40#include <iprt/mem.h>
41#include <iprt/stream.h>
42#include <iprt/string.h>
43#include <iprt/vfs.h>
44#include <iprt/zip.h>
45
46
47/*********************************************************************************************************************************
48* Structures and Typedefs *
49*********************************************************************************************************************************/
50
51/** @name InternalLinux structures
52 * @{ */
53
54
55/** @} */
56
57
58/**
59 * Config item type.
60 */
61typedef enum DBGDIGGERLINUXCFGITEMTYPE
62{
63 /** Invalid type. */
64 DBGDIGGERLINUXCFGITEMTYPE_INVALID = 0,
65 /** String. */
66 DBGDIGGERLINUXCFGITEMTYPE_STRING,
67 /** Number. */
68 DBGDIGGERLINUXCFGITEMTYPE_NUMBER,
69 /** Flag whether this feature is included in the
70 * kernel or as a module. */
71 DBGDIGGERLINUXCFGITEMTYPE_FLAG
72} DBGDIGGERLINUXCFGITEMTYPE;
73
74/**
75 * Item in the config database.
76 */
77typedef struct DBGDIGGERLINUXCFGITEM
78{
79 /** String space core. */
80 RTSTRSPACECORE Core;
81 /** Config item type. */
82 DBGDIGGERLINUXCFGITEMTYPE enmType;
83 /** Data based on the type. */
84 union
85 {
86 /** Number. */
87 int64_t i64Num;
88 /** Flag. */
89 bool fModule;
90 /** String - variable in size. */
91 char aszString[1];
92 } u;
93} DBGDIGGERLINUXCFGITEM;
94/** Pointer to a config database item. */
95typedef DBGDIGGERLINUXCFGITEM *PDBGDIGGERLINUXCFGITEM;
96/** Pointer to a const config database item. */
97typedef const DBGDIGGERLINUXCFGITEM *PCDBGDIGGERLINUXCFGITEM;
98
99/**
100 * Linux guest OS digger instance data.
101 */
102typedef struct DBGDIGGERLINUX
103{
104 /** Whether the information is valid or not.
105 * (For fending off illegal interface method calls.) */
106 bool fValid;
107 /** Set if 64-bit, clear if 32-bit. */
108 bool f64Bit;
109 /** Set if the kallsyms table uses relative addressing, clear
110 * if absolute addresses are used. */
111 bool fRelKrnlAddr;
112 /** The relative base when kernel symbols use offsets rather than
113 * absolute addresses. */
114 RTGCUINTPTR uKernelRelativeBase;
115 /** The guest kernel version used for version comparisons. */
116 uint32_t uKrnlVer;
117 /** The guest kernel major version. */
118 uint32_t uKrnlVerMaj;
119 /** The guest kernel minor version. */
120 uint32_t uKrnlVerMin;
121 /** The guest kernel build version. */
122 uint32_t uKrnlVerBld;
123
124 /** The address of the linux banner.
125 * This is set during probing. */
126 DBGFADDRESS AddrLinuxBanner;
127 /** Kernel base address.
128 * This is set during probing, refined during kallsyms parsing. */
129 DBGFADDRESS AddrKernelBase;
130 /** The kernel size. */
131 uint32_t cbKernel;
132
133 /** The number of kernel symbols (kallsyms_num_syms).
134 * This is set during init. */
135 uint32_t cKernelSymbols;
136 /** The size of the kernel name table (sizeof(kallsyms_names)). */
137 uint32_t cbKernelNames;
138 /** Number of entries in the kernel_markers table. */
139 uint32_t cKernelNameMarkers;
140 /** The size of the kernel symbol token table. */
141 uint32_t cbKernelTokenTable;
142 /** The address of the encoded kernel symbol names (kallsyms_names). */
143 DBGFADDRESS AddrKernelNames;
144 /** The address of the kernel symbol addresses (kallsyms_addresses). */
145 DBGFADDRESS AddrKernelAddresses;
146 /** The address of the kernel symbol name markers (kallsyms_markers). */
147 DBGFADDRESS AddrKernelNameMarkers;
148 /** The address of the kernel symbol token table (kallsyms_token_table). */
149 DBGFADDRESS AddrKernelTokenTable;
150 /** The address of the kernel symbol token index table (kallsyms_token_index). */
151 DBGFADDRESS AddrKernelTokenIndex;
152
153 /** The kernel message log interface. */
154 DBGFOSIDMESG IDmesg;
155
156 /** The config database root. */
157 RTSTRSPACE hCfgDb;
158} DBGDIGGERLINUX;
159/** Pointer to the linux guest OS digger instance data. */
160typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
161
162
163/**
164 * The current printk_log structure.
165 */
166typedef struct LNXPRINTKHDR
167{
168 /** Monotonic timestamp. */
169 uint64_t nsTimestamp;
170 /** The total size of this message record. */
171 uint16_t cbTotal;
172 /** The size of the text part (immediately follows the header). */
173 uint16_t cbText;
174 /** The size of the optional dictionary part (follows the text). */
175 uint16_t cbDict;
176 /** The syslog facility number. */
177 uint8_t bFacility;
178 /** First 5 bits are internal flags, next 3 bits are log level. */
179 uint8_t fFlagsAndLevel;
180} LNXPRINTKHDR;
181AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
182/** Pointer to linux printk_log header. */
183typedef LNXPRINTKHDR *PLNXPRINTKHDR;
184/** Pointer to linux const printk_log header. */
185typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
186
187
188/*********************************************************************************************************************************
189* Defined Constants And Macros *
190*********************************************************************************************************************************/
191/** First kernel map address for 32bit Linux hosts (__START_KERNEL_map). */
192#define LNX32_KERNEL_ADDRESS_START UINT32_C(0xc0000000)
193/** First kernel map address for 64bit Linux hosts (__START_KERNEL_map). */
194#define LNX64_KERNEL_ADDRESS_START UINT64_C(0xffffffff80000000)
195/** Validates a 32-bit linux kernel address */
196#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
197/** Validates a 64-bit linux kernel address */
198#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
199
200/** The max kernel size. */
201#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
202/** Maximum kernel log buffer size. */
203#define LNX_MAX_KERNEL_LOG_SIZE (16 * _1M)
204
205/** The maximum size we expect for kallsyms_names. */
206#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
207/** The maximum size we expect for kallsyms_token_table. */
208#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
209/** The minimum number of symbols we expect in kallsyms_num_syms. */
210#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
211/** The maximum number of symbols we expect in kallsyms_num_syms. */
212#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
213/** The min length an encoded symbol in kallsyms_names is expected to have. */
214#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
215/** The max length an encoded symbol in kallsyms_names is expected to have.
216 * @todo check real life here. */
217#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
218/** The approximate maximum length of a string token. */
219#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
220/** Maximum compressed config size expected. */
221#define LNX_MAX_COMPRESSED_CFG_SIZE _1M
222
223/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
224#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
225/** Macro for building a Linux kernel version which can be used for comparisons. */
226#define LNX_MK_VER(major, minor, build) (((major) << 22) | ((minor) << 12) | (build))
227
228
229/*********************************************************************************************************************************
230* Internal Functions *
231*********************************************************************************************************************************/
232static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
233
234
235/*********************************************************************************************************************************
236* Global Variables *
237*********************************************************************************************************************************/
238/** Table of common linux kernel addresses. */
239static uint64_t g_au64LnxKernelAddresses[] =
240{
241 UINT64_C(0xc0100000),
242 UINT64_C(0x90100000),
243 UINT64_C(0xffffffff80200000)
244};
245
246static const uint8_t g_abLinuxVersion[] = "Linux version ";
247/** The needle for searching for the kernel log area (the value is observed in pretty much all 32bit and 64bit x86 kernels).
248 * This needle should appear only once in the memory due to the address being filled in by a format string. */
249static const uint8_t g_abKrnlLogNeedle[] = "BIOS-e820: [mem 0x0000000000000000";
250
251
252/**
253 * Tries to resolve the kernel log buffer start and end by searching for needle.
254 *
255 * @returns VBox status code.
256 * @param pThis The Linux digger data.
257 * @param pUVM The VM handle.
258 * @param pVMM The VMM function table.
259 * @param pGCPtrLogBuf Where to store the start of the kernel log buffer on success.
260 * @param pcbLogBuf Where to store the size of the kernel log buffer on success.
261 */
262static int dbgDiggerLinuxKrnlLogBufFindByNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
263 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
264{
265 int rc = VINF_SUCCESS;
266
267 /* Try to find the needle, it should be very early in the kernel log buffer. */
268 DBGFADDRESS AddrScan;
269 DBGFADDRESS AddrHit;
270 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrScan, pThis->f64Bit ? LNX64_KERNEL_ADDRESS_START : LNX32_KERNEL_ADDRESS_START);
271
272 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &AddrScan, ~(RTGCUINTPTR)0, 1 /*uAlign*/,
273 g_abKrnlLogNeedle, sizeof(g_abKrnlLogNeedle) - 1, &AddrHit);
274 if (RT_SUCCESS(rc))
275 {
276 uint32_t cbLogBuf = 0;
277 uint64_t tsLastNs = 0;
278 DBGFADDRESS AddrCur;
279
280 pVMM->pfnDBGFR3AddrSub(&AddrHit, sizeof(LNXPRINTKHDR));
281 AddrCur = AddrHit;
282
283 /* Try to find the end of the kernel log buffer. */
284 for (;;)
285 {
286 if (cbLogBuf >= LNX_MAX_KERNEL_LOG_SIZE)
287 break;
288
289 LNXPRINTKHDR Hdr;
290 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrCur, &Hdr, sizeof(Hdr));
291 if (RT_SUCCESS(rc))
292 {
293 uint32_t const cbLogAlign = 4;
294
295 /*
296 * If the header does not look valid anymore we stop.
297 * Timestamps are monotonically increasing.
298 */
299 if ( !Hdr.cbTotal /* Zero entry size means there is no record anymore, doesn't make sense to look futher. */
300 || Hdr.cbText + Hdr.cbDict + sizeof(Hdr) > Hdr.cbTotal
301 || (Hdr.cbTotal & (cbLogAlign - 1)) != 0
302 || tsLastNs > Hdr.nsTimestamp)
303 break;
304
305 /** @todo Maybe read text part and verify it is all ASCII. */
306
307 cbLogBuf += Hdr.cbTotal;
308 pVMM->pfnDBGFR3AddrAdd(&AddrCur, Hdr.cbTotal);
309 }
310
311 if (RT_FAILURE(rc))
312 break;
313 }
314
315 /** @todo Go back to find the start address of the kernel log (or we loose potential kernel log messages). */
316
317 if ( RT_SUCCESS(rc)
318 && cbLogBuf)
319 {
320 /* Align log buffer size to a power of two. */
321 uint32_t idxBitLast = ASMBitLastSetU32(cbLogBuf);
322 idxBitLast--; /* There is at least one bit set, see check above. */
323
324 if (cbLogBuf & (RT_BIT_32(idxBitLast) - 1))
325 idxBitLast++;
326
327 *pGCPtrLogBuf = AddrHit.FlatPtr;
328 *pcbLogBuf = RT_MIN(RT_BIT_32(idxBitLast), LNX_MAX_KERNEL_LOG_SIZE);
329 }
330 else if (RT_SUCCESS(rc))
331 rc = VERR_NOT_FOUND;
332 }
333
334 return rc;
335}
336
337
338/**
339 * Converts a given offset into an absolute address if relative kernel offsets are used for
340 * kallsyms.
341 *
342 * @returns The absolute kernel address.
343 * @param pThis The Linux digger data.
344 * @param uOffset The offset to convert.
345 */
346DECLINLINE(RTGCUINTPTR) dbgDiggerLinuxConvOffsetToAddr(PDBGDIGGERLINUX pThis, int32_t uOffset)
347{
348 RTGCUINTPTR uAddr;
349
350 /*
351 * How the absolute address is calculated from the offset depends on the
352 * CONFIG_KALLSYMS_ABSOLUTE_PERCPU config which is only set for 64bit
353 * SMP kernels (we assume that all 64bit kernels always have SMP enabled too).
354 */
355 if (pThis->f64Bit)
356 {
357 if (uOffset >= 0)
358 uAddr = uOffset;
359 else
360 uAddr = pThis->uKernelRelativeBase - 1 - uOffset;
361 }
362 else
363 uAddr = pThis->uKernelRelativeBase + (uint32_t)uOffset;
364
365 return uAddr;
366}
367
368/**
369 * Disassembles a simple getter returning the value for it.
370 *
371 * @returns VBox status code.
372 * @param pThis The Linux digger data.
373 * @param pUVM The VM handle.
374 * @param pVMM The VMM function table.
375 * @param hMod The module to use.
376 * @param pszSymbol The symbol of the getter.
377 * @param pvVal Where to store the value on success.
378 * @param cbVal Size of the value in bytes.
379 */
380static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
381 const char *pszSymbol, void *pvVal, uint32_t cbVal)
382{
383 int rc = VINF_SUCCESS;
384
385 RTDBGSYMBOL SymInfo;
386 rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
387 if (RT_SUCCESS(rc))
388 {
389 /*
390 * Do the diassembling. Disassemble until a ret instruction is encountered
391 * or a limit is reached (don't want to disassemble for too long as the getter
392 * should be short).
393 * push and pop instructions are skipped as well as any mov instructions not
394 * touching the rax or eax register (depending on the size of the value).
395 */
396 unsigned cInstrDisassembled = 0;
397 uint32_t offInstr = 0;
398 bool fRet = false;
399 DISSTATE DisState;
400 RT_ZERO(DisState);
401
402 do
403 {
404 DBGFADDRESS Addr;
405 RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
406 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
407
408 /* Prefetch the instruction. */
409 uint8_t abInstr[32];
410 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &abInstr[0], sizeof(abInstr));
411 if (RT_SUCCESS(rc))
412 {
413 uint32_t cbInstr = 0;
414
415 rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
416 if (RT_SUCCESS(rc))
417 {
418 switch (DisState.pCurInstr->uOpcode)
419 {
420 case OP_PUSH:
421 case OP_POP:
422 case OP_NOP:
423 case OP_LEA:
424 break;
425 case OP_RETN:
426 /* Getter returned, abort disassembling. */
427 fRet = true;
428 break;
429 case OP_MOV:
430 /*
431 * Check that the destination is either rax or eax depending on the
432 * value size.
433 *
434 * Param1 is the destination and Param2 the source.
435 */
436 if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN32))
437 && cbVal == sizeof(uint32_t))
438 || ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN64))
439 && cbVal == sizeof(uint64_t)))
440 && DisState.Param1.arch.x86.Base.idxGenReg == DISGREG_RAX)
441 {
442 /* Parse the source. */
443 if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 | DISUSE_IMMEDIATE64))
444 memcpy(pvVal, &DisState.Param2.uValue, cbVal);
445 else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32|DISUSE_DISPLACEMENT32|DISUSE_DISPLACEMENT64))
446 {
447 RTGCPTR GCPtrVal = 0;
448
449 if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
450 GCPtrVal = GCPtrCur + DisState.Param2.arch.x86.uDisp.i32 + cbInstr;
451 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
452 GCPtrVal = (RTGCPTR)DisState.Param2.arch.x86.uDisp.u32;
453 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
454 GCPtrVal = (RTGCPTR)DisState.Param2.arch.x86.uDisp.u64;
455 else
456 AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
457
458 DBGFADDRESS AddrVal;
459 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
460 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
461 pvVal, cbVal);
462 }
463 }
464 break;
465 default:
466 /* All other instructions will cause an error for now (playing safe here). */
467 rc = VERR_INVALID_PARAMETER;
468 break;
469 }
470 cInstrDisassembled++;
471 offInstr += cbInstr;
472 }
473 }
474 } while ( RT_SUCCESS(rc)
475 && cInstrDisassembled < 20
476 && !fRet);
477 }
478
479 return rc;
480}
481
482/**
483 * Try to get at the log buffer starting address and size by disassembling emit_log_char.
484 *
485 * @returns VBox status code.
486 * @param pThis The Linux digger data.
487 * @param pUVM The VM handle.
488 * @param pVMM The VMM function table.
489 * @param hMod The module to use.
490 * @param pGCPtrLogBuf Where to store the log buffer pointer on success.
491 * @param pcbLogBuf Where to store the size of the log buffer on success.
492 */
493static int dbgDiggerLinuxQueryAsciiLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
494 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
495{
496 int rc = VINF_SUCCESS;
497
498 /**
499 * We disassemble emit_log_char to get at the log buffer address and size.
500 * This is used in case the symbols are not exported in kallsyms.
501 *
502 * This is what it typically looks like:
503 * vmlinux!emit_log_char:
504 * %00000000c01204a1 56 push esi
505 * %00000000c01204a2 8b 35 d0 1c 34 c0 mov esi, dword [0c0341cd0h]
506 * %00000000c01204a8 53 push ebx
507 * %00000000c01204a9 8b 1d 74 3b 3e c0 mov ebx, dword [0c03e3b74h]
508 * %00000000c01204af 8b 0d d8 1c 34 c0 mov ecx, dword [0c0341cd8h]
509 * %00000000c01204b5 8d 56 ff lea edx, [esi-001h]
510 * %00000000c01204b8 21 da and edx, ebx
511 * %00000000c01204ba 88 04 11 mov byte [ecx+edx], al
512 * %00000000c01204bd 8d 53 01 lea edx, [ebx+001h]
513 * %00000000c01204c0 89 d0 mov eax, edx
514 * [...]
515 */
516 RTDBGSYMBOL SymInfo;
517 rc = RTDbgModSymbolByName(hMod, "emit_log_char", &SymInfo);
518 if (RT_SUCCESS(rc))
519 {
520 /*
521 * Do the diassembling. Disassemble until a ret instruction is encountered
522 * or a limit is reached (don't want to disassemble for too long as the getter
523 * should be short). Certain instructions found are ignored (push, nop, etc.).
524 */
525 unsigned cInstrDisassembled = 0;
526 uint32_t offInstr = 0;
527 bool fRet = false;
528 DISSTATE DisState;
529 unsigned cAddressesUsed = 0;
530 struct { size_t cb; RTGCPTR GCPtrOrigSrc; } aAddresses[5];
531 RT_ZERO(DisState);
532 RT_ZERO(aAddresses);
533
534 do
535 {
536 DBGFADDRESS Addr;
537 RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
538 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
539
540 /* Prefetch the instruction. */
541 uint8_t abInstr[32];
542 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &abInstr[0], sizeof(abInstr));
543 if (RT_SUCCESS(rc))
544 {
545 uint32_t cbInstr = 0;
546
547 rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
548 if (RT_SUCCESS(rc))
549 {
550 switch (DisState.pCurInstr->uOpcode)
551 {
552 case OP_PUSH:
553 case OP_POP:
554 case OP_NOP:
555 case OP_LEA:
556 case OP_AND:
557 case OP_CBW:
558 case OP_DEC:
559 break;
560 case OP_RETN:
561 /* emit_log_char returned, abort disassembling. */
562 rc = VERR_NOT_FOUND;
563 fRet = true;
564 break;
565 case OP_MOV:
566 case OP_MOVSXD:
567 /*
568 * If a mov is encountered writing to memory with al (or dil for amd64) being the source the
569 * character is stored and we can infer the base address and size of the log buffer from
570 * the source addresses.
571 */
572 if ( (DisState.Param2.fUse & DISUSE_REG_GEN8)
573 && ( (DisState.Param2.arch.x86.Base.idxGenReg == DISGREG_AL && !pThis->f64Bit)
574 || (DisState.Param2.arch.x86.Base.idxGenReg == DISGREG_DIL && pThis->f64Bit))
575 && DISUSE_IS_EFFECTIVE_ADDR(DisState.Param1.fUse))
576 {
577 RTGCPTR GCPtrLogBuf = 0;
578 uint32_t cbLogBuf = 0;
579
580 /*
581 * We can stop disassembling now and inspect all registers, look for a valid kernel address first.
582 * Only one of the accessed registers should hold a valid kernel address.
583 * For the log size look for the biggest non kernel address.
584 */
585 for (unsigned i = 0; i < cAddressesUsed; i++)
586 {
587 DBGFADDRESS AddrVal;
588 union { uint8_t abVal[8]; uint32_t u32Val; uint64_t u64Val; } Val;
589
590 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
591 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal,
592 aAddresses[i].GCPtrOrigSrc),
593 &Val.abVal[0], aAddresses[i].cb);
594 if (RT_SUCCESS(rc))
595 {
596 if (pThis->f64Bit && aAddresses[i].cb == sizeof(uint64_t))
597 {
598 if (LNX64_VALID_ADDRESS(Val.u64Val))
599 {
600 if (GCPtrLogBuf == 0)
601 GCPtrLogBuf = Val.u64Val;
602 else
603 {
604 rc = VERR_NOT_FOUND;
605 break;
606 }
607 }
608 }
609 else
610 {
611 AssertMsgBreakStmt(aAddresses[i].cb == sizeof(uint32_t),
612 ("Invalid value size\n"), rc = VERR_INVALID_STATE);
613
614 /* Might be a kernel address or a size indicator. */
615 if (!pThis->f64Bit && LNX32_VALID_ADDRESS(Val.u32Val))
616 {
617 if (GCPtrLogBuf == 0)
618 GCPtrLogBuf = Val.u32Val;
619 else
620 {
621 rc = VERR_NOT_FOUND;
622 break;
623 }
624 }
625 else
626 {
627 /*
628 * The highest value will be the log buffer because the other
629 * accessed variables are indexes into the buffer and hence
630 * always smaller than the size.
631 */
632 if (cbLogBuf < Val.u32Val)
633 cbLogBuf = Val.u32Val;
634 }
635 }
636 }
637 }
638
639 if ( RT_SUCCESS(rc)
640 && GCPtrLogBuf != 0
641 && cbLogBuf != 0)
642 {
643 *pGCPtrLogBuf = GCPtrLogBuf;
644 *pcbLogBuf = cbLogBuf;
645 }
646 else if (RT_SUCCESS(rc))
647 rc = VERR_NOT_FOUND;
648
649 fRet = true;
650 break;
651 }
652 else
653 {
654 /*
655 * In case of a memory to register move store the destination register index and the
656 * source address in the relation table for later processing.
657 */
658 if ( (DisState.Param1.fUse & (DISUSE_BASE | DISUSE_REG_GEN32 | DISUSE_REG_GEN64))
659 && (DisState.Param2.arch.x86.cb == sizeof(uint32_t) || DisState.Param2.arch.x86.cb == sizeof(uint64_t))
660 && (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32|DISUSE_DISPLACEMENT32|DISUSE_DISPLACEMENT64)))
661 {
662 RTGCPTR GCPtrVal = 0;
663
664 if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
665 GCPtrVal = GCPtrCur + DisState.Param2.arch.x86.uDisp.i32 + cbInstr;
666 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
667 GCPtrVal = (RTGCPTR)DisState.Param2.arch.x86.uDisp.u32;
668 else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
669 GCPtrVal = (RTGCPTR)DisState.Param2.arch.x86.uDisp.u64;
670 else
671 AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
672
673 if (cAddressesUsed < RT_ELEMENTS(aAddresses))
674 {
675 /* movsxd reads always 32bits. */
676 if (DisState.pCurInstr->uOpcode == OP_MOVSXD)
677 aAddresses[cAddressesUsed].cb = sizeof(uint32_t);
678 else
679 aAddresses[cAddressesUsed].cb = DisState.Param2.arch.x86.cb;
680 aAddresses[cAddressesUsed].GCPtrOrigSrc = GCPtrVal;
681 cAddressesUsed++;
682 }
683 else
684 {
685 rc = VERR_INVALID_PARAMETER;
686 break;
687 }
688 }
689 }
690 break;
691 default:
692 /* All other instructions will cause an error for now (playing safe here). */
693 rc = VERR_INVALID_PARAMETER;
694 break;
695 }
696 cInstrDisassembled++;
697 offInstr += cbInstr;
698 }
699 }
700 } while ( RT_SUCCESS(rc)
701 && cInstrDisassembled < 20
702 && !fRet);
703 }
704
705 return rc;
706}
707
708/**
709 * Try to get at the log buffer starting address and size by disassembling some exposed helpers.
710 *
711 * @returns VBox status code.
712 * @param pThis The Linux digger data.
713 * @param pUVM The VM handle.
714 * @param pVMM The VMM function table.
715 * @param hMod The module to use.
716 * @param pGCPtrLogBuf Where to store the log buffer pointer on success.
717 * @param pcbLogBuf Where to store the size of the log buffer on success.
718 */
719static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
720 RTGCPTR *pGCPtrLogBuf, uint32_t *pcbLogBuf)
721{
722 int rc = VINF_SUCCESS;
723
724 struct { void *pvVar; uint32_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
725 {
726 { pGCPtrLogBuf, (uint32_t)sizeof(RTGCPTR), (uint32_t)(pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)), "log_buf_addr_get" },
727 { pcbLogBuf, (uint32_t)sizeof(uint32_t), (uint32_t)sizeof(uint32_t), "log_buf_len_get" }
728 };
729 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
730 {
731 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
732 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
733 rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, pVMM, hMod, aSymbols[i].pszSymbol,
734 aSymbols[i].pvVar, aSymbols[i].cbGuest);
735 }
736
737 return rc;
738}
739
740/**
741 * Returns whether the log buffer is a simple ascii buffer or a record based implementation
742 * based on the kernel version found.
743 *
744 * @returns Flag whether the log buffer is the simple ascii buffer.
745 * @param pThis The Linux digger data.
746 * @param pUVM The user mode VM handle.
747 * @param pVMM The VMM function table.
748 */
749static bool dbgDiggerLinuxLogBufferIsAsciiBuffer(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
750{
751 char szTmp[128];
752 char const *pszVer = &szTmp[sizeof(g_abLinuxVersion) - 1];
753
754 RT_ZERO(szTmp);
755 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, szTmp, sizeof(szTmp) - 1);
756 if ( RT_SUCCESS(rc)
757 && RTStrVersionCompare(pszVer, "3.4") == -1)
758 return true;
759
760 return false;
761}
762
763/**
764 * Worker to get at the kernel log for pre 3.4 kernels where the log buffer was just a char buffer.
765 *
766 * @returns VBox status code.
767 * @param pThis The Linux digger data.
768 * @param pUVM The VM user mdoe handle.
769 * @param pVMM The VMM function table.
770 * @param hMod The debug module handle.
771 * @param fFlags Flags reserved for future use, MBZ.
772 * @param cMessages The number of messages to retrieve, counting from the
773 * end of the log (i.e. like tail), use UINT32_MAX for all.
774 * @param pszBuf The output buffer.
775 * @param cbBuf The buffer size.
776 * @param pcbActual Where to store the number of bytes actually returned,
777 * including zero terminator. On VERR_BUFFER_OVERFLOW this
778 * holds the necessary buffer size. Optional.
779 */
780static int dbgDiggerLinuxLogBufferQueryAscii(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
781 uint32_t fFlags, uint32_t cMessages,
782 char *pszBuf, size_t cbBuf, size_t *pcbActual)
783{
784 RT_NOREF2(fFlags, cMessages);
785 int rc = VINF_SUCCESS;
786 RTGCPTR GCPtrLogBuf;
787 uint32_t cbLogBuf;
788
789 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
790 {
791 { &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
792 { &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
793 };
794 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
795 {
796 RTDBGSYMBOL SymInfo;
797 rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
798 if (RT_SUCCESS(rc))
799 {
800 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
801 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
802 DBGFADDRESS Addr;
803 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
804 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
805 (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
806 aSymbols[i].pvVar, aSymbols[i].cbGuest);
807 if (RT_SUCCESS(rc))
808 continue;
809 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
810 }
811 else
812 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
813 rc = VERR_NOT_FOUND;
814 break;
815 }
816
817 /*
818 * Some kernels don't expose the variables in kallsyms so we have to try disassemble
819 * some public helpers to get at the addresses.
820 *
821 * @todo: Maybe cache those values so we don't have to do the heavy work every time?
822 */
823 if (rc == VERR_NOT_FOUND)
824 {
825 rc = dbgDiggerLinuxQueryAsciiLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
826 if (RT_FAILURE(rc))
827 return rc;
828 }
829
830 /*
831 * Check if the values make sense.
832 */
833 if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
834 {
835 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
836 return VERR_NOT_FOUND;
837 }
838 if ( cbLogBuf < 4096
839 || !RT_IS_POWER_OF_TWO(cbLogBuf)
840 || cbLogBuf > 16*_1M)
841 {
842 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
843 return VERR_NOT_FOUND;
844 }
845
846 /*
847 * Read the whole log buffer.
848 */
849 uint8_t *pbLogBuf = (uint8_t *)RTMemAlloc(cbLogBuf);
850 if (!pbLogBuf)
851 {
852 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
853 return VERR_NO_MEMORY;
854 }
855 DBGFADDRESS Addr;
856 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
857 if (RT_FAILURE(rc))
858 {
859 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
860 cbLogBuf, Addr.FlatPtr, rc));
861 RTMemFree(pbLogBuf);
862 return VERR_NOT_FOUND;
863 }
864
865 /** @todo Try to parse where the single messages start to make use of cMessages. */
866 size_t cchLength = RTStrNLen((const char *)pbLogBuf, cbLogBuf);
867 memcpy(&pszBuf[0], pbLogBuf, RT_MIN(cbBuf, cchLength));
868
869 /* Done with the buffer. */
870 RTMemFree(pbLogBuf);
871
872 /* Set return size value. */
873 if (pcbActual)
874 *pcbActual = RT_MIN(cbBuf, cchLength);
875
876 return cbBuf <= cchLength ? VERR_BUFFER_OVERFLOW : VINF_SUCCESS;
877}
878
879
880/**
881 * Worker to process a given record based kernel log.
882 *
883 * @returns VBox status code.
884 * @param pThis The Linux digger data.
885 * @param pUVM The VM user mode handle.
886 * @param pVMM The VMM function table.
887 * @param GCPtrLogBuf Flat guest address of the start of the log buffer.
888 * @param cbLogBuf Power of two aligned size of the log buffer.
889 * @param idxFirst Index in the log bfufer of the first message.
890 * @param idxNext Index where to write hte next message in the log buffer.
891 * @param fFlags Flags reserved for future use, MBZ.
892 * @param cMessages The number of messages to retrieve, counting from the
893 * end of the log (i.e. like tail), use UINT32_MAX for all.
894 * @param pszBuf The output buffer.
895 * @param cbBuf The buffer size.
896 * @param pcbActual Where to store the number of bytes actually returned,
897 * including zero terminator. On VERR_BUFFER_OVERFLOW this
898 * holds the necessary buffer size. Optional.
899 */
900static int dbgDiggerLinuxKrnLogBufferProcess(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTGCPTR GCPtrLogBuf,
901 uint32_t cbLogBuf, uint32_t idxFirst, uint32_t idxNext,
902 uint32_t fFlags, uint32_t cMessages, char *pszBuf, size_t cbBuf,
903 size_t *pcbActual)
904{
905 RT_NOREF(fFlags);
906
907 /*
908 * Check if the values make sense.
909 */
910 if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
911 {
912 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
913 return VERR_NOT_FOUND;
914 }
915 if ( cbLogBuf < _4K
916 || !RT_IS_POWER_OF_TWO(cbLogBuf)
917 || cbLogBuf > LNX_MAX_KERNEL_LOG_SIZE)
918 {
919 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
920 return VERR_NOT_FOUND;
921 }
922 uint32_t const cbLogAlign = 4;
923 if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
924 || (idxFirst & (cbLogAlign - 1)) != 0)
925 {
926 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
927 return VERR_NOT_FOUND;
928 }
929 if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
930 || (idxNext & (cbLogAlign - 1)) != 0)
931 {
932 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
933 return VERR_NOT_FOUND;
934 }
935
936 /*
937 * Read the whole log buffer.
938 */
939 uint8_t *pbLogBuf = (uint8_t *)RTMemAlloc(cbLogBuf);
940 if (!pbLogBuf)
941 {
942 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
943 return VERR_NO_MEMORY;
944 }
945 DBGFADDRESS Addr;
946 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
947 if (RT_FAILURE(rc))
948 {
949 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
950 cbLogBuf, Addr.FlatPtr, rc));
951 RTMemFree(pbLogBuf);
952 return VERR_NOT_FOUND;
953 }
954
955 /*
956 * Count the messages in the buffer while doing some basic validation.
957 */
958 uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
959 : idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
960 uint32_t cbLeft = cbUsed;
961 uint32_t offCur = idxFirst;
962 uint32_t cLogMsgs = 0;
963
964 while (cbLeft > 0)
965 {
966 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
967 if (!pHdr->cbTotal)
968 {
969 /* Wrap around packet, most likely... */
970 if (cbLogBuf - offCur >= cbLeft)
971 break;
972 offCur = 0;
973 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
974 }
975 if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
976 || pHdr->cbTotal > cbLeft
977 || (pHdr->cbTotal & (cbLogAlign - 1)) != 0
978 || pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
979 {
980 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
981 offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
982 break;
983 }
984
985 if (pHdr->cbText > 0)
986 cLogMsgs++;
987
988 /* next */
989 offCur += pHdr->cbTotal;
990 cbLeft -= pHdr->cbTotal;
991 }
992 if (!cLogMsgs)
993 {
994 RTMemFree(pbLogBuf);
995 return VERR_NOT_FOUND;
996 }
997
998 /*
999 * Copy the messages into the output buffer.
1000 */
1001 offCur = idxFirst;
1002 cbLeft = cbUsed - cbLeft;
1003
1004 /* Skip messages that the caller doesn't want. */
1005 if (cMessages < cLogMsgs)
1006 {
1007 uint32_t cToSkip = cLogMsgs - cMessages;
1008 cLogMsgs -= cToSkip;
1009
1010 while (cToSkip > 0)
1011 {
1012 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1013 if (!pHdr->cbTotal)
1014 {
1015 offCur = 0;
1016 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1017 }
1018 if (pHdr->cbText > 0)
1019 cToSkip--;
1020
1021 /* next */
1022 offCur += pHdr->cbTotal;
1023 cbLeft -= pHdr->cbTotal;
1024 }
1025 }
1026
1027 /* Now copy the messages. */
1028 size_t offDst = 0;
1029 while (cbLeft > 0)
1030 {
1031 PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1032 if ( !pHdr->cbTotal
1033 || !cLogMsgs)
1034 {
1035 if (cbLogBuf - offCur >= cbLeft)
1036 break;
1037 offCur = 0;
1038 pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1039 }
1040
1041 if (pHdr->cbText > 0)
1042 {
1043 char *pchText = (char *)(pHdr + 1);
1044 size_t cchText = RTStrNLen(pchText, pHdr->cbText);
1045 if (offDst + cchText < cbBuf)
1046 {
1047 memcpy(&pszBuf[offDst], pHdr + 1, cchText);
1048 pszBuf[offDst + cchText] = '\n';
1049 }
1050 else if (offDst < cbBuf)
1051 memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
1052 offDst += cchText + 1;
1053 }
1054
1055 /* next */
1056 offCur += pHdr->cbTotal;
1057 cbLeft -= pHdr->cbTotal;
1058 }
1059
1060 /* Done with the buffer. */
1061 RTMemFree(pbLogBuf);
1062
1063 /* Make sure we've reserved a char for the terminator. */
1064 if (!offDst)
1065 offDst = 1;
1066
1067 /* Set return size value. */
1068 if (pcbActual)
1069 *pcbActual = offDst;
1070
1071 if (offDst <= cbBuf)
1072 return VINF_SUCCESS;
1073 return VERR_BUFFER_OVERFLOW;
1074}
1075
1076
1077/**
1078 * Worker to get at the kernel log for post 3.4 kernels where the log buffer contains records.
1079 *
1080 * @returns VBox status code.
1081 * @param pThis The Linux digger data.
1082 * @param pUVM The VM user mdoe handle.
1083 * @param pVMM The VMM function table.
1084 * @param hMod The debug module handle.
1085 * @param fFlags Flags reserved for future use, MBZ.
1086 * @param cMessages The number of messages to retrieve, counting from the
1087 * end of the log (i.e. like tail), use UINT32_MAX for all.
1088 * @param pszBuf The output buffer.
1089 * @param cbBuf The buffer size.
1090 * @param pcbActual Where to store the number of bytes actually returned,
1091 * including zero terminator. On VERR_BUFFER_OVERFLOW this
1092 * holds the necessary buffer size. Optional.
1093 */
1094static int dbgDiggerLinuxLogBufferQueryRecords(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
1095 uint32_t fFlags, uint32_t cMessages,
1096 char *pszBuf, size_t cbBuf, size_t *pcbActual)
1097{
1098 int rc = VINF_SUCCESS;
1099 RTGCPTR GCPtrLogBuf;
1100 uint32_t cbLogBuf;
1101 uint32_t idxFirst;
1102 uint32_t idxNext;
1103
1104 struct { void *pvVar; size_t cbHost, cbGuest; const char *pszSymbol; } aSymbols[] =
1105 {
1106 { &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
1107 { &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
1108 { &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
1109 { &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
1110 };
1111 for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
1112 {
1113 RTDBGSYMBOL SymInfo;
1114 rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
1115 if (RT_SUCCESS(rc))
1116 {
1117 RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
1118 Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
1119 DBGFADDRESS Addr;
1120 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1121 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1122 (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
1123 aSymbols[i].pvVar, aSymbols[i].cbGuest);
1124 if (RT_SUCCESS(rc))
1125 continue;
1126 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
1127 }
1128 else
1129 LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
1130 rc = VERR_NOT_FOUND;
1131 break;
1132 }
1133
1134 /*
1135 * Some kernels don't expose the variables in kallsyms so we have to try disassemble
1136 * some public helpers to get at the addresses.
1137 *
1138 * @todo: Maybe cache those values so we don't have to do the heavy work every time?
1139 */
1140 if (rc == VERR_NOT_FOUND)
1141 {
1142 idxFirst = 0;
1143 idxNext = 0;
1144 rc = dbgDiggerLinuxQueryLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
1145 if (RT_FAILURE(rc))
1146 {
1147 /*
1148 * Last resort, scan for a known value which should appear only once in the kernel log buffer
1149 * and try to deduce the boundaries from there.
1150 */
1151 return dbgDiggerLinuxKrnlLogBufFindByNeedle(pThis, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1152 }
1153 }
1154
1155 return dbgDiggerLinuxKrnLogBufferProcess(pThis, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, idxFirst, idxNext,
1156 fFlags, cMessages, pszBuf, cbBuf, pcbActual);
1157}
1158
1159/**
1160 * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
1161 */
1162static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, uint32_t fFlags,
1163 uint32_t cMessages, char *pszBuf, size_t cbBuf, size_t *pcbActual)
1164{
1165 PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
1166
1167 if (cMessages < 1)
1168 return VERR_INVALID_PARAMETER;
1169
1170 /*
1171 * Resolve the symbols we need and read their values.
1172 */
1173 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1174 RTDBGMOD hMod;
1175 int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
1176 RTDbgAsRelease(hAs);
1177
1178 size_t cbActual = 0;
1179 if (RT_SUCCESS(rc))
1180 {
1181 /*
1182 * Check whether the kernel log buffer is a simple char buffer or the newer
1183 * record based implementation.
1184 * The record based implementation was presumably introduced with kernel 3.4,
1185 * see: http://thread.gmane.org/gmane.linux.kernel/1284184
1186 */
1187 if (dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1188 rc = dbgDiggerLinuxLogBufferQueryAscii(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1189 else
1190 rc = dbgDiggerLinuxLogBufferQueryRecords(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1191
1192 /* Release the module in any case. */
1193 RTDbgModRelease(hMod);
1194 }
1195 else
1196 {
1197 /*
1198 * For the record based kernel versions we have a last resort heuristic which doesn't
1199 * require any symbols, try that here.
1200 */
1201 if (!dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1202 {
1203 RTGCPTR GCPtrLogBuf = 0;
1204 uint32_t cbLogBuf = 0;
1205
1206 rc = dbgDiggerLinuxKrnlLogBufFindByNeedle(pData, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1207 if (RT_SUCCESS(rc))
1208 rc = dbgDiggerLinuxKrnLogBufferProcess(pData, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, 0 /*idxFirst*/, 0 /*idxNext*/,
1209 fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1210 }
1211 else
1212 rc = VERR_NOT_FOUND;
1213 }
1214
1215 if (RT_FAILURE(rc) && rc != VERR_BUFFER_OVERFLOW)
1216 return rc;
1217
1218 if (pcbActual)
1219 *pcbActual = cbActual;
1220
1221 /*
1222 * All VBox strings are UTF-8 and bad things may in theory happen if we
1223 * pass bad UTF-8 to code which assumes it's all valid. So, we enforce
1224 * UTF-8 upon the guest kernel messages here even if they (probably) have
1225 * no defined code set in reality.
1226 */
1227 if ( RT_SUCCESS(rc)
1228 && cbActual <= cbBuf)
1229 {
1230 pszBuf[cbActual - 1] = '\0';
1231 RTStrPurgeEncoding(pszBuf);
1232 return VINF_SUCCESS;
1233 }
1234
1235 if (cbBuf)
1236 {
1237 pszBuf[cbBuf - 1] = '\0';
1238 RTStrPurgeEncoding(pszBuf);
1239 }
1240 return VERR_BUFFER_OVERFLOW;
1241}
1242
1243
1244/**
1245 * Worker destroying the config database.
1246 */
1247static DECLCALLBACK(int) dbgDiggerLinuxCfgDbDestroyWorker(PRTSTRSPACECORE pStr, void *pvUser)
1248{
1249 PDBGDIGGERLINUXCFGITEM pCfgItem = (PDBGDIGGERLINUXCFGITEM)pStr;
1250 RTStrFree((char *)pCfgItem->Core.pszString);
1251 RTMemFree(pCfgItem);
1252 NOREF(pvUser);
1253 return 0;
1254}
1255
1256
1257/**
1258 * Destroy the config database.
1259 *
1260 * @returns nothing.
1261 * @param pThis The Linux digger data.
1262 */
1263static void dbgDiggerLinuxCfgDbDestroy(PDBGDIGGERLINUX pThis)
1264{
1265 RTStrSpaceDestroy(&pThis->hCfgDb, dbgDiggerLinuxCfgDbDestroyWorker, NULL);
1266}
1267
1268
1269/**
1270 * @copydoc DBGFOSREG::pfnStackUnwindAssist
1271 */
1272static DECLCALLBACK(int) dbgDiggerLinuxStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
1273 PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
1274 RTDBGAS hAs, uint64_t *puScratch)
1275{
1276 RT_NOREF(pUVM, pVMM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
1277 return VINF_SUCCESS;
1278}
1279
1280
1281/**
1282 * @copydoc DBGFOSREG::pfnQueryInterface
1283 */
1284static DECLCALLBACK(void *) dbgDiggerLinuxQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, DBGFOSINTERFACE enmIf)
1285{
1286 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1287 RT_NOREF(pUVM, pVMM);
1288
1289 switch (enmIf)
1290 {
1291 case DBGFOSINTERFACE_DMESG:
1292 return &pThis->IDmesg;
1293
1294 default:
1295 return NULL;
1296 }
1297}
1298
1299
1300/**
1301 * @copydoc DBGFOSREG::pfnQueryVersion
1302 */
1303static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
1304 char *pszVersion, size_t cchVersion)
1305{
1306 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1307 Assert(pThis->fValid);
1308
1309 /*
1310 * It's all in the linux banner.
1311 */
1312 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
1313 if (RT_SUCCESS(rc))
1314 {
1315 char *pszEnd = RTStrEnd(pszVersion, cchVersion);
1316 AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
1317 while ( pszEnd > pszVersion
1318 && RT_C_IS_SPACE(pszEnd[-1]))
1319 pszEnd--;
1320 *pszEnd = '\0';
1321 }
1322 else
1323 RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
1324
1325 return rc;
1326}
1327
1328
1329/**
1330 * @copydoc DBGFOSREG::pfnTerm
1331 */
1332static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1333{
1334 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1335 Assert(pThis->fValid);
1336
1337 /*
1338 * Destroy configuration database.
1339 */
1340 dbgDiggerLinuxCfgDbDestroy(pThis);
1341
1342 /*
1343 * Unlink and release our modules.
1344 */
1345 RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1346 if (hDbgAs != NIL_RTDBGAS)
1347 {
1348 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
1349 while (iMod-- > 0)
1350 {
1351 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
1352 if (hMod != NIL_RTDBGMOD)
1353 {
1354 if (RTDbgModGetTag(hMod) == DIG_LNX_MOD_TAG)
1355 {
1356 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
1357 AssertRC(rc);
1358 }
1359 RTDbgModRelease(hMod);
1360 }
1361 }
1362 RTDbgAsRelease(hDbgAs);
1363 }
1364
1365 pThis->fValid = false;
1366}
1367
1368
1369/**
1370 * @copydoc DBGFOSREG::pfnRefresh
1371 */
1372static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1373{
1374 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1375 RT_NOREF(pThis);
1376 Assert(pThis->fValid);
1377
1378 /*
1379 * For now we'll flush and reload everything.
1380 */
1381 dbgDiggerLinuxTerm(pUVM, pVMM, pvData);
1382 return dbgDiggerLinuxInit(pUVM, pVMM, pvData);
1383}
1384
1385
1386/**
1387 * Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
1388 * digger data.
1389 *
1390 * @returns VINF_SUCCESS.
1391 * @param pThis The Linux digger data to update.
1392 * @param pVMM The VMM function table.
1393 * @param pAddrKernelNames The kallsyms_names address.
1394 * @param cKernelSymbols The number of kernel symbol.
1395 * @param cbAddress The guest address size.
1396 */
1397static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pAddrKernelNames,
1398 uint32_t cKernelSymbols, uint32_t cbAddress)
1399{
1400 pThis->cKernelSymbols = cKernelSymbols;
1401 pThis->AddrKernelNames = *pAddrKernelNames;
1402 pThis->AddrKernelAddresses = *pAddrKernelNames;
1403 uint32_t cbSymbolsSkip = (pThis->fRelKrnlAddr ? 2 : 1) * cbAddress; /* Relative addressing introduces kallsyms_relative_base. */
1404 uint32_t cbOffsets = pThis->fRelKrnlAddr ? sizeof(int32_t) : cbAddress; /* Offsets are always 32bits wide for relative addressing. */
1405 uint32_t cbAlign = 0;
1406
1407 /*
1408 * If the number of symbols is odd there is padding to align the following guest pointer
1409 * sized data properly on 64bit systems with relative addressing.
1410 */
1411 if ( pThis->fRelKrnlAddr
1412 && pThis->f64Bit
1413 && (pThis->cKernelSymbols & 1))
1414 cbAlign = sizeof(int32_t);
1415 pVMM->pfnDBGFR3AddrSub(&pThis->AddrKernelAddresses, cKernelSymbols * cbOffsets + cbSymbolsSkip + cbAlign);
1416
1417 Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
1418 "dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
1419 "dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
1420 pThis->AddrKernelAddresses.FlatPtr,
1421 pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
1422 pThis->AddrKernelNames.FlatPtr));
1423 return VINF_SUCCESS;
1424}
1425
1426
1427/**
1428 * Tries to find the address of the kallsyms_names, kallsyms_num_syms and
1429 * kallsyms_addresses symbols.
1430 *
1431 * The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
1432 * addresses of the other two are stored as pThis->AddrKernelNames and
1433 * pThis->AddrKernelAddresses.
1434 *
1435 * @returns VBox status code, success indicating that all three variables have
1436 * been found and taken down.
1437 * @param pUVM The user mode VM handle.
1438 * @param pVMM The VMM function table.
1439 * @param pThis The Linux digger data.
1440 * @param pHitAddr An address we think is inside kallsyms_names.
1441 */
1442static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis,
1443 PCDBGFADDRESS pHitAddr)
1444{
1445 /*
1446 * Search backwards in chunks.
1447 */
1448 union
1449 {
1450 uint8_t ab[0x1000];
1451 uint32_t au32[0x1000 / sizeof(uint32_t)];
1452 uint64_t au64[0x1000 / sizeof(uint64_t)];
1453 } uBuf;
1454 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
1455 uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1456 DBGFADDRESS CurAddr = *pHitAddr;
1457 pVMM->pfnDBGFR3AddrSub(&CurAddr, cbBuf);
1458 cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
1459 for (;;)
1460 {
1461 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1462 if (RT_FAILURE(rc))
1463 return rc;
1464
1465 /*
1466 * Since Linux 4.6 there are two different methods to store the kallsyms addresses
1467 * in the image.
1468 *
1469 * The first and longer existing method is to store the absolute addresses in an
1470 * array starting at kallsyms_addresses followed by a field which stores the number
1471 * of kernel symbols called kallsyms_num_syms.
1472 * The newer method is to use offsets stored in kallsyms_offsets and have a base pointer
1473 * to relate the offsets to called kallsyms_relative_base. One entry in kallsyms_offsets is
1474 * always 32bit wide regardless of the guest pointer size (this halves the table on 64bit
1475 * systems) but means more work for us for the 64bit case.
1476 *
1477 * When absolute addresses are used the following assumptions hold:
1478 *
1479 * We assume that the three symbols are aligned on guest pointer boundary.
1480 *
1481 * The boundary between the two tables should be noticable as the number
1482 * is unlikely to be more than 16 millions, there will be at least one zero
1483 * byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
1484 * that common in the kallsyms_names table.
1485 *
1486 * Also the kallsyms_names table starts with a length byte, which means
1487 * we're likely to see a byte in the range 1..31.
1488 *
1489 * The kallsyms_addresses are mostly sorted (except for the start where the
1490 * absolute symbols are), so we'll spot a bunch of kernel addresses
1491 * immediately preceeding the kallsyms_num_syms field.
1492 *
1493 * Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
1494 * the check for kernel addresses preceeding it.
1495 *
1496 * For relative offsets most of the assumptions from above are true too
1497 * except that we have to distinguish between the relative base address and the offsets.
1498 * Every observed kernel has a valid kernel address fo the relative base and kallsyms_relative_base
1499 * always comes before kallsyms_num_syms and is aligned on a guest pointer boundary.
1500 * Offsets are stored before kallsyms_relative_base and don't contain valid kernel addresses.
1501 *
1502 * To distinguish between absolute and relative offsetting we check the data before a candidate
1503 * for kallsyms_num_syms. If all entries before the kallsyms_num_syms candidate are valid kernel
1504 * addresses absolute addresses are assumed. If this is not the case but the first entry before
1505 * kallsyms_num_syms is a valid kernel address we check whether the data before and the possible
1506 * relative base form a valid kernel address and assume relative offsets.
1507 *
1508 * Other notable changes between various Linux kernel versions:
1509 *
1510 * 4.20.0+: Commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a made kallsyms_num_syms 32bit
1511 * even on 64bit systems but the alignment of the variables makes the code below work for now
1512 * (tested with a 5.4 and 5.12 kernel) do we keep it that way to avoid making the code even
1513 * messy.
1514 */
1515 if (pThis->f64Bit)
1516 {
1517 uint32_t i = cbBuf / sizeof(uint64_t) - 1;
1518 while (i-- > 0)
1519 if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1520 && uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1521 {
1522 uint8_t *pb = (uint8_t *)&uBuf.au64[i + 1];
1523 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1524 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1525 {
1526 /*
1527 * Check whether we have a valid kernel address and try to distinguish
1528 * whether the kernel uses relative offsetting or absolute addresses.
1529 */
1530 if ( (i >= 1 && LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1531 && (i >= 2 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1532 && (i >= 3 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1533 {
1534 RTGCUINTPTR uKrnlRelBase = uBuf.au64[i - 1];
1535 DBGFADDRESS RelAddr = CurAddr;
1536 int32_t aiRelOff[3];
1537 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1538 pVMM->pfnDBGFR3AddrAdd(&RelAddr,
1539 (i - 1) * sizeof(uint64_t) - sizeof(aiRelOff)),
1540 &aiRelOff[0], sizeof(aiRelOff));
1541 if ( RT_SUCCESS(rc)
1542 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[0])
1543 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[1])
1544 && LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[2]))
1545 {
1546 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1547 uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint64_t)));
1548 pThis->fRelKrnlAddr = true;
1549 pThis->uKernelRelativeBase = uKrnlRelBase;
1550 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1551 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1552 (uint32_t)uBuf.au64[i], sizeof(uint64_t));
1553 }
1554 }
1555
1556 if ( (i <= 0 || LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1557 && (i <= 1 || LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1558 && (i <= 2 || LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1559 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1560 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1561 (uint32_t)uBuf.au64[i], sizeof(uint64_t));
1562 }
1563 }
1564 }
1565 else
1566 {
1567 uint32_t i = cbBuf / sizeof(uint32_t) - 1;
1568 while (i-- > 0)
1569 if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1570 && uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1571 {
1572 uint8_t *pb = (uint8_t *)&uBuf.au32[i + 1];
1573 if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1574 && pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1575 {
1576 /* Check for relative base addressing. */
1577 if (i >= 1 && LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1578 {
1579 RTGCUINTPTR uKrnlRelBase = uBuf.au32[i - 1];
1580 if ( (i <= 1 || LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 2]))
1581 && (i <= 2 || LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 3])))
1582 {
1583 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1584 uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint32_t)));
1585 pThis->fRelKrnlAddr = true;
1586 pThis->uKernelRelativeBase = uKrnlRelBase;
1587 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1588 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1589 uBuf.au32[i], sizeof(uint32_t));
1590 }
1591 }
1592
1593 if ( (i <= 0 || LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1594 && (i <= 1 || LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
1595 && (i <= 2 || LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
1596 return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1597 pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1598 uBuf.au32[i], sizeof(uint32_t));
1599 }
1600 }
1601 }
1602
1603 /*
1604 * Advance
1605 */
1606 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1607 {
1608 Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1609 return VERR_NOT_FOUND;
1610 }
1611 cbLeft -= sizeof(uBuf);
1612 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uBuf));
1613 cbBuf = sizeof(uBuf);
1614 }
1615}
1616
1617
1618/**
1619 * Worker for dbgDiggerLinuxFindEndNames that records the findings.
1620 *
1621 * @returns VINF_SUCCESS
1622 * @param pThis The linux digger data to update.
1623 * @param pVMM The VMM function table.
1624 * @param pAddrMarkers The address of the marker (kallsyms_markers).
1625 * @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
1626 */
1627static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM,
1628 PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
1629{
1630 pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
1631 pThis->AddrKernelNameMarkers = *pAddrMarkers;
1632 pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
1633 pThis->AddrKernelTokenTable = *pAddrMarkers;
1634 pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
1635
1636 Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
1637 "dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
1638 "dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
1639 pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
1640 pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
1641 pThis->AddrKernelTokenTable.FlatPtr));
1642 return VINF_SUCCESS;
1643}
1644
1645
1646/**
1647 * Tries to find the end of kallsyms_names and thereby the start of
1648 * kallsyms_markers and kallsyms_token_table.
1649 *
1650 * The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
1651 * the two other symbols in pThis->AddrKernelNameMarkers and
1652 * pThis->AddrKernelTokenTable. The number of marker entries is stored in
1653 * pThis->cKernelNameMarkers.
1654 *
1655 * @returns VBox status code, success indicating that all three variables have
1656 * been found and taken down.
1657 * @param pUVM The user mode VM handle.
1658 * @param pVMM The VMM function table.
1659 * @param pThis The Linux digger data.
1660 * @param pHitAddr An address we think is inside kallsyms_names.
1661 */
1662static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1663{
1664 /*
1665 * Search forward in chunks.
1666 */
1667 union
1668 {
1669 uint8_t ab[0x1000];
1670 uint32_t au32[0x1000 / sizeof(uint32_t)];
1671 uint64_t au64[0x1000 / sizeof(uint64_t)];
1672 } uBuf;
1673 bool fPendingZeroHit = false;
1674 uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
1675 uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1676 DBGFADDRESS CurAddr = *pHitAddr;
1677 pVMM->pfnDBGFR3AddrSub(&CurAddr, offBuf);
1678 for (;;)
1679 {
1680 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1681 if (RT_FAILURE(rc))
1682 return rc;
1683
1684 /*
1685 * The kallsyms_names table is followed by kallsyms_markers we assume,
1686 * using sizeof(unsigned long) alignment like the preceeding symbols.
1687 *
1688 * The kallsyms_markers table has entried sizeof(unsigned long) and
1689 * contains offsets into kallsyms_names. The kallsyms_markers used to
1690 * index kallsyms_names and reduce seek time when looking up the name
1691 * of an address/symbol. Each entry in kallsyms_markers covers 256
1692 * symbol names.
1693 *
1694 * Because of this, the first entry is always zero and all the entries
1695 * are ascending. It also follows that the size of the table can be
1696 * calculated from kallsyms_num_syms.
1697 *
1698 * Note! We could also have walked kallsyms_names by skipping
1699 * kallsyms_num_syms names, but this is faster and we will
1700 * validate the encoded names later.
1701 *
1702 * git commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a (which became 4.20+) makes kallsyms_markers
1703 * and kallsyms_num_syms uint32_t, even on 64bit systems. Take that into account.
1704 */
1705 if ( pThis->f64Bit
1706 && pThis->uKrnlVer < LNX_MK_VER(4, 20, 0))
1707 {
1708 if ( RT_UNLIKELY(fPendingZeroHit)
1709 && uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1710 && uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1711 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1712 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
1713
1714 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
1715 for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
1716 if (uBuf.au64[i] == 0)
1717 {
1718 if (RT_UNLIKELY(i + 1 >= cEntries))
1719 {
1720 fPendingZeroHit = true;
1721 break;
1722 }
1723 if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1724 && uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1725 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1726 pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
1727 }
1728 }
1729 else
1730 {
1731 if ( RT_UNLIKELY(fPendingZeroHit)
1732 && uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1733 && uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1734 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1735 pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
1736
1737 uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
1738 for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
1739 if (uBuf.au32[i] == 0)
1740 {
1741 if (RT_UNLIKELY(i + 1 >= cEntries))
1742 {
1743 fPendingZeroHit = true;
1744 break;
1745 }
1746 if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1747 && uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1748 return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1749 pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
1750 }
1751 }
1752
1753 /*
1754 * Advance
1755 */
1756 if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1757 {
1758 Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1759 return VERR_NOT_FOUND;
1760 }
1761 cbLeft -= sizeof(uBuf);
1762 pVMM->pfnDBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
1763 offBuf = 0;
1764 }
1765}
1766
1767
1768/**
1769 * Locates the kallsyms_token_index table.
1770 *
1771 * Storing the address in pThis->AddrKernelTokenIndex and the size of the token
1772 * table in pThis->cbKernelTokenTable.
1773 *
1774 * @returns VBox status code.
1775 * @param pUVM The user mode VM handle.
1776 * @param pVMM The VMM function table.
1777 * @param pThis The Linux digger data.
1778 */
1779static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1780{
1781 /*
1782 * The kallsyms_token_table is very much like a string table. Due to the
1783 * nature of the compression algorithm it is reasonably short (one example
1784 * here is 853 bytes), so we'll not be reading it in chunks but in full.
1785 * To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
1786 * memory or any other nasty stuff...
1787 */
1788 union
1789 {
1790 uint8_t ab[0x2000];
1791 uint16_t au16[0x2000 / sizeof(uint16_t)];
1792 } uBuf;
1793 DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
1794 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &CurAddr, &uBuf, sizeof(uBuf));
1795 if (RT_FAILURE(rc))
1796 return rc;
1797
1798 /*
1799 * We've got two choices here, either walk the string table or look for
1800 * the next structure, kallsyms_token_index.
1801 *
1802 * The token index is a table of 256 uint16_t entries (index by bytes
1803 * from kallsyms_names) that gives offsets in kallsyms_token_table. It
1804 * starts with a zero entry and the following entries are sorted in
1805 * ascending order. The range of the entries are reasonably small since
1806 * kallsyms_token_table is small.
1807 *
1808 * The alignment seems to be sizeof(unsigned long), just like
1809 * kallsyms_token_table.
1810 *
1811 * So, we start by looking for a zero 16-bit entry.
1812 */
1813 uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
1814
1815 for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
1816 if ( uBuf.au16[i] == 0
1817 && uBuf.au16[i + 1] > 0
1818 && uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
1819 && (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1820 && (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1821 && (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1822 && (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1823 && (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1824 )
1825 {
1826 pThis->AddrKernelTokenIndex = CurAddr;
1827 pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
1828 pThis->cbKernelTokenTable = i * sizeof(uint16_t);
1829 return VINF_SUCCESS;
1830 }
1831
1832 Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
1833 return VERR_NOT_FOUND;
1834}
1835
1836
1837/**
1838 * Loads the kernel symbols from the given kallsyms offset table decoding the symbol names
1839 * (worker common for dbgDiggerLinuxLoadKernelSymbolsAbsolute() and dbgDiggerLinuxLoadKernelSymbolsRelative()).
1840 *
1841 * @returns VBox status code.
1842 * @param pUVM The user mode VM handle.
1843 * @param pVMM The VMM function table.
1844 * @param pThis The Linux digger data.
1845 * @param uKernelStart Flat kernel start address.
1846 * @param cbKernel Size of the kernel in bytes.
1847 * @param pauSymOff Pointer to the array of symbol offsets in the kallsyms table
1848 * relative to the start of the kernel.
1849 */
1850static int dbgDiggerLinuxLoadKernelSymbolsWorker(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, RTGCUINTPTR uKernelStart,
1851 RTGCUINTPTR cbKernel, RTGCUINTPTR *pauSymOff)
1852{
1853 uint8_t *pbNames = (uint8_t *)RTMemAllocZ(pThis->cbKernelNames);
1854 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1855 if (RT_SUCCESS(rc))
1856 {
1857 char *pszzTokens = (char *)RTMemAllocZ(pThis->cbKernelTokenTable);
1858 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1859 if (RT_SUCCESS(rc))
1860 {
1861 uint16_t *paoffTokens = (uint16_t *)RTMemAllocZ(256 * sizeof(uint16_t));
1862 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1863 if (RT_SUCCESS(rc))
1864 {
1865 /*
1866 * Create a module for the kernel.
1867 */
1868 RTDBGMOD hMod;
1869 rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /*fFlags*/);
1870 if (RT_SUCCESS(rc))
1871 {
1872 rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1873 rc = VINF_SUCCESS;
1874
1875 /*
1876 * Enumerate the symbols.
1877 */
1878 uint32_t offName = 0;
1879 uint32_t cLeft = pThis->cKernelSymbols;
1880 while (cLeft-- > 0 && RT_SUCCESS(rc))
1881 {
1882 /* Decode the symbol name first. */
1883 if (RT_LIKELY(offName < pThis->cbKernelNames))
1884 {
1885 uint8_t cbName = pbNames[offName++];
1886 if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1887 {
1888 char szSymbol[4096];
1889 uint32_t offSymbol = 0;
1890 while (cbName-- > 0)
1891 {
1892 uint8_t bEnc = pbNames[offName++];
1893 uint16_t offToken = paoffTokens[bEnc];
1894 if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1895 {
1896 const char *pszToken = &pszzTokens[offToken];
1897 char ch;
1898 while ((ch = *pszToken++) != '\0')
1899 if (offSymbol < sizeof(szSymbol) - 1)
1900 szSymbol[offSymbol++] = ch;
1901 }
1902 else
1903 {
1904 rc = VERR_INVALID_UTF8_ENCODING;
1905 break;
1906 }
1907 }
1908 szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1909
1910 /* The offset. */
1911 RTGCUINTPTR uSymOff = *pauSymOff;
1912 pauSymOff++;
1913
1914 /* Add it without the type char. */
1915 if (uSymOff <= cbKernel)
1916 {
1917 rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymOff,
1918 0 /*cb*/, 0 /*fFlags*/, NULL);
1919 if (RT_FAILURE(rc))
1920 {
1921 if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1922 || rc == VERR_DBG_INVALID_RVA
1923 || rc == VERR_DBG_ADDRESS_CONFLICT
1924 || rc == VERR_DBG_DUPLICATE_SYMBOL)
1925 {
1926 Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1927 rc = VINF_SUCCESS;
1928 }
1929 else
1930 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1931 }
1932 }
1933 }
1934 else
1935 {
1936 rc = VERR_END_OF_STRING;
1937 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1938 offName, cLeft, cbName, pThis->cbKernelNames));
1939 }
1940 }
1941 else
1942 {
1943 rc = VERR_END_OF_STRING;
1944 Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1945 offName, cLeft, pThis->cbKernelNames));
1946 }
1947 }
1948
1949 /*
1950 * Link the module into the address space.
1951 */
1952 if (RT_SUCCESS(rc))
1953 {
1954 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1955 if (hAs != NIL_RTDBGAS)
1956 rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1957 else
1958 rc = VERR_INTERNAL_ERROR;
1959 RTDbgAsRelease(hAs);
1960 }
1961 else
1962 Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1963 RTDbgModRelease(hMod);
1964 }
1965 else
1966 Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1967 }
1968 else
1969 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1970 pThis->AddrKernelTokenIndex.FlatPtr, rc));
1971 RTMemFree(paoffTokens);
1972 }
1973 else
1974 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1975 pThis->AddrKernelTokenTable.FlatPtr, rc));
1976 RTMemFree(pszzTokens);
1977 }
1978 else
1979 Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1980 pThis->AddrKernelNames.FlatPtr, rc));
1981 RTMemFree(pbNames);
1982
1983 return rc;
1984}
1985
1986/**
1987 * Loads the kernel symbols from the kallsyms table if it contains absolute addresses
1988 *
1989 * @returns VBox status code.
1990 * @param pUVM The user mode VM handle.
1991 * @param pVMM The VMM function table.
1992 * @param pThis The Linux digger data.
1993 */
1994static int dbgDiggerLinuxLoadKernelSymbolsAbsolute(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1995{
1996 /*
1997 * Allocate memory for temporary table copies, reading the tables as we go.
1998 */
1999 uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
2000 void *pvAddresses = RTMemAllocZ(pThis->cKernelSymbols * cbGuestAddr);
2001 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelAddresses,
2002 pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
2003 if (RT_SUCCESS(rc))
2004 {
2005 /*
2006 * Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2007 */
2008 RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2009 RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2010 RTGCUINTPTR *pauSymOff = (RTGCUINTPTR *)RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2011 uint32_t i;
2012 if (cbGuestAddr == sizeof(uint64_t))
2013 {
2014 uint64_t *pauAddrs = (uint64_t *)pvAddresses;
2015 for (i = 0; i < pThis->cKernelSymbols; i++)
2016 if ( pauAddrs[i] < uKernelStart
2017 && LNX64_VALID_ADDRESS(pauAddrs[i])
2018 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2019 uKernelStart = pauAddrs[i];
2020
2021 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2022 if ( pauAddrs[i] > uKernelEnd
2023 && LNX64_VALID_ADDRESS(pauAddrs[i])
2024 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2025 uKernelEnd = pauAddrs[i];
2026
2027 for (i = 0; i < pThis->cKernelSymbols; i++)
2028 pauSymOff[i] = pauAddrs[i] - uKernelStart;
2029 }
2030 else
2031 {
2032 uint32_t *pauAddrs = (uint32_t *)pvAddresses;
2033 for (i = 0; i < pThis->cKernelSymbols; i++)
2034 if ( pauAddrs[i] < uKernelStart
2035 && LNX32_VALID_ADDRESS(pauAddrs[i])
2036 && uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2037 uKernelStart = pauAddrs[i];
2038
2039 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2040 if ( pauAddrs[i] > uKernelEnd
2041 && LNX32_VALID_ADDRESS(pauAddrs[i])
2042 && pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2043 uKernelEnd = pauAddrs[i];
2044
2045 for (i = 0; i < pThis->cKernelSymbols; i++)
2046 pauSymOff[i] = pauAddrs[i] - uKernelStart;
2047 }
2048
2049 RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2050 pThis->cbKernel = (uint32_t)cbKernel;
2051 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2052 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2053
2054 rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2055 if (RT_FAILURE(rc))
2056 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Loading symbols from given offset table failed: %Rrc\n", rc));
2057 RTMemTmpFree(pauSymOff);
2058 }
2059 else
2060 Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Reading symbol addresses at %RGv failed: %Rrc\n",
2061 pThis->AddrKernelAddresses.FlatPtr, rc));
2062 RTMemFree(pvAddresses);
2063
2064 return rc;
2065}
2066
2067
2068/**
2069 * Loads the kernel symbols from the kallsyms table if it contains absolute addresses
2070 *
2071 * @returns VBox status code.
2072 * @param pUVM The user mode VM handle.
2073 * @param pVMM The VMM function table.
2074 * @param pThis The Linux digger data.
2075 */
2076static int dbgDiggerLinuxLoadKernelSymbolsRelative(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2077{
2078 /*
2079 * Allocate memory for temporary table copies, reading the tables as we go.
2080 */
2081 int32_t *pai32Offsets = (int32_t *)RTMemAllocZ(pThis->cKernelSymbols * sizeof(int32_t));
2082 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &pThis->AddrKernelAddresses,
2083 pai32Offsets, pThis->cKernelSymbols * sizeof(int32_t));
2084 if (RT_SUCCESS(rc))
2085 {
2086 /*
2087 * Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2088 */
2089 RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2090 RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2091 RTGCUINTPTR *pauSymOff = (RTGCUINTPTR *)RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2092 uint32_t i;
2093
2094 for (i = 0; i < pThis->cKernelSymbols; i++)
2095 {
2096 RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2097
2098 if ( uSymAddr < uKernelStart
2099 && (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2100 && uKernelStart - uSymAddr < LNX_MAX_KERNEL_SIZE)
2101 uKernelStart = uSymAddr;
2102 }
2103
2104 for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2105 {
2106 RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2107
2108 if ( uSymAddr > uKernelEnd
2109 && (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2110 && uSymAddr - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2111 uKernelEnd = uSymAddr;
2112
2113 /* Store the offset from the derived kernel start address. */
2114 pauSymOff[i] = uSymAddr - uKernelStart;
2115 }
2116
2117 RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2118 pThis->cbKernel = (uint32_t)cbKernel;
2119 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2120 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2121
2122 rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2123 if (RT_FAILURE(rc))
2124 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Loading symbols from given offset table failed: %Rrc\n", rc));
2125 RTMemTmpFree(pauSymOff);
2126 }
2127 else
2128 Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Reading symbol addresses at %RGv failed: %Rrc\n",
2129 pThis->AddrKernelAddresses.FlatPtr, rc));
2130 RTMemFree(pai32Offsets);
2131
2132 return rc;
2133}
2134
2135
2136/**
2137 * Loads the kernel symbols.
2138 *
2139 * @returns VBox status code.
2140 * @param pUVM The user mode VM handle.
2141 * @param pVMM The VMM function table.
2142 * @param pThis The Linux digger data.
2143 */
2144static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2145{
2146 /*
2147 * First the kernel itself.
2148 */
2149 if (pThis->fRelKrnlAddr)
2150 return dbgDiggerLinuxLoadKernelSymbolsRelative(pUVM, pVMM, pThis);
2151 return dbgDiggerLinuxLoadKernelSymbolsAbsolute(pUVM, pVMM, pThis);
2152}
2153
2154
2155/*
2156 * The module structure changed it was easier to produce different code for
2157 * each version of the structure. The C preprocessor rules!
2158 */
2159#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleCodeTmpl.cpp.h"
2160
2161#define LNX_BIT_SUFFIX _amd64
2162#define LNX_PTR_T uint64_t
2163#define LNX_64BIT 1
2164#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2165
2166#define LNX_BIT_SUFFIX _x86
2167#define LNX_PTR_T uint32_t
2168#define LNX_64BIT 0
2169#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2170
2171#undef LNX_TEMPLATE_HEADER
2172
2173static const struct
2174{
2175 uint32_t uVersion;
2176 bool f64Bit;
2177 uint64_t (*pfnProcessModule)(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGFADDRESS pAddrModule);
2178} g_aModVersions[] =
2179{
2180#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleTableEntryTmpl.cpp.h"
2181
2182#define LNX_BIT_SUFFIX _amd64
2183#define LNX_64BIT 1
2184#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2185
2186#define LNX_BIT_SUFFIX _x86
2187#define LNX_64BIT 0
2188#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2189
2190#undef LNX_TEMPLATE_HEADER
2191};
2192
2193
2194/**
2195 * Tries to find and process the module list.
2196 *
2197 * @returns VBox status code.
2198 * @param pThis The Linux digger data.
2199 * @param pUVM The user mode VM handle.
2200 * @param pVMM The VMM function table.
2201 */
2202static int dbgDiggerLinuxLoadModules(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2203{
2204 /*
2205 * Locate the list head.
2206 */
2207 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
2208 RTDBGSYMBOL SymInfo;
2209 int rc = RTDbgAsSymbolByName(hAs, "vmlinux!modules", &SymInfo, NULL);
2210 RTDbgAsRelease(hAs);
2211 if (RT_FAILURE(rc))
2212 return VERR_NOT_FOUND;
2213
2214 if (RT_FAILURE(rc))
2215 {
2216 LogRel(("dbgDiggerLinuxLoadModules: Failed to locate the module list (%Rrc).\n", rc));
2217 return VERR_NOT_FOUND;
2218 }
2219
2220 /*
2221 * Read the list anchor.
2222 */
2223 union
2224 {
2225 uint32_t volatile u32Pair[2];
2226 uint64_t u64Pair[2];
2227 } uListAnchor;
2228 DBGFADDRESS Addr;
2229 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value),
2230 &uListAnchor, pThis->f64Bit ? sizeof(uListAnchor.u64Pair) : sizeof(uListAnchor.u32Pair));
2231 if (RT_FAILURE(rc))
2232 {
2233 LogRel(("dbgDiggerLinuxLoadModules: Error reading list anchor at %RX64: %Rrc\n", SymInfo.Value, rc));
2234 return VERR_NOT_FOUND;
2235 }
2236 if (!pThis->f64Bit)
2237 {
2238 uListAnchor.u64Pair[1] = uListAnchor.u32Pair[1];
2239 ASMCompilerBarrier();
2240 uListAnchor.u64Pair[0] = uListAnchor.u32Pair[0];
2241 }
2242
2243 if (pThis->uKrnlVer == 0)
2244 {
2245 LogRel(("dbgDiggerLinuxLoadModules: No valid kernel version given: %#x\n", pThis->uKrnlVer));
2246 return VERR_NOT_FOUND;
2247 }
2248
2249 /*
2250 * Find the g_aModVersion entry that fits the best.
2251 * ASSUMES strict descending order by bitcount and version.
2252 */
2253 Assert(g_aModVersions[0].f64Bit == true);
2254 unsigned i = 0;
2255 if (!pThis->f64Bit)
2256 while (i < RT_ELEMENTS(g_aModVersions) && g_aModVersions[i].f64Bit)
2257 i++;
2258 while ( i < RT_ELEMENTS(g_aModVersions)
2259 && g_aModVersions[i].f64Bit == pThis->f64Bit
2260 && pThis->uKrnlVer < g_aModVersions[i].uVersion)
2261 i++;
2262 if (i >= RT_ELEMENTS(g_aModVersions))
2263 {
2264 LogRel(("dbgDiggerLinuxLoadModules: Failed to find anything matching version: %u.%u.%u\n",
2265 pThis->uKrnlVerMaj, pThis->uKrnlVerMin, pThis->uKrnlVerBld));
2266 return VERR_NOT_FOUND;
2267 }
2268
2269 /*
2270 * Walk the list.
2271 */
2272 uint64_t uModAddr = uListAnchor.u64Pair[0];
2273 for (size_t iModule = 0; iModule < 4096 && uModAddr != SymInfo.Value && uModAddr != 0; iModule++)
2274 uModAddr = g_aModVersions[i].pfnProcessModule(pThis, pUVM, pVMM, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uModAddr));
2275
2276 return VINF_SUCCESS;
2277}
2278
2279
2280/**
2281 * Checks if there is a likely kallsyms_names fragment at pHitAddr.
2282 *
2283 * @returns true if it's a likely fragment, false if not.
2284 * @param pUVM The user mode VM handle.
2285 * @param pVMM The VMM function table.
2286 * @param pHitAddr The address where paNeedle was found.
2287 * @param pabNeedle The fragment we've been searching for.
2288 * @param cbNeedle The length of the fragment.
2289 */
2290static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pHitAddr,
2291 uint8_t const *pabNeedle, uint8_t cbNeedle)
2292{
2293 /*
2294 * Examples of lead and tail bytes of our choosen needle in a randomly
2295 * picked kernel:
2296 * k o b j
2297 * 22 6b 6f 62 6a aa
2298 * fc 6b 6f 62 6a aa
2299 * 82 6b 6f 62 6a 5f - ascii trail byte (_).
2300 * ee 6b 6f 62 6a aa
2301 * fc 6b 6f 62 6a 5f - ascii trail byte (_).
2302 * 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
2303 * 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
2304 * ... omitting 29 samples similar to the last two ...
2305 * d8 6b 6f 62 6a aa
2306 * d8 6b 6f 62 6a aa
2307 * d8 6b 6f 62 6a aa
2308 * d8 6b 6f 62 6a aa
2309 * f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
2310 * f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
2311 * fd 6b 6f 62 6a 0f
2312 * ... enough.
2313 */
2314 uint8_t abBuf[32];
2315 DBGFADDRESS ReadAddr = *pHitAddr;
2316 pVMM->pfnDBGFR3AddrSub(&ReadAddr, 2);
2317 int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
2318 if (RT_SUCCESS(rc))
2319 {
2320 if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
2321 {
2322 uint8_t const bLead = abBuf[1] == '_' || abBuf[1] == 'T' || abBuf[1] == 't' ? abBuf[0] : abBuf[1];
2323 uint8_t const offTail = 2 + cbNeedle;
2324 uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
2325 if ( bLead >= 1 && (bLead < 0x20 || bLead >= 0x80)
2326 && bTail >= 1 && (bTail < 0x20 || bTail >= 0x80))
2327 return true;
2328 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
2329 pHitAddr->FlatPtr, bLead, bTail, offTail));
2330 }
2331 else
2332 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
2333 }
2334 else
2335 Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
2336
2337 return false;
2338}
2339
2340/**
2341 * Tries to find and load the kernel symbol table with the given needle.
2342 *
2343 * @returns VBox status code.
2344 * @param pThis The Linux digger data.
2345 * @param pUVM The user mode VM handle.
2346 * @param pVMM The VMM function table.
2347 * @param pabNeedle The needle to use for searching.
2348 * @param cbNeedle Size of the needle in bytes.
2349 */
2350static int dbgDiggerLinuxFindSymbolTableFromNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2351 uint8_t const *pabNeedle, uint8_t cbNeedle)
2352{
2353 /*
2354 * Go looking for the kallsyms table. If it's there, it will be somewhere
2355 * after the linux_banner symbol, so use it for starting the search.
2356 */
2357 int rc = VINF_SUCCESS;
2358 DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2359 uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2360 while (cbLeft > 4096)
2361 {
2362 DBGFADDRESS HitAddr;
2363 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &CurAddr, cbLeft, 1 /*uAlign*/,
2364 pabNeedle, cbNeedle, &HitAddr);
2365 if (RT_FAILURE(rc))
2366 break;
2367 if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2368 {
2369 /* There will be another hit near by. */
2370 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 1);
2371 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /*uAlign*/,
2372 pabNeedle, cbNeedle, &HitAddr);
2373 if ( RT_SUCCESS(rc)
2374 && dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2375 {
2376 /*
2377 * We've got a very likely candidate for a location inside kallsyms_names.
2378 * Try find the start of it, that is to say, try find kallsyms_num_syms.
2379 * kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
2380 */
2381 rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pVMM, pThis, &HitAddr);
2382 if (RT_SUCCESS(rc))
2383 rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pVMM, pThis, &HitAddr);
2384 if (RT_SUCCESS(rc))
2385 rc = dbgDiggerLinuxFindTokenIndex(pUVM, pVMM, pThis);
2386 if (RT_SUCCESS(rc))
2387 rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pVMM, pThis);
2388 if (RT_SUCCESS(rc))
2389 {
2390 rc = dbgDiggerLinuxLoadModules(pThis, pUVM, pVMM);
2391 break;
2392 }
2393 }
2394 }
2395
2396 /*
2397 * Advance.
2398 */
2399 RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + cbNeedle;
2400 if (RT_UNLIKELY(cbDistance >= cbLeft))
2401 {
2402 Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
2403 break;
2404 }
2405 cbLeft -= cbDistance;
2406 pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2407 }
2408
2409 return rc;
2410}
2411
2412/**
2413 * Skips whitespace and comments in the given config returning the pointer
2414 * to the first non whitespace character.
2415 *
2416 * @returns Pointer to the first non whitespace character or NULL if the end
2417 * of the string was reached.
2418 * @param pszCfg The config string.
2419 */
2420static const char *dbgDiggerLinuxCfgSkipWhitespace(const char *pszCfg)
2421{
2422 do
2423 {
2424 while ( *pszCfg != '\0'
2425 && ( RT_C_IS_SPACE(*pszCfg)
2426 || *pszCfg == '\n'))
2427 pszCfg++;
2428
2429 /* Do we have a comment? Skip it. */
2430 if (*pszCfg == '#')
2431 {
2432 while ( *pszCfg != '\n'
2433 && *pszCfg != '\0')
2434 pszCfg++;
2435 }
2436 } while ( *pszCfg != '\0'
2437 && ( RT_C_IS_SPACE(*pszCfg)
2438 || *pszCfg == '\n'
2439 || *pszCfg == '#'));
2440
2441 return pszCfg;
2442}
2443
2444/**
2445 * Parses an identifier at the given position.
2446 *
2447 * @returns VBox status code.
2448 * @param pszCfg The config data.
2449 * @param ppszCfgNext Where to store the pointer to the data following the identifier.
2450 * @param ppszIde Where to store the pointer to the identifier on success.
2451 * Free with RTStrFree().
2452 */
2453static int dbgDiggerLinuxCfgParseIde(const char *pszCfg, const char **ppszCfgNext, char **ppszIde)
2454{
2455 int rc = VINF_SUCCESS;
2456 size_t cchIde = 0;
2457
2458 while ( *pszCfg != '\0'
2459 && ( RT_C_IS_ALNUM(*pszCfg)
2460 || *pszCfg == '_'))
2461 {
2462 cchIde++;
2463 pszCfg++;
2464 }
2465
2466 if (cchIde)
2467 {
2468 *ppszIde = RTStrDupN(pszCfg - cchIde, cchIde);
2469 if (!*ppszIde)
2470 rc = VERR_NO_STR_MEMORY;
2471 }
2472
2473 *ppszCfgNext = pszCfg;
2474 return rc;
2475}
2476
2477/**
2478 * Parses a value for a config item.
2479 *
2480 * @returns VBox status code.
2481 * @param pszCfg The config data.
2482 * @param ppszCfgNext Where to store the pointer to the data following the identifier.
2483 * @param ppCfgItem Where to store the created config item on success.
2484 */
2485static int dbgDiggerLinuxCfgParseVal(const char *pszCfg, const char **ppszCfgNext,
2486 PDBGDIGGERLINUXCFGITEM *ppCfgItem)
2487{
2488 int rc = VINF_SUCCESS;
2489 PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2490
2491 if (RT_C_IS_DIGIT(*pszCfg) || *pszCfg == '-')
2492 {
2493 /* Parse the number. */
2494 int64_t i64Num;
2495 rc = RTStrToInt64Ex(pszCfg, (char **)ppszCfgNext, 0, &i64Num);
2496 if ( RT_SUCCESS(rc)
2497 || rc == VWRN_TRAILING_CHARS
2498 || rc == VWRN_TRAILING_SPACES)
2499 {
2500 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2501 if (pCfgItem)
2502 {
2503 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_NUMBER;
2504 pCfgItem->u.i64Num = i64Num;
2505 }
2506 else
2507 rc = VERR_NO_MEMORY;
2508 }
2509 }
2510 else if (*pszCfg == '\"')
2511 {
2512 /* Parse a string. */
2513 const char *pszCfgCur = pszCfg + 1;
2514 while ( *pszCfgCur != '\0'
2515 && *pszCfgCur != '\"')
2516 pszCfgCur++;
2517
2518 if (*pszCfgCur == '\"')
2519 {
2520 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGDIGGERLINUXCFGITEM,
2521 u.aszString[pszCfgCur - pszCfg + 1]));
2522 if (pCfgItem)
2523 {
2524 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_STRING;
2525 RTStrCopyEx(&pCfgItem->u.aszString[0], pszCfgCur - pszCfg + 1, pszCfg, pszCfgCur - pszCfg);
2526 *ppszCfgNext = pszCfgCur + 1;
2527 }
2528 else
2529 rc = VERR_NO_MEMORY;
2530 }
2531 else
2532 rc = VERR_INVALID_STATE;
2533 }
2534 else if ( *pszCfg == 'y'
2535 || *pszCfg == 'm')
2536 {
2537 /* Included or module. */
2538 pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2539 if (pCfgItem)
2540 {
2541 pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_FLAG;
2542 pCfgItem->u.fModule = *pszCfg == 'm';
2543 }
2544 else
2545 rc = VERR_NO_MEMORY;
2546 pszCfg++;
2547 *ppszCfgNext = pszCfg;
2548 }
2549 else
2550 rc = VERR_INVALID_STATE;
2551
2552 if (RT_SUCCESS(rc))
2553 *ppCfgItem = pCfgItem;
2554 else if (pCfgItem)
2555 RTMemFree(pCfgItem);
2556
2557 return rc;
2558}
2559
2560/**
2561 * Parses the given kernel config and creates the config database.
2562 *
2563 * @returns VBox status code
2564 * @param pThis The Linux digger data.
2565 * @param pszCfg The config string.
2566 */
2567static int dbgDiggerLinuxCfgParse(PDBGDIGGERLINUX pThis, const char *pszCfg)
2568{
2569 int rc = VINF_SUCCESS;
2570
2571 /*
2572 * The config is a text file with the following elements:
2573 * # starts a comment which goes till the end of the line
2574 * <Ide>=<val> where <Ide> is an identifier consisting of
2575 * alphanumerical characters (including _)
2576 * <val> denotes the value for the identifier and can have the following
2577 * formats:
2578 * (-)[0-9]* for numbers
2579 * "..." for a string value
2580 * m when a feature is enabled as a module
2581 * y when a feature is enabled
2582 * Newlines are used as a separator between values and mark the end
2583 * of a comment
2584 */
2585 const char *pszCfgCur = pszCfg;
2586 while ( RT_SUCCESS(rc)
2587 && *pszCfgCur != '\0')
2588 {
2589 /* Start skipping the whitespace. */
2590 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2591 if ( pszCfgCur
2592 && *pszCfgCur != '\0')
2593 {
2594 char *pszIde = NULL;
2595 /* Must be an identifier, parse it. */
2596 rc = dbgDiggerLinuxCfgParseIde(pszCfgCur, &pszCfgCur, &pszIde);
2597 if (RT_SUCCESS(rc))
2598 {
2599 /*
2600 * Skip whitespace again (shouldn't be required because = follows immediately
2601 * in the observed configs).
2602 */
2603 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2604 if ( pszCfgCur
2605 && *pszCfgCur == '=')
2606 {
2607 pszCfgCur++;
2608 pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2609 if ( pszCfgCur
2610 && *pszCfgCur != '\0')
2611 {
2612 /* Get the value. */
2613 PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2614 rc = dbgDiggerLinuxCfgParseVal(pszCfgCur, &pszCfgCur, &pCfgItem);
2615 if (RT_SUCCESS(rc))
2616 {
2617 pCfgItem->Core.pszString = pszIde;
2618 bool fRc = RTStrSpaceInsert(&pThis->hCfgDb, &pCfgItem->Core);
2619 if (!fRc)
2620 {
2621 RTStrFree(pszIde);
2622 RTMemFree(pCfgItem);
2623 rc = VERR_INVALID_STATE;
2624 }
2625 }
2626 }
2627 else
2628 rc = VERR_EOF;
2629 }
2630 else
2631 rc = VERR_INVALID_STATE;
2632 }
2633
2634 if (RT_FAILURE(rc))
2635 RTStrFree(pszIde);
2636 }
2637 else
2638 break; /* Reached the end of the config. */
2639 }
2640
2641 if (RT_FAILURE(rc))
2642 dbgDiggerLinuxCfgDbDestroy(pThis);
2643
2644 return rc;
2645}
2646
2647/**
2648 * Decompresses the given config and validates the UTF-8 encoding.
2649 *
2650 * @returns VBox status code.
2651 * @param pbCfgComp The compressed config.
2652 * @param cbCfgComp Size of the compressed config.
2653 * @param ppszCfg Where to store the pointer to the decompressed config
2654 * on success.
2655 */
2656static int dbgDiggerLinuxCfgDecompress(const uint8_t *pbCfgComp, size_t cbCfgComp, char **ppszCfg)
2657{
2658 int rc = VINF_SUCCESS;
2659 RTVFSIOSTREAM hVfsIos = NIL_RTVFSIOSTREAM;
2660
2661 rc = RTVfsIoStrmFromBuffer(RTFILE_O_READ, pbCfgComp, cbCfgComp, &hVfsIos);
2662 if (RT_SUCCESS(rc))
2663 {
2664 RTVFSIOSTREAM hVfsIosDecomp = NIL_RTVFSIOSTREAM;
2665 rc = RTZipGzipDecompressIoStream(hVfsIos, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsIosDecomp);
2666 if (RT_SUCCESS(rc))
2667 {
2668 char *pszCfg = NULL;
2669 size_t cchCfg = 0;
2670 size_t cbRead = 0;
2671
2672 do
2673 {
2674 uint8_t abBuf[_64K];
2675 rc = RTVfsIoStrmRead(hVfsIosDecomp, abBuf, sizeof(abBuf), true /*fBlocking*/, &cbRead);
2676 if (rc == VINF_EOF && cbRead == 0)
2677 rc = VINF_SUCCESS;
2678 if ( RT_SUCCESS(rc)
2679 && cbRead > 0)
2680 {
2681 /* Append data. */
2682 char *pszCfgNew = pszCfg;
2683 rc = RTStrRealloc(&pszCfgNew, cchCfg + cbRead + 1);
2684 if (RT_SUCCESS(rc))
2685 {
2686 pszCfg = pszCfgNew;
2687 memcpy(pszCfg + cchCfg, &abBuf[0], cbRead);
2688 cchCfg += cbRead;
2689 pszCfg[cchCfg] = '\0'; /* Enforce string termination. */
2690 }
2691 }
2692 } while (RT_SUCCESS(rc) && cbRead > 0);
2693
2694 if (RT_SUCCESS(rc))
2695 *ppszCfg = pszCfg;
2696 else if (RT_FAILURE(rc) && pszCfg)
2697 RTStrFree(pszCfg);
2698
2699 RTVfsIoStrmRelease(hVfsIosDecomp);
2700 }
2701 RTVfsIoStrmRelease(hVfsIos);
2702 }
2703
2704 return rc;
2705}
2706
2707/**
2708 * Reads and decodes the compressed kernel config.
2709 *
2710 * @returns VBox status code.
2711 * @param pThis The Linux digger data.
2712 * @param pUVM The user mode VM handle.
2713 * @param pVMM The VMM function table.
2714 * @param pAddrStart The start address of the compressed config.
2715 * @param cbCfgComp The size of the compressed config.
2716 */
2717static int dbgDiggerLinuxCfgDecode(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2718 PCDBGFADDRESS pAddrStart, size_t cbCfgComp)
2719{
2720 int rc = VINF_SUCCESS;
2721 uint8_t *pbCfgComp = (uint8_t *)RTMemTmpAlloc(cbCfgComp);
2722 if (!pbCfgComp)
2723 return VERR_NO_MEMORY;
2724
2725 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pAddrStart, pbCfgComp, cbCfgComp);
2726 if (RT_SUCCESS(rc))
2727 {
2728 char *pszCfg = NULL;
2729 rc = dbgDiggerLinuxCfgDecompress(pbCfgComp, cbCfgComp, &pszCfg);
2730 if (RT_SUCCESS(rc))
2731 {
2732 if (RTStrIsValidEncoding(pszCfg))
2733 rc = dbgDiggerLinuxCfgParse(pThis, pszCfg);
2734 else
2735 rc = VERR_INVALID_UTF8_ENCODING;
2736 RTStrFree(pszCfg);
2737 }
2738 }
2739
2740 RTMemFree(pbCfgComp);
2741 return rc;
2742}
2743
2744/**
2745 * Tries to find the compressed kernel config in the kernel address space
2746 * and sets up the config database.
2747 *
2748 * @returns VBox status code.
2749 * @param pThis The Linux digger data.
2750 * @param pUVM The user mode VM handle.
2751 * @param pVMM The VMM function table.
2752 */
2753static int dbgDiggerLinuxCfgFind(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2754{
2755 /*
2756 * Go looking for the IKCFG_ST string which indicates the start
2757 * of the compressed config file.
2758 */
2759 static const uint8_t s_abCfgNeedleStart[] = "IKCFG_ST";
2760 static const uint8_t s_abCfgNeedleEnd[] = "IKCFG_ED";
2761 int rc = VINF_SUCCESS;
2762 DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2763 uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2764 while (cbLeft > 4096)
2765 {
2766 DBGFADDRESS HitAddrStart;
2767 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &CurAddr, cbLeft, 1 /*uAlign*/,
2768 s_abCfgNeedleStart, sizeof(s_abCfgNeedleStart) - 1, &HitAddrStart);
2769 if (RT_FAILURE(rc))
2770 break;
2771
2772 /* Check for the end marker which shouldn't be that far away. */
2773 pVMM->pfnDBGFR3AddrAdd(&HitAddrStart, sizeof(s_abCfgNeedleStart) - 1);
2774 DBGFADDRESS HitAddrEnd;
2775 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /* idCpu */, &HitAddrStart, LNX_MAX_COMPRESSED_CFG_SIZE,
2776 1 /* uAlign */, s_abCfgNeedleEnd, sizeof(s_abCfgNeedleEnd) - 1, &HitAddrEnd);
2777 if (RT_SUCCESS(rc))
2778 {
2779 /* Allocate a buffer to hold the compressed data between the markers and fetch it. */
2780 RTGCUINTPTR cbCfg = HitAddrEnd.FlatPtr - HitAddrStart.FlatPtr;
2781 Assert(cbCfg == (size_t)cbCfg);
2782 rc = dbgDiggerLinuxCfgDecode(pThis, pUVM, pVMM, &HitAddrStart, cbCfg);
2783 if (RT_SUCCESS(rc))
2784 break;
2785 }
2786
2787 /*
2788 * Advance.
2789 */
2790 RTGCUINTPTR cbDistance = HitAddrStart.FlatPtr - CurAddr.FlatPtr + sizeof(s_abCfgNeedleStart) - 1;
2791 if (RT_UNLIKELY(cbDistance >= cbLeft))
2792 {
2793 LogFunc(("Failed to find compressed kernel config\n"));
2794 break;
2795 }
2796 cbLeft -= cbDistance;
2797 pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2798 }
2799
2800 return rc;
2801}
2802
2803/**
2804 * Probes for a Linux kernel starting at the given address.
2805 *
2806 * @returns Flag whether something which looks like a valid Linux kernel was found.
2807 * @param pThis The Linux digger data.
2808 * @param pUVM The user mode VM handle.
2809 * @param pVMM The VMM function table.
2810 * @param uAddrStart The address to start scanning at.
2811 * @param cbScan How much to scan.
2812 */
2813static bool dbgDiggerLinuxProbeWithAddr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2814 RTGCUINTPTR uAddrStart, size_t cbScan)
2815{
2816 /*
2817 * Look for "Linux version " at the start of the rodata segment.
2818 * Hope that this comes before any message buffer or other similar string.
2819 */
2820 DBGFADDRESS KernelAddr;
2821 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uAddrStart);
2822 DBGFADDRESS HitAddr;
2823 int rc = pVMM->pfnDBGFR3MemScan(pUVM, 0, &KernelAddr, cbScan, 1,
2824 g_abLinuxVersion, sizeof(g_abLinuxVersion) - 1, &HitAddr);
2825 if (RT_SUCCESS(rc))
2826 {
2827 char szTmp[128];
2828 char const *pszX = &szTmp[sizeof(g_abLinuxVersion) - 1];
2829 rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
2830 if ( RT_SUCCESS(rc)
2831 && ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
2832 && pszX[1] == '.'
2833 && pszX[2] >= '0'
2834 && pszX[2] <= '6')
2835 || ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
2836 && pszX[0] <= '9'
2837 && pszX[1] == '.'
2838 && pszX[2] >= '0'
2839 && pszX[2] <= '9')
2840 )
2841 )
2842 {
2843 pThis->AddrKernelBase = KernelAddr;
2844 pThis->AddrLinuxBanner = HitAddr;
2845 return true;
2846 }
2847 }
2848
2849 return false;
2850}
2851
2852/**
2853 * Probes for a Linux kernel which has KASLR enabled.
2854 *
2855 * @returns Flag whether a possible candidate location was found.
2856 * @param pThis The Linux digger data.
2857 * @param pUVM The user mode VM handle.
2858 * @param pVMM The VMM function table.
2859 */
2860static bool dbgDiggerLinuxProbeKaslr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2861{
2862 /**
2863 * With KASLR the kernel is loaded at a different address at each boot making detection
2864 * more difficult for us.
2865 *
2866 * The randomization is done in arch/x86/boot/compressed/kaslr.c:choose_random_location() (as of Nov 2017).
2867 * At the end of the method a random offset is chosen using find_random_virt_addr() which is added to the
2868 * kernel map start in the caller (the start of the kernel depends on the bit size, see LNX32_KERNEL_ADDRESS_START
2869 * and LNX64_KERNEL_ADDRESS_START for 32bit and 64bit kernels respectively).
2870 * The lowest offset possible is LOAD_PHYSICAL_ADDR which is defined in arch/x86/include/asm/boot.h
2871 * using CONFIG_PHYSICAL_START aligned to CONFIG_PHYSICAL_ALIGN.
2872 * The default CONFIG_PHYSICAL_START and CONFIG_PHYSICAL_ALIGN are both 0x1000000 no matter whether a 32bit
2873 * or a 64bit kernel is used. So the lowest offset to the kernel start address is 0x1000000.
2874 * The find_random_virt_addr() the number of possible slots where the kernel can be placed based on the image size
2875 * is calculated using the following formula:
2876 * cSlots = ((KERNEL_IMAGE_SIZE - 0x1000000 (minimum) - image_size) / 0x1000000 (CONFIG_PHYSICAL_ALIGN)) + 1
2877 *
2878 * KERNEL_IMAGE_SIZE is 1GB for 64bit kernels and 512MB for 32bit kernels, so the maximum number of slots (resulting
2879 * in the largest possible offset) can be achieved when image_size (which contains the real size of the kernel image
2880 * which is unknown for us) goes to 0 and a 1GB KERNEL_IMAGE_SIZE is assumed. With that the biggest cSlots which can be
2881 * achieved is 64. The chosen random offset is taken from a random long integer using kaslr_get_random_long() modulo the
2882 * number of slots which selects a slot between 0 and 63. The final offset is calculated using:
2883 * offAddr = random_addr * 0x1000000 (CONFIG_PHYSICAL_ALIGN) + 0x1000000 (minimum)
2884 *
2885 * So the highest offset the kernel can start is 0x40000000 which is 1GB (plus the maximum kernel size we defined).
2886 */
2887 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX64_KERNEL_ADDRESS_START, _1G + LNX_MAX_KERNEL_SIZE))
2888 return true;
2889
2890 /*
2891 * 32bit variant, makes sure we don't exceed the 4GB address space or DBGFR3MemScan() returns VERR_DBGF_MEM_NOT_FOUND immediately
2892 * without searching the remainder of the address space.
2893 *
2894 * The default split is 3GB userspace and 1GB kernel, so we just search the entire upper 1GB kernel space.
2895 */
2896 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX32_KERNEL_ADDRESS_START, _4G - LNX32_KERNEL_ADDRESS_START))
2897 return true;
2898
2899 return false;
2900}
2901
2902/**
2903 * @copydoc DBGFOSREG::pfnInit
2904 */
2905static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2906{
2907 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2908 Assert(!pThis->fValid);
2909
2910 char szVersion[256] = "Linux version 4.19.0";
2911 int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, &szVersion[0], sizeof(szVersion));
2912 if (RT_SUCCESS(rc))
2913 {
2914 /*
2915 * Get a numerical version number.
2916 */
2917 const char *pszVersion = szVersion;
2918 while (*pszVersion && !RT_C_IS_DIGIT(*pszVersion))
2919 pszVersion++;
2920
2921 size_t offVersion = 0;
2922 uint32_t uMajor = 0;
2923 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2924 uMajor = uMajor * 10 + pszVersion[offVersion++] - '0';
2925
2926 if (pszVersion[offVersion] == '.')
2927 offVersion++;
2928
2929 uint32_t uMinor = 0;
2930 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2931 uMinor = uMinor * 10 + pszVersion[offVersion++] - '0';
2932
2933 if (pszVersion[offVersion] == '.')
2934 offVersion++;
2935
2936 uint32_t uBuild = 0;
2937 while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2938 uBuild = uBuild * 10 + pszVersion[offVersion++] - '0';
2939
2940 pThis->uKrnlVer = LNX_MK_VER(uMajor, uMinor, uBuild);
2941 pThis->uKrnlVerMaj = uMajor;
2942 pThis->uKrnlVerMin = uMinor;
2943 pThis->uKrnlVerBld = uBuild;
2944 if (pThis->uKrnlVer == 0)
2945 LogRel(("dbgDiggerLinuxInit: Failed to parse version string: %s\n", pszVersion));
2946 }
2947
2948 /*
2949 * Assume 64-bit kernels all live way beyond 32-bit address space.
2950 */
2951 pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
2952 pThis->fRelKrnlAddr = false;
2953
2954 pThis->hCfgDb = NULL;
2955
2956 /*
2957 * Try to find the compressed kernel config and parse it before we try
2958 * to get the symbol table, the config database is required to select
2959 * the method to use.
2960 */
2961 rc = dbgDiggerLinuxCfgFind(pThis, pUVM, pVMM);
2962 if (RT_FAILURE(rc))
2963 LogFlowFunc(("Failed to find kernel config (%Rrc), no config database available\n", rc));
2964
2965 static const uint8_t s_abNeedle[] = "kobj";
2966 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedle, sizeof(s_abNeedle) - 1);
2967 if (RT_FAILURE(rc))
2968 {
2969 /* Try alternate needle (seen on older x86 Linux kernels). */
2970 static const uint8_t s_abNeedleAlt[] = "kobjec";
2971 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleAlt, sizeof(s_abNeedleAlt) - 1);
2972 if (RT_FAILURE(rc))
2973 {
2974 static const uint8_t s_abNeedleOSuseX86[] = "nmi"; /* OpenSuSe 10.2 x86 */
2975 rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleOSuseX86, sizeof(s_abNeedleOSuseX86) - 1);
2976 }
2977 }
2978
2979 pThis->fValid = true;
2980 return VINF_SUCCESS;
2981}
2982
2983
2984/**
2985 * @copydoc DBGFOSREG::pfnProbe
2986 */
2987static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2988{
2989 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2990
2991 for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
2992 {
2993 if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, g_au64LnxKernelAddresses[i], LNX_MAX_KERNEL_SIZE))
2994 return true;
2995 }
2996
2997 /* Maybe the kernel uses KASLR. */
2998 if (dbgDiggerLinuxProbeKaslr(pThis, pUVM, pVMM))
2999 return true;
3000
3001 return false;
3002}
3003
3004
3005/**
3006 * @copydoc DBGFOSREG::pfnDestruct
3007 */
3008static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3009{
3010 RT_NOREF(pUVM, pVMM, pvData);
3011}
3012
3013
3014/**
3015 * @copydoc DBGFOSREG::pfnConstruct
3016 */
3017static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3018{
3019 RT_NOREF(pUVM, pVMM);
3020 PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
3021 pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
3022 pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
3023 pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
3024
3025 return VINF_SUCCESS;
3026}
3027
3028
3029const DBGFOSREG g_DBGDiggerLinux =
3030{
3031 /* .u32Magic = */ DBGFOSREG_MAGIC,
3032 /* .fFlags = */ 0,
3033 /* .cbData = */ sizeof(DBGDIGGERLINUX),
3034 /* .szName = */ "Linux",
3035 /* .pfnConstruct = */ dbgDiggerLinuxConstruct,
3036 /* .pfnDestruct = */ dbgDiggerLinuxDestruct,
3037 /* .pfnProbe = */ dbgDiggerLinuxProbe,
3038 /* .pfnInit = */ dbgDiggerLinuxInit,
3039 /* .pfnRefresh = */ dbgDiggerLinuxRefresh,
3040 /* .pfnTerm = */ dbgDiggerLinuxTerm,
3041 /* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
3042 /* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
3043 /* .pfnStackUnwindAssist = */ dbgDiggerLinuxStackUnwindAssist,
3044 /* .u32EndMagic = */ DBGFOSREG_MAGIC
3045};
3046
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette