DBGPlugInLinux.cpp@ 98123

Last change on this file since 98123 was 98103, checked in by vboxsync, 23 months ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 123.7 KB

Line
1	/* $Id: DBGPlugInLinux.cpp 98103 2023-01-17 14:15:46Z vboxsync $ */
2	/** @file
3	* DBGPlugInLinux - Debugger and Guest OS Digger Plugin For Linux.
4	*/
5
6	/*
7	* Copyright (C) 2008-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33	#include "DBGPlugIns.h"
34	#include "DBGPlugInCommonELF.h"
35	#include <VBox/vmm/vmmr3vtable.h>
36	#include <VBox/dis.h>
37	#include <iprt/ctype.h>
38	#include <iprt/file.h>
39	#include <iprt/err.h>
40	#include <iprt/mem.h>
41	#include <iprt/stream.h>
42	#include <iprt/string.h>
43	#include <iprt/vfs.h>
44	#include <iprt/zip.h>
45
46
47	/*********************************************************************************************************************************
48	* Structures and Typedefs *
49	*********************************************************************************************************************************/
50
51	/** @name InternalLinux structures
52	* @{ */
53
54
55	/** @} */
56
57
58	/**
59	* Config item type.
60	*/
61	typedef enum DBGDIGGERLINUXCFGITEMTYPE
62	{
63	/** Invalid type. */
64	DBGDIGGERLINUXCFGITEMTYPE_INVALID = 0,
65	/** String. */
66	DBGDIGGERLINUXCFGITEMTYPE_STRING,
67	/** Number. */
68	DBGDIGGERLINUXCFGITEMTYPE_NUMBER,
69	/** Flag whether this feature is included in the
70	* kernel or as a module. */
71	DBGDIGGERLINUXCFGITEMTYPE_FLAG
72	} DBGDIGGERLINUXCFGITEMTYPE;
73
74	/**
75	* Item in the config database.
76	*/
77	typedef struct DBGDIGGERLINUXCFGITEM
78	{
79	/** String space core. */
80	RTSTRSPACECORE Core;
81	/** Config item type. */
82	DBGDIGGERLINUXCFGITEMTYPE enmType;
83	/** Data based on the type. */
84	union
85	{
86	/** Number. */
87	int64_t i64Num;
88	/** Flag. */
89	bool fModule;
90	/** String - variable in size. */
91	char aszString[1];
92	} u;
93	} DBGDIGGERLINUXCFGITEM;
94	/** Pointer to a config database item. */
95	typedef DBGDIGGERLINUXCFGITEM *PDBGDIGGERLINUXCFGITEM;
96	/** Pointer to a const config database item. */
97	typedef const DBGDIGGERLINUXCFGITEM *PCDBGDIGGERLINUXCFGITEM;
98
99	/**
100	* Linux guest OS digger instance data.
101	*/
102	typedef struct DBGDIGGERLINUX
103	{
104	/** Whether the information is valid or not.
105	* (For fending off illegal interface method calls.) */
106	bool fValid;
107	/** Set if 64-bit, clear if 32-bit. */
108	bool f64Bit;
109	/** Set if the kallsyms table uses relative addressing, clear
110	* if absolute addresses are used. */
111	bool fRelKrnlAddr;
112	/** The relative base when kernel symbols use offsets rather than
113	* absolute addresses. */
114	RTGCUINTPTR uKernelRelativeBase;
115	/** The guest kernel version used for version comparisons. */
116	uint32_t uKrnlVer;
117	/** The guest kernel major version. */
118	uint32_t uKrnlVerMaj;
119	/** The guest kernel minor version. */
120	uint32_t uKrnlVerMin;
121	/** The guest kernel build version. */
122	uint32_t uKrnlVerBld;
123
124	/** The address of the linux banner.
125	* This is set during probing. */
126	DBGFADDRESS AddrLinuxBanner;
127	/** Kernel base address.
128	* This is set during probing, refined during kallsyms parsing. */
129	DBGFADDRESS AddrKernelBase;
130	/** The kernel size. */
131	uint32_t cbKernel;
132
133	/** The number of kernel symbols (kallsyms_num_syms).
134	* This is set during init. */
135	uint32_t cKernelSymbols;
136	/** The size of the kernel name table (sizeof(kallsyms_names)). */
137	uint32_t cbKernelNames;
138	/** Number of entries in the kernel_markers table. */
139	uint32_t cKernelNameMarkers;
140	/** The size of the kernel symbol token table. */
141	uint32_t cbKernelTokenTable;
142	/** The address of the encoded kernel symbol names (kallsyms_names). */
143	DBGFADDRESS AddrKernelNames;
144	/** The address of the kernel symbol addresses (kallsyms_addresses). */
145	DBGFADDRESS AddrKernelAddresses;
146	/** The address of the kernel symbol name markers (kallsyms_markers). */
147	DBGFADDRESS AddrKernelNameMarkers;
148	/** The address of the kernel symbol token table (kallsyms_token_table). */
149	DBGFADDRESS AddrKernelTokenTable;
150	/** The address of the kernel symbol token index table (kallsyms_token_index). */
151	DBGFADDRESS AddrKernelTokenIndex;
152
153	/** The kernel message log interface. */
154	DBGFOSIDMESG IDmesg;
155
156	/** The config database root. */
157	RTSTRSPACE hCfgDb;
158	} DBGDIGGERLINUX;
159	/** Pointer to the linux guest OS digger instance data. */
160	typedef DBGDIGGERLINUX *PDBGDIGGERLINUX;
161
162
163	/**
164	* The current printk_log structure.
165	*/
166	typedef struct LNXPRINTKHDR
167	{
168	/** Monotonic timestamp. */
169	uint64_t nsTimestamp;
170	/** The total size of this message record. */
171	uint16_t cbTotal;
172	/** The size of the text part (immediately follows the header). */
173	uint16_t cbText;
174	/** The size of the optional dictionary part (follows the text). */
175	uint16_t cbDict;
176	/** The syslog facility number. */
177	uint8_t bFacility;
178	/** First 5 bits are internal flags, next 3 bits are log level. */
179	uint8_t fFlagsAndLevel;
180	} LNXPRINTKHDR;
181	AssertCompileSize(LNXPRINTKHDR, 2*sizeof(uint64_t));
182	/** Pointer to linux printk_log header. */
183	typedef LNXPRINTKHDR *PLNXPRINTKHDR;
184	/** Pointer to linux const printk_log header. */
185	typedef LNXPRINTKHDR const *PCLNXPRINTKHDR;
186
187
188	/*********************************************************************************************************************************
189	* Defined Constants And Macros *
190	*********************************************************************************************************************************/
191	/** First kernel map address for 32bit Linux hosts (__START_KERNEL_map). */
192	#define LNX32_KERNEL_ADDRESS_START UINT32_C(0xc0000000)
193	/** First kernel map address for 64bit Linux hosts (__START_KERNEL_map). */
194	#define LNX64_KERNEL_ADDRESS_START UINT64_C(0xffffffff80000000)
195	/** Validates a 32-bit linux kernel address */
196	#define LNX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
197	/** Validates a 64-bit linux kernel address */
198	#define LNX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
199
200	/** The max kernel size. */
201	#define LNX_MAX_KERNEL_SIZE UINT32_C(0x0f000000)
202	/** Maximum kernel log buffer size. */
203	#define LNX_MAX_KERNEL_LOG_SIZE (16 * _1M)
204
205	/** The maximum size we expect for kallsyms_names. */
206	#define LNX_MAX_KALLSYMS_NAMES_SIZE UINT32_C(0x200000)
207	/** The maximum size we expect for kallsyms_token_table. */
208	#define LNX_MAX_KALLSYMS_TOKEN_TABLE_SIZE UINT32_C(0x10000)
209	/** The minimum number of symbols we expect in kallsyms_num_syms. */
210	#define LNX_MIN_KALLSYMS_SYMBOLS UINT32_C(2048)
211	/** The maximum number of symbols we expect in kallsyms_num_syms. */
212	#define LNX_MAX_KALLSYMS_SYMBOLS UINT32_C(1048576)
213	/** The min length an encoded symbol in kallsyms_names is expected to have. */
214	#define LNX_MIN_KALLSYMS_ENC_LENGTH UINT8_C(1)
215	/** The max length an encoded symbol in kallsyms_names is expected to have.
216	* @todo check real life here. */
217	#define LNX_MAX_KALLSYMS_ENC_LENGTH UINT8_C(28)
218	/** The approximate maximum length of a string token. */
219	#define LNX_MAX_KALLSYMS_TOKEN_LEN UINT16_C(32)
220	/** Maximum compressed config size expected. */
221	#define LNX_MAX_COMPRESSED_CFG_SIZE _1M
222
223	/** Module tag for linux ('linuxmod' on little endian ASCII systems). */
224	#define DIG_LNX_MOD_TAG UINT64_C(0x545f5d78758e898c)
225	/** Macro for building a Linux kernel version which can be used for comparisons. */
226	#define LNX_MK_VER(major, minor, build) (((major) << 22) \| ((minor) << 12) \| (build))
227
228
229	/*********************************************************************************************************************************
230	* Internal Functions *
231	*********************************************************************************************************************************/
232	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
233
234
235	/*********************************************************************************************************************************
236	* Global Variables *
237	*********************************************************************************************************************************/
238	/** Table of common linux kernel addresses. */
239	static uint64_t g_au64LnxKernelAddresses[] =
240	{
241	UINT64_C(0xc0100000),
242	UINT64_C(0x90100000),
243	UINT64_C(0xffffffff80200000)
244	};
245
246	static const uint8_t g_abLinuxVersion[] = "Linux version ";
247	/** The needle for searching for the kernel log area (the value is observed in pretty much all 32bit and 64bit x86 kernels).
248	* This needle should appear only once in the memory due to the address being filled in by a format string. */
249	static const uint8_t g_abKrnlLogNeedle[] = "BIOS-e820: [mem 0x0000000000000000";
250
251
252	/**
253	* Tries to resolve the kernel log buffer start and end by searching for needle.
254	*
255	* @returns VBox status code.
256	* @param pThis The Linux digger data.
257	* @param pUVM The VM handle.
258	* @param pVMM The VMM function table.
259	* @param pGCPtrLogBuf Where to store the start of the kernel log buffer on success.
260	* @param pcbLogBuf Where to store the size of the kernel log buffer on success.
261	*/
262	static int dbgDiggerLinuxKrnlLogBufFindByNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
263	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
264	{
265	int rc = VINF_SUCCESS;
266
267	/* Try to find the needle, it should be very early in the kernel log buffer. */
268	DBGFADDRESS AddrScan;
269	DBGFADDRESS AddrHit;
270	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrScan, pThis->f64Bit ? LNX64_KERNEL_ADDRESS_START : LNX32_KERNEL_ADDRESS_START);
271
272	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &AddrScan, ~(RTGCUINTPTR)0, 1 /uAlign/,
273	g_abKrnlLogNeedle, sizeof(g_abKrnlLogNeedle) - 1, &AddrHit);
274	if (RT_SUCCESS(rc))
275	{
276	uint32_t cbLogBuf = 0;
277	uint64_t tsLastNs = 0;
278	DBGFADDRESS AddrCur;
279
280	pVMM->pfnDBGFR3AddrSub(&AddrHit, sizeof(LNXPRINTKHDR));
281	AddrCur = AddrHit;
282
283	/* Try to find the end of the kernel log buffer. */
284	for (;;)
285	{
286	if (cbLogBuf >= LNX_MAX_KERNEL_LOG_SIZE)
287	break;
288
289	LNXPRINTKHDR Hdr;
290	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrCur, &Hdr, sizeof(Hdr));
291	if (RT_SUCCESS(rc))
292	{
293	uint32_t const cbLogAlign = 4;
294
295	/*
296	* If the header does not look valid anymore we stop.
297	* Timestamps are monotonically increasing.
298	*/
299	if ( !Hdr.cbTotal /* Zero entry size means there is no record anymore, doesn't make sense to look futher. */
300	\|\| Hdr.cbText + Hdr.cbDict + sizeof(Hdr) > Hdr.cbTotal
301	\|\| (Hdr.cbTotal & (cbLogAlign - 1)) != 0
302	\|\| tsLastNs > Hdr.nsTimestamp)
303	break;
304
305	/** @todo Maybe read text part and verify it is all ASCII. */
306
307	cbLogBuf += Hdr.cbTotal;
308	pVMM->pfnDBGFR3AddrAdd(&AddrCur, Hdr.cbTotal);
309	}
310
311	if (RT_FAILURE(rc))
312	break;
313	}
314
315	/** @todo Go back to find the start address of the kernel log (or we loose potential kernel log messages). */
316
317	if ( RT_SUCCESS(rc)
318	&& cbLogBuf)
319	{
320	/* Align log buffer size to a power of two. */
321	uint32_t idxBitLast = ASMBitLastSetU32(cbLogBuf);
322	idxBitLast--; /* There is at least one bit set, see check above. */
323
324	if (cbLogBuf & (RT_BIT_32(idxBitLast) - 1))
325	idxBitLast++;
326
327	*pGCPtrLogBuf = AddrHit.FlatPtr;
328	*pcbLogBuf = RT_MIN(RT_BIT_32(idxBitLast), LNX_MAX_KERNEL_LOG_SIZE);
329	}
330	else if (RT_SUCCESS(rc))
331	rc = VERR_NOT_FOUND;
332	}
333
334	return rc;
335	}
336
337
338	/**
339	* Converts a given offset into an absolute address if relative kernel offsets are used for
340	* kallsyms.
341	*
342	* @returns The absolute kernel address.
343	* @param pThis The Linux digger data.
344	* @param uOffset The offset to convert.
345	*/
346	DECLINLINE(RTGCUINTPTR) dbgDiggerLinuxConvOffsetToAddr(PDBGDIGGERLINUX pThis, int32_t uOffset)
347	{
348	RTGCUINTPTR uAddr;
349
350	/*
351	* How the absolute address is calculated from the offset depends on the
352	* CONFIG_KALLSYMS_ABSOLUTE_PERCPU config which is only set for 64bit
353	* SMP kernels (we assume that all 64bit kernels always have SMP enabled too).
354	*/
355	if (pThis->f64Bit)
356	{
357	if (uOffset >= 0)
358	uAddr = uOffset;
359	else
360	uAddr = pThis->uKernelRelativeBase - 1 - uOffset;
361	}
362	else
363	uAddr = pThis->uKernelRelativeBase + (uint32_t)uOffset;
364
365	return uAddr;
366	}
367
368	/**
369	* Disassembles a simple getter returning the value for it.
370	*
371	* @returns VBox status code.
372	* @param pThis The Linux digger data.
373	* @param pUVM The VM handle.
374	* @param pVMM The VMM function table.
375	* @param hMod The module to use.
376	* @param pszSymbol The symbol of the getter.
377	* @param pvVal Where to store the value on success.
378	* @param cbVal Size of the value in bytes.
379	*/
380	static int dbgDiggerLinuxDisassembleSimpleGetter(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
381	const char pszSymbol, void pvVal, uint32_t cbVal)
382	{
383	int rc = VINF_SUCCESS;
384
385	RTDBGSYMBOL SymInfo;
386	rc = RTDbgModSymbolByName(hMod, pszSymbol, &SymInfo);
387	if (RT_SUCCESS(rc))
388	{
389	/*
390	* Do the diassembling. Disassemble until a ret instruction is encountered
391	* or a limit is reached (don't want to disassemble for too long as the getter
392	* should be short).
393	* push and pop instructions are skipped as well as any mov instructions not
394	* touching the rax or eax register (depending on the size of the value).
395	*/
396	unsigned cInstrDisassembled = 0;
397	uint32_t offInstr = 0;
398	bool fRet = false;
399	DISSTATE DisState;
400	RT_ZERO(DisState);
401
402	do
403	{
404	DBGFADDRESS Addr;
405	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
406	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
407
408	/* Prefetch the instruction. */
409	uint8_t abInstr[32];
410	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
411	if (RT_SUCCESS(rc))
412	{
413	uint32_t cbInstr = 0;
414
415	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
416	if (RT_SUCCESS(rc))
417	{
418	switch (DisState.pCurInstr->uOpcode)
419	{
420	case OP_PUSH:
421	case OP_POP:
422	case OP_NOP:
423	case OP_LEA:
424	break;
425	case OP_RETN:
426	/* Getter returned, abort disassembling. */
427	fRet = true;
428	break;
429	case OP_MOV:
430	/*
431	* Check that the destination is either rax or eax depending on the
432	* value size.
433	*
434	* Param1 is the destination and Param2 the source.
435	*/
436	if ( ( ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN32))
437	&& cbVal == sizeof(uint32_t))
438	\|\| ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN64))
439	&& cbVal == sizeof(uint64_t)))
440	&& DisState.Param1.Base.idxGenReg == DISGREG_RAX)
441	{
442	/* Parse the source. */
443	if (DisState.Param2.fUse & (DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
444	memcpy(pvVal, &DisState.Param2.uValue, cbVal);
445	else if (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64))
446	{
447	RTGCPTR GCPtrVal = 0;
448
449	if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
450	GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
451	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
452	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
453	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
454	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
455	else
456	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
457
458	DBGFADDRESS AddrVal;
459	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
460	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal, GCPtrVal),
461	pvVal, cbVal);
462	}
463	}
464	break;
465	default:
466	/* All other instructions will cause an error for now (playing safe here). */
467	rc = VERR_INVALID_PARAMETER;
468	break;
469	}
470	cInstrDisassembled++;
471	offInstr += cbInstr;
472	}
473	}
474	} while ( RT_SUCCESS(rc)
475	&& cInstrDisassembled < 20
476	&& !fRet);
477	}
478
479	return rc;
480	}
481
482	/**
483	* Try to get at the log buffer starting address and size by disassembling emit_log_char.
484	*
485	* @returns VBox status code.
486	* @param pThis The Linux digger data.
487	* @param pUVM The VM handle.
488	* @param pVMM The VMM function table.
489	* @param hMod The module to use.
490	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
491	* @param pcbLogBuf Where to store the size of the log buffer on success.
492	*/
493	static int dbgDiggerLinuxQueryAsciiLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
494	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
495	{
496	int rc = VINF_SUCCESS;
497
498	/**
499	* We disassemble emit_log_char to get at the log buffer address and size.
500	* This is used in case the symbols are not exported in kallsyms.
501	*
502	* This is what it typically looks like:
503	* vmlinux!emit_log_char:
504	* %00000000c01204a1 56 push esi
505	* %00000000c01204a2 8b 35 d0 1c 34 c0 mov esi, dword [0c0341cd0h]
506	* %00000000c01204a8 53 push ebx
507	* %00000000c01204a9 8b 1d 74 3b 3e c0 mov ebx, dword [0c03e3b74h]
508	* %00000000c01204af 8b 0d d8 1c 34 c0 mov ecx, dword [0c0341cd8h]
509	* %00000000c01204b5 8d 56 ff lea edx, [esi-001h]
510	* %00000000c01204b8 21 da and edx, ebx
511	* %00000000c01204ba 88 04 11 mov byte [ecx+edx], al
512	* %00000000c01204bd 8d 53 01 lea edx, [ebx+001h]
513	* %00000000c01204c0 89 d0 mov eax, edx
514	* [...]
515	*/
516	RTDBGSYMBOL SymInfo;
517	rc = RTDbgModSymbolByName(hMod, "emit_log_char", &SymInfo);
518	if (RT_SUCCESS(rc))
519	{
520	/*
521	* Do the diassembling. Disassemble until a ret instruction is encountered
522	* or a limit is reached (don't want to disassemble for too long as the getter
523	* should be short). Certain instructions found are ignored (push, nop, etc.).
524	*/
525	unsigned cInstrDisassembled = 0;
526	uint32_t offInstr = 0;
527	bool fRet = false;
528	DISSTATE DisState;
529	unsigned cAddressesUsed = 0;
530	struct { size_t cb; RTGCPTR GCPtrOrigSrc; } aAddresses[5];
531	RT_ZERO(DisState);
532	RT_ZERO(aAddresses);
533
534	do
535	{
536	DBGFADDRESS Addr;
537	RTGCPTR GCPtrCur = (RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr + offInstr;
538	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrCur);
539
540	/* Prefetch the instruction. */
541	uint8_t abInstr[32];
542	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &abInstr[0], sizeof(abInstr));
543	if (RT_SUCCESS(rc))
544	{
545	uint32_t cbInstr = 0;
546
547	rc = DISInstr(&abInstr[0], pThis->f64Bit ? DISCPUMODE_64BIT : DISCPUMODE_32BIT, &DisState, &cbInstr);
548	if (RT_SUCCESS(rc))
549	{
550	switch (DisState.pCurInstr->uOpcode)
551	{
552	case OP_PUSH:
553	case OP_POP:
554	case OP_NOP:
555	case OP_LEA:
556	case OP_AND:
557	case OP_CBW:
558	case OP_DEC:
559	break;
560	case OP_RETN:
561	/* emit_log_char returned, abort disassembling. */
562	rc = VERR_NOT_FOUND;
563	fRet = true;
564	break;
565	case OP_MOV:
566	case OP_MOVSXD:
567	/*
568	* If a mov is encountered writing to memory with al (or dil for amd64) being the source the
569	* character is stored and we can infer the base address and size of the log buffer from
570	* the source addresses.
571	*/
572	if ( (DisState.Param2.fUse & DISUSE_REG_GEN8)
573	&& ( (DisState.Param2.Base.idxGenReg == DISGREG_AL && !pThis->f64Bit)
574	\|\| (DisState.Param2.Base.idxGenReg == DISGREG_DIL && pThis->f64Bit))
575	&& DISUSE_IS_EFFECTIVE_ADDR(DisState.Param1.fUse))
576	{
577	RTGCPTR GCPtrLogBuf = 0;
578	uint32_t cbLogBuf = 0;
579
580	/*
581	* We can stop disassembling now and inspect all registers, look for a valid kernel address first.
582	* Only one of the accessed registers should hold a valid kernel address.
583	* For the log size look for the biggest non kernel address.
584	*/
585	for (unsigned i = 0; i < cAddressesUsed; i++)
586	{
587	DBGFADDRESS AddrVal;
588	union { uint8_t abVal[8]; uint32_t u32Val; uint64_t u64Val; } Val;
589
590	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
591	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrVal,
592	aAddresses[i].GCPtrOrigSrc),
593	&Val.abVal[0], aAddresses[i].cb);
594	if (RT_SUCCESS(rc))
595	{
596	if (pThis->f64Bit && aAddresses[i].cb == sizeof(uint64_t))
597	{
598	if (LNX64_VALID_ADDRESS(Val.u64Val))
599	{
600	if (GCPtrLogBuf == 0)
601	GCPtrLogBuf = Val.u64Val;
602	else
603	{
604	rc = VERR_NOT_FOUND;
605	break;
606	}
607	}
608	}
609	else
610	{
611	AssertMsgBreakStmt(aAddresses[i].cb == sizeof(uint32_t),
612	("Invalid value size\n"), rc = VERR_INVALID_STATE);
613
614	/* Might be a kernel address or a size indicator. */
615	if (!pThis->f64Bit && LNX32_VALID_ADDRESS(Val.u32Val))
616	{
617	if (GCPtrLogBuf == 0)
618	GCPtrLogBuf = Val.u32Val;
619	else
620	{
621	rc = VERR_NOT_FOUND;
622	break;
623	}
624	}
625	else
626	{
627	/*
628	* The highest value will be the log buffer because the other
629	* accessed variables are indexes into the buffer and hence
630	* always smaller than the size.
631	*/
632	if (cbLogBuf < Val.u32Val)
633	cbLogBuf = Val.u32Val;
634	}
635	}
636	}
637	}
638
639	if ( RT_SUCCESS(rc)
640	&& GCPtrLogBuf != 0
641	&& cbLogBuf != 0)
642	{
643	*pGCPtrLogBuf = GCPtrLogBuf;
644	*pcbLogBuf = cbLogBuf;
645	}
646	else if (RT_SUCCESS(rc))
647	rc = VERR_NOT_FOUND;
648
649	fRet = true;
650	break;
651	}
652	else
653	{
654	/*
655	* In case of a memory to register move store the destination register index and the
656	* source address in the relation table for later processing.
657	*/
658	if ( (DisState.Param1.fUse & (DISUSE_BASE \| DISUSE_REG_GEN32 \| DISUSE_REG_GEN64))
659	&& (DisState.Param2.cb == sizeof(uint32_t) \|\| DisState.Param2.cb == sizeof(uint64_t))
660	&& (DisState.Param2.fUse & (DISUSE_RIPDISPLACEMENT32\|DISUSE_DISPLACEMENT32\|DISUSE_DISPLACEMENT64)))
661	{
662	RTGCPTR GCPtrVal = 0;
663
664	if (DisState.Param2.fUse & DISUSE_RIPDISPLACEMENT32)
665	GCPtrVal = GCPtrCur + DisState.Param2.uDisp.i32 + cbInstr;
666	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT32)
667	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u32;
668	else if (DisState.Param2.fUse & DISUSE_DISPLACEMENT64)
669	GCPtrVal = (RTGCPTR)DisState.Param2.uDisp.u64;
670	else
671	AssertMsgFailedBreakStmt(("Invalid displacement\n"), rc = VERR_INVALID_STATE);
672
673	if (cAddressesUsed < RT_ELEMENTS(aAddresses))
674	{
675	/* movsxd reads always 32bits. */
676	if (DisState.pCurInstr->uOpcode == OP_MOVSXD)
677	aAddresses[cAddressesUsed].cb = sizeof(uint32_t);
678	else
679	aAddresses[cAddressesUsed].cb = DisState.Param2.cb;
680	aAddresses[cAddressesUsed].GCPtrOrigSrc = GCPtrVal;
681	cAddressesUsed++;
682	}
683	else
684	{
685	rc = VERR_INVALID_PARAMETER;
686	break;
687	}
688	}
689	}
690	break;
691	default:
692	/* All other instructions will cause an error for now (playing safe here). */
693	rc = VERR_INVALID_PARAMETER;
694	break;
695	}
696	cInstrDisassembled++;
697	offInstr += cbInstr;
698	}
699	}
700	} while ( RT_SUCCESS(rc)
701	&& cInstrDisassembled < 20
702	&& !fRet);
703	}
704
705	return rc;
706	}
707
708	/**
709	* Try to get at the log buffer starting address and size by disassembling some exposed helpers.
710	*
711	* @returns VBox status code.
712	* @param pThis The Linux digger data.
713	* @param pUVM The VM handle.
714	* @param pVMM The VMM function table.
715	* @param hMod The module to use.
716	* @param pGCPtrLogBuf Where to store the log buffer pointer on success.
717	* @param pcbLogBuf Where to store the size of the log buffer on success.
718	*/
719	static int dbgDiggerLinuxQueryLogBufferPtrs(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
720	RTGCPTR pGCPtrLogBuf, uint32_t pcbLogBuf)
721	{
722	int rc = VINF_SUCCESS;
723
724	struct { void pvVar; uint32_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
725	{
726	{ pGCPtrLogBuf, (uint32_t)sizeof(RTGCPTR), (uint32_t)(pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)), "log_buf_addr_get" },
727	{ pcbLogBuf, (uint32_t)sizeof(uint32_t), (uint32_t)sizeof(uint32_t), "log_buf_len_get" }
728	};
729	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols) && RT_SUCCESS(rc); i++)
730	{
731	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
732	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
733	rc = dbgDiggerLinuxDisassembleSimpleGetter(pThis, pUVM, pVMM, hMod, aSymbols[i].pszSymbol,
734	aSymbols[i].pvVar, aSymbols[i].cbGuest);
735	}
736
737	return rc;
738	}
739
740	/**
741	* Returns whether the log buffer is a simple ascii buffer or a record based implementation
742	* based on the kernel version found.
743	*
744	* @returns Flag whether the log buffer is the simple ascii buffer.
745	* @param pThis The Linux digger data.
746	* @param pUVM The user mode VM handle.
747	* @param pVMM The VMM function table.
748	*/
749	static bool dbgDiggerLinuxLogBufferIsAsciiBuffer(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
750	{
751	char szTmp[128];
752	char const *pszVer = &szTmp[sizeof(g_abLinuxVersion) - 1];
753
754	RT_ZERO(szTmp);
755	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, szTmp, sizeof(szTmp) - 1);
756	if ( RT_SUCCESS(rc)
757	&& RTStrVersionCompare(pszVer, "3.4") == -1)
758	return true;
759
760	return false;
761	}
762
763	/**
764	* Worker to get at the kernel log for pre 3.4 kernels where the log buffer was just a char buffer.
765	*
766	* @returns VBox status code.
767	* @param pThis The Linux digger data.
768	* @param pUVM The VM user mdoe handle.
769	* @param pVMM The VMM function table.
770	* @param hMod The debug module handle.
771	* @param fFlags Flags reserved for future use, MBZ.
772	* @param cMessages The number of messages to retrieve, counting from the
773	* end of the log (i.e. like tail), use UINT32_MAX for all.
774	* @param pszBuf The output buffer.
775	* @param cbBuf The buffer size.
776	* @param pcbActual Where to store the number of bytes actually returned,
777	* including zero terminator. On VERR_BUFFER_OVERFLOW this
778	* holds the necessary buffer size. Optional.
779	*/
780	static int dbgDiggerLinuxLogBufferQueryAscii(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
781	uint32_t fFlags, uint32_t cMessages,
782	char pszBuf, size_t cbBuf, size_t pcbActual)
783	{
784	RT_NOREF2(fFlags, cMessages);
785	int rc = VINF_SUCCESS;
786	RTGCPTR GCPtrLogBuf;
787	uint32_t cbLogBuf;
788
789	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
790	{
791	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
792	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
793	};
794	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
795	{
796	RTDBGSYMBOL SymInfo;
797	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
798	if (RT_SUCCESS(rc))
799	{
800	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
801	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
802	DBGFADDRESS Addr;
803	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
804	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
805	(RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
806	aSymbols[i].pvVar, aSymbols[i].cbGuest);
807	if (RT_SUCCESS(rc))
808	continue;
809	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
810	}
811	else
812	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
813	rc = VERR_NOT_FOUND;
814	break;
815	}
816
817	/*
818	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
819	* some public helpers to get at the addresses.
820	*
821	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
822	*/
823	if (rc == VERR_NOT_FOUND)
824	{
825	rc = dbgDiggerLinuxQueryAsciiLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
826	if (RT_FAILURE(rc))
827	return rc;
828	}
829
830	/*
831	* Check if the values make sense.
832	*/
833	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
834	{
835	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
836	return VERR_NOT_FOUND;
837	}
838	if ( cbLogBuf < 4096
839	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
840	\|\| cbLogBuf > 16*_1M)
841	{
842	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
843	return VERR_NOT_FOUND;
844	}
845
846	/*
847	* Read the whole log buffer.
848	*/
849	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
850	if (!pbLogBuf)
851	{
852	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
853	return VERR_NO_MEMORY;
854	}
855	DBGFADDRESS Addr;
856	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
857	if (RT_FAILURE(rc))
858	{
859	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
860	cbLogBuf, Addr.FlatPtr, rc));
861	RTMemFree(pbLogBuf);
862	return VERR_NOT_FOUND;
863	}
864
865	/** @todo Try to parse where the single messages start to make use of cMessages. */
866	size_t cchLength = RTStrNLen((const char *)pbLogBuf, cbLogBuf);
867	memcpy(&pszBuf[0], pbLogBuf, RT_MIN(cbBuf, cchLength));
868
869	/* Done with the buffer. */
870	RTMemFree(pbLogBuf);
871
872	/* Set return size value. */
873	if (pcbActual)
874	*pcbActual = RT_MIN(cbBuf, cchLength);
875
876	return cbBuf <= cchLength ? VERR_BUFFER_OVERFLOW : VINF_SUCCESS;
877	}
878
879
880	/**
881	* Worker to process a given record based kernel log.
882	*
883	* @returns VBox status code.
884	* @param pThis The Linux digger data.
885	* @param pUVM The VM user mode handle.
886	* @param pVMM The VMM function table.
887	* @param GCPtrLogBuf Flat guest address of the start of the log buffer.
888	* @param cbLogBuf Power of two aligned size of the log buffer.
889	* @param idxFirst Index in the log bfufer of the first message.
890	* @param idxNext Index where to write hte next message in the log buffer.
891	* @param fFlags Flags reserved for future use, MBZ.
892	* @param cMessages The number of messages to retrieve, counting from the
893	* end of the log (i.e. like tail), use UINT32_MAX for all.
894	* @param pszBuf The output buffer.
895	* @param cbBuf The buffer size.
896	* @param pcbActual Where to store the number of bytes actually returned,
897	* including zero terminator. On VERR_BUFFER_OVERFLOW this
898	* holds the necessary buffer size. Optional.
899	*/
900	static int dbgDiggerLinuxKrnLogBufferProcess(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTGCPTR GCPtrLogBuf,
901	uint32_t cbLogBuf, uint32_t idxFirst, uint32_t idxNext,
902	uint32_t fFlags, uint32_t cMessages, char *pszBuf, size_t cbBuf,
903	size_t *pcbActual)
904	{
905	RT_NOREF(fFlags);
906
907	/*
908	* Check if the values make sense.
909	*/
910	if (pThis->f64Bit ? !LNX64_VALID_ADDRESS(GCPtrLogBuf) : !LNX32_VALID_ADDRESS(GCPtrLogBuf))
911	{
912	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf' value %RGv is not valid.\n", GCPtrLogBuf));
913	return VERR_NOT_FOUND;
914	}
915	if ( cbLogBuf < _4K
916	\|\| !RT_IS_POWER_OF_TWO(cbLogBuf)
917	\|\| cbLogBuf > LNX_MAX_KERNEL_LOG_SIZE)
918	{
919	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_buf_len' value %#x is not valid.\n", cbLogBuf));
920	return VERR_NOT_FOUND;
921	}
922	uint32_t const cbLogAlign = 4;
923	if ( idxFirst > cbLogBuf - sizeof(LNXPRINTKHDR)
924	\|\| (idxFirst & (cbLogAlign - 1)) != 0)
925	{
926	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_first_idx' value %#x is not valid.\n", idxFirst));
927	return VERR_NOT_FOUND;
928	}
929	if ( idxNext > cbLogBuf - sizeof(LNXPRINTKHDR)
930	\|\| (idxNext & (cbLogAlign - 1)) != 0)
931	{
932	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: 'log_next_idx' value %#x is not valid.\n", idxNext));
933	return VERR_NOT_FOUND;
934	}
935
936	/*
937	* Read the whole log buffer.
938	*/
939	uint8_t pbLogBuf = (uint8_t )RTMemAlloc(cbLogBuf);
940	if (!pbLogBuf)
941	{
942	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Failed to allocate %#x bytes for log buffer\n", cbLogBuf));
943	return VERR_NO_MEMORY;
944	}
945	DBGFADDRESS Addr;
946	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrLogBuf), pbLogBuf, cbLogBuf);
947	if (RT_FAILURE(rc))
948	{
949	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error reading %#x bytes of log buffer at %RGv: %Rrc\n",
950	cbLogBuf, Addr.FlatPtr, rc));
951	RTMemFree(pbLogBuf);
952	return VERR_NOT_FOUND;
953	}
954
955	/*
956	* Count the messages in the buffer while doing some basic validation.
957	*/
958	uint32_t const cbUsed = idxFirst == idxNext ? cbLogBuf /* could be empty... */
959	: idxFirst < idxNext ? idxNext - idxFirst : cbLogBuf - idxFirst + idxNext;
960	uint32_t cbLeft = cbUsed;
961	uint32_t offCur = idxFirst;
962	uint32_t cLogMsgs = 0;
963
964	while (cbLeft > 0)
965	{
966	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
967	if (!pHdr->cbTotal)
968	{
969	/* Wrap around packet, most likely... */
970	if (cbLogBuf - offCur >= cbLeft)
971	break;
972	offCur = 0;
973	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
974	}
975	if (RT_UNLIKELY( pHdr->cbTotal > cbLogBuf - sizeof(*pHdr) - offCur
976	\|\| pHdr->cbTotal > cbLeft
977	\|\| (pHdr->cbTotal & (cbLogAlign - 1)) != 0
978	\|\| pHdr->cbTotal < (uint32_t)pHdr->cbText + (uint32_t)pHdr->cbDict + sizeof(*pHdr) ))
979	{
980	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Invalid printk_log record at %#x: cbTotal=%#x cbText=%#x cbDict=%#x cbLogBuf=%#x cbLeft=%#x\n",
981	offCur, pHdr->cbTotal, pHdr->cbText, pHdr->cbDict, cbLogBuf, cbLeft));
982	break;
983	}
984
985	if (pHdr->cbText > 0)
986	cLogMsgs++;
987
988	/* next */
989	offCur += pHdr->cbTotal;
990	cbLeft -= pHdr->cbTotal;
991	}
992	if (!cLogMsgs)
993	{
994	RTMemFree(pbLogBuf);
995	return VERR_NOT_FOUND;
996	}
997
998	/*
999	* Copy the messages into the output buffer.
1000	*/
1001	offCur = idxFirst;
1002	cbLeft = cbUsed - cbLeft;
1003
1004	/* Skip messages that the caller doesn't want. */
1005	if (cMessages < cLogMsgs)
1006	{
1007	uint32_t cToSkip = cLogMsgs - cMessages;
1008	cLogMsgs -= cToSkip;
1009
1010	while (cToSkip > 0)
1011	{
1012	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1013	if (!pHdr->cbTotal)
1014	{
1015	offCur = 0;
1016	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1017	}
1018	if (pHdr->cbText > 0)
1019	cToSkip--;
1020
1021	/* next */
1022	offCur += pHdr->cbTotal;
1023	cbLeft -= pHdr->cbTotal;
1024	}
1025	}
1026
1027	/* Now copy the messages. */
1028	size_t offDst = 0;
1029	while (cbLeft > 0)
1030	{
1031	PCLNXPRINTKHDR pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1032	if ( !pHdr->cbTotal
1033	\|\| !cLogMsgs)
1034	{
1035	if (cbLogBuf - offCur >= cbLeft)
1036	break;
1037	offCur = 0;
1038	pHdr = (PCLNXPRINTKHDR)&pbLogBuf[offCur];
1039	}
1040
1041	if (pHdr->cbText > 0)
1042	{
1043	char pchText = (char )(pHdr + 1);
1044	size_t cchText = RTStrNLen(pchText, pHdr->cbText);
1045	if (offDst + cchText < cbBuf)
1046	{
1047	memcpy(&pszBuf[offDst], pHdr + 1, cchText);
1048	pszBuf[offDst + cchText] = '\n';
1049	}
1050	else if (offDst < cbBuf)
1051	memcpy(&pszBuf[offDst], pHdr + 1, cbBuf - offDst);
1052	offDst += cchText + 1;
1053	}
1054
1055	/* next */
1056	offCur += pHdr->cbTotal;
1057	cbLeft -= pHdr->cbTotal;
1058	}
1059
1060	/* Done with the buffer. */
1061	RTMemFree(pbLogBuf);
1062
1063	/* Make sure we've reserved a char for the terminator. */
1064	if (!offDst)
1065	offDst = 1;
1066
1067	/* Set return size value. */
1068	if (pcbActual)
1069	*pcbActual = offDst;
1070
1071	if (offDst <= cbBuf)
1072	return VINF_SUCCESS;
1073	return VERR_BUFFER_OVERFLOW;
1074	}
1075
1076
1077	/**
1078	* Worker to get at the kernel log for post 3.4 kernels where the log buffer contains records.
1079	*
1080	* @returns VBox status code.
1081	* @param pThis The Linux digger data.
1082	* @param pUVM The VM user mdoe handle.
1083	* @param pVMM The VMM function table.
1084	* @param hMod The debug module handle.
1085	* @param fFlags Flags reserved for future use, MBZ.
1086	* @param cMessages The number of messages to retrieve, counting from the
1087	* end of the log (i.e. like tail), use UINT32_MAX for all.
1088	* @param pszBuf The output buffer.
1089	* @param cbBuf The buffer size.
1090	* @param pcbActual Where to store the number of bytes actually returned,
1091	* including zero terminator. On VERR_BUFFER_OVERFLOW this
1092	* holds the necessary buffer size. Optional.
1093	*/
1094	static int dbgDiggerLinuxLogBufferQueryRecords(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, RTDBGMOD hMod,
1095	uint32_t fFlags, uint32_t cMessages,
1096	char pszBuf, size_t cbBuf, size_t pcbActual)
1097	{
1098	int rc = VINF_SUCCESS;
1099	RTGCPTR GCPtrLogBuf;
1100	uint32_t cbLogBuf;
1101	uint32_t idxFirst;
1102	uint32_t idxNext;
1103
1104	struct { void pvVar; size_t cbHost, cbGuest; const char pszSymbol; } aSymbols[] =
1105	{
1106	{ &GCPtrLogBuf, sizeof(GCPtrLogBuf), pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t), "log_buf" },
1107	{ &cbLogBuf, sizeof(cbLogBuf), sizeof(cbLogBuf), "log_buf_len" },
1108	{ &idxFirst, sizeof(idxFirst), sizeof(idxFirst), "log_first_idx" },
1109	{ &idxNext, sizeof(idxNext), sizeof(idxNext), "log_next_idx" },
1110	};
1111	for (uint32_t i = 0; i < RT_ELEMENTS(aSymbols); i++)
1112	{
1113	RTDBGSYMBOL SymInfo;
1114	rc = RTDbgModSymbolByName(hMod, aSymbols[i].pszSymbol, &SymInfo);
1115	if (RT_SUCCESS(rc))
1116	{
1117	RT_BZERO(aSymbols[i].pvVar, aSymbols[i].cbHost);
1118	Assert(aSymbols[i].cbHost >= aSymbols[i].cbGuest);
1119	DBGFADDRESS Addr;
1120	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1121	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1122	(RTGCPTR)SymInfo.Value + pThis->AddrKernelBase.FlatPtr),
1123	aSymbols[i].pvVar, aSymbols[i].cbGuest);
1124	if (RT_SUCCESS(rc))
1125	continue;
1126	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Reading '%s' at %RGv: %Rrc\n", aSymbols[i].pszSymbol, Addr.FlatPtr, rc));
1127	}
1128	else
1129	LogRel(("dbgDiggerLinuxIDmsg_QueryKernelLog: Error looking up '%s': %Rrc\n", aSymbols[i].pszSymbol, rc));
1130	rc = VERR_NOT_FOUND;
1131	break;
1132	}
1133
1134	/*
1135	* Some kernels don't expose the variables in kallsyms so we have to try disassemble
1136	* some public helpers to get at the addresses.
1137	*
1138	* @todo: Maybe cache those values so we don't have to do the heavy work every time?
1139	*/
1140	if (rc == VERR_NOT_FOUND)
1141	{
1142	idxFirst = 0;
1143	idxNext = 0;
1144	rc = dbgDiggerLinuxQueryLogBufferPtrs(pThis, pUVM, pVMM, hMod, &GCPtrLogBuf, &cbLogBuf);
1145	if (RT_FAILURE(rc))
1146	{
1147	/*
1148	* Last resort, scan for a known value which should appear only once in the kernel log buffer
1149	* and try to deduce the boundaries from there.
1150	*/
1151	return dbgDiggerLinuxKrnlLogBufFindByNeedle(pThis, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1152	}
1153	}
1154
1155	return dbgDiggerLinuxKrnLogBufferProcess(pThis, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, idxFirst, idxNext,
1156	fFlags, cMessages, pszBuf, cbBuf, pcbActual);
1157	}
1158
1159	/**
1160	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
1161	*/
1162	static DECLCALLBACK(int) dbgDiggerLinuxIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, uint32_t fFlags,
1163	uint32_t cMessages, char pszBuf, size_t cbBuf, size_t pcbActual)
1164	{
1165	PDBGDIGGERLINUX pData = RT_FROM_MEMBER(pThis, DBGDIGGERLINUX, IDmesg);
1166
1167	if (cMessages < 1)
1168	return VERR_INVALID_PARAMETER;
1169
1170	/*
1171	* Resolve the symbols we need and read their values.
1172	*/
1173	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1174	RTDBGMOD hMod;
1175	int rc = RTDbgAsModuleByName(hAs, "vmlinux", 0, &hMod);
1176	RTDbgAsRelease(hAs);
1177
1178	size_t cbActual = 0;
1179	if (RT_SUCCESS(rc))
1180	{
1181	/*
1182	* Check whether the kernel log buffer is a simple char buffer or the newer
1183	* record based implementation.
1184	* The record based implementation was presumably introduced with kernel 3.4,
1185	* see: http://thread.gmane.org/gmane.linux.kernel/1284184
1186	*/
1187	if (dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1188	rc = dbgDiggerLinuxLogBufferQueryAscii(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1189	else
1190	rc = dbgDiggerLinuxLogBufferQueryRecords(pData, pUVM, pVMM, hMod, fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1191
1192	/* Release the module in any case. */
1193	RTDbgModRelease(hMod);
1194	}
1195	else
1196	{
1197	/*
1198	* For the record based kernel versions we have a last resort heuristic which doesn't
1199	* require any symbols, try that here.
1200	*/
1201	if (!dbgDiggerLinuxLogBufferIsAsciiBuffer(pData, pUVM, pVMM))
1202	{
1203	RTGCPTR GCPtrLogBuf = 0;
1204	uint32_t cbLogBuf = 0;
1205
1206	rc = dbgDiggerLinuxKrnlLogBufFindByNeedle(pData, pUVM, pVMM, &GCPtrLogBuf, &cbLogBuf);
1207	if (RT_SUCCESS(rc))
1208	rc = dbgDiggerLinuxKrnLogBufferProcess(pData, pUVM, pVMM, GCPtrLogBuf, cbLogBuf, 0 /idxFirst/, 0 /idxNext/,
1209	fFlags, cMessages, pszBuf, cbBuf, &cbActual);
1210	}
1211	else
1212	rc = VERR_NOT_FOUND;
1213	}
1214
1215	if (RT_FAILURE(rc) && rc != VERR_BUFFER_OVERFLOW)
1216	return rc;
1217
1218	if (pcbActual)
1219	*pcbActual = cbActual;
1220
1221	/*
1222	* All VBox strings are UTF-8 and bad things may in theory happen if we
1223	* pass bad UTF-8 to code which assumes it's all valid. So, we enforce
1224	* UTF-8 upon the guest kernel messages here even if they (probably) have
1225	* no defined code set in reality.
1226	*/
1227	if ( RT_SUCCESS(rc)
1228	&& cbActual <= cbBuf)
1229	{
1230	pszBuf[cbActual - 1] = '\0';
1231	RTStrPurgeEncoding(pszBuf);
1232	return VINF_SUCCESS;
1233	}
1234
1235	if (cbBuf)
1236	{
1237	pszBuf[cbBuf - 1] = '\0';
1238	RTStrPurgeEncoding(pszBuf);
1239	}
1240	return VERR_BUFFER_OVERFLOW;
1241	}
1242
1243
1244	/**
1245	* Worker destroying the config database.
1246	*/
1247	static DECLCALLBACK(int) dbgDiggerLinuxCfgDbDestroyWorker(PRTSTRSPACECORE pStr, void *pvUser)
1248	{
1249	PDBGDIGGERLINUXCFGITEM pCfgItem = (PDBGDIGGERLINUXCFGITEM)pStr;
1250	RTStrFree((char *)pCfgItem->Core.pszString);
1251	RTMemFree(pCfgItem);
1252	NOREF(pvUser);
1253	return 0;
1254	}
1255
1256
1257	/**
1258	* Destroy the config database.
1259	*
1260	* @returns nothing.
1261	* @param pThis The Linux digger data.
1262	*/
1263	static void dbgDiggerLinuxCfgDbDestroy(PDBGDIGGERLINUX pThis)
1264	{
1265	RTStrSpaceDestroy(&pThis->hCfgDb, dbgDiggerLinuxCfgDbDestroyWorker, NULL);
1266	}
1267
1268
1269	/**
1270	* @copydoc DBGFOSREG::pfnStackUnwindAssist
1271	*/
1272	static DECLCALLBACK(int) dbgDiggerLinuxStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
1273	PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
1274	RTDBGAS hAs, uint64_t *puScratch)
1275	{
1276	RT_NOREF(pUVM, pVMM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
1277	return VINF_SUCCESS;
1278	}
1279
1280
1281	/**
1282	* @copydoc DBGFOSREG::pfnQueryInterface
1283	*/
1284	static DECLCALLBACK(void ) dbgDiggerLinuxQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void pvData, DBGFOSINTERFACE enmIf)
1285	{
1286	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1287	RT_NOREF(pUVM, pVMM);
1288
1289	switch (enmIf)
1290	{
1291	case DBGFOSINTERFACE_DMESG:
1292	return &pThis->IDmesg;
1293
1294	default:
1295	return NULL;
1296	}
1297	}
1298
1299
1300	/**
1301	* @copydoc DBGFOSREG::pfnQueryVersion
1302	*/
1303	static DECLCALLBACK(int) dbgDiggerLinuxQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
1304	char *pszVersion, size_t cchVersion)
1305	{
1306	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1307	Assert(pThis->fValid);
1308
1309	/*
1310	* It's all in the linux banner.
1311	*/
1312	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, pszVersion, cchVersion);
1313	if (RT_SUCCESS(rc))
1314	{
1315	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
1316	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
1317	while ( pszEnd > pszVersion
1318	&& RT_C_IS_SPACE(pszEnd[-1]))
1319	pszEnd--;
1320	*pszEnd = '\0';
1321	}
1322	else
1323	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
1324
1325	return rc;
1326	}
1327
1328
1329	/**
1330	* @copydoc DBGFOSREG::pfnTerm
1331	*/
1332	static DECLCALLBACK(void) dbgDiggerLinuxTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1333	{
1334	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1335	Assert(pThis->fValid);
1336
1337	/*
1338	* Destroy configuration database.
1339	*/
1340	dbgDiggerLinuxCfgDbDestroy(pThis);
1341
1342	/*
1343	* Unlink and release our modules.
1344	*/
1345	RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1346	if (hDbgAs != NIL_RTDBGAS)
1347	{
1348	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
1349	while (iMod-- > 0)
1350	{
1351	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
1352	if (hMod != NIL_RTDBGMOD)
1353	{
1354	if (RTDbgModGetTag(hMod) == DIG_LNX_MOD_TAG)
1355	{
1356	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
1357	AssertRC(rc);
1358	}
1359	RTDbgModRelease(hMod);
1360	}
1361	}
1362	RTDbgAsRelease(hDbgAs);
1363	}
1364
1365	pThis->fValid = false;
1366	}
1367
1368
1369	/**
1370	* @copydoc DBGFOSREG::pfnRefresh
1371	*/
1372	static DECLCALLBACK(int) dbgDiggerLinuxRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1373	{
1374	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
1375	RT_NOREF(pThis);
1376	Assert(pThis->fValid);
1377
1378	/*
1379	* For now we'll flush and reload everything.
1380	*/
1381	dbgDiggerLinuxTerm(pUVM, pVMM, pvData);
1382	return dbgDiggerLinuxInit(pUVM, pVMM, pvData);
1383	}
1384
1385
1386	/**
1387	* Worker for dbgDiggerLinuxFindStartOfNamesAndSymbolCount that update the
1388	* digger data.
1389	*
1390	* @returns VINF_SUCCESS.
1391	* @param pThis The Linux digger data to update.
1392	* @param pVMM The VMM function table.
1393	* @param pAddrKernelNames The kallsyms_names address.
1394	* @param cKernelSymbols The number of kernel symbol.
1395	* @param cbAddress The guest address size.
1396	*/
1397	static int dbgDiggerLinuxFoundStartOfNames(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pAddrKernelNames,
1398	uint32_t cKernelSymbols, uint32_t cbAddress)
1399	{
1400	pThis->cKernelSymbols = cKernelSymbols;
1401	pThis->AddrKernelNames = *pAddrKernelNames;
1402	pThis->AddrKernelAddresses = *pAddrKernelNames;
1403	uint32_t cbSymbolsSkip = (pThis->fRelKrnlAddr ? 2 : 1) * cbAddress; /* Relative addressing introduces kallsyms_relative_base. */
1404	uint32_t cbOffsets = pThis->fRelKrnlAddr ? sizeof(int32_t) : cbAddress; /* Offsets are always 32bits wide for relative addressing. */
1405	uint32_t cbAlign = 0;
1406
1407	/*
1408	* If the number of symbols is odd there is padding to align the following guest pointer
1409	* sized data properly on 64bit systems with relative addressing.
1410	*/
1411	if ( pThis->fRelKrnlAddr
1412	&& pThis->f64Bit
1413	&& (pThis->cKernelSymbols & 1))
1414	cbAlign = sizeof(int32_t);
1415	pVMM->pfnDBGFR3AddrSub(&pThis->AddrKernelAddresses, cKernelSymbols * cbOffsets + cbSymbolsSkip + cbAlign);
1416
1417	Log(("dbgDiggerLinuxFoundStartOfNames: AddrKernelAddresses=%RGv\n"
1418	"dbgDiggerLinuxFoundStartOfNames: cKernelSymbols=%#x (at %RGv)\n"
1419	"dbgDiggerLinuxFoundStartOfNames: AddrKernelName=%RGv\n",
1420	pThis->AddrKernelAddresses.FlatPtr,
1421	pThis->cKernelSymbols, pThis->AddrKernelNames.FlatPtr - cbAddress,
1422	pThis->AddrKernelNames.FlatPtr));
1423	return VINF_SUCCESS;
1424	}
1425
1426
1427	/**
1428	* Tries to find the address of the kallsyms_names, kallsyms_num_syms and
1429	* kallsyms_addresses symbols.
1430	*
1431	* The kallsyms_num_syms is read and stored in pThis->cKernelSymbols, while the
1432	* addresses of the other two are stored as pThis->AddrKernelNames and
1433	* pThis->AddrKernelAddresses.
1434	*
1435	* @returns VBox status code, success indicating that all three variables have
1436	* been found and taken down.
1437	* @param pUVM The user mode VM handle.
1438	* @param pVMM The VMM function table.
1439	* @param pThis The Linux digger data.
1440	* @param pHitAddr An address we think is inside kallsyms_names.
1441	*/
1442	static int dbgDiggerLinuxFindStartOfNamesAndSymbolCount(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis,
1443	PCDBGFADDRESS pHitAddr)
1444	{
1445	/*
1446	* Search backwards in chunks.
1447	*/
1448	union
1449	{
1450	uint8_t ab[0x1000];
1451	uint32_t au32[0x1000 / sizeof(uint32_t)];
1452	uint64_t au64[0x1000 / sizeof(uint64_t)];
1453	} uBuf;
1454	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE;
1455	uint32_t cbBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1456	DBGFADDRESS CurAddr = *pHitAddr;
1457	pVMM->pfnDBGFR3AddrSub(&CurAddr, cbBuf);
1458	cbBuf += sizeof(uint64_t) - 1; /* In case our kobj hit is in the first 4/8 bytes. */
1459	for (;;)
1460	{
1461	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1462	if (RT_FAILURE(rc))
1463	return rc;
1464
1465	/*
1466	* Since Linux 4.6 there are two different methods to store the kallsyms addresses
1467	* in the image.
1468	*
1469	* The first and longer existing method is to store the absolute addresses in an
1470	* array starting at kallsyms_addresses followed by a field which stores the number
1471	* of kernel symbols called kallsyms_num_syms.
1472	* The newer method is to use offsets stored in kallsyms_offsets and have a base pointer
1473	* to relate the offsets to called kallsyms_relative_base. One entry in kallsyms_offsets is
1474	* always 32bit wide regardless of the guest pointer size (this halves the table on 64bit
1475	* systems) but means more work for us for the 64bit case.
1476	*
1477	* When absolute addresses are used the following assumptions hold:
1478	*
1479	* We assume that the three symbols are aligned on guest pointer boundary.
1480	*
1481	* The boundary between the two tables should be noticable as the number
1482	* is unlikely to be more than 16 millions, there will be at least one zero
1483	* byte where it is, 64-bit will have 5 zero bytes. Zero bytes aren't all
1484	* that common in the kallsyms_names table.
1485	*
1486	* Also the kallsyms_names table starts with a length byte, which means
1487	* we're likely to see a byte in the range 1..31.
1488	*
1489	* The kallsyms_addresses are mostly sorted (except for the start where the
1490	* absolute symbols are), so we'll spot a bunch of kernel addresses
1491	* immediately preceeding the kallsyms_num_syms field.
1492	*
1493	* Lazy bird: If kallsyms_num_syms is on a buffer boundrary, we skip
1494	* the check for kernel addresses preceeding it.
1495	*
1496	* For relative offsets most of the assumptions from above are true too
1497	* except that we have to distinguish between the relative base address and the offsets.
1498	* Every observed kernel has a valid kernel address fo the relative base and kallsyms_relative_base
1499	* always comes before kallsyms_num_syms and is aligned on a guest pointer boundary.
1500	* Offsets are stored before kallsyms_relative_base and don't contain valid kernel addresses.
1501	*
1502	* To distinguish between absolute and relative offsetting we check the data before a candidate
1503	* for kallsyms_num_syms. If all entries before the kallsyms_num_syms candidate are valid kernel
1504	* addresses absolute addresses are assumed. If this is not the case but the first entry before
1505	* kallsyms_num_syms is a valid kernel address we check whether the data before and the possible
1506	* relative base form a valid kernel address and assume relative offsets.
1507	*
1508	* Other notable changes between various Linux kernel versions:
1509	*
1510	* 4.20.0+: Commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a made kallsyms_num_syms 32bit
1511	* even on 64bit systems but the alignment of the variables makes the code below work for now
1512	* (tested with a 5.4 and 5.12 kernel) do we keep it that way to avoid making the code even
1513	* messy.
1514	*/
1515	if (pThis->f64Bit)
1516	{
1517	uint32_t i = cbBuf / sizeof(uint64_t) - 1;
1518	while (i-- > 0)
1519	if ( uBuf.au64[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1520	&& uBuf.au64[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1521	{
1522	uint8_t pb = (uint8_t )&uBuf.au64[i + 1];
1523	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1524	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1525	{
1526	/*
1527	* Check whether we have a valid kernel address and try to distinguish
1528	* whether the kernel uses relative offsetting or absolute addresses.
1529	*/
1530	if ( (i >= 1 && LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1531	&& (i >= 2 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1532	&& (i >= 3 && !LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1533	{
1534	RTGCUINTPTR uKrnlRelBase = uBuf.au64[i - 1];
1535	DBGFADDRESS RelAddr = CurAddr;
1536	int32_t aiRelOff[3];
1537	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1538	pVMM->pfnDBGFR3AddrAdd(&RelAddr,
1539	(i - 1) * sizeof(uint64_t) - sizeof(aiRelOff)),
1540	&aiRelOff[0], sizeof(aiRelOff));
1541	if ( RT_SUCCESS(rc)
1542	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[0])
1543	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[1])
1544	&& LNX64_VALID_ADDRESS(uKrnlRelBase + aiRelOff[2]))
1545	{
1546	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1547	uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint64_t)));
1548	pThis->fRelKrnlAddr = true;
1549	pThis->uKernelRelativeBase = uKrnlRelBase;
1550	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1551	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1552	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
1553	}
1554	}
1555
1556	if ( (i <= 0 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 1]))
1557	&& (i <= 1 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 2]))
1558	&& (i <= 2 \|\| LNX64_VALID_ADDRESS(uBuf.au64[i - 3])))
1559	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1560	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint64_t)),
1561	(uint32_t)uBuf.au64[i], sizeof(uint64_t));
1562	}
1563	}
1564	}
1565	else
1566	{
1567	uint32_t i = cbBuf / sizeof(uint32_t) - 1;
1568	while (i-- > 0)
1569	if ( uBuf.au32[i] <= LNX_MAX_KALLSYMS_SYMBOLS
1570	&& uBuf.au32[i] >= LNX_MIN_KALLSYMS_SYMBOLS)
1571	{
1572	uint8_t pb = (uint8_t )&uBuf.au32[i + 1];
1573	if ( pb[0] <= LNX_MAX_KALLSYMS_ENC_LENGTH
1574	&& pb[0] >= LNX_MIN_KALLSYMS_ENC_LENGTH)
1575	{
1576	/* Check for relative base addressing. */
1577	if (i >= 1 && LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1578	{
1579	RTGCUINTPTR uKrnlRelBase = uBuf.au32[i - 1];
1580	if ( (i <= 1 \|\| LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 2]))
1581	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uKrnlRelBase + uBuf.au32[i - 3])))
1582	{
1583	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: relative base %RGv (at %RGv)\n",
1584	uKrnlRelBase, CurAddr.FlatPtr + (i - 1) * sizeof(uint32_t)));
1585	pThis->fRelKrnlAddr = true;
1586	pThis->uKernelRelativeBase = uKrnlRelBase;
1587	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1588	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1589	uBuf.au32[i], sizeof(uint32_t));
1590	}
1591	}
1592
1593	if ( (i <= 0 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 1]))
1594	&& (i <= 1 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 2]))
1595	&& (i <= 2 \|\| LNX32_VALID_ADDRESS(uBuf.au32[i - 3])))
1596	return dbgDiggerLinuxFoundStartOfNames(pThis, pVMM,
1597	pVMM->pfnDBGFR3AddrAdd(&CurAddr, (i + 1) * sizeof(uint32_t)),
1598	uBuf.au32[i], sizeof(uint32_t));
1599	}
1600	}
1601	}
1602
1603	/*
1604	* Advance
1605	*/
1606	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1607	{
1608	Log(("dbgDiggerLinuxFindStartOfNamesAndSymbolCount: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1609	return VERR_NOT_FOUND;
1610	}
1611	cbLeft -= sizeof(uBuf);
1612	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uBuf));
1613	cbBuf = sizeof(uBuf);
1614	}
1615	}
1616
1617
1618	/**
1619	* Worker for dbgDiggerLinuxFindEndNames that records the findings.
1620	*
1621	* @returns VINF_SUCCESS
1622	* @param pThis The linux digger data to update.
1623	* @param pVMM The VMM function table.
1624	* @param pAddrMarkers The address of the marker (kallsyms_markers).
1625	* @param cbMarkerEntry The size of a marker entry (32-bit or 64-bit).
1626	*/
1627	static int dbgDiggerLinuxFoundMarkers(PDBGDIGGERLINUX pThis, PCVMMR3VTABLE pVMM,
1628	PCDBGFADDRESS pAddrMarkers, uint32_t cbMarkerEntry)
1629	{
1630	pThis->cbKernelNames = pAddrMarkers->FlatPtr - pThis->AddrKernelNames.FlatPtr;
1631	pThis->AddrKernelNameMarkers = *pAddrMarkers;
1632	pThis->cKernelNameMarkers = RT_ALIGN_32(pThis->cKernelSymbols, 256) / 256;
1633	pThis->AddrKernelTokenTable = *pAddrMarkers;
1634	pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenTable, pThis->cKernelNameMarkers * cbMarkerEntry);
1635
1636	Log(("dbgDiggerLinuxFoundMarkers: AddrKernelNames=%RGv cbKernelNames=%#x\n"
1637	"dbgDiggerLinuxFoundMarkers: AddrKernelNameMarkers=%RGv cKernelNameMarkers=%#x\n"
1638	"dbgDiggerLinuxFoundMarkers: AddrKernelTokenTable=%RGv\n",
1639	pThis->AddrKernelNames.FlatPtr, pThis->cbKernelNames,
1640	pThis->AddrKernelNameMarkers.FlatPtr, pThis->cKernelNameMarkers,
1641	pThis->AddrKernelTokenTable.FlatPtr));
1642	return VINF_SUCCESS;
1643	}
1644
1645
1646	/**
1647	* Tries to find the end of kallsyms_names and thereby the start of
1648	* kallsyms_markers and kallsyms_token_table.
1649	*
1650	* The kallsyms_names size is stored in pThis->cbKernelNames, the addresses of
1651	* the two other symbols in pThis->AddrKernelNameMarkers and
1652	* pThis->AddrKernelTokenTable. The number of marker entries is stored in
1653	* pThis->cKernelNameMarkers.
1654	*
1655	* @returns VBox status code, success indicating that all three variables have
1656	* been found and taken down.
1657	* @param pUVM The user mode VM handle.
1658	* @param pVMM The VMM function table.
1659	* @param pThis The Linux digger data.
1660	* @param pHitAddr An address we think is inside kallsyms_names.
1661	*/
1662	static int dbgDiggerLinuxFindEndOfNamesAndMore(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, PCDBGFADDRESS pHitAddr)
1663	{
1664	/*
1665	* Search forward in chunks.
1666	*/
1667	union
1668	{
1669	uint8_t ab[0x1000];
1670	uint32_t au32[0x1000 / sizeof(uint32_t)];
1671	uint64_t au64[0x1000 / sizeof(uint64_t)];
1672	} uBuf;
1673	bool fPendingZeroHit = false;
1674	uint32_t cbLeft = LNX_MAX_KALLSYMS_NAMES_SIZE + sizeof(uBuf);
1675	uint32_t offBuf = pHitAddr->FlatPtr & (sizeof(uBuf) - 1);
1676	DBGFADDRESS CurAddr = *pHitAddr;
1677	pVMM->pfnDBGFR3AddrSub(&CurAddr, offBuf);
1678	for (;;)
1679	{
1680	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1681	if (RT_FAILURE(rc))
1682	return rc;
1683
1684	/*
1685	* The kallsyms_names table is followed by kallsyms_markers we assume,
1686	* using sizeof(unsigned long) alignment like the preceeding symbols.
1687	*
1688	* The kallsyms_markers table has entried sizeof(unsigned long) and
1689	* contains offsets into kallsyms_names. The kallsyms_markers used to
1690	* index kallsyms_names and reduce seek time when looking up the name
1691	* of an address/symbol. Each entry in kallsyms_markers covers 256
1692	* symbol names.
1693	*
1694	* Because of this, the first entry is always zero and all the entries
1695	* are ascending. It also follows that the size of the table can be
1696	* calculated from kallsyms_num_syms.
1697	*
1698	* Note! We could also have walked kallsyms_names by skipping
1699	* kallsyms_num_syms names, but this is faster and we will
1700	* validate the encoded names later.
1701	*
1702	* git commit 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a (which became 4.20+) makes kallsyms_markers
1703	* and kallsyms_num_syms uint32_t, even on 64bit systems. Take that into account.
1704	*/
1705	if ( pThis->f64Bit
1706	&& pThis->uKrnlVer < LNX_MK_VER(4, 20, 0))
1707	{
1708	if ( RT_UNLIKELY(fPendingZeroHit)
1709	&& uBuf.au64[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1710	&& uBuf.au64[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1711	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1712	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint64_t)), sizeof(uint64_t));
1713
1714	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint64_t);
1715	for (uint32_t i = offBuf / sizeof(uint64_t); i < cEntries; i++)
1716	if (uBuf.au64[i] == 0)
1717	{
1718	if (RT_UNLIKELY(i + 1 >= cEntries))
1719	{
1720	fPendingZeroHit = true;
1721	break;
1722	}
1723	if ( uBuf.au64[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1724	&& uBuf.au64[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1725	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1726	pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint64_t)), sizeof(uint64_t));
1727	}
1728	}
1729	else
1730	{
1731	if ( RT_UNLIKELY(fPendingZeroHit)
1732	&& uBuf.au32[0] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1733	&& uBuf.au32[0] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1734	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1735	pVMM->pfnDBGFR3AddrSub(&CurAddr, sizeof(uint32_t)), sizeof(uint32_t));
1736
1737	uint32_t const cEntries = sizeof(uBuf) / sizeof(uint32_t);
1738	for (uint32_t i = offBuf / sizeof(uint32_t); i < cEntries; i++)
1739	if (uBuf.au32[i] == 0)
1740	{
1741	if (RT_UNLIKELY(i + 1 >= cEntries))
1742	{
1743	fPendingZeroHit = true;
1744	break;
1745	}
1746	if ( uBuf.au32[i + 1] >= (LNX_MIN_KALLSYMS_ENC_LENGTH + 1) * 256
1747	&& uBuf.au32[i + 1] <= (LNX_MAX_KALLSYMS_ENC_LENGTH + 1) * 256)
1748	return dbgDiggerLinuxFoundMarkers(pThis, pVMM,
1749	pVMM->pfnDBGFR3AddrAdd(&CurAddr, i * sizeof(uint32_t)), sizeof(uint32_t));
1750	}
1751	}
1752
1753	/*
1754	* Advance
1755	*/
1756	if (RT_UNLIKELY(cbLeft <= sizeof(uBuf)))
1757	{
1758	Log(("dbgDiggerLinuxFindEndOfNamesAndMore: failed (pHitAddr=%RGv)\n", pHitAddr->FlatPtr));
1759	return VERR_NOT_FOUND;
1760	}
1761	cbLeft -= sizeof(uBuf);
1762	pVMM->pfnDBGFR3AddrAdd(&CurAddr, sizeof(uBuf));
1763	offBuf = 0;
1764	}
1765	}
1766
1767
1768	/**
1769	* Locates the kallsyms_token_index table.
1770	*
1771	* Storing the address in pThis->AddrKernelTokenIndex and the size of the token
1772	* table in pThis->cbKernelTokenTable.
1773	*
1774	* @returns VBox status code.
1775	* @param pUVM The user mode VM handle.
1776	* @param pVMM The VMM function table.
1777	* @param pThis The Linux digger data.
1778	*/
1779	static int dbgDiggerLinuxFindTokenIndex(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1780	{
1781	/*
1782	* The kallsyms_token_table is very much like a string table. Due to the
1783	* nature of the compression algorithm it is reasonably short (one example
1784	* here is 853 bytes), so we'll not be reading it in chunks but in full.
1785	* To be on the safe side, we read 8KB, ASSUMING we won't run into unmapped
1786	* memory or any other nasty stuff...
1787	*/
1788	union
1789	{
1790	uint8_t ab[0x2000];
1791	uint16_t au16[0x2000 / sizeof(uint16_t)];
1792	} uBuf;
1793	DBGFADDRESS CurAddr = pThis->AddrKernelTokenTable;
1794	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &CurAddr, &uBuf, sizeof(uBuf));
1795	if (RT_FAILURE(rc))
1796	return rc;
1797
1798	/*
1799	* We've got two choices here, either walk the string table or look for
1800	* the next structure, kallsyms_token_index.
1801	*
1802	* The token index is a table of 256 uint16_t entries (index by bytes
1803	* from kallsyms_names) that gives offsets in kallsyms_token_table. It
1804	* starts with a zero entry and the following entries are sorted in
1805	* ascending order. The range of the entries are reasonably small since
1806	* kallsyms_token_table is small.
1807	*
1808	* The alignment seems to be sizeof(unsigned long), just like
1809	* kallsyms_token_table.
1810	*
1811	* So, we start by looking for a zero 16-bit entry.
1812	*/
1813	uint32_t cIncr = (pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t)) / sizeof(uint16_t);
1814
1815	for (uint32_t i = 0; i < sizeof(uBuf) / sizeof(uint16_t) - 16; i += cIncr)
1816	if ( uBuf.au16[i] == 0
1817	&& uBuf.au16[i + 1] > 0
1818	&& uBuf.au16[i + 1] <= LNX_MAX_KALLSYMS_TOKEN_LEN
1819	&& (uint16_t)(uBuf.au16[i + 2] - uBuf.au16[i + 1] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1820	&& (uint16_t)(uBuf.au16[i + 3] - uBuf.au16[i + 2] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1821	&& (uint16_t)(uBuf.au16[i + 4] - uBuf.au16[i + 3] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1822	&& (uint16_t)(uBuf.au16[i + 5] - uBuf.au16[i + 4] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1823	&& (uint16_t)(uBuf.au16[i + 6] - uBuf.au16[i + 5] - 1U) <= (uint16_t)LNX_MAX_KALLSYMS_TOKEN_LEN
1824	)
1825	{
1826	pThis->AddrKernelTokenIndex = CurAddr;
1827	pVMM->pfnDBGFR3AddrAdd(&pThis->AddrKernelTokenIndex, i * sizeof(uint16_t));
1828	pThis->cbKernelTokenTable = i * sizeof(uint16_t);
1829	return VINF_SUCCESS;
1830	}
1831
1832	Log(("dbgDiggerLinuxFindTokenIndex: Failed (%RGv..%RGv)\n", CurAddr.FlatPtr, CurAddr.FlatPtr + (RTGCUINTPTR)sizeof(uBuf)));
1833	return VERR_NOT_FOUND;
1834	}
1835
1836
1837	/**
1838	* Loads the kernel symbols from the given kallsyms offset table decoding the symbol names
1839	* (worker common for dbgDiggerLinuxLoadKernelSymbolsAbsolute() and dbgDiggerLinuxLoadKernelSymbolsRelative()).
1840	*
1841	* @returns VBox status code.
1842	* @param pUVM The user mode VM handle.
1843	* @param pVMM The VMM function table.
1844	* @param pThis The Linux digger data.
1845	* @param uKernelStart Flat kernel start address.
1846	* @param cbKernel Size of the kernel in bytes.
1847	* @param pauSymOff Pointer to the array of symbol offsets in the kallsyms table
1848	* relative to the start of the kernel.
1849	*/
1850	static int dbgDiggerLinuxLoadKernelSymbolsWorker(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis, RTGCUINTPTR uKernelStart,
1851	RTGCUINTPTR cbKernel, RTGCUINTPTR *pauSymOff)
1852	{
1853	uint8_t pbNames = (uint8_t )RTMemAllocZ(pThis->cbKernelNames);
1854	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelNames, pbNames, pThis->cbKernelNames);
1855	if (RT_SUCCESS(rc))
1856	{
1857	char pszzTokens = (char )RTMemAllocZ(pThis->cbKernelTokenTable);
1858	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenTable, pszzTokens, pThis->cbKernelTokenTable);
1859	if (RT_SUCCESS(rc))
1860	{
1861	uint16_t paoffTokens = (uint16_t )RTMemAllocZ(256 * sizeof(uint16_t));
1862	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelTokenIndex, paoffTokens, 256 * sizeof(uint16_t));
1863	if (RT_SUCCESS(rc))
1864	{
1865	/*
1866	* Create a module for the kernel.
1867	*/
1868	RTDBGMOD hMod;
1869	rc = RTDbgModCreate(&hMod, "vmlinux", cbKernel, 0 /fFlags/);
1870	if (RT_SUCCESS(rc))
1871	{
1872	rc = RTDbgModSetTag(hMod, DIG_LNX_MOD_TAG); AssertRC(rc);
1873	rc = VINF_SUCCESS;
1874
1875	/*
1876	* Enumerate the symbols.
1877	*/
1878	uint32_t offName = 0;
1879	uint32_t cLeft = pThis->cKernelSymbols;
1880	while (cLeft-- > 0 && RT_SUCCESS(rc))
1881	{
1882	/* Decode the symbol name first. */
1883	if (RT_LIKELY(offName < pThis->cbKernelNames))
1884	{
1885	uint8_t cbName = pbNames[offName++];
1886	if (RT_LIKELY(offName + cbName <= pThis->cbKernelNames))
1887	{
1888	char szSymbol[4096];
1889	uint32_t offSymbol = 0;
1890	while (cbName-- > 0)
1891	{
1892	uint8_t bEnc = pbNames[offName++];
1893	uint16_t offToken = paoffTokens[bEnc];
1894	if (RT_LIKELY(offToken < pThis->cbKernelTokenTable))
1895	{
1896	const char *pszToken = &pszzTokens[offToken];
1897	char ch;
1898	while ((ch = *pszToken++) != '\0')
1899	if (offSymbol < sizeof(szSymbol) - 1)
1900	szSymbol[offSymbol++] = ch;
1901	}
1902	else
1903	{
1904	rc = VERR_INVALID_UTF8_ENCODING;
1905	break;
1906	}
1907	}
1908	szSymbol[offSymbol < sizeof(szSymbol) ? offSymbol : sizeof(szSymbol) - 1] = '\0';
1909
1910	/* The offset. */
1911	RTGCUINTPTR uSymOff = *pauSymOff;
1912	pauSymOff++;
1913
1914	/* Add it without the type char. */
1915	if (uSymOff <= cbKernel)
1916	{
1917	rc = RTDbgModSymbolAdd(hMod, &szSymbol[1], RTDBGSEGIDX_RVA, uSymOff,
1918	0 /cb/, 0 /fFlags/, NULL);
1919	if (RT_FAILURE(rc))
1920	{
1921	if ( rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
1922	\|\| rc == VERR_DBG_INVALID_RVA
1923	\|\| rc == VERR_DBG_ADDRESS_CONFLICT
1924	\|\| rc == VERR_DBG_DUPLICATE_SYMBOL)
1925	{
1926	Log2(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n", szSymbol, rc));
1927	rc = VINF_SUCCESS;
1928	}
1929	else
1930	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n", szSymbol, rc));
1931	}
1932	}
1933	}
1934	else
1935	{
1936	rc = VERR_END_OF_STRING;
1937	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbName=%#x cbKernelNames=%#x\n",
1938	offName, cLeft, cbName, pThis->cbKernelNames));
1939	}
1940	}
1941	else
1942	{
1943	rc = VERR_END_OF_STRING;
1944	Log(("dbgDiggerLinuxLoadKernelSymbols: offName=%#x cLeft=%#x cbKernelNames=%#x\n",
1945	offName, cLeft, pThis->cbKernelNames));
1946	}
1947	}
1948
1949	/*
1950	* Link the module into the address space.
1951	*/
1952	if (RT_SUCCESS(rc))
1953	{
1954	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1955	if (hAs != NIL_RTDBGAS)
1956	rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
1957	else
1958	rc = VERR_INTERNAL_ERROR;
1959	RTDbgAsRelease(hAs);
1960	}
1961	else
1962	Log(("dbgDiggerLinuxLoadKernelSymbols: Failed: %Rrc\n", rc));
1963	RTDbgModRelease(hMod);
1964	}
1965	else
1966	Log(("dbgDiggerLinuxLoadKernelSymbols: RTDbgModCreate failed: %Rrc\n", rc));
1967	}
1968	else
1969	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token index at %RGv failed: %Rrc\n",
1970	pThis->AddrKernelTokenIndex.FlatPtr, rc));
1971	RTMemFree(paoffTokens);
1972	}
1973	else
1974	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading token table at %RGv failed: %Rrc\n",
1975	pThis->AddrKernelTokenTable.FlatPtr, rc));
1976	RTMemFree(pszzTokens);
1977	}
1978	else
1979	Log(("dbgDiggerLinuxLoadKernelSymbols: Reading encoded names at %RGv failed: %Rrc\n",
1980	pThis->AddrKernelNames.FlatPtr, rc));
1981	RTMemFree(pbNames);
1982
1983	return rc;
1984	}
1985
1986	/**
1987	* Loads the kernel symbols from the kallsyms table if it contains absolute addresses
1988	*
1989	* @returns VBox status code.
1990	* @param pUVM The user mode VM handle.
1991	* @param pVMM The VMM function table.
1992	* @param pThis The Linux digger data.
1993	*/
1994	static int dbgDiggerLinuxLoadKernelSymbolsAbsolute(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
1995	{
1996	/*
1997	* Allocate memory for temporary table copies, reading the tables as we go.
1998	*/
1999	uint32_t const cbGuestAddr = pThis->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t);
2000	void pvAddresses = RTMemAllocZ(pThis->cKernelSymbols cbGuestAddr);
2001	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses,
2002	pvAddresses, pThis->cKernelSymbols * cbGuestAddr);
2003	if (RT_SUCCESS(rc))
2004	{
2005	/*
2006	* Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2007	*/
2008	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2009	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2010	RTGCUINTPTR pauSymOff = (RTGCUINTPTR )RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2011	uint32_t i;
2012	if (cbGuestAddr == sizeof(uint64_t))
2013	{
2014	uint64_t pauAddrs = (uint64_t )pvAddresses;
2015	for (i = 0; i < pThis->cKernelSymbols; i++)
2016	if ( pauAddrs[i] < uKernelStart
2017	&& LNX64_VALID_ADDRESS(pauAddrs[i])
2018	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2019	uKernelStart = pauAddrs[i];
2020
2021	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2022	if ( pauAddrs[i] > uKernelEnd
2023	&& LNX64_VALID_ADDRESS(pauAddrs[i])
2024	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2025	uKernelEnd = pauAddrs[i];
2026
2027	for (i = 0; i < pThis->cKernelSymbols; i++)
2028	pauSymOff[i] = pauAddrs[i] - uKernelStart;
2029	}
2030	else
2031	{
2032	uint32_t pauAddrs = (uint32_t )pvAddresses;
2033	for (i = 0; i < pThis->cKernelSymbols; i++)
2034	if ( pauAddrs[i] < uKernelStart
2035	&& LNX32_VALID_ADDRESS(pauAddrs[i])
2036	&& uKernelStart - pauAddrs[i] < LNX_MAX_KERNEL_SIZE)
2037	uKernelStart = pauAddrs[i];
2038
2039	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2040	if ( pauAddrs[i] > uKernelEnd
2041	&& LNX32_VALID_ADDRESS(pauAddrs[i])
2042	&& pauAddrs[i] - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2043	uKernelEnd = pauAddrs[i];
2044
2045	for (i = 0; i < pThis->cKernelSymbols; i++)
2046	pauSymOff[i] = pauAddrs[i] - uKernelStart;
2047	}
2048
2049	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2050	pThis->cbKernel = (uint32_t)cbKernel;
2051	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2052	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2053
2054	rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2055	if (RT_FAILURE(rc))
2056	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Loading symbols from given offset table failed: %Rrc\n", rc));
2057	RTMemTmpFree(pauSymOff);
2058	}
2059	else
2060	Log(("dbgDiggerLinuxLoadKernelSymbolsAbsolute: Reading symbol addresses at %RGv failed: %Rrc\n",
2061	pThis->AddrKernelAddresses.FlatPtr, rc));
2062	RTMemFree(pvAddresses);
2063
2064	return rc;
2065	}
2066
2067
2068	/**
2069	* Loads the kernel symbols from the kallsyms table if it contains absolute addresses
2070	*
2071	* @returns VBox status code.
2072	* @param pUVM The user mode VM handle.
2073	* @param pVMM The VMM function table.
2074	* @param pThis The Linux digger data.
2075	*/
2076	static int dbgDiggerLinuxLoadKernelSymbolsRelative(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2077	{
2078	/*
2079	* Allocate memory for temporary table copies, reading the tables as we go.
2080	*/
2081	int32_t pai32Offsets = (int32_t )RTMemAllocZ(pThis->cKernelSymbols * sizeof(int32_t));
2082	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &pThis->AddrKernelAddresses,
2083	pai32Offsets, pThis->cKernelSymbols * sizeof(int32_t));
2084	if (RT_SUCCESS(rc))
2085	{
2086	/*
2087	* Figure out the kernel start and end and convert the absolute addresses to relative offsets.
2088	*/
2089	RTGCUINTPTR uKernelStart = pThis->AddrKernelAddresses.FlatPtr;
2090	RTGCUINTPTR uKernelEnd = pThis->AddrKernelTokenIndex.FlatPtr + 256 * sizeof(uint16_t);
2091	RTGCUINTPTR pauSymOff = (RTGCUINTPTR )RTMemTmpAllocZ(pThis->cKernelSymbols * sizeof(RTGCUINTPTR));
2092	uint32_t i;
2093
2094	for (i = 0; i < pThis->cKernelSymbols; i++)
2095	{
2096	RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2097
2098	if ( uSymAddr < uKernelStart
2099	&& (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2100	&& uKernelStart - uSymAddr < LNX_MAX_KERNEL_SIZE)
2101	uKernelStart = uSymAddr;
2102	}
2103
2104	for (i = pThis->cKernelSymbols - 1; i > 0; i--)
2105	{
2106	RTGCUINTPTR uSymAddr = dbgDiggerLinuxConvOffsetToAddr(pThis, pai32Offsets[i]);
2107
2108	if ( uSymAddr > uKernelEnd
2109	&& (pThis->f64Bit ? LNX64_VALID_ADDRESS(uSymAddr) : LNX32_VALID_ADDRESS(uSymAddr))
2110	&& uSymAddr - uKernelEnd < LNX_MAX_KERNEL_SIZE)
2111	uKernelEnd = uSymAddr;
2112
2113	/* Store the offset from the derived kernel start address. */
2114	pauSymOff[i] = uSymAddr - uKernelStart;
2115	}
2116
2117	RTGCUINTPTR cbKernel = uKernelEnd - uKernelStart;
2118	pThis->cbKernel = (uint32_t)cbKernel;
2119	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelBase, uKernelStart);
2120	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: uKernelStart=%RGv cbKernel=%#x\n", uKernelStart, cbKernel));
2121
2122	rc = dbgDiggerLinuxLoadKernelSymbolsWorker(pUVM, pVMM, pThis, uKernelStart, cbKernel, pauSymOff);
2123	if (RT_FAILURE(rc))
2124	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Loading symbols from given offset table failed: %Rrc\n", rc));
2125	RTMemTmpFree(pauSymOff);
2126	}
2127	else
2128	Log(("dbgDiggerLinuxLoadKernelSymbolsRelative: Reading symbol addresses at %RGv failed: %Rrc\n",
2129	pThis->AddrKernelAddresses.FlatPtr, rc));
2130	RTMemFree(pai32Offsets);
2131
2132	return rc;
2133	}
2134
2135
2136	/**
2137	* Loads the kernel symbols.
2138	*
2139	* @returns VBox status code.
2140	* @param pUVM The user mode VM handle.
2141	* @param pVMM The VMM function table.
2142	* @param pThis The Linux digger data.
2143	*/
2144	static int dbgDiggerLinuxLoadKernelSymbols(PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGDIGGERLINUX pThis)
2145	{
2146	/*
2147	* First the kernel itself.
2148	*/
2149	if (pThis->fRelKrnlAddr)
2150	return dbgDiggerLinuxLoadKernelSymbolsRelative(pUVM, pVMM, pThis);
2151	return dbgDiggerLinuxLoadKernelSymbolsAbsolute(pUVM, pVMM, pThis);
2152	}
2153
2154
2155	/*
2156	* The module structure changed it was easier to produce different code for
2157	* each version of the structure. The C preprocessor rules!
2158	*/
2159	#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleCodeTmpl.cpp.h"
2160
2161	#define LNX_BIT_SUFFIX _amd64
2162	#define LNX_PTR_T uint64_t
2163	#define LNX_64BIT 1
2164	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2165
2166	#define LNX_BIT_SUFFIX _x86
2167	#define LNX_PTR_T uint32_t
2168	#define LNX_64BIT 0
2169	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2170
2171	#undef LNX_TEMPLATE_HEADER
2172
2173	static const struct
2174	{
2175	uint32_t uVersion;
2176	bool f64Bit;
2177	uint64_t (*pfnProcessModule)(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, PDBGFADDRESS pAddrModule);
2178	} g_aModVersions[] =
2179	{
2180	#define LNX_TEMPLATE_HEADER "DBGPlugInLinuxModuleTableEntryTmpl.cpp.h"
2181
2182	#define LNX_BIT_SUFFIX _amd64
2183	#define LNX_64BIT 1
2184	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2185
2186	#define LNX_BIT_SUFFIX _x86
2187	#define LNX_64BIT 0
2188	#include "DBGPlugInLinuxModuleVerTmpl.cpp.h"
2189
2190	#undef LNX_TEMPLATE_HEADER
2191	};
2192
2193
2194	/**
2195	* Tries to find and process the module list.
2196	*
2197	* @returns VBox status code.
2198	* @param pThis The Linux digger data.
2199	* @param pUVM The user mode VM handle.
2200	* @param pVMM The VMM function table.
2201	*/
2202	static int dbgDiggerLinuxLoadModules(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2203	{
2204	/*
2205	* Locate the list head.
2206	*/
2207	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
2208	RTDBGSYMBOL SymInfo;
2209	int rc = RTDbgAsSymbolByName(hAs, "vmlinux!modules", &SymInfo, NULL);
2210	RTDbgAsRelease(hAs);
2211	if (RT_FAILURE(rc))
2212	return VERR_NOT_FOUND;
2213
2214	if (RT_FAILURE(rc))
2215	{
2216	LogRel(("dbgDiggerLinuxLoadModules: Failed to locate the module list (%Rrc).\n", rc));
2217	return VERR_NOT_FOUND;
2218	}
2219
2220	/*
2221	* Read the list anchor.
2222	*/
2223	union
2224	{
2225	uint32_t volatile u32Pair[2];
2226	uint64_t u64Pair[2];
2227	} uListAnchor;
2228	DBGFADDRESS Addr;
2229	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value),
2230	&uListAnchor, pThis->f64Bit ? sizeof(uListAnchor.u64Pair) : sizeof(uListAnchor.u32Pair));
2231	if (RT_FAILURE(rc))
2232	{
2233	LogRel(("dbgDiggerLinuxLoadModules: Error reading list anchor at %RX64: %Rrc\n", SymInfo.Value, rc));
2234	return VERR_NOT_FOUND;
2235	}
2236	if (!pThis->f64Bit)
2237	{
2238	uListAnchor.u64Pair[1] = uListAnchor.u32Pair[1];
2239	ASMCompilerBarrier();
2240	uListAnchor.u64Pair[0] = uListAnchor.u32Pair[0];
2241	}
2242
2243	if (pThis->uKrnlVer == 0)
2244	{
2245	LogRel(("dbgDiggerLinuxLoadModules: No valid kernel version given: %#x\n", pThis->uKrnlVer));
2246	return VERR_NOT_FOUND;
2247	}
2248
2249	/*
2250	* Find the g_aModVersion entry that fits the best.
2251	* ASSUMES strict descending order by bitcount and version.
2252	*/
2253	Assert(g_aModVersions[0].f64Bit == true);
2254	unsigned i = 0;
2255	if (!pThis->f64Bit)
2256	while (i < RT_ELEMENTS(g_aModVersions) && g_aModVersions[i].f64Bit)
2257	i++;
2258	while ( i < RT_ELEMENTS(g_aModVersions)
2259	&& g_aModVersions[i].f64Bit == pThis->f64Bit
2260	&& pThis->uKrnlVer < g_aModVersions[i].uVersion)
2261	i++;
2262	if (i >= RT_ELEMENTS(g_aModVersions))
2263	{
2264	LogRel(("dbgDiggerLinuxLoadModules: Failed to find anything matching version: %u.%u.%u\n",
2265	pThis->uKrnlVerMaj, pThis->uKrnlVerMin, pThis->uKrnlVerBld));
2266	return VERR_NOT_FOUND;
2267	}
2268
2269	/*
2270	* Walk the list.
2271	*/
2272	uint64_t uModAddr = uListAnchor.u64Pair[0];
2273	for (size_t iModule = 0; iModule < 4096 && uModAddr != SymInfo.Value && uModAddr != 0; iModule++)
2274	uModAddr = g_aModVersions[i].pfnProcessModule(pThis, pUVM, pVMM, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uModAddr));
2275
2276	return VINF_SUCCESS;
2277	}
2278
2279
2280	/**
2281	* Checks if there is a likely kallsyms_names fragment at pHitAddr.
2282	*
2283	* @returns true if it's a likely fragment, false if not.
2284	* @param pUVM The user mode VM handle.
2285	* @param pVMM The VMM function table.
2286	* @param pHitAddr The address where paNeedle was found.
2287	* @param pabNeedle The fragment we've been searching for.
2288	* @param cbNeedle The length of the fragment.
2289	*/
2290	static bool dbgDiggerLinuxIsLikelyNameFragment(PUVM pUVM, PCVMMR3VTABLE pVMM, PCDBGFADDRESS pHitAddr,
2291	uint8_t const *pabNeedle, uint8_t cbNeedle)
2292	{
2293	/*
2294	* Examples of lead and tail bytes of our choosen needle in a randomly
2295	* picked kernel:
2296	* k o b j
2297	* 22 6b 6f 62 6a aa
2298	* fc 6b 6f 62 6a aa
2299	* 82 6b 6f 62 6a 5f - ascii trail byte (_).
2300	* ee 6b 6f 62 6a aa
2301	* fc 6b 6f 62 6a 5f - ascii trail byte (_).
2302	* 0a 74 6b 6f 62 6a 5f ea - ascii lead (t) and trail (_) bytes.
2303	* 0b 54 6b 6f 62 6a aa - ascii lead byte (T).
2304	* ... omitting 29 samples similar to the last two ...
2305	* d8 6b 6f 62 6a aa
2306	* d8 6b 6f 62 6a aa
2307	* d8 6b 6f 62 6a aa
2308	* d8 6b 6f 62 6a aa
2309	* f9 5f 6b 6f 62 6a 5f 94 - ascii lead and trail bytes (_)
2310	* f9 5f 6b 6f 62 6a 0c - ascii lead byte (_).
2311	* fd 6b 6f 62 6a 0f
2312	* ... enough.
2313	*/
2314	uint8_t abBuf[32];
2315	DBGFADDRESS ReadAddr = *pHitAddr;
2316	pVMM->pfnDBGFR3AddrSub(&ReadAddr, 2);
2317	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &ReadAddr, abBuf, 2 + cbNeedle + 2);
2318	if (RT_SUCCESS(rc))
2319	{
2320	if (memcmp(&abBuf[2], pabNeedle, cbNeedle) == 0) /* paranoia */
2321	{
2322	uint8_t const bLead = abBuf[1] == '_' \|\| abBuf[1] == 'T' \|\| abBuf[1] == 't' ? abBuf[0] : abBuf[1];
2323	uint8_t const offTail = 2 + cbNeedle;
2324	uint8_t const bTail = abBuf[offTail] == '_' ? abBuf[offTail] : abBuf[offTail + 1];
2325	if ( bLead >= 1 && (bLead < 0x20 \|\| bLead >= 0x80)
2326	&& bTail >= 1 && (bTail < 0x20 \|\| bTail >= 0x80))
2327	return true;
2328	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: bLead=%#x bTail=%#x (offTail=%#x)\n",
2329	pHitAddr->FlatPtr, bLead, bTail, offTail));
2330	}
2331	else
2332	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: Needle changed!\n", pHitAddr->FlatPtr));
2333	}
2334	else
2335	Log(("dbgDiggerLinuxIsLikelyNameFragment: failed at %RGv: %Rrc\n", pHitAddr->FlatPtr, rc));
2336
2337	return false;
2338	}
2339
2340	/**
2341	* Tries to find and load the kernel symbol table with the given needle.
2342	*
2343	* @returns VBox status code.
2344	* @param pThis The Linux digger data.
2345	* @param pUVM The user mode VM handle.
2346	* @param pVMM The VMM function table.
2347	* @param pabNeedle The needle to use for searching.
2348	* @param cbNeedle Size of the needle in bytes.
2349	*/
2350	static int dbgDiggerLinuxFindSymbolTableFromNeedle(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2351	uint8_t const *pabNeedle, uint8_t cbNeedle)
2352	{
2353	/*
2354	* Go looking for the kallsyms table. If it's there, it will be somewhere
2355	* after the linux_banner symbol, so use it for starting the search.
2356	*/
2357	int rc = VINF_SUCCESS;
2358	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2359	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2360	while (cbLeft > 4096)
2361	{
2362	DBGFADDRESS HitAddr;
2363	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
2364	pabNeedle, cbNeedle, &HitAddr);
2365	if (RT_FAILURE(rc))
2366	break;
2367	if (dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2368	{
2369	/* There will be another hit near by. */
2370	pVMM->pfnDBGFR3AddrAdd(&HitAddr, 1);
2371	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, LNX_MAX_KALLSYMS_NAMES_SIZE, 1 /uAlign/,
2372	pabNeedle, cbNeedle, &HitAddr);
2373	if ( RT_SUCCESS(rc)
2374	&& dbgDiggerLinuxIsLikelyNameFragment(pUVM, pVMM, &HitAddr, pabNeedle, cbNeedle))
2375	{
2376	/*
2377	* We've got a very likely candidate for a location inside kallsyms_names.
2378	* Try find the start of it, that is to say, try find kallsyms_num_syms.
2379	* kallsyms_num_syms is aligned on sizeof(unsigned long) boundrary
2380	*/
2381	rc = dbgDiggerLinuxFindStartOfNamesAndSymbolCount(pUVM, pVMM, pThis, &HitAddr);
2382	if (RT_SUCCESS(rc))
2383	rc = dbgDiggerLinuxFindEndOfNamesAndMore(pUVM, pVMM, pThis, &HitAddr);
2384	if (RT_SUCCESS(rc))
2385	rc = dbgDiggerLinuxFindTokenIndex(pUVM, pVMM, pThis);
2386	if (RT_SUCCESS(rc))
2387	rc = dbgDiggerLinuxLoadKernelSymbols(pUVM, pVMM, pThis);
2388	if (RT_SUCCESS(rc))
2389	{
2390	rc = dbgDiggerLinuxLoadModules(pThis, pUVM, pVMM);
2391	break;
2392	}
2393	}
2394	}
2395
2396	/*
2397	* Advance.
2398	*/
2399	RTGCUINTPTR cbDistance = HitAddr.FlatPtr - CurAddr.FlatPtr + cbNeedle;
2400	if (RT_UNLIKELY(cbDistance >= cbLeft))
2401	{
2402	Log(("dbgDiggerLinuxInit: Failed to find kallsyms\n"));
2403	break;
2404	}
2405	cbLeft -= cbDistance;
2406	pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2407	}
2408
2409	return rc;
2410	}
2411
2412	/**
2413	* Skips whitespace and comments in the given config returning the pointer
2414	* to the first non whitespace character.
2415	*
2416	* @returns Pointer to the first non whitespace character or NULL if the end
2417	* of the string was reached.
2418	* @param pszCfg The config string.
2419	*/
2420	static const char dbgDiggerLinuxCfgSkipWhitespace(const char pszCfg)
2421	{
2422	do
2423	{
2424	while ( *pszCfg != '\0'
2425	&& ( RT_C_IS_SPACE(*pszCfg)
2426	\|\| *pszCfg == '\n'))
2427	pszCfg++;
2428
2429	/* Do we have a comment? Skip it. */
2430	if (*pszCfg == '#')
2431	{
2432	while ( *pszCfg != '\n'
2433	&& *pszCfg != '\0')
2434	pszCfg++;
2435	}
2436	} while ( *pszCfg != '\0'
2437	&& ( RT_C_IS_SPACE(*pszCfg)
2438	\|\| *pszCfg == '\n'
2439	\|\| *pszCfg == '#'));
2440
2441	return pszCfg;
2442	}
2443
2444	/**
2445	* Parses an identifier at the given position.
2446	*
2447	* @returns VBox status code.
2448	* @param pszCfg The config data.
2449	* @param ppszCfgNext Where to store the pointer to the data following the identifier.
2450	* @param ppszIde Where to store the pointer to the identifier on success.
2451	* Free with RTStrFree().
2452	*/
2453	static int dbgDiggerLinuxCfgParseIde(const char pszCfg, const char ppszCfgNext, char *ppszIde)
2454	{
2455	int rc = VINF_SUCCESS;
2456	size_t cchIde = 0;
2457
2458	while ( *pszCfg != '\0'
2459	&& ( RT_C_IS_ALNUM(*pszCfg)
2460	\|\| *pszCfg == '_'))
2461	{
2462	cchIde++;
2463	pszCfg++;
2464	}
2465
2466	if (cchIde)
2467	{
2468	*ppszIde = RTStrDupN(pszCfg - cchIde, cchIde);
2469	if (!*ppszIde)
2470	rc = VERR_NO_STR_MEMORY;
2471	}
2472
2473	*ppszCfgNext = pszCfg;
2474	return rc;
2475	}
2476
2477	/**
2478	* Parses a value for a config item.
2479	*
2480	* @returns VBox status code.
2481	* @param pszCfg The config data.
2482	* @param ppszCfgNext Where to store the pointer to the data following the identifier.
2483	* @param ppCfgItem Where to store the created config item on success.
2484	*/
2485	static int dbgDiggerLinuxCfgParseVal(const char pszCfg, const char *ppszCfgNext,
2486	PDBGDIGGERLINUXCFGITEM *ppCfgItem)
2487	{
2488	int rc = VINF_SUCCESS;
2489	PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2490
2491	if (RT_C_IS_DIGIT(pszCfg) \|\| pszCfg == '-')
2492	{
2493	/* Parse the number. */
2494	int64_t i64Num;
2495	rc = RTStrToInt64Ex(pszCfg, (char **)ppszCfgNext, 0, &i64Num);
2496	if ( RT_SUCCESS(rc)
2497	\|\| rc == VWRN_TRAILING_CHARS
2498	\|\| rc == VWRN_TRAILING_SPACES)
2499	{
2500	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2501	if (pCfgItem)
2502	{
2503	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_NUMBER;
2504	pCfgItem->u.i64Num = i64Num;
2505	}
2506	else
2507	rc = VERR_NO_MEMORY;
2508	}
2509	}
2510	else if (*pszCfg == '\"')
2511	{
2512	/* Parse a string. */
2513	const char *pszCfgCur = pszCfg + 1;
2514	while ( *pszCfgCur != '\0'
2515	&& *pszCfgCur != '\"')
2516	pszCfgCur++;
2517
2518	if (*pszCfgCur == '\"')
2519	{
2520	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGDIGGERLINUXCFGITEM,
2521	u.aszString[pszCfgCur - pszCfg + 1]));
2522	if (pCfgItem)
2523	{
2524	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_STRING;
2525	RTStrCopyEx(&pCfgItem->u.aszString[0], pszCfgCur - pszCfg + 1, pszCfg, pszCfgCur - pszCfg);
2526	*ppszCfgNext = pszCfgCur + 1;
2527	}
2528	else
2529	rc = VERR_NO_MEMORY;
2530	}
2531	else
2532	rc = VERR_INVALID_STATE;
2533	}
2534	else if ( *pszCfg == 'y'
2535	\|\| *pszCfg == 'm')
2536	{
2537	/* Included or module. */
2538	pCfgItem = (PDBGDIGGERLINUXCFGITEM)RTMemAllocZ(sizeof(DBGDIGGERLINUXCFGITEM));
2539	if (pCfgItem)
2540	{
2541	pCfgItem->enmType = DBGDIGGERLINUXCFGITEMTYPE_FLAG;
2542	pCfgItem->u.fModule = *pszCfg == 'm';
2543	}
2544	else
2545	rc = VERR_NO_MEMORY;
2546	pszCfg++;
2547	*ppszCfgNext = pszCfg;
2548	}
2549	else
2550	rc = VERR_INVALID_STATE;
2551
2552	if (RT_SUCCESS(rc))
2553	*ppCfgItem = pCfgItem;
2554	else if (pCfgItem)
2555	RTMemFree(pCfgItem);
2556
2557	return rc;
2558	}
2559
2560	/**
2561	* Parses the given kernel config and creates the config database.
2562	*
2563	* @returns VBox status code
2564	* @param pThis The Linux digger data.
2565	* @param pszCfg The config string.
2566	*/
2567	static int dbgDiggerLinuxCfgParse(PDBGDIGGERLINUX pThis, const char *pszCfg)
2568	{
2569	int rc = VINF_SUCCESS;
2570
2571	/*
2572	* The config is a text file with the following elements:
2573	* # starts a comment which goes till the end of the line
2574	* <Ide>=<val> where <Ide> is an identifier consisting of
2575	* alphanumerical characters (including _)
2576	* <val> denotes the value for the identifier and can have the following
2577	* formats:
2578	* (-)[0-9]* for numbers
2579	* "..." for a string value
2580	* m when a feature is enabled as a module
2581	* y when a feature is enabled
2582	* Newlines are used as a separator between values and mark the end
2583	* of a comment
2584	*/
2585	const char *pszCfgCur = pszCfg;
2586	while ( RT_SUCCESS(rc)
2587	&& *pszCfgCur != '\0')
2588	{
2589	/* Start skipping the whitespace. */
2590	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2591	if ( pszCfgCur
2592	&& *pszCfgCur != '\0')
2593	{
2594	char *pszIde = NULL;
2595	/* Must be an identifier, parse it. */
2596	rc = dbgDiggerLinuxCfgParseIde(pszCfgCur, &pszCfgCur, &pszIde);
2597	if (RT_SUCCESS(rc))
2598	{
2599	/*
2600	* Skip whitespace again (shouldn't be required because = follows immediately
2601	* in the observed configs).
2602	*/
2603	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2604	if ( pszCfgCur
2605	&& *pszCfgCur == '=')
2606	{
2607	pszCfgCur++;
2608	pszCfgCur = dbgDiggerLinuxCfgSkipWhitespace(pszCfgCur);
2609	if ( pszCfgCur
2610	&& *pszCfgCur != '\0')
2611	{
2612	/* Get the value. */
2613	PDBGDIGGERLINUXCFGITEM pCfgItem = NULL;
2614	rc = dbgDiggerLinuxCfgParseVal(pszCfgCur, &pszCfgCur, &pCfgItem);
2615	if (RT_SUCCESS(rc))
2616	{
2617	pCfgItem->Core.pszString = pszIde;
2618	bool fRc = RTStrSpaceInsert(&pThis->hCfgDb, &pCfgItem->Core);
2619	if (!fRc)
2620	{
2621	RTStrFree(pszIde);
2622	RTMemFree(pCfgItem);
2623	rc = VERR_INVALID_STATE;
2624	}
2625	}
2626	}
2627	else
2628	rc = VERR_EOF;
2629	}
2630	else
2631	rc = VERR_INVALID_STATE;
2632	}
2633
2634	if (RT_FAILURE(rc))
2635	RTStrFree(pszIde);
2636	}
2637	else
2638	break; /* Reached the end of the config. */
2639	}
2640
2641	if (RT_FAILURE(rc))
2642	dbgDiggerLinuxCfgDbDestroy(pThis);
2643
2644	return rc;
2645	}
2646
2647	/**
2648	* Decompresses the given config and validates the UTF-8 encoding.
2649	*
2650	* @returns VBox status code.
2651	* @param pbCfgComp The compressed config.
2652	* @param cbCfgComp Size of the compressed config.
2653	* @param ppszCfg Where to store the pointer to the decompressed config
2654	* on success.
2655	*/
2656	static int dbgDiggerLinuxCfgDecompress(const uint8_t pbCfgComp, size_t cbCfgComp, char *ppszCfg)
2657	{
2658	int rc = VINF_SUCCESS;
2659	RTVFSIOSTREAM hVfsIos = NIL_RTVFSIOSTREAM;
2660
2661	rc = RTVfsIoStrmFromBuffer(RTFILE_O_READ, pbCfgComp, cbCfgComp, &hVfsIos);
2662	if (RT_SUCCESS(rc))
2663	{
2664	RTVFSIOSTREAM hVfsIosDecomp = NIL_RTVFSIOSTREAM;
2665	rc = RTZipGzipDecompressIoStream(hVfsIos, RTZIPGZIPDECOMP_F_ALLOW_ZLIB_HDR, &hVfsIosDecomp);
2666	if (RT_SUCCESS(rc))
2667	{
2668	char *pszCfg = NULL;
2669	size_t cchCfg = 0;
2670	size_t cbRead = 0;
2671
2672	do
2673	{
2674	uint8_t abBuf[_64K];
2675	rc = RTVfsIoStrmRead(hVfsIosDecomp, abBuf, sizeof(abBuf), true /fBlocking/, &cbRead);
2676	if (rc == VINF_EOF && cbRead == 0)
2677	rc = VINF_SUCCESS;
2678	if ( RT_SUCCESS(rc)
2679	&& cbRead > 0)
2680	{
2681	/* Append data. */
2682	char *pszCfgNew = pszCfg;
2683	rc = RTStrRealloc(&pszCfgNew, cchCfg + cbRead + 1);
2684	if (RT_SUCCESS(rc))
2685	{
2686	pszCfg = pszCfgNew;
2687	memcpy(pszCfg + cchCfg, &abBuf[0], cbRead);
2688	cchCfg += cbRead;
2689	pszCfg[cchCfg] = '\0'; /* Enforce string termination. */
2690	}
2691	}
2692	} while (RT_SUCCESS(rc) && cbRead > 0);
2693
2694	if (RT_SUCCESS(rc))
2695	*ppszCfg = pszCfg;
2696	else if (RT_FAILURE(rc) && pszCfg)
2697	RTStrFree(pszCfg);
2698
2699	RTVfsIoStrmRelease(hVfsIosDecomp);
2700	}
2701	RTVfsIoStrmRelease(hVfsIos);
2702	}
2703
2704	return rc;
2705	}
2706
2707	/**
2708	* Reads and decodes the compressed kernel config.
2709	*
2710	* @returns VBox status code.
2711	* @param pThis The Linux digger data.
2712	* @param pUVM The user mode VM handle.
2713	* @param pVMM The VMM function table.
2714	* @param pAddrStart The start address of the compressed config.
2715	* @param cbCfgComp The size of the compressed config.
2716	*/
2717	static int dbgDiggerLinuxCfgDecode(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2718	PCDBGFADDRESS pAddrStart, size_t cbCfgComp)
2719	{
2720	int rc = VINF_SUCCESS;
2721	uint8_t pbCfgComp = (uint8_t )RTMemTmpAlloc(cbCfgComp);
2722	if (!pbCfgComp)
2723	return VERR_NO_MEMORY;
2724
2725	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pAddrStart, pbCfgComp, cbCfgComp);
2726	if (RT_SUCCESS(rc))
2727	{
2728	char *pszCfg = NULL;
2729	rc = dbgDiggerLinuxCfgDecompress(pbCfgComp, cbCfgComp, &pszCfg);
2730	if (RT_SUCCESS(rc))
2731	{
2732	if (RTStrIsValidEncoding(pszCfg))
2733	rc = dbgDiggerLinuxCfgParse(pThis, pszCfg);
2734	else
2735	rc = VERR_INVALID_UTF8_ENCODING;
2736	RTStrFree(pszCfg);
2737	}
2738	}
2739
2740	RTMemFree(pbCfgComp);
2741	return rc;
2742	}
2743
2744	/**
2745	* Tries to find the compressed kernel config in the kernel address space
2746	* and sets up the config database.
2747	*
2748	* @returns VBox status code.
2749	* @param pThis The Linux digger data.
2750	* @param pUVM The user mode VM handle.
2751	* @param pVMM The VMM function table.
2752	*/
2753	static int dbgDiggerLinuxCfgFind(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2754	{
2755	/*
2756	* Go looking for the IKCFG_ST string which indicates the start
2757	* of the compressed config file.
2758	*/
2759	static const uint8_t s_abCfgNeedleStart[] = "IKCFG_ST";
2760	static const uint8_t s_abCfgNeedleEnd[] = "IKCFG_ED";
2761	int rc = VINF_SUCCESS;
2762	DBGFADDRESS CurAddr = pThis->AddrLinuxBanner;
2763	uint32_t cbLeft = LNX_MAX_KERNEL_SIZE;
2764	while (cbLeft > 4096)
2765	{
2766	DBGFADDRESS HitAddrStart;
2767	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &CurAddr, cbLeft, 1 /uAlign/,
2768	s_abCfgNeedleStart, sizeof(s_abCfgNeedleStart) - 1, &HitAddrStart);
2769	if (RT_FAILURE(rc))
2770	break;
2771
2772	/* Check for the end marker which shouldn't be that far away. */
2773	pVMM->pfnDBGFR3AddrAdd(&HitAddrStart, sizeof(s_abCfgNeedleStart) - 1);
2774	DBGFADDRESS HitAddrEnd;
2775	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /* idCpu */, &HitAddrStart, LNX_MAX_COMPRESSED_CFG_SIZE,
2776	1 /* uAlign */, s_abCfgNeedleEnd, sizeof(s_abCfgNeedleEnd) - 1, &HitAddrEnd);
2777	if (RT_SUCCESS(rc))
2778	{
2779	/* Allocate a buffer to hold the compressed data between the markers and fetch it. */
2780	RTGCUINTPTR cbCfg = HitAddrEnd.FlatPtr - HitAddrStart.FlatPtr;
2781	Assert(cbCfg == (size_t)cbCfg);
2782	rc = dbgDiggerLinuxCfgDecode(pThis, pUVM, pVMM, &HitAddrStart, cbCfg);
2783	if (RT_SUCCESS(rc))
2784	break;
2785	}
2786
2787	/*
2788	* Advance.
2789	*/
2790	RTGCUINTPTR cbDistance = HitAddrStart.FlatPtr - CurAddr.FlatPtr + sizeof(s_abCfgNeedleStart) - 1;
2791	if (RT_UNLIKELY(cbDistance >= cbLeft))
2792	{
2793	LogFunc(("Failed to find compressed kernel config\n"));
2794	break;
2795	}
2796	cbLeft -= cbDistance;
2797	pVMM->pfnDBGFR3AddrAdd(&CurAddr, cbDistance);
2798	}
2799
2800	return rc;
2801	}
2802
2803	/**
2804	* Probes for a Linux kernel starting at the given address.
2805	*
2806	* @returns Flag whether something which looks like a valid Linux kernel was found.
2807	* @param pThis The Linux digger data.
2808	* @param pUVM The user mode VM handle.
2809	* @param pVMM The VMM function table.
2810	* @param uAddrStart The address to start scanning at.
2811	* @param cbScan How much to scan.
2812	*/
2813	static bool dbgDiggerLinuxProbeWithAddr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
2814	RTGCUINTPTR uAddrStart, size_t cbScan)
2815	{
2816	/*
2817	* Look for "Linux version " at the start of the rodata segment.
2818	* Hope that this comes before any message buffer or other similar string.
2819	*/
2820	DBGFADDRESS KernelAddr;
2821	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uAddrStart);
2822	DBGFADDRESS HitAddr;
2823	int rc = pVMM->pfnDBGFR3MemScan(pUVM, 0, &KernelAddr, cbScan, 1,
2824	g_abLinuxVersion, sizeof(g_abLinuxVersion) - 1, &HitAddr);
2825	if (RT_SUCCESS(rc))
2826	{
2827	char szTmp[128];
2828	char const *pszX = &szTmp[sizeof(g_abLinuxVersion) - 1];
2829	rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &HitAddr, szTmp, sizeof(szTmp));
2830	if ( RT_SUCCESS(rc)
2831	&& ( ( pszX[0] == '2' /* 2.x.y with x in {0..6} */
2832	&& pszX[1] == '.'
2833	&& pszX[2] >= '0'
2834	&& pszX[2] <= '6')
2835	\|\| ( pszX[0] >= '3' /* 3.x, 4.x, ... 9.x */
2836	&& pszX[0] <= '9'
2837	&& pszX[1] == '.'
2838	&& pszX[2] >= '0'
2839	&& pszX[2] <= '9')
2840	)
2841	)
2842	{
2843	pThis->AddrKernelBase = KernelAddr;
2844	pThis->AddrLinuxBanner = HitAddr;
2845	return true;
2846	}
2847	}
2848
2849	return false;
2850	}
2851
2852	/**
2853	* Probes for a Linux kernel which has KASLR enabled.
2854	*
2855	* @returns Flag whether a possible candidate location was found.
2856	* @param pThis The Linux digger data.
2857	* @param pUVM The user mode VM handle.
2858	* @param pVMM The VMM function table.
2859	*/
2860	static bool dbgDiggerLinuxProbeKaslr(PDBGDIGGERLINUX pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
2861	{
2862	/**
2863	* With KASLR the kernel is loaded at a different address at each boot making detection
2864	* more difficult for us.
2865	*
2866	* The randomization is done in arch/x86/boot/compressed/kaslr.c:choose_random_location() (as of Nov 2017).
2867	* At the end of the method a random offset is chosen using find_random_virt_addr() which is added to the
2868	* kernel map start in the caller (the start of the kernel depends on the bit size, see LNX32_KERNEL_ADDRESS_START
2869	* and LNX64_KERNEL_ADDRESS_START for 32bit and 64bit kernels respectively).
2870	* The lowest offset possible is LOAD_PHYSICAL_ADDR which is defined in arch/x86/include/asm/boot.h
2871	* using CONFIG_PHYSICAL_START aligned to CONFIG_PHYSICAL_ALIGN.
2872	* The default CONFIG_PHYSICAL_START and CONFIG_PHYSICAL_ALIGN are both 0x1000000 no matter whether a 32bit
2873	* or a 64bit kernel is used. So the lowest offset to the kernel start address is 0x1000000.
2874	* The find_random_virt_addr() the number of possible slots where the kernel can be placed based on the image size
2875	* is calculated using the following formula:
2876	* cSlots = ((KERNEL_IMAGE_SIZE - 0x1000000 (minimum) - image_size) / 0x1000000 (CONFIG_PHYSICAL_ALIGN)) + 1
2877	*
2878	* KERNEL_IMAGE_SIZE is 1GB for 64bit kernels and 512MB for 32bit kernels, so the maximum number of slots (resulting
2879	* in the largest possible offset) can be achieved when image_size (which contains the real size of the kernel image
2880	* which is unknown for us) goes to 0 and a 1GB KERNEL_IMAGE_SIZE is assumed. With that the biggest cSlots which can be
2881	* achieved is 64. The chosen random offset is taken from a random long integer using kaslr_get_random_long() modulo the
2882	* number of slots which selects a slot between 0 and 63. The final offset is calculated using:
2883	* offAddr = random_addr * 0x1000000 (CONFIG_PHYSICAL_ALIGN) + 0x1000000 (minimum)
2884	*
2885	* So the highest offset the kernel can start is 0x40000000 which is 1GB (plus the maximum kernel size we defined).
2886	*/
2887	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX64_KERNEL_ADDRESS_START, _1G + LNX_MAX_KERNEL_SIZE))
2888	return true;
2889
2890	/*
2891	* 32bit variant, makes sure we don't exceed the 4GB address space or DBGFR3MemScan() returns VERR_DBGF_MEM_NOT_FOUND immediately
2892	* without searching the remainder of the address space.
2893	*
2894	* The default split is 3GB userspace and 1GB kernel, so we just search the entire upper 1GB kernel space.
2895	*/
2896	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, LNX32_KERNEL_ADDRESS_START, _4G - LNX32_KERNEL_ADDRESS_START))
2897	return true;
2898
2899	return false;
2900	}
2901
2902	/**
2903	* @copydoc DBGFOSREG::pfnInit
2904	*/
2905	static DECLCALLBACK(int) dbgDiggerLinuxInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2906	{
2907	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2908	Assert(!pThis->fValid);
2909
2910	char szVersion[256] = "Linux version 4.19.0";
2911	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrLinuxBanner, &szVersion[0], sizeof(szVersion));
2912	if (RT_SUCCESS(rc))
2913	{
2914	/*
2915	* Get a numerical version number.
2916	*/
2917	const char *pszVersion = szVersion;
2918	while (pszVersion && !RT_C_IS_DIGIT(pszVersion))
2919	pszVersion++;
2920
2921	size_t offVersion = 0;
2922	uint32_t uMajor = 0;
2923	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2924	uMajor = uMajor * 10 + pszVersion[offVersion++] - '0';
2925
2926	if (pszVersion[offVersion] == '.')
2927	offVersion++;
2928
2929	uint32_t uMinor = 0;
2930	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2931	uMinor = uMinor * 10 + pszVersion[offVersion++] - '0';
2932
2933	if (pszVersion[offVersion] == '.')
2934	offVersion++;
2935
2936	uint32_t uBuild = 0;
2937	while (pszVersion[offVersion] && RT_C_IS_DIGIT(pszVersion[offVersion]))
2938	uBuild = uBuild * 10 + pszVersion[offVersion++] - '0';
2939
2940	pThis->uKrnlVer = LNX_MK_VER(uMajor, uMinor, uBuild);
2941	pThis->uKrnlVerMaj = uMajor;
2942	pThis->uKrnlVerMin = uMinor;
2943	pThis->uKrnlVerBld = uBuild;
2944	if (pThis->uKrnlVer == 0)
2945	LogRel(("dbgDiggerLinuxInit: Failed to parse version string: %s\n", pszVersion));
2946	}
2947
2948	/*
2949	* Assume 64-bit kernels all live way beyond 32-bit address space.
2950	*/
2951	pThis->f64Bit = pThis->AddrLinuxBanner.FlatPtr > UINT32_MAX;
2952	pThis->fRelKrnlAddr = false;
2953
2954	pThis->hCfgDb = NULL;
2955
2956	/*
2957	* Try to find the compressed kernel config and parse it before we try
2958	* to get the symbol table, the config database is required to select
2959	* the method to use.
2960	*/
2961	rc = dbgDiggerLinuxCfgFind(pThis, pUVM, pVMM);
2962	if (RT_FAILURE(rc))
2963	LogFlowFunc(("Failed to find kernel config (%Rrc), no config database available\n", rc));
2964
2965	static const uint8_t s_abNeedle[] = "kobj";
2966	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedle, sizeof(s_abNeedle) - 1);
2967	if (RT_FAILURE(rc))
2968	{
2969	/* Try alternate needle (seen on older x86 Linux kernels). */
2970	static const uint8_t s_abNeedleAlt[] = "kobjec";
2971	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleAlt, sizeof(s_abNeedleAlt) - 1);
2972	if (RT_FAILURE(rc))
2973	{
2974	static const uint8_t s_abNeedleOSuseX86[] = "nmi"; /* OpenSuSe 10.2 x86 */
2975	rc = dbgDiggerLinuxFindSymbolTableFromNeedle(pThis, pUVM, pVMM, s_abNeedleOSuseX86, sizeof(s_abNeedleOSuseX86) - 1);
2976	}
2977	}
2978
2979	pThis->fValid = true;
2980	return VINF_SUCCESS;
2981	}
2982
2983
2984	/**
2985	* @copydoc DBGFOSREG::pfnProbe
2986	*/
2987	static DECLCALLBACK(bool) dbgDiggerLinuxProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
2988	{
2989	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
2990
2991	for (unsigned i = 0; i < RT_ELEMENTS(g_au64LnxKernelAddresses); i++)
2992	{
2993	if (dbgDiggerLinuxProbeWithAddr(pThis, pUVM, pVMM, g_au64LnxKernelAddresses[i], LNX_MAX_KERNEL_SIZE))
2994	return true;
2995	}
2996
2997	/* Maybe the kernel uses KASLR. */
2998	if (dbgDiggerLinuxProbeKaslr(pThis, pUVM, pVMM))
2999	return true;
3000
3001	return false;
3002	}
3003
3004
3005	/**
3006	* @copydoc DBGFOSREG::pfnDestruct
3007	*/
3008	static DECLCALLBACK(void) dbgDiggerLinuxDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3009	{
3010	RT_NOREF(pUVM, pVMM, pvData);
3011	}
3012
3013
3014	/**
3015	* @copydoc DBGFOSREG::pfnConstruct
3016	*/
3017	static DECLCALLBACK(int) dbgDiggerLinuxConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
3018	{
3019	RT_NOREF(pUVM, pVMM);
3020	PDBGDIGGERLINUX pThis = (PDBGDIGGERLINUX)pvData;
3021	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
3022	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerLinuxIDmsg_QueryKernelLog;
3023	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
3024
3025	return VINF_SUCCESS;
3026	}
3027
3028
3029	const DBGFOSREG g_DBGDiggerLinux =
3030	{
3031	/* .u32Magic = */ DBGFOSREG_MAGIC,
3032	/* .fFlags = */ 0,
3033	/* .cbData = */ sizeof(DBGDIGGERLINUX),
3034	/* .szName = */ "Linux",
3035	/* .pfnConstruct = */ dbgDiggerLinuxConstruct,
3036	/* .pfnDestruct = */ dbgDiggerLinuxDestruct,
3037	/* .pfnProbe = */ dbgDiggerLinuxProbe,
3038	/* .pfnInit = */ dbgDiggerLinuxInit,
3039	/* .pfnRefresh = */ dbgDiggerLinuxRefresh,
3040	/* .pfnTerm = */ dbgDiggerLinuxTerm,
3041	/* .pfnQueryVersion = */ dbgDiggerLinuxQueryVersion,
3042	/* .pfnQueryInterface = */ dbgDiggerLinuxQueryInterface,
3043	/* .pfnStackUnwindAssist = */ dbgDiggerLinuxStackUnwindAssist,
3044	/* .u32EndMagic = */ DBGFOSREG_MAGIC
3045	};
3046

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInLinux.cpp@ 98123

Download in other formats: