vbox的更動 64380 路徑 trunk/src/VBox/Debugger

時間撮記:

2016-10-24 下午12:39:30 (8 年 以前)

作者:

vboxsync

訊息:

Debugger/Digger/FreeBSD: Update, loads the symbols now and supports getting at the kernel log buffer

檔案:

• trunk/src/VBox/Debugger/DBGPlugInFreeBsd.cpp (修改) (13 筆差異)

trunk/src/VBox/Debugger/DBGPlugInFreeBsd.cpp

@@ -25 +25 @@
 #include <VBox/vmm/dbgf.h>
 #include <iprt/asm.h>
+#include <iprt/ctype.h>
 #include <iprt/mem.h>
 #include <iprt/stream.h>
@@ -42 +43 @@
 
 /**
+ * ELF headers union.
+ */
+typedef union ELFEHDRS
+{
+    /** 32bit version of the ELF header. */
+    Elf32_Ehdr    Hdr32;
+    /** 64bit version of the ELF header. */
+    Elf64_Ehdr    Hdr64;
+} ELFEHDRS;
+/** Pointer to a ELF header union. */
+typedef ELFEHDRS *PELFEHDRS;
+/** Pointer to const ELF header union. */
+typedef ELFEHDRS const *PCELFEHDRS;
+
+/**
+ * ELF symbol entry union.
+ */
+typedef union ELFSYMS
+{
+    /** 32bit version of the ELF section header. */
+    Elf32_Sym     Hdr32;
+    /** 64bit version of the ELF section header. */
+    Elf64_Sym     Hdr64;
+} ELFSYMS;
+/** Pointer to a ELF symbol entry union. */
+typedef ELFSYMS *PELFSYMS;
+/** Pointer to const ELF symbol entry union. */
+typedef ELFSYMS const *PCELFSYMS;
+
+/**
+ * Message buffer structure.
+ */
+typedef union FBSDMSGBUF
+{
+    /** 32bit version. */
+    struct
+    {
+        /** Message buffer pointer. */
+        uint32_t        msg_ptr;
+        /** Magic value to identify the structure. */
+        uint32_t        msg_magic;
+        /** Size of the buffer area. */
+        uint32_t        msg_size;
+        /** Write sequence number. */
+        uint32_t        msg_wseq;
+        /** Read sequence number. */
+        uint32_t        msg_rseq;
+        /** @todo: More fields which are not required atm. */
+    } Hdr32;
+    /** 64bit version. */
+    struct
+    {
+        /** Message buffer pointer. */
+        uint64_t        msg_ptr;
+        /** Magic value to identify the structure. */
+        uint32_t        msg_magic;
+        /** Size of the buffer area. */
+        uint32_t        msg_size;
+        /** Write sequence number. */
+        uint32_t        msg_wseq;
+        /** Read sequence number. */
+        uint32_t        msg_rseq;
+        /** @todo: More fields which are not required atm. */
+    } Hdr64;
+} FBSDMSGBUF;
+/** Pointer to a message buffer structure. */
+typedef FBSDMSGBUF *PFBSDMSGBUF;
+/** Pointer to a const message buffer structure. */
+typedef FBSDMSGBUF const *PCFBSDMSGBUF;
+
+/** Magic value to identify the message buffer structure. */
+#define FBSD_MSGBUF_MAGIC UINT32_C(0x063062)
+
+/**
  * FreeBSD guest OS digger instance data.
  */
@@ -48 +123 @@
     /** Whether the information is valid or not.
      * (For fending off illegal interface method calls.) */
-    bool        fValid;
+    bool            fValid;
     /** 64-bit/32-bit indicator. */
-    bool        f64Bit;
+    bool            f64Bit;
 
     /** Address of the start of the kernel ELF image,
      * set during probing. */
-    DBGFADDRESS AddrKernelElfStart;
+    DBGFADDRESS     AddrKernelElfStart;
+    /** Address of the the interpreter content aka "/red/herring". */
+    DBGFADDRESS     AddrKernelInterp;
+    /** Address of the start of the text section. */
+    DBGFADDRESS     AddrKernelText;
+
+    /** The kernel message log interface. */
+    DBGFOSIDMESG    IDmesg;
 
 } DBGDIGGERFBSD;
@@ -70 +152 @@
 
 /** Min kernel address (64bit). */
-#define FBSD64_MIN_KRNL_ADDR             UINT64_C(0xFFFFFE0000000000)
+#define FBSD64_MIN_KRNL_ADDR             UINT64_C(0xFFFFF80000000000)
 /** Max kernel address (64bit). */
 #define FBSD64_MAX_KRNL_ADDR             UINT64_C(0xFFFFFFFFFFF00000)
@@ -82 +164 @@
                                           && (Addr) < FBSD64_MAX_KRNL_ADDR)
 
+/** Validates a FreeBSD kernel address. */
+#define FBSD_VALID_ADDRESS(a_pThis, a_Addr) ((a_pThis)->f64Bit ? FBSD64_VALID_ADDRESS(a_Addr) : FBSD32_VALID_ADDRESS(a_Addr))
+
 /** Maximum offset from the start of the ELF image we look for the /red/herring .interp section content. */
 #define FBSD_MAX_INTERP_OFFSET           _16K
@@ -87 +172 @@
 #define FBSD_MAX_KERNEL_SIZE             UINT32_C(0x0f000000)
 
+/** Versioned and bitness wrapper. */
+#define FBSD_UNION(a_pThis, a_pUnion, a_Member)  ((a_pThis)->f64Bit ? (a_pUnion)->Hdr64. a_Member : (a_pUnion)->Hdr32. a_Member )
 
 /*********************************************************************************************************************************
@@ -102 +189 @@
     UINT64_C(0xffffffff80100000)
 };
+/** Magic string which resides in the .interp section of the image. */
+static const uint8_t g_abNeedleInterp[] = "/red/herring";
+
+
+/**
+ * Load the symbols from the .dynsym and .dynstr sections given
+ * by their address in guest memory.
+ *
+ * @returns VBox status code.
+ * @param   pThis           The instance data.
+ * @param   pUVM            The user mode VM handle.
+ * @param   pszName         The image name.
+ * @param   uKernelStart    The kernel start address.
+ * @param   cbKernel        Size of the kernel image.
+ * @param   pAddrDynsym     Start address of the .dynsym section.
+ * @param   cSymbols        Number of symbols in the .dynsym section.
+ * @param   pAddrDynstr     Start address of the .dynstr section containing the symbol names.
+ * @param   cbDynstr        Size of the .dynstr section.
+ */
+static int dbgDiggerFreeBsdLoadSymbols(PDBGDIGGERFBSD pThis, PUVM pUVM, const char *pszName, RTGCUINTPTR uKernelStart,
+                                       size_t cbKernel, PDBGFADDRESS pAddrDynsym, uint32_t cSymbols, PDBGFADDRESS pAddrDynstr,
+                                       size_t cbDynstr)
+{
+    LogFlowFunc(("pThis=%#p pszName=%s uKernelStart=%RGv cbKernel=%zu pAddrDynsym=%#p{%RGv} cSymbols=%u pAddrDynstr=%#p{%RGv} cbDynstr=%zu\n",
+                 pThis, pszName, uKernelStart, cbKernel, pAddrDynsym, pAddrDynsym->FlatPtr, cSymbols, pAddrDynstr, pAddrDynstr->FlatPtr, cbDynstr));
+
+    char *pbDynstr = (char *)RTMemAllocZ(cbDynstr);
+    int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pAddrDynstr, pbDynstr, cbDynstr);
+    if (RT_SUCCESS(rc))
+    {
+        uint32_t cbDynsymEnt = pThis->f64Bit ? sizeof(Elf64_Sym) : sizeof(Elf32_Sym);
+        uint8_t *pbDynsym = (uint8_t *)RTMemAllocZ(cSymbols * cbDynsymEnt);
+        rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pAddrDynsym, pbDynsym, cSymbols * cbDynsymEnt);
+        if (RT_SUCCESS(rc))
+        {
+            /*
+             * Create a module for the kernel.
+             */
+            RTDBGMOD hMod;
+            rc = RTDbgModCreate(&hMod, pszName, cbKernel, 0 /*fFlags*/);
+            if (RT_SUCCESS(rc))
+            {
+                rc = RTDbgModSetTag(hMod, DIG_FBSD_MOD_TAG); AssertRC(rc);
+                rc = VINF_SUCCESS;
+
+                /*
+                 * Enumerate the symbols.
+                 */
+                uint32_t cLeft = cSymbols;
+                while (cLeft-- > 0 && RT_SUCCESS(rc))
+                {
+                    PCELFSYMS   pSym      = (PCELFSYMS)&pbDynsym[cLeft * cbDynsymEnt];
+                    uint32_t    idxSymStr = FBSD_UNION(pThis, pSym, st_name);
+                    uint8_t     uType     = FBSD_UNION(pThis, pSym, st_info);
+                    RTGCUINTPTR AddrVal   = FBSD_UNION(pThis, pSym, st_value);
+                    size_t      cbSymVal  = FBSD_UNION(pThis, pSym, st_size);
+
+                    /* Add it without the type char. */
+                    RT_NOREF(uType);
+                    if (AddrVal <= uKernelStart + cbKernel)
+                    {
+                        rc = RTDbgModSymbolAdd(hMod, &pbDynstr[idxSymStr], RTDBGSEGIDX_RVA, AddrVal - uKernelStart,
+                                               cbSymVal, 0 /*fFlags*/, NULL);
+                        if (RT_FAILURE(rc))
+                        {
+                            if (   rc == VERR_DBG_SYMBOL_NAME_OUT_OF_RANGE
+                                || rc == VERR_DBG_INVALID_RVA
+                                || rc == VERR_DBG_ADDRESS_CONFLICT
+                                || rc == VERR_DBG_DUPLICATE_SYMBOL)
+                            {
+                                Log2(("dbgDiggerFreeBsdLoadSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc (ignored)\n",
+                                      &pbDynstr[idxSymStr], rc));
+                                rc = VINF_SUCCESS;
+                            }
+                            else
+                                Log(("dbgDiggerFreeBsdLoadSymbols: RTDbgModSymbolAdd(,%s,) failed %Rrc\n",
+                                     &pbDynstr[idxSymStr], rc));
+                        }
+                    }
+                }
+
+                /*
+                 * Link the module into the address space.
+                 */
+                if (RT_SUCCESS(rc))
+                {
+                    RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
+                    if (hAs != NIL_RTDBGAS)
+                        rc = RTDbgAsModuleLink(hAs, hMod, uKernelStart, RTDBGASLINK_FLAGS_REPLACE);
+                    else
+                        rc = VERR_INTERNAL_ERROR;
+                    RTDbgAsRelease(hAs);
+                }
+                else
+                    Log(("dbgDiggerFreeBsdLoadSymbols: Failed: %Rrc\n", rc));
+                RTDbgModRelease(hMod);
+            }
+            else
+                Log(("dbgDiggerFreeBsdLoadSymbols: RTDbgModCreate failed: %Rrc\n", rc));
+        }
+        else
+            Log(("dbgDiggerFreeBsdLoadSymbols: Reading symbol table at %RGv failed: %Rrc\n",
+                 pAddrDynsym->FlatPtr, rc));
+        RTMemFree(pbDynsym);
+    }
+    else
+        Log(("dbgDiggerFreeBsdLoadSymbols: Reading symbol string table at %RGv failed: %Rrc\n",
+             pAddrDynstr->FlatPtr, rc));
+    RTMemFree(pbDynstr);
+
+    LogFlowFunc(("returns %Rrc\n", rc));
+    return rc;
+}
+
+/**
+ * Process the kernel image.
+ *
+ * @param   pThis           The instance data.
+ * @param   pUVM            The user mode VM handle.
+ * @param   pszName         The image name.
+ */
+static void dbgDiggerFreeBsdProcessKernelImage(PDBGDIGGERFBSD pThis, PUVM pUVM, const char *pszName)
+{
+    /*
+     * FreeBSD has parts of the kernel ELF image in guest memory, starting with the
+     * ELF header and the content of the sections which are indicated to be loaded
+     * into memory (text, rodata, etc.) of course. Whats missing are the section headers
+     * which is understandable but unfortunate because it would make our life easier.
+     *
+     * All checked FreeBSD kernels so far have the following layout in the kernel:
+     *     [.interp] - contiains the /red/herring string we used for probing earlier
+     *     [.hash]   - contains the hashes of the symbol names, 8 byte alignent
+     *     [.dynsym] - contains the ELF symbol descriptors, 8 byte alignment
+     *     [.dynstr] - contains the symbol names as a string table, 1 byte alignmnt
+     *     [.text]   - contains the executable code, 16 byte alignment.
+     * The sections are always adjacent (sans alignment) so we just parse the .hash section right after
+     * .interp, ELF states that it can contain 32bit or 64bit words but all observed kernels
+     * always use 32bit words. It contains two counters at the beginning which we can use to
+     * deduct the .hash section size and the beginning of .dynsym.
+     * .dynsym contains an array of symbol descriptors which have a fixed size depending on the
+     * guest bitness.
+     * Finding the end of .dynsym is not easily doable as there is no counter available (it lives
+     * in the section headers) at this point so we just have to check whether the record is valid
+     * and if not check if it contains an ASCII string which marks the start of the .dynstr section.
+     */
+
+    /* Calculate the start of the .hash section. */
+    DBGFADDRESS AddrHashStart = pThis->AddrKernelInterp;
+    DBGFR3AddrAdd(&AddrHashStart, sizeof(g_abNeedleInterp));
+    AddrHashStart.FlatPtr = RT_ALIGN_GCPT(AddrHashStart.FlatPtr, 8, RTGCUINTPTR);
+    uint32_t au32Counters[2];
+    int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrHashStart, &au32Counters[0], sizeof(au32Counters));
+    if (RT_SUCCESS(rc))
+    {
+        size_t cbHash = (au32Counters[0] + au32Counters[1] + 2) * sizeof(uint32_t);
+        if (AddrHashStart.FlatPtr + cbHash < pThis->AddrKernelText.FlatPtr) /* Should be much smaller */
+        {
+            DBGFADDRESS AddrDynsymStart = AddrHashStart;
+            uint32_t cSymbols = 0;
+            size_t cbKernel = 0;
+            RTGCUINTPTR uKernelStart = pThis->AddrKernelElfStart.FlatPtr;
+
+            DBGFR3AddrAdd(&AddrDynsymStart, cbHash);
+            AddrDynsymStart.FlatPtr = RT_ALIGN_GCPT(AddrDynsymStart.FlatPtr, 8, RTGCUINTPTR);
+
+            DBGFADDRESS AddrDynstrStart = AddrDynsymStart;
+            while (AddrDynstrStart.FlatPtr < pThis->AddrKernelText.FlatPtr)
+            {
+                size_t cbDynSymEnt = pThis->f64Bit ? sizeof(Elf64_Sym) : sizeof(Elf32_Sym);
+                uint8_t abBuf[_16K];
+                size_t cbToRead = RT_MIN(sizeof(abBuf), pThis->AddrKernelText.FlatPtr - AddrDynstrStart.FlatPtr);
+
+                rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrDynstrStart, &abBuf[0], cbToRead);
+                if (RT_FAILURE(rc))
+                    break;
+
+                for (unsigned i = 0; i < cbToRead / cbDynSymEnt; i++)
+                {
+                    PCELFSYMS   pSym      = (PCELFSYMS)&abBuf[i * cbDynSymEnt];
+                    uint32_t    idxSymStr = FBSD_UNION(pThis, pSym, st_name);
+                    uint8_t     uType     = FBSD_UNION(pThis, pSym, st_info);
+                    RTGCUINTPTR AddrVal   = FBSD_UNION(pThis, pSym, st_value);
+                    size_t      cbSymVal  = FBSD_UNION(pThis, pSym, st_size);
+
+                    /*
+                     * If the entry doesn't look valid check whether it contains an ASCII string,
+                     * we then found the start of the .dynstr section.
+                     */
+                    RT_NOREF(uType);
+                    if (   ELF32_ST_TYPE(uType) != STT_NOTYPE
+                        && (   !FBSD_VALID_ADDRESS(pThis, AddrVal)
+                            || cbSymVal > FBSD_MAX_KERNEL_SIZE
+                            || idxSymStr > pThis->AddrKernelText.FlatPtr - AddrDynstrStart.FlatPtr))
+                    {
+                        LogFlowFunc(("Invalid symbol table entry found at %RGv\n",
+                                     AddrDynstrStart.FlatPtr + i * cbDynSymEnt));
+
+                        uint8_t *pbBuf = &abBuf[i * cbDynSymEnt];
+                        size_t cbLeft = cbToRead - i * cbDynSymEnt;
+                        /*
+                         * Check to the end of the buffer whether it contains only a certain set of
+                         * ASCII characters and 0 terminators.
+                         */
+                        while (   cbLeft > 0
+                               && (   RT_C_IS_ALNUM(*pbBuf)
+                                   || *pbBuf == '_'
+                                   || *pbBuf == '\0'
+                                   || *pbBuf == '.'))
+                        {
+                            cbLeft--;
+                            pbBuf++;
+                        }
+
+                        if (!cbLeft)
+                        {
+                            DBGFR3AddrAdd(&AddrDynstrStart, i * cbDynSymEnt);
+                            LogFlowFunc(("Found all required section start addresses (.dynsym=%RGv cSymbols=%u, .dynstr=%RGv cb=%u)\n",
+                                         AddrDynsymStart.FlatPtr, cSymbols, AddrDynstrStart.FlatPtr,
+                                         pThis->AddrKernelText.FlatPtr - AddrDynstrStart.FlatPtr));
+                            dbgDiggerFreeBsdLoadSymbols(pThis, pUVM, pszName, uKernelStart, cbKernel, &AddrDynsymStart, cSymbols, &AddrDynstrStart,
+                                                        pThis->AddrKernelText.FlatPtr - AddrDynstrStart.FlatPtr);
+                            return;
+                        }
+                        else
+                            LogFlowFunc(("Found invalid ASCII character in .dynstr section candidate: %#x\n", *pbBuf));
+                    }
+                    else
+                    {
+                        cSymbols++;
+                        if (   ELF32_ST_TYPE(uType) != STT_NOTYPE
+                            && FBSD_VALID_ADDRESS(pThis, AddrVal))
+                        {
+                            uKernelStart = RT_MIN(uKernelStart, AddrVal);
+                            cbKernel = RT_MAX(cbKernel, AddrVal + cbSymVal - uKernelStart);
+                        }
+                    }
+                }
+
+                /* Don't account incomplete entries. */
+                DBGFR3AddrAdd(&AddrDynstrStart, (cbToRead / cbDynSymEnt) * cbDynSymEnt);
+            }
+        }
+        else
+            LogFlowFunc((".hash section overlaps with .text section: %zu (expected much less than %u)\n", cbHash,
+                         pThis->AddrKernelText.FlatPtr - AddrHashStart.FlatPtr));
+    }
+}
+
+
+/**
+ * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
+ */
+static DECLCALLBACK(int) dbgDiggerFreeBsdIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
+                                                              char *pszBuf, size_t cbBuf, size_t *pcbActual)
+{
+    RT_NOREF1(fFlags);
+    PDBGDIGGERFBSD pData = RT_FROM_MEMBER(pThis, DBGDIGGERFBSD, IDmesg);
+
+    if (cMessages < 1)
+        return VERR_INVALID_PARAMETER;
+
+    /* Resolve the message buffer address from the msgbufp symbol. */
+    RTDBGSYMBOL SymInfo;
+    int rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "kernel!msgbufp", &SymInfo, NULL);
+    if (RT_SUCCESS(rc))
+    {
+        DBGFADDRESS AddrMsgBuf;
+
+        /* Read the message buffer pointer. */
+        RTGCPTR     GCPtrMsgBufP = 0;
+        rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &AddrMsgBuf, SymInfo.Value),
+                           &GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
+        if (RT_FAILURE(rc))
+        {
+            Log(("dbgDiggerFreeBsdIDmsg_QueryKernelLog: failed to read msgbufp at %RGv: %Rrc\n", AddrMsgBuf.FlatPtr, rc));
+            return VERR_NOT_FOUND;
+        }
+        if (!FBSD_VALID_ADDRESS(pData, GCPtrMsgBufP))
+        {
+            Log(("dbgDiggerFreeBsdIDmsg_QueryKernelLog: Invalid address for msgbufp: %RGv\n", GCPtrMsgBufP));
+            return VERR_NOT_FOUND;
+        }
+
+        /* Read the structure. */
+        FBSDMSGBUF MsgBuf;
+        rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &AddrMsgBuf, GCPtrMsgBufP),
+                           &MsgBuf, sizeof(MsgBuf));
+        if (RT_SUCCESS(rc))
+        {
+            RTGCUINTPTR AddrBuf = FBSD_UNION(pData, &MsgBuf, msg_ptr);
+            uint32_t cbMsgBuf = FBSD_UNION(pData, &MsgBuf, msg_size);
+            uint32_t uMsgBufSeqR = FBSD_UNION(pData, &MsgBuf, msg_rseq);
+            uint32_t uMsgBufSeqW = FBSD_UNION(pData, &MsgBuf, msg_wseq);
+
+            /*
+             * Validate the structure.
+             */
+            if (   FBSD_UNION(pData, &MsgBuf, msg_magic) != FBSD_MSGBUF_MAGIC
+                || cbMsgBuf < UINT32_C(4096)
+                || cbMsgBuf > 16*_1M
+                || FBSD_UNION(pData, &MsgBuf, msg_rseq) > cbMsgBuf
+                || FBSD_UNION(pData, &MsgBuf, msg_wseq) > cbMsgBuf
+                || !FBSD_VALID_ADDRESS(pData, AddrBuf) )
+            {
+                Log(("dbgDiggerFreeBsdIDmsg_QueryKernelLog: Invalid MsgBuf data: msg_magic=%#x msg_size=%#x msg_rseq=%#x msg_wseq=%#x msg_ptr=%RGv\n",
+                     FBSD_UNION(pData, &MsgBuf, msg_magic), cbMsgBuf, uMsgBufSeqR, uMsgBufSeqW, AddrBuf));
+                return VERR_INVALID_STATE;
+            }
+
+            /*
+             * Read the buffer.
+             */
+            char *pchMsgBuf = (char *)RTMemAlloc(cbMsgBuf);
+            if (!pchMsgBuf)
+            {
+                Log(("dbgDiggerFreeBsdIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
+                     cbMsgBuf));
+                return VERR_INVALID_STATE;
+            }
+            rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &AddrMsgBuf, AddrBuf), pchMsgBuf, cbMsgBuf);
+            if (RT_SUCCESS(rc))
+            {
+                /*
+                 * Copy it out raw.
+                 */
+                uint32_t offDst = 0;
+                if (uMsgBufSeqR < uMsgBufSeqW)
+                {
+                    /* Single chunk between the read and write offsets. */
+                    uint32_t cbToCopy = uMsgBufSeqW - uMsgBufSeqR;
+                    if (cbToCopy < cbBuf)
+                    {
+                        memcpy(pszBuf, &pchMsgBuf[uMsgBufSeqR], cbToCopy);
+                        pszBuf[cbToCopy] = '\0';
+                        rc = VINF_SUCCESS;
+                    }
+                    else
+                    {
+                        if (cbBuf)
+                        {
+                            memcpy(pszBuf, &pchMsgBuf[uMsgBufSeqR], cbBuf - 1);
+                            pszBuf[cbBuf - 1] = '\0';
+                        }
+                        rc = VERR_BUFFER_OVERFLOW;
+                    }
+                    offDst = cbToCopy + 1;
+                }
+                else
+                {
+                    /* Two chunks, read offset to end, start to write offset. */
+                    uint32_t cbFirst  = cbMsgBuf - uMsgBufSeqR;
+                    uint32_t cbSecond = uMsgBufSeqW;
+                    if (cbFirst + cbSecond < cbBuf)
+                    {
+                        memcpy(pszBuf, &pchMsgBuf[uMsgBufSeqR], cbFirst);
+                        memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
+                        offDst = cbFirst + cbSecond;
+                        pszBuf[offDst++] = '\0';
+                        rc = VINF_SUCCESS;
+                    }
+                    else
+                    {
+                        offDst = cbFirst + cbSecond + 1;
+                        if (cbFirst < cbBuf)
+                        {
+                            memcpy(pszBuf, &pchMsgBuf[uMsgBufSeqR], cbFirst);
+                            memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
+                            pszBuf[cbBuf - 1] = '\0';
+                        }
+                        else if (cbBuf)
+                        {
+                            memcpy(pszBuf, &pchMsgBuf[uMsgBufSeqR], cbBuf - 1);
+                            pszBuf[cbBuf - 1] = '\0';
+                        }
+                        rc = VERR_BUFFER_OVERFLOW;
+                    }
+                }
+
+                if (pcbActual)
+                    *pcbActual = offDst;
+            }
+            else
+                Log(("dbgDiggerFreeBsdIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n", cbBuf, AddrBuf, rc));
+            RTMemFree(pchMsgBuf);
+        }
+        else
+            LogFlowFunc(("Failed to read message buffer header: %Rrc\n", rc));
+    }
+
+    return rc;
+}
+
 
 /**
@@ -108 +587 @@
 static DECLCALLBACK(void *) dbgDiggerFreeBsdQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
 {
-    RT_NOREF3(pUVM, pvData, enmIf);
-    return NULL;
+    RT_NOREF1(pUVM);
+    PDBGDIGGERFBSD pThis = (PDBGDIGGERFBSD)pvData;
+    switch (enmIf)
+    {
+        case DBGFOSINTERFACE_DMESG:
+            return &pThis->IDmesg;
+
+        default:
+            return NULL;
+    }
 }
 
@@ -121 +608 @@
     Assert(pThis->fValid);
 
-    RT_NOREF4(pUVM, pThis, pszVersion, cchVersion);
-
-    return VERR_NOT_IMPLEMENTED;
+    RTDBGSYMBOL SymInfo;
+    int rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "kernel!version", &SymInfo, NULL);
+    if (RT_SUCCESS(rc))
+    {
+        DBGFADDRESS AddrVersion;
+        DBGFR3AddrFromFlat(pUVM, &AddrVersion, SymInfo.Value);
+
+        rc = DBGFR3MemReadString(pUVM, 0, &AddrVersion, pszVersion, cchVersion);
+        if (RT_SUCCESS(rc))
+        {
+            char *pszEnd = RTStrEnd(pszVersion, cchVersion);
+            AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
+            while (     pszEnd > pszVersion
+                   &&   RT_C_IS_SPACE(pszEnd[-1]))
+                pszEnd--;
+            *pszEnd = '\0';
+        }
+        else
+            RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemReadString -> %Rrc", rc);
+    }
+
+    return rc;
 }
 
@@ -167 +673 @@
     RT_NOREF1(pUVM);
 
+    dbgDiggerFreeBsdProcessKernelImage(pThis, pUVM, "kernel");
     pThis->fValid = true;
     return VINF_SUCCESS;
@@ -204 +711 @@
              * ELF header.
              */
-            static const uint8_t s_abNeedleInterp[] = "/red/herring";
             DBGFADDRESS HitAddrInterp;
             rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, FBSD_MAX_INTERP_OFFSET, 1,
-                               s_abNeedleInterp, sizeof(s_abNeedleInterp), &HitAddrInterp);
+                               g_abNeedleInterp, sizeof(g_abNeedleInterp), &HitAddrInterp);
             if (RT_SUCCESS(rc))
             {
@@ -237 +743 @@
                         pThis->f64Bit = ElfHdr.Hdr32.e_ident[EI_CLASS] == ELFCLASS64;
                         pThis->AddrKernelElfStart = HitAddr;
+                        pThis->AddrKernelInterp = HitAddrInterp;
+                        pThis->AddrKernelText.FlatPtr = FBSD_UNION(pThis, &ElfHdr, e_entry);
+                        LogFunc(("Found %s FreeBSD kernel at %RGv (.interp section at %RGv, .text section at %RGv)\n",
+                                 pThis->f64Bit ? "amd64" : "i386", pThis->AddrKernelElfStart.FlatPtr,
+                                 pThis->AddrKernelInterp.FlatPtr, pThis->AddrKernelText.FlatPtr));
                         return true;
                     }
@@ -271 +782 @@
 static DECLCALLBACK(int)  dbgDiggerFreeBsdConstruct(PUVM pUVM, void *pvData)
 {
-    RT_NOREF2(pUVM, pvData);
+    RT_NOREF1(pUVM);
+    PDBGDIGGERFBSD pThis = (PDBGDIGGERFBSD)pvData;
+
+    pThis->fValid = false;
+    pThis->f64Bit = false;
+    pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
+    pThis->IDmesg.pfnQueryKernelLog = dbgDiggerFreeBsdIDmsg_QueryKernelLog;
+    pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
+
     return VINF_SUCCESS;
 }