win_dump.c

   1 /*
   2  * Windows crashdump
   3  *
   4  * Copyright (c) 2018 Virtuozzo International GmbH
   5  *
   6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7  * See the COPYING file in the top-level directory.
   8  *
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "qemu/cutils.h"
  13 #include "elf.h"
  14 #include "cpu.h"
  15 #include "exec/hwaddr.h"
  16 #include "monitor/monitor.h"
  17 #include "sysemu/kvm.h"
  18 #include "sysemu/dump.h"
  19 #include "sysemu/sysemu.h"
  20 #include "sysemu/memory_mapping.h"
  21 #include "sysemu/cpus.h"
  22 #include "qapi/error.h"
  23 #include "qapi/qmp/qerror.h"
  24 #include "qemu/error-report.h"
  25 #include "hw/misc/vmcoreinfo.h"
  26 #include "win_dump.h"
  27
  28 static size_t write_run(WinDumpPhyMemRun64 *run, int fd, Error **errp)
  29 {
  30     void *buf;
  31     uint64_t addr = run->BasePage << TARGET_PAGE_BITS;
  32     uint64_t size = run->PageCount << TARGET_PAGE_BITS;
  33     uint64_t len, l;
  34     size_t total = 0;
  35
  36     while (size) {
  37         len = size;
  38
  39         buf = cpu_physical_memory_map(addr, &len, false);
  40         if (!buf) {
  41             error_setg(errp, "win-dump: failed to map physical range"
  42                              " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
  43             return 0;
  44         }
  45
  46         l = qemu_write_full(fd, buf, len);
  47         cpu_physical_memory_unmap(buf, addr, false, len);
  48         if (l != len) {
  49             error_setg(errp, QERR_IO_ERROR);
  50             return 0;
  51         }
  52
  53         addr += l;
  54         size -= l;
  55         total += l;
  56     }
  57
  58     return total;
  59 }
  60
  61 static void write_runs(DumpState *s, WinDumpHeader64 *h, Error **errp)
  62 {
  63     WinDumpPhyMemDesc64 *desc = &h->PhysicalMemoryBlock;
  64     WinDumpPhyMemRun64 *run = desc->Run;
  65     Error *local_err = NULL;
  66     int i;
  67
  68     for (i = 0; i < desc->NumberOfRuns; i++) {
  69         s->written_size += write_run(run + i, s->fd, &local_err);
  70         if (local_err) {
  71             error_propagate(errp, local_err);
  72             return;
  73         }
  74     }
  75 }
  76
  77 static void patch_mm_pfn_database(WinDumpHeader64 *h, Error **errp)
  78 {
  79     if (cpu_memory_rw_debug(first_cpu,
  80             h->KdDebuggerDataBlock + KDBG_MM_PFN_DATABASE_OFFSET64,
  81             (uint8_t *)&h->PfnDatabase, sizeof(h->PfnDatabase), 0)) {
  82         error_setg(errp, "win-dump: failed to read MmPfnDatabase");
  83         return;
  84     }
  85 }
  86
  87 static void patch_bugcheck_data(WinDumpHeader64 *h, Error **errp)
  88 {
  89     uint64_t KiBugcheckData;
  90
  91     if (cpu_memory_rw_debug(first_cpu,
  92             h->KdDebuggerDataBlock + KDBG_KI_BUGCHECK_DATA_OFFSET64,
  93             (uint8_t *)&KiBugcheckData, sizeof(KiBugcheckData), 0)) {
  94         error_setg(errp, "win-dump: failed to read KiBugcheckData");
  95         return;
  96     }
  97
  98     if (cpu_memory_rw_debug(first_cpu,
  99             KiBugcheckData,
 100             h->BugcheckData, sizeof(h->BugcheckData), 0)) {
 101         error_setg(errp, "win-dump: failed to read bugcheck data");
 102         return;
 103     }
 104
 105     /*
 106      * If BugcheckCode wasn't saved, we consider guest OS as alive.
 107      */
 108
 109     if (!h->BugcheckCode) {
 110         h->BugcheckCode = LIVE_SYSTEM_DUMP;
 111     }
 112 }
 113
 114 /*
 115  * This routine tries to correct mistakes in crashdump header.
 116  */
 117 static void patch_header(WinDumpHeader64 *h)
 118 {
 119     Error *local_err = NULL;
 120
 121     h->RequiredDumpSpace = sizeof(WinDumpHeader64) +
 122             (h->PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 123     h->PhysicalMemoryBlock.unused = 0;
 124     h->unused1 = 0;
 125
 126     patch_mm_pfn_database(h, &local_err);
 127     if (local_err) {
 128         warn_report_err(local_err);
 129         local_err = NULL;
 130     }
 131     patch_bugcheck_data(h, &local_err);
 132     if (local_err) {
 133         warn_report_err(local_err);
 134     }
 135 }
 136
 137 static void check_header(WinDumpHeader64 *h, Error **errp)
 138 {
 139     const char Signature[] = "PAGE";
 140     const char ValidDump[] = "DU64";
 141
 142     if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
 143         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 144                          " got '%.4s'", Signature, h->Signature);
 145         return;
 146     }
 147
 148     if (memcmp(h->ValidDump, ValidDump, sizeof(h->ValidDump))) {
 149         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 150                          " got '%.4s'", ValidDump, h->ValidDump);
 151         return;
 152     }
 153 }
 154
 155 static void check_kdbg(WinDumpHeader64 *h, Error **errp)
 156 {
 157     const char OwnerTag[] = "KDBG";
 158     char read_OwnerTag[4];
 159     uint64_t KdDebuggerDataBlock = h->KdDebuggerDataBlock;
 160     bool try_fallback = true;
 161
 162 try_again:
 163     if (cpu_memory_rw_debug(first_cpu,
 164             KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64,
 165             (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
 166         error_setg(errp, "win-dump: failed to read OwnerTag");
 167         return;
 168     }
 169
 170     if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
 171         if (try_fallback) {
 172             /*
 173              * If attempt to use original KDBG failed
 174              * (most likely because of its encryption),
 175              * we try to use KDBG obtained by guest driver.
 176              */
 177
 178             KdDebuggerDataBlock = h->BugcheckParameter1;
 179             try_fallback = false;
 180             goto try_again;
 181         } else {
 182             error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
 183                              " expected '%.4s', got '%.4s'",
 184                              OwnerTag, read_OwnerTag);
 185             return;
 186         }
 187     }
 188
 189     h->KdDebuggerDataBlock = KdDebuggerDataBlock;
 190 }
 191
 192 struct saved_context {
 193     WinContext ctx;
 194     uint64_t addr;
 195 };
 196
 197 static void patch_and_save_context(WinDumpHeader64 *h,
 198                                    struct saved_context *saved_ctx,
 199                                    Error **errp)
 200 {
 201     uint64_t KiProcessorBlock;
 202     uint16_t OffsetPrcbContext;
 203     CPUState *cpu;
 204     int i = 0;
 205
 206     if (cpu_memory_rw_debug(first_cpu,
 207             h->KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET64,
 208             (uint8_t *)&KiProcessorBlock, sizeof(KiProcessorBlock), 0)) {
 209         error_setg(errp, "win-dump: failed to read KiProcessorBlock");
 210         return;
 211     }
 212
 213     if (cpu_memory_rw_debug(first_cpu,
 214             h->KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET64,
 215             (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
 216         error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
 217         return;
 218     }
 219
 220     CPU_FOREACH(cpu) {
 221         X86CPU *x86_cpu = X86_CPU(cpu);
 222         CPUX86State *env = &x86_cpu->env;
 223         uint64_t Prcb;
 224         uint64_t Context;
 225         WinContext ctx;
 226
 227         if (cpu_memory_rw_debug(first_cpu,
 228                 KiProcessorBlock + i * sizeof(uint64_t),
 229                 (uint8_t *)&Prcb, sizeof(Prcb), 0)) {
 230             error_setg(errp, "win-dump: failed to read"
 231                              " CPU #%d PRCB location", i);
 232             return;
 233         }
 234
 235         if (cpu_memory_rw_debug(first_cpu,
 236                 Prcb + OffsetPrcbContext,
 237                 (uint8_t *)&Context, sizeof(Context), 0)) {
 238             error_setg(errp, "win-dump: failed to read"
 239                              " CPU #%d ContextFrame location", i);
 240             return;
 241         }
 242
 243         saved_ctx[i].addr = Context;
 244
 245         ctx = (WinContext){
 246             .ContextFlags = WIN_CTX_ALL,
 247             .MxCsr = env->mxcsr,
 248
 249             .SegEs = env->segs[0].selector,
 250             .SegCs = env->segs[1].selector,
 251             .SegSs = env->segs[2].selector,
 252             .SegDs = env->segs[3].selector,
 253             .SegFs = env->segs[4].selector,
 254             .SegGs = env->segs[5].selector,
 255             .EFlags = cpu_compute_eflags(env),
 256
 257             .Dr0 = env->dr[0],
 258             .Dr1 = env->dr[1],
 259             .Dr2 = env->dr[2],
 260             .Dr3 = env->dr[3],
 261             .Dr6 = env->dr[6],
 262             .Dr7 = env->dr[7],
 263
 264             .Rax = env->regs[R_EAX],
 265             .Rbx = env->regs[R_EBX],
 266             .Rcx = env->regs[R_ECX],
 267             .Rdx = env->regs[R_EDX],
 268             .Rsp = env->regs[R_ESP],
 269             .Rbp = env->regs[R_EBP],
 270             .Rsi = env->regs[R_ESI],
 271             .Rdi = env->regs[R_EDI],
 272             .R8  = env->regs[8],
 273             .R9  = env->regs[9],
 274             .R10 = env->regs[10],
 275             .R11 = env->regs[11],
 276             .R12 = env->regs[12],
 277             .R13 = env->regs[13],
 278             .R14 = env->regs[14],
 279             .R15 = env->regs[15],
 280
 281             .Rip = env->eip,
 282             .FltSave = {
 283                 .MxCsr = env->mxcsr,
 284             },
 285         };
 286
 287         if (cpu_memory_rw_debug(first_cpu, Context,
 288                 (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 0)) {
 289             error_setg(errp, "win-dump: failed to save CPU #%d context", i);
 290             return;
 291         }
 292
 293         if (cpu_memory_rw_debug(first_cpu, Context,
 294                 (uint8_t *)&ctx, sizeof(WinContext), 1)) {
 295             error_setg(errp, "win-dump: failed to write CPU #%d context", i);
 296             return;
 297         }
 298
 299         i++;
 300     }
 301 }
 302
 303 static void restore_context(WinDumpHeader64 *h,
 304                             struct saved_context *saved_ctx)
 305 {
 306     int i;
 307     Error *err = NULL;
 308
 309     for (i = 0; i < h->NumberProcessors; i++) {
 310         if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
 311                 (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 1)) {
 312             error_setg(&err, "win-dump: failed to restore CPU #%d context", i);
 313             warn_report_err(err);
 314         }
 315     }
 316 }
 317
 318 void create_win_dump(DumpState *s, Error **errp)
 319 {
 320     WinDumpHeader64 *h = (WinDumpHeader64 *)(s->guest_note +
 321             VMCOREINFO_ELF_NOTE_HDR_SIZE);
 322     X86CPU *first_x86_cpu = X86_CPU(first_cpu);
 323     uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
 324     struct saved_context *saved_ctx = NULL;
 325     Error *local_err = NULL;
 326
 327     if (s->guest_note_size != sizeof(WinDumpHeader64) +
 328             VMCOREINFO_ELF_NOTE_HDR_SIZE) {
 329         error_setg(errp, "win-dump: invalid vmcoreinfo note size");
 330         return;
 331     }
 332
 333     check_header(h, &local_err);
 334     if (local_err) {
 335         error_propagate(errp, local_err);
 336         return;
 337     }
 338
 339     /*
 340      * Further access to kernel structures by virtual addresses
 341      * should be made from system context.
 342      */
 343
 344     first_x86_cpu->env.cr[3] = h->DirectoryTableBase;
 345
 346     check_kdbg(h, &local_err);
 347     if (local_err) {
 348         error_propagate(errp, local_err);
 349         goto out_cr3;
 350     }
 351
 352     patch_header(h);
 353
 354     saved_ctx = g_new(struct saved_context, h->NumberProcessors);
 355
 356     /*
 357      * Always patch context because there is no way
 358      * to determine if the system-saved context is valid
 359      */
 360
 361     patch_and_save_context(h, saved_ctx, &local_err);
 362     if (local_err) {
 363         error_propagate(errp, local_err);
 364         goto out_free;
 365     }
 366
 367     s->total_size = h->RequiredDumpSpace;
 368
 369     s->written_size = qemu_write_full(s->fd, h, sizeof(*h));
 370     if (s->written_size != sizeof(*h)) {
 371         error_setg(errp, QERR_IO_ERROR);
 372         goto out_restore;
 373     }
 374
 375     write_runs(s, h, &local_err);
 376     if (local_err) {
 377         error_propagate(errp, local_err);
 378         goto out_restore;
 379     }
 380
 381 out_restore:
 382     restore_context(h, saved_ctx);
 383 out_free:
 384     g_free(saved_ctx);
 385 out_cr3:
 386     first_x86_cpu->env.cr[3] = saved_cr3;
 387
 388     return;
 389 }