dump/win_dump.c

   1 /*
   2  * Windows crashdump (target specific implementations)
   3  *
   4  * Copyright (c) 2018 Virtuozzo International GmbH
   5  *
   6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7  * See the COPYING file in the top-level directory.
   8  *
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "sysemu/dump.h"
  13 #include "qapi/error.h"
  14 #include "qemu/error-report.h"
  15 #include "exec/cpu-defs.h"
  16 #include "hw/core/cpu.h"
  17 #include "qemu/win_dump_defs.h"
  18 #include "win_dump.h"
  19 #include "cpu.h"
  20
  21 #if defined(TARGET_X86_64)
  22
  23 bool win_dump_available(Error **errp)
  24 {
  25     return true;
  26 }
  27
  28 static size_t win_dump_ptr_size(bool x64)
  29 {
  30     return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
  31 }
  32
  33 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
  34 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
  35
  36 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
  37 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
  38
  39 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
  40 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
  41
  42 static size_t win_dump_ctx_size(bool x64)
  43 {
  44     return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
  45 }
  46
  47 static size_t write_run(uint64_t base_page, uint64_t page_count,
  48         int fd, Error **errp)
  49 {
  50     void *buf;
  51     uint64_t addr = base_page << TARGET_PAGE_BITS;
  52     uint64_t size = page_count << TARGET_PAGE_BITS;
  53     uint64_t len, l;
  54     int eno;
  55     size_t total = 0;
  56
  57     while (size) {
  58         len = size;
  59
  60         buf = cpu_physical_memory_map(addr, &len, false);
  61         if (!buf) {
  62             error_setg(errp, "win-dump: failed to map physical range"
  63                              " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
  64             return 0;
  65         }
  66
  67         l = qemu_write_full(fd, buf, len);
  68         eno = errno;
  69         cpu_physical_memory_unmap(buf, addr, false, len);
  70         if (l != len) {
  71             error_setg_errno(errp, eno, "win-dump: failed to save memory");
  72             return 0;
  73         }
  74
  75         addr += l;
  76         size -= l;
  77         total += l;
  78     }
  79
  80     return total;
  81 }
  82
  83 static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp)
  84 {
  85     uint64_t BasePage, PageCount;
  86     Error *local_err = NULL;
  87     int i;
  88
  89     for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) {
  90         BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage);
  91         PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount);
  92         s->written_size += write_run(BasePage, PageCount, s->fd, &local_err);
  93         if (local_err) {
  94             error_propagate(errp, local_err);
  95             return;
  96         }
  97     }
  98 }
  99
 100 static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr)
 101 {
 102     int ret;
 103     uint32_t ptr32;
 104     uint64_t ptr64;
 105
 106     ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32,
 107             win_dump_ptr_size(x64), 0);
 108
 109     *ptr = x64 ? ptr64 : ptr32;
 110
 111     return ret;
 112 }
 113
 114 static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp)
 115 {
 116     if (cpu_memory_rw_debug(first_cpu,
 117             WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
 118             WIN_DUMP_FIELD_PTR(PfnDatabase),
 119             WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
 120         error_setg(errp, "win-dump: failed to read MmPfnDatabase");
 121         return;
 122     }
 123 }
 124
 125 static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp)
 126 {
 127     uint64_t KiBugcheckData;
 128
 129     if (cpu_read_ptr(x64, first_cpu,
 130             WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
 131             &KiBugcheckData)) {
 132         error_setg(errp, "win-dump: failed to read KiBugcheckData");
 133         return;
 134     }
 135
 136     if (cpu_memory_rw_debug(first_cpu, KiBugcheckData,
 137             WIN_DUMP_FIELD(BugcheckData),
 138             WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) {
 139         error_setg(errp, "win-dump: failed to read bugcheck data");
 140         return;
 141     }
 142
 143     /*
 144      * If BugcheckCode wasn't saved, we consider guest OS as alive.
 145      */
 146
 147     if (!WIN_DUMP_FIELD(BugcheckCode)) {
 148         *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP;
 149     }
 150 }
 151
 152 /*
 153  * This routine tries to correct mistakes in crashdump header.
 154  */
 155 static void patch_header(WinDumpHeader *h, bool x64)
 156 {
 157     Error *local_err = NULL;
 158
 159     if (x64) {
 160         h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
 161             (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 162         h->x64.PhysicalMemoryBlock.unused = 0;
 163         h->x64.unused1 = 0;
 164     } else {
 165         h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
 166             (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 167     }
 168
 169     patch_mm_pfn_database(h, x64, &local_err);
 170     if (local_err) {
 171         warn_report_err(local_err);
 172         local_err = NULL;
 173     }
 174     patch_bugcheck_data(h, x64, &local_err);
 175     if (local_err) {
 176         warn_report_err(local_err);
 177     }
 178 }
 179
 180 static bool check_header(WinDumpHeader *h, bool *x64, Error **errp)
 181 {
 182     const char Signature[] = "PAGE";
 183
 184     if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
 185         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 186                          " got '%.4s'", Signature, h->Signature);
 187         return false;
 188     }
 189
 190     if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
 191         *x64 = false;
 192     } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
 193         *x64 = true;
 194     } else {
 195         error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
 196                    " got '%.4s'", h->ValidDump);
 197         return false;
 198     }
 199
 200     return true;
 201 }
 202
 203 static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp)
 204 {
 205     const char OwnerTag[] = "KDBG";
 206     char read_OwnerTag[4];
 207     uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
 208     bool try_fallback = true;
 209
 210 try_again:
 211     if (cpu_memory_rw_debug(first_cpu,
 212             KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
 213             (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
 214         error_setg(errp, "win-dump: failed to read OwnerTag");
 215         return;
 216     }
 217
 218     if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
 219         if (try_fallback) {
 220             /*
 221              * If attempt to use original KDBG failed
 222              * (most likely because of its encryption),
 223              * we try to use KDBG obtained by guest driver.
 224              */
 225
 226             KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1);
 227             try_fallback = false;
 228             goto try_again;
 229         } else {
 230             error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
 231                              " expected '%.4s', got '%.4s'",
 232                              OwnerTag, read_OwnerTag);
 233             return;
 234         }
 235     }
 236
 237     if (x64) {
 238         h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
 239     } else {
 240         h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
 241     }
 242 }
 243
 244 struct saved_context {
 245     WinContext ctx;
 246     uint64_t addr;
 247 };
 248
 249 static void patch_and_save_context(WinDumpHeader *h, bool x64,
 250                                    struct saved_context *saved_ctx,
 251                                    Error **errp)
 252 {
 253     uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
 254     uint64_t KiProcessorBlock;
 255     uint16_t OffsetPrcbContext;
 256     CPUState *cpu;
 257     int i = 0;
 258
 259     if (cpu_read_ptr(x64, first_cpu,
 260             KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
 261             &KiProcessorBlock)) {
 262         error_setg(errp, "win-dump: failed to read KiProcessorBlock");
 263         return;
 264     }
 265
 266     if (cpu_memory_rw_debug(first_cpu,
 267             KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
 268             (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
 269         error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
 270         return;
 271     }
 272
 273     CPU_FOREACH(cpu) {
 274         X86CPU *x86_cpu = X86_CPU(cpu);
 275         CPUX86State *env = &x86_cpu->env;
 276         uint64_t Prcb;
 277         uint64_t Context;
 278         WinContext ctx;
 279
 280         if (i >= WIN_DUMP_FIELD(NumberProcessors)) {
 281             warn_report("win-dump: number of QEMU CPUs is bigger than"
 282                         " NumberProcessors (%u) in guest Windows",
 283                         WIN_DUMP_FIELD(NumberProcessors));
 284             return;
 285         }
 286
 287         if (cpu_read_ptr(x64, first_cpu,
 288                 KiProcessorBlock + i * win_dump_ptr_size(x64),
 289                 &Prcb)) {
 290             error_setg(errp, "win-dump: failed to read"
 291                              " CPU #%d PRCB location", i);
 292             return;
 293         }
 294
 295         if (cpu_read_ptr(x64, first_cpu,
 296                 Prcb + OffsetPrcbContext,
 297                 &Context)) {
 298             error_setg(errp, "win-dump: failed to read"
 299                              " CPU #%d ContextFrame location", i);
 300             return;
 301         }
 302
 303         saved_ctx[i].addr = Context;
 304
 305         if (x64) {
 306             ctx.x64 = (WinContext64){
 307                 .ContextFlags = WIN_CTX64_ALL,
 308                 .MxCsr = env->mxcsr,
 309
 310                 .SegEs = env->segs[0].selector,
 311                 .SegCs = env->segs[1].selector,
 312                 .SegSs = env->segs[2].selector,
 313                 .SegDs = env->segs[3].selector,
 314                 .SegFs = env->segs[4].selector,
 315                 .SegGs = env->segs[5].selector,
 316                 .EFlags = cpu_compute_eflags(env),
 317
 318                 .Dr0 = env->dr[0],
 319                 .Dr1 = env->dr[1],
 320                 .Dr2 = env->dr[2],
 321                 .Dr3 = env->dr[3],
 322                 .Dr6 = env->dr[6],
 323                 .Dr7 = env->dr[7],
 324
 325                 .Rax = env->regs[R_EAX],
 326                 .Rbx = env->regs[R_EBX],
 327                 .Rcx = env->regs[R_ECX],
 328                 .Rdx = env->regs[R_EDX],
 329                 .Rsp = env->regs[R_ESP],
 330                 .Rbp = env->regs[R_EBP],
 331                 .Rsi = env->regs[R_ESI],
 332                 .Rdi = env->regs[R_EDI],
 333                 .R8  = env->regs[8],
 334                 .R9  = env->regs[9],
 335                 .R10 = env->regs[10],
 336                 .R11 = env->regs[11],
 337                 .R12 = env->regs[12],
 338                 .R13 = env->regs[13],
 339                 .R14 = env->regs[14],
 340                 .R15 = env->regs[15],
 341
 342                 .Rip = env->eip,
 343                 .FltSave = {
 344                     .MxCsr = env->mxcsr,
 345                 },
 346             };
 347         } else {
 348             ctx.x32 = (WinContext32){
 349                 .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG,
 350
 351                 .SegEs = env->segs[0].selector,
 352                 .SegCs = env->segs[1].selector,
 353                 .SegSs = env->segs[2].selector,
 354                 .SegDs = env->segs[3].selector,
 355                 .SegFs = env->segs[4].selector,
 356                 .SegGs = env->segs[5].selector,
 357                 .EFlags = cpu_compute_eflags(env),
 358
 359                 .Dr0 = env->dr[0],
 360                 .Dr1 = env->dr[1],
 361                 .Dr2 = env->dr[2],
 362                 .Dr3 = env->dr[3],
 363                 .Dr6 = env->dr[6],
 364                 .Dr7 = env->dr[7],
 365
 366                 .Eax = env->regs[R_EAX],
 367                 .Ebx = env->regs[R_EBX],
 368                 .Ecx = env->regs[R_ECX],
 369                 .Edx = env->regs[R_EDX],
 370                 .Esp = env->regs[R_ESP],
 371                 .Ebp = env->regs[R_EBP],
 372                 .Esi = env->regs[R_ESI],
 373                 .Edi = env->regs[R_EDI],
 374
 375                 .Eip = env->eip,
 376             };
 377         }
 378
 379         if (cpu_memory_rw_debug(first_cpu, Context,
 380                 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
 381             error_setg(errp, "win-dump: failed to save CPU #%d context", i);
 382             return;
 383         }
 384
 385         if (cpu_memory_rw_debug(first_cpu, Context,
 386                 &ctx, win_dump_ctx_size(x64), 1)) {
 387             error_setg(errp, "win-dump: failed to write CPU #%d context", i);
 388             return;
 389         }
 390
 391         i++;
 392     }
 393 }
 394
 395 static void restore_context(WinDumpHeader *h, bool x64,
 396                             struct saved_context *saved_ctx)
 397 {
 398     int i;
 399
 400     for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
 401         if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
 402                 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
 403             warn_report("win-dump: failed to restore CPU #%d context", i);
 404         }
 405     }
 406 }
 407
 408 void create_win_dump(DumpState *s, Error **errp)
 409 {
 410     WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
 411     X86CPU *first_x86_cpu = X86_CPU(first_cpu);
 412     uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
 413     struct saved_context *saved_ctx = NULL;
 414     Error *local_err = NULL;
 415     bool x64 = true;
 416     size_t hdr_size;
 417
 418     if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
 419             s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
 420         error_setg(errp, "win-dump: invalid vmcoreinfo note size");
 421         return;
 422     }
 423
 424     if (!check_header(h, &x64, &local_err)) {
 425         error_propagate(errp, local_err);
 426         return;
 427     }
 428
 429     hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);
 430
 431     /*
 432      * Further access to kernel structures by virtual addresses
 433      * should be made from system context.
 434      */
 435
 436     first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);
 437
 438     check_kdbg(h, x64, &local_err);
 439     if (local_err) {
 440         error_propagate(errp, local_err);
 441         goto out_cr3;
 442     }
 443
 444     patch_header(h, x64);
 445
 446     saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));
 447
 448     /*
 449      * Always patch context because there is no way
 450      * to determine if the system-saved context is valid
 451      */
 452
 453     patch_and_save_context(h, x64, saved_ctx, &local_err);
 454     if (local_err) {
 455         error_propagate(errp, local_err);
 456         goto out_free;
 457     }
 458
 459     s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);
 460
 461     s->written_size = qemu_write_full(s->fd, h, hdr_size);
 462     if (s->written_size != hdr_size) {
 463         error_setg_errno(errp, errno, "win-dump: failed to write header");
 464         goto out_restore;
 465     }
 466
 467     write_runs(s, h, x64, &local_err);
 468     if (local_err) {
 469         error_propagate(errp, local_err);
 470         goto out_restore;
 471     }
 472
 473 out_restore:
 474     restore_context(h, x64, saved_ctx);
 475 out_free:
 476     g_free(saved_ctx);
 477 out_cr3:
 478     first_x86_cpu->env.cr[3] = saved_cr3;
 479
 480     return;
 481 }
 482
 483 #else /* !TARGET_X86_64 */
 484
 485 bool win_dump_available(Error **errp)
 486 {
 487     error_setg(errp, "Windows dump is only available for x86-64");
 488
 489     return false;
 490 }
 491
 492 void create_win_dump(DumpState *s, Error **errp)
 493 {
 494     win_dump_available(errp);
 495 }
 496
 497 #endif