2 * Windows crashdump (target specific implementations)
4 * Copyright (c) 2018 Virtuozzo International GmbH
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
11 #include "qemu/osdep.h"
12 #include "sysemu/dump.h"
13 #include "qapi/error.h"
14 #include "qapi/qmp/qerror.h"
15 #include "exec/cpu-defs.h"
16 #include "hw/core/cpu.h"
17 #include "qemu/win_dump_defs.h"
21 #if defined(TARGET_X86_64)
23 bool win_dump_available(Error
**errp
)
28 static size_t win_dump_ptr_size(bool x64
)
30 return x64
? sizeof(uint64_t) : sizeof(uint32_t);
33 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
34 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
36 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
37 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
39 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
40 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
42 static size_t win_dump_ctx_size(bool x64
)
44 return x64
? sizeof(WinContext64
) : sizeof(WinContext32
);
47 static size_t write_run(uint64_t base_page
, uint64_t page_count
,
51 uint64_t addr
= base_page
<< TARGET_PAGE_BITS
;
52 uint64_t size
= page_count
<< TARGET_PAGE_BITS
;
59 buf
= cpu_physical_memory_map(addr
, &len
, false);
61 error_setg(errp
, "win-dump: failed to map physical range"
62 " 0x%016" PRIx64
"-0x%016" PRIx64
, addr
, addr
+ size
- 1);
66 l
= qemu_write_full(fd
, buf
, len
);
67 cpu_physical_memory_unmap(buf
, addr
, false, len
);
69 error_setg(errp
, QERR_IO_ERROR
);
81 static void write_runs(DumpState
*s
, WinDumpHeader
*h
, bool x64
, Error
**errp
)
83 uint64_t BasePage
, PageCount
;
84 Error
*local_err
= NULL
;
87 for (i
= 0; i
< WIN_DUMP_FIELD(PhysicalMemoryBlock
.NumberOfRuns
); i
++) {
88 BasePage
= WIN_DUMP_FIELD(PhysicalMemoryBlock
.Run
[i
].BasePage
);
89 PageCount
= WIN_DUMP_FIELD(PhysicalMemoryBlock
.Run
[i
].PageCount
);
90 s
->written_size
+= write_run(BasePage
, PageCount
, s
->fd
, &local_err
);
92 error_propagate(errp
, local_err
);
98 static int cpu_read_ptr(bool x64
, CPUState
*cpu
, uint64_t addr
, uint64_t *ptr
)
104 ret
= cpu_memory_rw_debug(cpu
, addr
, x64
? (void *)&ptr64
: (void *)&ptr32
,
105 win_dump_ptr_size(x64
), 0);
107 *ptr
= x64
? ptr64
: ptr32
;
112 static void patch_mm_pfn_database(WinDumpHeader
*h
, bool x64
, Error
**errp
)
114 if (cpu_memory_rw_debug(first_cpu
,
115 WIN_DUMP_FIELD(KdDebuggerDataBlock
) + KDBG_MM_PFN_DATABASE_OFFSET
,
116 WIN_DUMP_FIELD_PTR(PfnDatabase
),
117 WIN_DUMP_FIELD_SIZE(PfnDatabase
), 0)) {
118 error_setg(errp
, "win-dump: failed to read MmPfnDatabase");
123 static void patch_bugcheck_data(WinDumpHeader
*h
, bool x64
, Error
**errp
)
125 uint64_t KiBugcheckData
;
127 if (cpu_read_ptr(x64
, first_cpu
,
128 WIN_DUMP_FIELD(KdDebuggerDataBlock
) + KDBG_KI_BUGCHECK_DATA_OFFSET
,
130 error_setg(errp
, "win-dump: failed to read KiBugcheckData");
134 if (cpu_memory_rw_debug(first_cpu
, KiBugcheckData
,
135 WIN_DUMP_FIELD(BugcheckData
),
136 WIN_DUMP_FIELD_SIZE(BugcheckData
), 0)) {
137 error_setg(errp
, "win-dump: failed to read bugcheck data");
142 * If BugcheckCode wasn't saved, we consider guest OS as alive.
145 if (!WIN_DUMP_FIELD(BugcheckCode
)) {
146 *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode
) = LIVE_SYSTEM_DUMP
;
151 * This routine tries to correct mistakes in crashdump header.
153 static void patch_header(WinDumpHeader
*h
, bool x64
)
155 Error
*local_err
= NULL
;
158 h
->x64
.RequiredDumpSpace
= sizeof(WinDumpHeader64
) +
159 (h
->x64
.PhysicalMemoryBlock
.NumberOfPages
<< TARGET_PAGE_BITS
);
160 h
->x64
.PhysicalMemoryBlock
.unused
= 0;
163 h
->x32
.RequiredDumpSpace
= sizeof(WinDumpHeader32
) +
164 (h
->x32
.PhysicalMemoryBlock
.NumberOfPages
<< TARGET_PAGE_BITS
);
167 patch_mm_pfn_database(h
, x64
, &local_err
);
169 warn_report_err(local_err
);
172 patch_bugcheck_data(h
, x64
, &local_err
);
174 warn_report_err(local_err
);
178 static bool check_header(WinDumpHeader
*h
, bool *x64
, Error
**errp
)
180 const char Signature
[] = "PAGE";
182 if (memcmp(h
->Signature
, Signature
, sizeof(h
->Signature
))) {
183 error_setg(errp
, "win-dump: invalid header, expected '%.4s',"
184 " got '%.4s'", Signature
, h
->Signature
);
188 if (!memcmp(h
->ValidDump
, "DUMP", sizeof(h
->ValidDump
))) {
190 } else if (!memcmp(h
->ValidDump
, "DU64", sizeof(h
->ValidDump
))) {
193 error_setg(errp
, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
194 " got '%.4s'", h
->ValidDump
);
201 static void check_kdbg(WinDumpHeader
*h
, bool x64
, Error
**errp
)
203 const char OwnerTag
[] = "KDBG";
204 char read_OwnerTag
[4];
205 uint64_t KdDebuggerDataBlock
= WIN_DUMP_FIELD(KdDebuggerDataBlock
);
206 bool try_fallback
= true;
209 if (cpu_memory_rw_debug(first_cpu
,
210 KdDebuggerDataBlock
+ KDBG_OWNER_TAG_OFFSET
,
211 (uint8_t *)&read_OwnerTag
, sizeof(read_OwnerTag
), 0)) {
212 error_setg(errp
, "win-dump: failed to read OwnerTag");
216 if (memcmp(read_OwnerTag
, OwnerTag
, sizeof(read_OwnerTag
))) {
219 * If attempt to use original KDBG failed
220 * (most likely because of its encryption),
221 * we try to use KDBG obtained by guest driver.
224 KdDebuggerDataBlock
= WIN_DUMP_FIELD(BugcheckParameter1
);
225 try_fallback
= false;
228 error_setg(errp
, "win-dump: invalid KDBG OwnerTag,"
229 " expected '%.4s', got '%.4s'",
230 OwnerTag
, read_OwnerTag
);
236 h
->x64
.KdDebuggerDataBlock
= KdDebuggerDataBlock
;
238 h
->x32
.KdDebuggerDataBlock
= KdDebuggerDataBlock
;
242 struct saved_context
{
247 static void patch_and_save_context(WinDumpHeader
*h
, bool x64
,
248 struct saved_context
*saved_ctx
,
251 uint64_t KdDebuggerDataBlock
= WIN_DUMP_FIELD(KdDebuggerDataBlock
);
252 uint64_t KiProcessorBlock
;
253 uint16_t OffsetPrcbContext
;
257 if (cpu_read_ptr(x64
, first_cpu
,
258 KdDebuggerDataBlock
+ KDBG_KI_PROCESSOR_BLOCK_OFFSET
,
259 &KiProcessorBlock
)) {
260 error_setg(errp
, "win-dump: failed to read KiProcessorBlock");
264 if (cpu_memory_rw_debug(first_cpu
,
265 KdDebuggerDataBlock
+ KDBG_OFFSET_PRCB_CONTEXT_OFFSET
,
266 (uint8_t *)&OffsetPrcbContext
, sizeof(OffsetPrcbContext
), 0)) {
267 error_setg(errp
, "win-dump: failed to read OffsetPrcbContext");
272 X86CPU
*x86_cpu
= X86_CPU(cpu
);
273 CPUX86State
*env
= &x86_cpu
->env
;
278 if (i
>= WIN_DUMP_FIELD(NumberProcessors
)) {
279 warn_report("win-dump: number of QEMU CPUs is bigger than"
280 " NumberProcessors (%u) in guest Windows",
281 WIN_DUMP_FIELD(NumberProcessors
));
285 if (cpu_read_ptr(x64
, first_cpu
,
286 KiProcessorBlock
+ i
* win_dump_ptr_size(x64
),
288 error_setg(errp
, "win-dump: failed to read"
289 " CPU #%d PRCB location", i
);
293 if (cpu_read_ptr(x64
, first_cpu
,
294 Prcb
+ OffsetPrcbContext
,
296 error_setg(errp
, "win-dump: failed to read"
297 " CPU #%d ContextFrame location", i
);
301 saved_ctx
[i
].addr
= Context
;
304 ctx
.x64
= (WinContext64
){
305 .ContextFlags
= WIN_CTX64_ALL
,
308 .SegEs
= env
->segs
[0].selector
,
309 .SegCs
= env
->segs
[1].selector
,
310 .SegSs
= env
->segs
[2].selector
,
311 .SegDs
= env
->segs
[3].selector
,
312 .SegFs
= env
->segs
[4].selector
,
313 .SegGs
= env
->segs
[5].selector
,
314 .EFlags
= cpu_compute_eflags(env
),
323 .Rax
= env
->regs
[R_EAX
],
324 .Rbx
= env
->regs
[R_EBX
],
325 .Rcx
= env
->regs
[R_ECX
],
326 .Rdx
= env
->regs
[R_EDX
],
327 .Rsp
= env
->regs
[R_ESP
],
328 .Rbp
= env
->regs
[R_EBP
],
329 .Rsi
= env
->regs
[R_ESI
],
330 .Rdi
= env
->regs
[R_EDI
],
333 .R10
= env
->regs
[10],
334 .R11
= env
->regs
[11],
335 .R12
= env
->regs
[12],
336 .R13
= env
->regs
[13],
337 .R14
= env
->regs
[14],
338 .R15
= env
->regs
[15],
346 ctx
.x32
= (WinContext32
){
347 .ContextFlags
= WIN_CTX32_FULL
| WIN_CTX_DBG
,
349 .SegEs
= env
->segs
[0].selector
,
350 .SegCs
= env
->segs
[1].selector
,
351 .SegSs
= env
->segs
[2].selector
,
352 .SegDs
= env
->segs
[3].selector
,
353 .SegFs
= env
->segs
[4].selector
,
354 .SegGs
= env
->segs
[5].selector
,
355 .EFlags
= cpu_compute_eflags(env
),
364 .Eax
= env
->regs
[R_EAX
],
365 .Ebx
= env
->regs
[R_EBX
],
366 .Ecx
= env
->regs
[R_ECX
],
367 .Edx
= env
->regs
[R_EDX
],
368 .Esp
= env
->regs
[R_ESP
],
369 .Ebp
= env
->regs
[R_EBP
],
370 .Esi
= env
->regs
[R_ESI
],
371 .Edi
= env
->regs
[R_EDI
],
377 if (cpu_memory_rw_debug(first_cpu
, Context
,
378 &saved_ctx
[i
].ctx
, win_dump_ctx_size(x64
), 0)) {
379 error_setg(errp
, "win-dump: failed to save CPU #%d context", i
);
383 if (cpu_memory_rw_debug(first_cpu
, Context
,
384 &ctx
, win_dump_ctx_size(x64
), 1)) {
385 error_setg(errp
, "win-dump: failed to write CPU #%d context", i
);
393 static void restore_context(WinDumpHeader
*h
, bool x64
,
394 struct saved_context
*saved_ctx
)
398 for (i
= 0; i
< WIN_DUMP_FIELD(NumberProcessors
); i
++) {
399 if (cpu_memory_rw_debug(first_cpu
, saved_ctx
[i
].addr
,
400 &saved_ctx
[i
].ctx
, win_dump_ctx_size(x64
), 1)) {
401 warn_report("win-dump: failed to restore CPU #%d context", i
);
406 void create_win_dump(DumpState
*s
, Error
**errp
)
408 WinDumpHeader
*h
= (void *)(s
->guest_note
+ VMCOREINFO_ELF_NOTE_HDR_SIZE
);
409 X86CPU
*first_x86_cpu
= X86_CPU(first_cpu
);
410 uint64_t saved_cr3
= first_x86_cpu
->env
.cr
[3];
411 struct saved_context
*saved_ctx
= NULL
;
412 Error
*local_err
= NULL
;
416 if (s
->guest_note_size
!= VMCOREINFO_WIN_DUMP_NOTE_SIZE32
&&
417 s
->guest_note_size
!= VMCOREINFO_WIN_DUMP_NOTE_SIZE64
) {
418 error_setg(errp
, "win-dump: invalid vmcoreinfo note size");
422 if (!check_header(h
, &x64
, &local_err
)) {
423 error_propagate(errp
, local_err
);
427 hdr_size
= x64
? sizeof(WinDumpHeader64
) : sizeof(WinDumpHeader32
);
430 * Further access to kernel structures by virtual addresses
431 * should be made from system context.
434 first_x86_cpu
->env
.cr
[3] = WIN_DUMP_FIELD(DirectoryTableBase
);
436 check_kdbg(h
, x64
, &local_err
);
438 error_propagate(errp
, local_err
);
442 patch_header(h
, x64
);
444 saved_ctx
= g_new(struct saved_context
, WIN_DUMP_FIELD(NumberProcessors
));
447 * Always patch context because there is no way
448 * to determine if the system-saved context is valid
451 patch_and_save_context(h
, x64
, saved_ctx
, &local_err
);
453 error_propagate(errp
, local_err
);
457 s
->total_size
= WIN_DUMP_FIELD(RequiredDumpSpace
);
459 s
->written_size
= qemu_write_full(s
->fd
, h
, hdr_size
);
460 if (s
->written_size
!= hdr_size
) {
461 error_setg(errp
, QERR_IO_ERROR
);
465 write_runs(s
, h
, x64
, &local_err
);
467 error_propagate(errp
, local_err
);
472 restore_context(h
, x64
, saved_ctx
);
476 first_x86_cpu
->env
.cr
[3] = saved_cr3
;
481 #else /* !TARGET_X86_64 */
483 bool win_dump_available(Error
**errp
)
485 error_setg(errp
, "Windows dump is only available for x86-64");