2 * Windows crashdump (target specific implementations)
4 * Copyright (c) 2018 Virtuozzo International GmbH
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
11 #include "qemu/osdep.h"
12 #include "sysemu/dump.h"
13 #include "qapi/error.h"
14 #include "qemu/error-report.h"
15 #include "qapi/qmp/qerror.h"
16 #include "exec/cpu-defs.h"
17 #include "hw/core/cpu.h"
18 #include "qemu/win_dump_defs.h"
22 #if defined(TARGET_X86_64)
24 bool win_dump_available(Error **errp)
29 static size_t win_dump_ptr_size(bool x64)
31 return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
34 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
35 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
37 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
38 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
40 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
41 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
43 static size_t win_dump_ctx_size(bool x64)
45 return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
48 static size_t write_run(uint64_t base_page, uint64_t page_count,
52 uint64_t addr = base_page << TARGET_PAGE_BITS;
53 uint64_t size = page_count << TARGET_PAGE_BITS;
60 buf = cpu_physical_memory_map(addr, &len, false);
62 error_setg(errp, "win-dump: failed to map physical range"
63 " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
67 l = qemu_write_full(fd, buf, len);
68 cpu_physical_memory_unmap(buf, addr, false, len);
70 error_setg(errp, QERR_IO_ERROR);
82 static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp)
84 uint64_t BasePage, PageCount;
85 Error *local_err = NULL;
88 for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) {
89 BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage);
90 PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount);
91 s->written_size += write_run(BasePage, PageCount, s->fd, &local_err);
93 error_propagate(errp, local_err);
99 static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr)
105 ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32,
106 win_dump_ptr_size(x64), 0);
108 *ptr = x64 ? ptr64 : ptr32;
113 static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp)
115 if (cpu_memory_rw_debug(first_cpu,
116 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
117 WIN_DUMP_FIELD_PTR(PfnDatabase),
118 WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
119 error_setg(errp, "win-dump: failed to read MmPfnDatabase");
124 static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp)
126 uint64_t KiBugcheckData;
128 if (cpu_read_ptr(x64, first_cpu,
129 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
131 error_setg(errp, "win-dump: failed to read KiBugcheckData");
135 if (cpu_memory_rw_debug(first_cpu, KiBugcheckData,
136 WIN_DUMP_FIELD(BugcheckData),
137 WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) {
138 error_setg(errp, "win-dump: failed to read bugcheck data");
143 * If BugcheckCode wasn't saved, we consider guest OS as alive.
146 if (!WIN_DUMP_FIELD(BugcheckCode)) {
147 *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP;
152 * This routine tries to correct mistakes in crashdump header.
154 static void patch_header(WinDumpHeader *h, bool x64)
156 Error *local_err = NULL;
159 h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
160 (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
161 h->x64.PhysicalMemoryBlock.unused = 0;
164 h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
165 (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
168 patch_mm_pfn_database(h, x64, &local_err);
170 warn_report_err(local_err);
173 patch_bugcheck_data(h, x64, &local_err);
175 warn_report_err(local_err);
179 static bool check_header(WinDumpHeader *h, bool *x64, Error **errp)
181 const char Signature[] = "PAGE";
183 if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
184 error_setg(errp, "win-dump: invalid header, expected '%.4s',"
185 " got '%.4s'", Signature, h->Signature);
189 if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
191 } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
194 error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
195 " got '%.4s'", h->ValidDump);
202 static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp)
204 const char OwnerTag[] = "KDBG";
205 char read_OwnerTag[4];
206 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
207 bool try_fallback = true;
210 if (cpu_memory_rw_debug(first_cpu,
211 KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
212 (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
213 error_setg(errp, "win-dump: failed to read OwnerTag");
217 if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
220 * If attempt to use original KDBG failed
221 * (most likely because of its encryption),
222 * we try to use KDBG obtained by guest driver.
225 KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1);
226 try_fallback = false;
229 error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
230 " expected '%.4s', got '%.4s'",
231 OwnerTag, read_OwnerTag);
237 h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
239 h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
243 struct saved_context {
248 static void patch_and_save_context(WinDumpHeader *h, bool x64,
249 struct saved_context *saved_ctx,
252 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
253 uint64_t KiProcessorBlock;
254 uint16_t OffsetPrcbContext;
258 if (cpu_read_ptr(x64, first_cpu,
259 KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
260 &KiProcessorBlock)) {
261 error_setg(errp, "win-dump: failed to read KiProcessorBlock");
265 if (cpu_memory_rw_debug(first_cpu,
266 KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
267 (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
268 error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
273 X86CPU *x86_cpu = X86_CPU(cpu);
274 CPUX86State *env = &x86_cpu->env;
279 if (i >= WIN_DUMP_FIELD(NumberProcessors)) {
280 warn_report("win-dump: number of QEMU CPUs is bigger than"
281 " NumberProcessors (%u) in guest Windows",
282 WIN_DUMP_FIELD(NumberProcessors));
286 if (cpu_read_ptr(x64, first_cpu,
287 KiProcessorBlock + i * win_dump_ptr_size(x64),
289 error_setg(errp, "win-dump: failed to read"
290 " CPU #%d PRCB location", i);
294 if (cpu_read_ptr(x64, first_cpu,
295 Prcb + OffsetPrcbContext,
297 error_setg(errp, "win-dump: failed to read"
298 " CPU #%d ContextFrame location", i);
302 saved_ctx[i].addr = Context;
305 ctx.x64 = (WinContext64){
306 .ContextFlags = WIN_CTX64_ALL,
309 .SegEs = env->segs[0].selector,
310 .SegCs = env->segs[1].selector,
311 .SegSs = env->segs[2].selector,
312 .SegDs = env->segs[3].selector,
313 .SegFs = env->segs[4].selector,
314 .SegGs = env->segs[5].selector,
315 .EFlags = cpu_compute_eflags(env),
324 .Rax = env->regs[R_EAX],
325 .Rbx = env->regs[R_EBX],
326 .Rcx = env->regs[R_ECX],
327 .Rdx = env->regs[R_EDX],
328 .Rsp = env->regs[R_ESP],
329 .Rbp = env->regs[R_EBP],
330 .Rsi = env->regs[R_ESI],
331 .Rdi = env->regs[R_EDI],
334 .R10 = env->regs[10],
335 .R11 = env->regs[11],
336 .R12 = env->regs[12],
337 .R13 = env->regs[13],
338 .R14 = env->regs[14],
339 .R15 = env->regs[15],
347 ctx.x32 = (WinContext32){
348 .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG,
350 .SegEs = env->segs[0].selector,
351 .SegCs = env->segs[1].selector,
352 .SegSs = env->segs[2].selector,
353 .SegDs = env->segs[3].selector,
354 .SegFs = env->segs[4].selector,
355 .SegGs = env->segs[5].selector,
356 .EFlags = cpu_compute_eflags(env),
365 .Eax = env->regs[R_EAX],
366 .Ebx = env->regs[R_EBX],
367 .Ecx = env->regs[R_ECX],
368 .Edx = env->regs[R_EDX],
369 .Esp = env->regs[R_ESP],
370 .Ebp = env->regs[R_EBP],
371 .Esi = env->regs[R_ESI],
372 .Edi = env->regs[R_EDI],
378 if (cpu_memory_rw_debug(first_cpu, Context,
379 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
380 error_setg(errp, "win-dump: failed to save CPU #%d context", i);
384 if (cpu_memory_rw_debug(first_cpu, Context,
385 &ctx, win_dump_ctx_size(x64), 1)) {
386 error_setg(errp, "win-dump: failed to write CPU #%d context", i);
394 static void restore_context(WinDumpHeader *h, bool x64,
395 struct saved_context *saved_ctx)
399 for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
400 if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
401 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
402 warn_report("win-dump: failed to restore CPU #%d context", i);
407 void create_win_dump(DumpState *s, Error **errp)
409 WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
410 X86CPU *first_x86_cpu = X86_CPU(first_cpu);
411 uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
412 struct saved_context *saved_ctx = NULL;
413 Error *local_err = NULL;
417 if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
418 s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
419 error_setg(errp, "win-dump: invalid vmcoreinfo note size");
423 if (!check_header(h, &x64, &local_err)) {
424 error_propagate(errp, local_err);
428 hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);
431 * Further access to kernel structures by virtual addresses
432 * should be made from system context.
435 first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);
437 check_kdbg(h, x64, &local_err);
439 error_propagate(errp, local_err);
443 patch_header(h, x64);
445 saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));
448 * Always patch context because there is no way
449 * to determine if the system-saved context is valid
452 patch_and_save_context(h, x64, saved_ctx, &local_err);
454 error_propagate(errp, local_err);
458 s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);
460 s->written_size = qemu_write_full(s->fd, h, hdr_size);
461 if (s->written_size != hdr_size) {
462 error_setg(errp, QERR_IO_ERROR);
466 write_runs(s, h, x64, &local_err);
468 error_propagate(errp, local_err);
473 restore_context(h, x64, saved_ctx);
477 first_x86_cpu->env.cr[3] = saved_cr3;
482 #else /* !TARGET_X86_64 */
484 bool win_dump_available(Error **errp)
486 error_setg(errp, "Windows dump is only available for x86-64");
491 void create_win_dump(DumpState *s, Error **errp)
493 win_dump_available(errp);