win_dump.c

   1 /*
   2  * Windows crashdump
   3  *
   4  * Copyright (c) 2018 Virtuozzo International GmbH
   5  *
   6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7  * See the COPYING file in the top-level directory.
   8  *
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "qemu/cutils.h"
  13 #include "elf.h"
  14 #include "cpu.h"
  15 #include "exec/hwaddr.h"
  16 #include "monitor/monitor.h"
  17 #include "sysemu/kvm.h"
  18 #include "sysemu/dump.h"
  19 #include "sysemu/sysemu.h"
  20 #include "sysemu/memory_mapping.h"
  21 #include "sysemu/cpus.h"
  22 #include "qapi/error.h"
  23 #include "qapi/qmp/qerror.h"
  24 #include "qemu/error-report.h"
  25 #include "hw/misc/vmcoreinfo.h"
  26 #include "win_dump.h"
  27
  28 static size_t write_run(WinDumpPhyMemRun64 *run, int fd, Error **errp)
  29 {
  30     void *buf;
  31     uint64_t addr = run->BasePage << TARGET_PAGE_BITS;
  32     uint64_t size = run->PageCount << TARGET_PAGE_BITS;
  33     uint64_t len = size;
  34
  35     buf = cpu_physical_memory_map(addr, &len, false);
  36     if (!buf) {
  37         error_setg(errp, "win-dump: failed to map run");
  38         return 0;
  39     }
  40     if (len != size) {
  41         error_setg(errp, "win-dump: failed to map entire run");
  42         len = 0;
  43         goto out_unmap;
  44     }
  45
  46     len = qemu_write_full(fd, buf, len);
  47     if (len != size) {
  48         error_setg(errp, QERR_IO_ERROR);
  49     }
  50
  51 out_unmap:
  52     cpu_physical_memory_unmap(buf, addr, false, len);
  53
  54     return len;
  55 }
  56
  57 static void write_runs(DumpState *s, WinDumpHeader64 *h, Error **errp)
  58 {
  59     WinDumpPhyMemDesc64 *desc = &h->PhysicalMemoryBlock;
  60     WinDumpPhyMemRun64 *run = desc->Run;
  61     Error *local_err = NULL;
  62     int i;
  63
  64     for (i = 0; i < desc->NumberOfRuns; i++) {
  65         s->written_size += write_run(run + i, s->fd, &local_err);
  66         if (local_err) {
  67             error_propagate(errp, local_err);
  68             return;
  69         }
  70     }
  71 }
  72
  73 static void patch_mm_pfn_database(WinDumpHeader64 *h, Error **errp)
  74 {
  75     if (cpu_memory_rw_debug(first_cpu,
  76             h->KdDebuggerDataBlock + KDBG_MM_PFN_DATABASE_OFFSET64,
  77             (uint8_t *)&h->PfnDatabase, sizeof(h->PfnDatabase), 0)) {
  78         error_setg(errp, "win-dump: failed to read MmPfnDatabase");
  79         return;
  80     }
  81 }
  82
  83 static void patch_bugcheck_data(WinDumpHeader64 *h, Error **errp)
  84 {
  85     uint64_t KiBugcheckData;
  86
  87     if (cpu_memory_rw_debug(first_cpu,
  88             h->KdDebuggerDataBlock + KDBG_KI_BUGCHECK_DATA_OFFSET64,
  89             (uint8_t *)&KiBugcheckData, sizeof(KiBugcheckData), 0)) {
  90         error_setg(errp, "win-dump: failed to read KiBugcheckData");
  91         return;
  92     }
  93
  94     if (cpu_memory_rw_debug(first_cpu,
  95             KiBugcheckData,
  96             h->BugcheckData, sizeof(h->BugcheckData), 0)) {
  97         error_setg(errp, "win-dump: failed to read bugcheck data");
  98         return;
  99     }
 100
 101     /*
 102      * If BugcheckCode wasn't saved, we consider guest OS as alive.
 103      */
 104
 105     if (!h->BugcheckCode) {
 106         h->BugcheckCode = LIVE_SYSTEM_DUMP;
 107     }
 108 }
 109
 110 /*
 111  * This routine tries to correct mistakes in crashdump header.
 112  */
 113 static void patch_header(WinDumpHeader64 *h)
 114 {
 115     Error *local_err = NULL;
 116
 117     h->RequiredDumpSpace = sizeof(WinDumpHeader64) +
 118             (h->PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 119     h->PhysicalMemoryBlock.unused = 0;
 120     h->unused1 = 0;
 121
 122     patch_mm_pfn_database(h, &local_err);
 123     if (local_err) {
 124         warn_report_err(local_err);
 125         local_err = NULL;
 126     }
 127     patch_bugcheck_data(h, &local_err);
 128     if (local_err) {
 129         warn_report_err(local_err);
 130     }
 131 }
 132
 133 static void check_header(WinDumpHeader64 *h, Error **errp)
 134 {
 135     const char Signature[] = "PAGE";
 136     const char ValidDump[] = "DU64";
 137
 138     if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
 139         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 140                          " got '%.4s'", Signature, h->Signature);
 141         return;
 142     }
 143
 144     if (memcmp(h->ValidDump, ValidDump, sizeof(h->ValidDump))) {
 145         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 146                          " got '%.4s'", ValidDump, h->ValidDump);
 147         return;
 148     }
 149 }
 150
 151 static void check_kdbg(WinDumpHeader64 *h, Error **errp)
 152 {
 153     const char OwnerTag[] = "KDBG";
 154     char read_OwnerTag[4];
 155     uint64_t KdDebuggerDataBlock = h->KdDebuggerDataBlock;
 156     bool try_fallback = true;
 157
 158 try_again:
 159     if (cpu_memory_rw_debug(first_cpu,
 160             KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64,
 161             (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
 162         error_setg(errp, "win-dump: failed to read OwnerTag");
 163         return;
 164     }
 165
 166     if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
 167         if (try_fallback) {
 168             /*
 169              * If attempt to use original KDBG failed
 170              * (most likely because of its encryption),
 171              * we try to use KDBG obtained by guest driver.
 172              */
 173
 174             KdDebuggerDataBlock = h->BugcheckParameter1;
 175             try_fallback = false;
 176             goto try_again;
 177         } else {
 178             error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
 179                              " expected '%.4s', got '%.4s'",
 180                              OwnerTag, read_OwnerTag);
 181             return;
 182         }
 183     }
 184
 185     h->KdDebuggerDataBlock = KdDebuggerDataBlock;
 186 }
 187
 188 struct saved_context {
 189     WinContext ctx;
 190     uint64_t addr;
 191 };
 192
 193 static void patch_and_save_context(WinDumpHeader64 *h,
 194                                    struct saved_context *saved_ctx,
 195                                    Error **errp)
 196 {
 197     uint64_t KiProcessorBlock;
 198     uint16_t OffsetPrcbContext;
 199     CPUState *cpu;
 200     int i = 0;
 201
 202     if (cpu_memory_rw_debug(first_cpu,
 203             h->KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET64,
 204             (uint8_t *)&KiProcessorBlock, sizeof(KiProcessorBlock), 0)) {
 205         error_setg(errp, "win-dump: failed to read KiProcessorBlock");
 206         return;
 207     }
 208
 209     if (cpu_memory_rw_debug(first_cpu,
 210             h->KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET64,
 211             (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
 212         error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
 213         return;
 214     }
 215
 216     CPU_FOREACH(cpu) {
 217         X86CPU *x86_cpu = X86_CPU(cpu);
 218         CPUX86State *env = &x86_cpu->env;
 219         uint64_t Prcb;
 220         uint64_t Context;
 221         WinContext ctx;
 222
 223         if (cpu_memory_rw_debug(first_cpu,
 224                 KiProcessorBlock + i * sizeof(uint64_t),
 225                 (uint8_t *)&Prcb, sizeof(Prcb), 0)) {
 226             error_setg(errp, "win-dump: failed to read"
 227                              " CPU #%d PRCB location", i);
 228             return;
 229         }
 230
 231         if (cpu_memory_rw_debug(first_cpu,
 232                 Prcb + OffsetPrcbContext,
 233                 (uint8_t *)&Context, sizeof(Context), 0)) {
 234             error_setg(errp, "win-dump: failed to read"
 235                              " CPU #%d ContextFrame location", i);
 236             return;
 237         }
 238
 239         saved_ctx[i].addr = Context;
 240
 241         ctx = (WinContext){
 242             .ContextFlags = WIN_CTX_ALL,
 243             .MxCsr = env->mxcsr,
 244
 245             .SegEs = env->segs[0].selector,
 246             .SegCs = env->segs[1].selector,
 247             .SegSs = env->segs[2].selector,
 248             .SegDs = env->segs[3].selector,
 249             .SegFs = env->segs[4].selector,
 250             .SegGs = env->segs[5].selector,
 251             .EFlags = cpu_compute_eflags(env),
 252
 253             .Dr0 = env->dr[0],
 254             .Dr1 = env->dr[1],
 255             .Dr2 = env->dr[2],
 256             .Dr3 = env->dr[3],
 257             .Dr6 = env->dr[6],
 258             .Dr7 = env->dr[7],
 259
 260             .Rax = env->regs[R_EAX],
 261             .Rbx = env->regs[R_EBX],
 262             .Rcx = env->regs[R_ECX],
 263             .Rdx = env->regs[R_EDX],
 264             .Rsp = env->regs[R_ESP],
 265             .Rbp = env->regs[R_EBP],
 266             .Rsi = env->regs[R_ESI],
 267             .Rdi = env->regs[R_EDI],
 268             .R8  = env->regs[8],
 269             .R9  = env->regs[9],
 270             .R10 = env->regs[10],
 271             .R11 = env->regs[11],
 272             .R12 = env->regs[12],
 273             .R13 = env->regs[13],
 274             .R14 = env->regs[14],
 275             .R15 = env->regs[15],
 276
 277             .Rip = env->eip,
 278             .FltSave = {
 279                 .MxCsr = env->mxcsr,
 280             },
 281         };
 282
 283         if (cpu_memory_rw_debug(first_cpu, Context,
 284                 (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 0)) {
 285             error_setg(errp, "win-dump: failed to save CPU #%d context", i);
 286             return;
 287         }
 288
 289         if (cpu_memory_rw_debug(first_cpu, Context,
 290                 (uint8_t *)&ctx, sizeof(WinContext), 1)) {
 291             error_setg(errp, "win-dump: failed to write CPU #%d context", i);
 292             return;
 293         }
 294
 295         i++;
 296     }
 297 }
 298
 299 static void restore_context(WinDumpHeader64 *h,
 300                             struct saved_context *saved_ctx)
 301 {
 302     int i;
 303     Error *err = NULL;
 304
 305     for (i = 0; i < h->NumberProcessors; i++) {
 306         if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
 307                 (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 1)) {
 308             error_setg(&err, "win-dump: failed to restore CPU #%d context", i);
 309             warn_report_err(err);
 310         }
 311     }
 312 }
 313
 314 void create_win_dump(DumpState *s, Error **errp)
 315 {
 316     WinDumpHeader64 *h = (WinDumpHeader64 *)(s->guest_note +
 317             VMCOREINFO_ELF_NOTE_HDR_SIZE);
 318     X86CPU *first_x86_cpu = X86_CPU(first_cpu);
 319     uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
 320     struct saved_context *saved_ctx = NULL;
 321     Error *local_err = NULL;
 322
 323     if (s->guest_note_size != sizeof(WinDumpHeader64) +
 324             VMCOREINFO_ELF_NOTE_HDR_SIZE) {
 325         error_setg(errp, "win-dump: invalid vmcoreinfo note size");
 326         return;
 327     }
 328
 329     check_header(h, &local_err);
 330     if (local_err) {
 331         error_propagate(errp, local_err);
 332         return;
 333     }
 334
 335     /*
 336      * Further access to kernel structures by virtual addresses
 337      * should be made from system context.
 338      */
 339
 340     first_x86_cpu->env.cr[3] = h->DirectoryTableBase;
 341
 342     check_kdbg(h, &local_err);
 343     if (local_err) {
 344         error_propagate(errp, local_err);
 345         goto out_cr3;
 346     }
 347
 348     patch_header(h);
 349
 350     saved_ctx = g_new(struct saved_context, h->NumberProcessors);
 351
 352     /*
 353      * Always patch context because there is no way
 354      * to determine if the system-saved context is valid
 355      */
 356
 357     patch_and_save_context(h, saved_ctx, &local_err);
 358     if (local_err) {
 359         error_propagate(errp, local_err);
 360         goto out_free;
 361     }
 362
 363     s->total_size = h->RequiredDumpSpace;
 364
 365     s->written_size = qemu_write_full(s->fd, h, sizeof(*h));
 366     if (s->written_size != sizeof(*h)) {
 367         error_setg(errp, QERR_IO_ERROR);
 368         goto out_restore;
 369     }
 370
 371     write_runs(s, h, &local_err);
 372     if (local_err) {
 373         error_propagate(errp, local_err);
 374         goto out_restore;
 375     }
 376
 377 out_restore:
 378     restore_context(h, saved_ctx);
 379 out_free:
 380     g_free(saved_ctx);
 381 out_cr3:
 382     first_x86_cpu->env.cr[3] = saved_cr3;
 383
 384     return;
 385 }