qemu/win_dump.c
<<
>>
Prefs
   1/*
   2 * Windows crashdump
   3 *
   4 * Copyright (c) 2018 Virtuozzo International GmbH
   5 *
   6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7 * See the COPYING file in the top-level directory.
   8 *
   9 */
  10
  11#include "qemu/osdep.h"
  12#include "qemu/cutils.h"
  13#include "elf.h"
  14#include "cpu.h"
  15#include "exec/hwaddr.h"
  16#include "monitor/monitor.h"
  17#include "sysemu/kvm.h"
  18#include "sysemu/dump.h"
  19#include "sysemu/sysemu.h"
  20#include "sysemu/memory_mapping.h"
  21#include "sysemu/cpus.h"
  22#include "qapi/error.h"
  23#include "qapi/qmp/qerror.h"
  24#include "qemu/error-report.h"
  25#include "hw/misc/vmcoreinfo.h"
  26#include "win_dump.h"
  27
  28static size_t write_run(WinDumpPhyMemRun64 *run, int fd, Error **errp)
  29{
  30    void *buf;
  31    uint64_t addr = run->BasePage << TARGET_PAGE_BITS;
  32    uint64_t size = run->PageCount << TARGET_PAGE_BITS;
  33    uint64_t len = size;
  34
  35    buf = cpu_physical_memory_map(addr, &len, false);
  36    if (!buf) {
  37        error_setg(errp, "win-dump: failed to map run");
  38        return 0;
  39    }
  40    if (len != size) {
  41        error_setg(errp, "win-dump: failed to map entire run");
  42        len = 0;
  43        goto out_unmap;
  44    }
  45
  46    len = qemu_write_full(fd, buf, len);
  47    if (len != size) {
  48        error_setg(errp, QERR_IO_ERROR);
  49    }
  50
  51out_unmap:
  52    cpu_physical_memory_unmap(buf, addr, false, len);
  53
  54    return len;
  55}
  56
  57static void write_runs(DumpState *s, WinDumpHeader64 *h, Error **errp)
  58{
  59    WinDumpPhyMemDesc64 *desc = &h->PhysicalMemoryBlock;
  60    WinDumpPhyMemRun64 *run = desc->Run;
  61    Error *local_err = NULL;
  62    int i;
  63
  64    for (i = 0; i < desc->NumberOfRuns; i++) {
  65        s->written_size += write_run(run + i, s->fd, &local_err);
  66        if (local_err) {
  67            error_propagate(errp, local_err);
  68            return;
  69        }
  70    }
  71}
  72
  73static void patch_mm_pfn_database(WinDumpHeader64 *h, Error **errp)
  74{
  75    if (cpu_memory_rw_debug(first_cpu,
  76            h->KdDebuggerDataBlock + KDBG_MM_PFN_DATABASE_OFFSET64,
  77            (uint8_t *)&h->PfnDatabase, sizeof(h->PfnDatabase), 0)) {
  78        error_setg(errp, "win-dump: failed to read MmPfnDatabase");
  79        return;
  80    }
  81}
  82
  83static void patch_bugcheck_data(WinDumpHeader64 *h, Error **errp)
  84{
  85    uint64_t KiBugcheckData;
  86
  87    if (cpu_memory_rw_debug(first_cpu,
  88            h->KdDebuggerDataBlock + KDBG_KI_BUGCHECK_DATA_OFFSET64,
  89            (uint8_t *)&KiBugcheckData, sizeof(KiBugcheckData), 0)) {
  90        error_setg(errp, "win-dump: failed to read KiBugcheckData");
  91        return;
  92    }
  93
  94    if (cpu_memory_rw_debug(first_cpu,
  95            KiBugcheckData,
  96            h->BugcheckData, sizeof(h->BugcheckData), 0)) {
  97        error_setg(errp, "win-dump: failed to read bugcheck data");
  98        return;
  99    }
 100
 101    /*
 102     * If BugcheckCode wasn't saved, we consider guest OS as alive.
 103     */
 104
 105    if (!h->BugcheckCode) {
 106        h->BugcheckCode = LIVE_SYSTEM_DUMP;
 107    }
 108}
 109
 110/*
 111 * This routine tries to correct mistakes in crashdump header.
 112 */
 113static void patch_header(WinDumpHeader64 *h)
 114{
 115    Error *local_err = NULL;
 116
 117    h->RequiredDumpSpace = sizeof(WinDumpHeader64) +
 118            (h->PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 119    h->PhysicalMemoryBlock.unused = 0;
 120    h->unused1 = 0;
 121
 122    patch_mm_pfn_database(h, &local_err);
 123    if (local_err) {
 124        warn_report_err(local_err);
 125        local_err = NULL;
 126    }
 127    patch_bugcheck_data(h, &local_err);
 128    if (local_err) {
 129        warn_report_err(local_err);
 130    }
 131}
 132
 133static void check_header(WinDumpHeader64 *h, Error **errp)
 134{
 135    const char Signature[] = "PAGE";
 136    const char ValidDump[] = "DU64";
 137
 138    if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
 139        error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 140                         " got '%.4s'", Signature, h->Signature);
 141        return;
 142    }
 143
 144    if (memcmp(h->ValidDump, ValidDump, sizeof(h->ValidDump))) {
 145        error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 146                         " got '%.4s'", ValidDump, h->ValidDump);
 147        return;
 148    }
 149}
 150
 151static void check_kdbg(WinDumpHeader64 *h, Error **errp)
 152{
 153    const char OwnerTag[] = "KDBG";
 154    char read_OwnerTag[4];
 155    uint64_t KdDebuggerDataBlock = h->KdDebuggerDataBlock;
 156    bool try_fallback = true;
 157
 158try_again:
 159    if (cpu_memory_rw_debug(first_cpu,
 160            KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64,
 161            (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
 162        error_setg(errp, "win-dump: failed to read OwnerTag");
 163        return;
 164    }
 165
 166    if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
 167        if (try_fallback) {
 168            /*
 169             * If attempt to use original KDBG failed
 170             * (most likely because of its encryption),
 171             * we try to use KDBG obtained by guest driver.
 172             */
 173
 174            KdDebuggerDataBlock = h->BugcheckParameter1;
 175            try_fallback = false;
 176            goto try_again;
 177        } else {
 178            error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
 179                             " expected '%.4s', got '%.4s'",
 180                             OwnerTag, read_OwnerTag);
 181            return;
 182        }
 183    }
 184
 185    h->KdDebuggerDataBlock = KdDebuggerDataBlock;
 186}
 187
 188struct saved_context {
 189    WinContext ctx;
 190    uint64_t addr;
 191};
 192
 193static void patch_and_save_context(WinDumpHeader64 *h,
 194                                   struct saved_context *saved_ctx,
 195                                   Error **errp)
 196{
 197    uint64_t KiProcessorBlock;
 198    uint16_t OffsetPrcbContext;
 199    CPUState *cpu;
 200    int i = 0;
 201
 202    if (cpu_memory_rw_debug(first_cpu,
 203            h->KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET64,
 204            (uint8_t *)&KiProcessorBlock, sizeof(KiProcessorBlock), 0)) {
 205        error_setg(errp, "win-dump: failed to read KiProcessorBlock");
 206        return;
 207    }
 208
 209    if (cpu_memory_rw_debug(first_cpu,
 210            h->KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET64,
 211            (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
 212        error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
 213        return;
 214    }
 215
 216    CPU_FOREACH(cpu) {
 217        X86CPU *x86_cpu = X86_CPU(cpu);
 218        CPUX86State *env = &x86_cpu->env;
 219        uint64_t Prcb;
 220        uint64_t Context;
 221        WinContext ctx;
 222
 223        if (cpu_memory_rw_debug(first_cpu,
 224                KiProcessorBlock + i * sizeof(uint64_t),
 225                (uint8_t *)&Prcb, sizeof(Prcb), 0)) {
 226            error_setg(errp, "win-dump: failed to read"
 227                             " CPU #%d PRCB location", i);
 228            return;
 229        }
 230
 231        if (cpu_memory_rw_debug(first_cpu,
 232                Prcb + OffsetPrcbContext,
 233                (uint8_t *)&Context, sizeof(Context), 0)) {
 234            error_setg(errp, "win-dump: failed to read"
 235                             " CPU #%d ContextFrame location", i);
 236            return;
 237        }
 238
 239        saved_ctx[i].addr = Context;
 240
 241        ctx = (WinContext){
 242            .ContextFlags = WIN_CTX_ALL,
 243            .MxCsr = env->mxcsr,
 244
 245            .SegEs = env->segs[0].selector,
 246            .SegCs = env->segs[1].selector,
 247            .SegSs = env->segs[2].selector,
 248            .SegDs = env->segs[3].selector,
 249            .SegFs = env->segs[4].selector,
 250            .SegGs = env->segs[5].selector,
 251            .EFlags = cpu_compute_eflags(env),
 252
 253            .Dr0 = env->dr[0],
 254            .Dr1 = env->dr[1],
 255            .Dr2 = env->dr[2],
 256            .Dr3 = env->dr[3],
 257            .Dr6 = env->dr[6],
 258            .Dr7 = env->dr[7],
 259
 260            .Rax = env->regs[R_EAX],
 261            .Rbx = env->regs[R_EBX],
 262            .Rcx = env->regs[R_ECX],
 263            .Rdx = env->regs[R_EDX],
 264            .Rsp = env->regs[R_ESP],
 265            .Rbp = env->regs[R_EBP],
 266            .Rsi = env->regs[R_ESI],
 267            .Rdi = env->regs[R_EDI],
 268            .R8  = env->regs[8],
 269            .R9  = env->regs[9],
 270            .R10 = env->regs[10],
 271            .R11 = env->regs[11],
 272            .R12 = env->regs[12],
 273            .R13 = env->regs[13],
 274            .R14 = env->regs[14],
 275            .R15 = env->regs[15],
 276
 277            .Rip = env->eip,
 278            .FltSave = {
 279                .MxCsr = env->mxcsr,
 280            },
 281        };
 282
 283        if (cpu_memory_rw_debug(first_cpu, Context,
 284                (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 0)) {
 285            error_setg(errp, "win-dump: failed to save CPU #%d context", i);
 286            return;
 287        }
 288
 289        if (cpu_memory_rw_debug(first_cpu, Context,
 290                (uint8_t *)&ctx, sizeof(WinContext), 1)) {
 291            error_setg(errp, "win-dump: failed to write CPU #%d context", i);
 292            return;
 293        }
 294
 295        i++;
 296    }
 297}
 298
 299static void restore_context(WinDumpHeader64 *h,
 300                            struct saved_context *saved_ctx)
 301{
 302    int i;
 303    Error *err = NULL;
 304
 305    for (i = 0; i < h->NumberProcessors; i++) {
 306        if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
 307                (uint8_t *)&saved_ctx[i].ctx, sizeof(WinContext), 1)) {
 308            error_setg(&err, "win-dump: failed to restore CPU #%d context", i);
 309            warn_report_err(err);
 310        }
 311    }
 312}
 313
 314void create_win_dump(DumpState *s, Error **errp)
 315{
 316    WinDumpHeader64 *h = (WinDumpHeader64 *)(s->guest_note +
 317            VMCOREINFO_ELF_NOTE_HDR_SIZE);
 318    X86CPU *first_x86_cpu = X86_CPU(first_cpu);
 319    uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
 320    struct saved_context *saved_ctx = NULL;
 321    Error *local_err = NULL;
 322
 323    if (s->guest_note_size != sizeof(WinDumpHeader64) +
 324            VMCOREINFO_ELF_NOTE_HDR_SIZE) {
 325        error_setg(errp, "win-dump: invalid vmcoreinfo note size");
 326        return;
 327    }
 328
 329    check_header(h, &local_err);
 330    if (local_err) {
 331        error_propagate(errp, local_err);
 332        return;
 333    }
 334
 335    /*
 336     * Further access to kernel structures by virtual addresses
 337     * should be made from system context.
 338     */
 339
 340    first_x86_cpu->env.cr[3] = h->DirectoryTableBase;
 341
 342    check_kdbg(h, &local_err);
 343    if (local_err) {
 344        error_propagate(errp, local_err);
 345        goto out_cr3;
 346    }
 347
 348    patch_header(h);
 349
 350    saved_ctx = g_new(struct saved_context, h->NumberProcessors);
 351
 352    /*
 353     * Always patch context because there is no way
 354     * to determine if the system-saved context is valid
 355     */
 356
 357    patch_and_save_context(h, saved_ctx, &local_err);
 358    if (local_err) {
 359        error_propagate(errp, local_err);
 360        goto out_free;
 361    }
 362
 363    s->total_size = h->RequiredDumpSpace;
 364
 365    s->written_size = qemu_write_full(s->fd, h, sizeof(*h));
 366    if (s->written_size != sizeof(*h)) {
 367        error_setg(errp, QERR_IO_ERROR);
 368        goto out_restore;
 369    }
 370
 371    write_runs(s, h, &local_err);
 372    if (local_err) {
 373        error_propagate(errp, local_err);
 374        goto out_restore;
 375    }
 376
 377out_restore:
 378    restore_context(h, saved_ctx);
 379out_free:
 380    g_free(saved_ctx);
 381out_cr3:
 382    first_x86_cpu->env.cr[3] = saved_cr3;
 383
 384    return;
 385}
 386