1 /* 2 * Windows crashdump (target specific implementations) 3 * 4 * Copyright (c) 2018 Virtuozzo International GmbH 5 * 6 * This work is licensed under the terms of the GNU GPL, version 2 or later. 7 * See the COPYING file in the top-level directory. 8 * 9 */ 10 11 #include "qemu/osdep.h" 12 #include "sysemu/dump.h" 13 #include "qapi/error.h" 14 #include "qapi/qmp/qerror.h" 15 #include "exec/cpu-defs.h" 16 #include "hw/core/cpu.h" 17 #include "qemu/win_dump_defs.h" 18 #include "win_dump.h" 19 #include "cpu.h" 20 21 #if defined(TARGET_X86_64) 22 23 bool win_dump_available(Error **errp) 24 { 25 return true; 26 } 27 28 static size_t win_dump_ptr_size(bool x64) 29 { 30 return x64 ? sizeof(uint64_t) : sizeof(uint32_t); 31 } 32 33 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f) 34 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field) 35 36 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f) 37 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field) 38 39 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f)) 40 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field) 41 42 static size_t win_dump_ctx_size(bool x64) 43 { 44 return x64 ? sizeof(WinContext64) : sizeof(WinContext32); 45 } 46 47 static size_t write_run(uint64_t base_page, uint64_t page_count, 48 int fd, Error **errp) 49 { 50 void *buf; 51 uint64_t addr = base_page << TARGET_PAGE_BITS; 52 uint64_t size = page_count << TARGET_PAGE_BITS; 53 uint64_t len, l; 54 size_t total = 0; 55 56 while (size) { 57 len = size; 58 59 buf = cpu_physical_memory_map(addr, &len, false); 60 if (!buf) { 61 error_setg(errp, "win-dump: failed to map physical range" 62 " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1); 63 return 0; 64 } 65 66 l = qemu_write_full(fd, buf, len); 67 cpu_physical_memory_unmap(buf, addr, false, len); 68 if (l != len) { 69 error_setg(errp, QERR_IO_ERROR); 70 return 0; 71 } 72 73 addr += l; 74 size -= l; 75 total += l; 76 } 77 78 return total; 79 } 80 81 static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp) 82 { 83 uint64_t BasePage, PageCount; 84 Error *local_err = NULL; 85 int i; 86 87 for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) { 88 BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage); 89 PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount); 90 s->written_size += write_run(BasePage, PageCount, s->fd, &local_err); 91 if (local_err) { 92 error_propagate(errp, local_err); 93 return; 94 } 95 } 96 } 97 98 static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr) 99 { 100 int ret; 101 uint32_t ptr32; 102 uint64_t ptr64; 103 104 ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32, 105 win_dump_ptr_size(x64), 0); 106 107 *ptr = x64 ? ptr64 : ptr32; 108 109 return ret; 110 } 111 112 static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp) 113 { 114 if (cpu_memory_rw_debug(first_cpu, 115 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET, 116 WIN_DUMP_FIELD_PTR(PfnDatabase), 117 WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) { 118 error_setg(errp, "win-dump: failed to read MmPfnDatabase"); 119 return; 120 } 121 } 122 123 static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp) 124 { 125 uint64_t KiBugcheckData; 126 127 if (cpu_read_ptr(x64, first_cpu, 128 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET, 129 &KiBugcheckData)) { 130 error_setg(errp, "win-dump: failed to read KiBugcheckData"); 131 return; 132 } 133 134 if (cpu_memory_rw_debug(first_cpu, KiBugcheckData, 135 WIN_DUMP_FIELD(BugcheckData), 136 WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) { 137 error_setg(errp, "win-dump: failed to read bugcheck data"); 138 return; 139 } 140 141 /* 142 * If BugcheckCode wasn't saved, we consider guest OS as alive. 143 */ 144 145 if (!WIN_DUMP_FIELD(BugcheckCode)) { 146 *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP; 147 } 148 } 149 150 /* 151 * This routine tries to correct mistakes in crashdump header. 152 */ 153 static void patch_header(WinDumpHeader *h, bool x64) 154 { 155 Error *local_err = NULL; 156 157 if (x64) { 158 h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) + 159 (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS); 160 h->x64.PhysicalMemoryBlock.unused = 0; 161 h->x64.unused1 = 0; 162 } else { 163 h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) + 164 (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS); 165 } 166 167 patch_mm_pfn_database(h, x64, &local_err); 168 if (local_err) { 169 warn_report_err(local_err); 170 local_err = NULL; 171 } 172 patch_bugcheck_data(h, x64, &local_err); 173 if (local_err) { 174 warn_report_err(local_err); 175 } 176 } 177 178 static bool check_header(WinDumpHeader *h, bool *x64, Error **errp) 179 { 180 const char Signature[] = "PAGE"; 181 182 if (memcmp(h->Signature, Signature, sizeof(h->Signature))) { 183 error_setg(errp, "win-dump: invalid header, expected '%.4s'," 184 " got '%.4s'", Signature, h->Signature); 185 return false; 186 } 187 188 if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) { 189 *x64 = false; 190 } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) { 191 *x64 = true; 192 } else { 193 error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64'," 194 " got '%.4s'", h->ValidDump); 195 return false; 196 } 197 198 return true; 199 } 200 201 static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp) 202 { 203 const char OwnerTag[] = "KDBG"; 204 char read_OwnerTag[4]; 205 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock); 206 bool try_fallback = true; 207 208 try_again: 209 if (cpu_memory_rw_debug(first_cpu, 210 KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET, 211 (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) { 212 error_setg(errp, "win-dump: failed to read OwnerTag"); 213 return; 214 } 215 216 if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) { 217 if (try_fallback) { 218 /* 219 * If attempt to use original KDBG failed 220 * (most likely because of its encryption), 221 * we try to use KDBG obtained by guest driver. 222 */ 223 224 KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1); 225 try_fallback = false; 226 goto try_again; 227 } else { 228 error_setg(errp, "win-dump: invalid KDBG OwnerTag," 229 " expected '%.4s', got '%.4s'", 230 OwnerTag, read_OwnerTag); 231 return; 232 } 233 } 234 235 if (x64) { 236 h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock; 237 } else { 238 h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock; 239 } 240 } 241 242 struct saved_context { 243 WinContext ctx; 244 uint64_t addr; 245 }; 246 247 static void patch_and_save_context(WinDumpHeader *h, bool x64, 248 struct saved_context *saved_ctx, 249 Error **errp) 250 { 251 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock); 252 uint64_t KiProcessorBlock; 253 uint16_t OffsetPrcbContext; 254 CPUState *cpu; 255 int i = 0; 256 257 if (cpu_read_ptr(x64, first_cpu, 258 KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET, 259 &KiProcessorBlock)) { 260 error_setg(errp, "win-dump: failed to read KiProcessorBlock"); 261 return; 262 } 263 264 if (cpu_memory_rw_debug(first_cpu, 265 KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET, 266 (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) { 267 error_setg(errp, "win-dump: failed to read OffsetPrcbContext"); 268 return; 269 } 270 271 CPU_FOREACH(cpu) { 272 X86CPU *x86_cpu = X86_CPU(cpu); 273 CPUX86State *env = &x86_cpu->env; 274 uint64_t Prcb; 275 uint64_t Context; 276 WinContext ctx; 277 278 if (i >= WIN_DUMP_FIELD(NumberProcessors)) { 279 warn_report("win-dump: number of QEMU CPUs is bigger than" 280 " NumberProcessors (%u) in guest Windows", 281 WIN_DUMP_FIELD(NumberProcessors)); 282 return; 283 } 284 285 if (cpu_read_ptr(x64, first_cpu, 286 KiProcessorBlock + i * win_dump_ptr_size(x64), 287 &Prcb)) { 288 error_setg(errp, "win-dump: failed to read" 289 " CPU #%d PRCB location", i); 290 return; 291 } 292 293 if (cpu_read_ptr(x64, first_cpu, 294 Prcb + OffsetPrcbContext, 295 &Context)) { 296 error_setg(errp, "win-dump: failed to read" 297 " CPU #%d ContextFrame location", i); 298 return; 299 } 300 301 saved_ctx[i].addr = Context; 302 303 if (x64) { 304 ctx.x64 = (WinContext64){ 305 .ContextFlags = WIN_CTX64_ALL, 306 .MxCsr = env->mxcsr, 307 308 .SegEs = env->segs[0].selector, 309 .SegCs = env->segs[1].selector, 310 .SegSs = env->segs[2].selector, 311 .SegDs = env->segs[3].selector, 312 .SegFs = env->segs[4].selector, 313 .SegGs = env->segs[5].selector, 314 .EFlags = cpu_compute_eflags(env), 315 316 .Dr0 = env->dr[0], 317 .Dr1 = env->dr[1], 318 .Dr2 = env->dr[2], 319 .Dr3 = env->dr[3], 320 .Dr6 = env->dr[6], 321 .Dr7 = env->dr[7], 322 323 .Rax = env->regs[R_EAX], 324 .Rbx = env->regs[R_EBX], 325 .Rcx = env->regs[R_ECX], 326 .Rdx = env->regs[R_EDX], 327 .Rsp = env->regs[R_ESP], 328 .Rbp = env->regs[R_EBP], 329 .Rsi = env->regs[R_ESI], 330 .Rdi = env->regs[R_EDI], 331 .R8 = env->regs[8], 332 .R9 = env->regs[9], 333 .R10 = env->regs[10], 334 .R11 = env->regs[11], 335 .R12 = env->regs[12], 336 .R13 = env->regs[13], 337 .R14 = env->regs[14], 338 .R15 = env->regs[15], 339 340 .Rip = env->eip, 341 .FltSave = { 342 .MxCsr = env->mxcsr, 343 }, 344 }; 345 } else { 346 ctx.x32 = (WinContext32){ 347 .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG, 348 349 .SegEs = env->segs[0].selector, 350 .SegCs = env->segs[1].selector, 351 .SegSs = env->segs[2].selector, 352 .SegDs = env->segs[3].selector, 353 .SegFs = env->segs[4].selector, 354 .SegGs = env->segs[5].selector, 355 .EFlags = cpu_compute_eflags(env), 356 357 .Dr0 = env->dr[0], 358 .Dr1 = env->dr[1], 359 .Dr2 = env->dr[2], 360 .Dr3 = env->dr[3], 361 .Dr6 = env->dr[6], 362 .Dr7 = env->dr[7], 363 364 .Eax = env->regs[R_EAX], 365 .Ebx = env->regs[R_EBX], 366 .Ecx = env->regs[R_ECX], 367 .Edx = env->regs[R_EDX], 368 .Esp = env->regs[R_ESP], 369 .Ebp = env->regs[R_EBP], 370 .Esi = env->regs[R_ESI], 371 .Edi = env->regs[R_EDI], 372 373 .Eip = env->eip, 374 }; 375 } 376 377 if (cpu_memory_rw_debug(first_cpu, Context, 378 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) { 379 error_setg(errp, "win-dump: failed to save CPU #%d context", i); 380 return; 381 } 382 383 if (cpu_memory_rw_debug(first_cpu, Context, 384 &ctx, win_dump_ctx_size(x64), 1)) { 385 error_setg(errp, "win-dump: failed to write CPU #%d context", i); 386 return; 387 } 388 389 i++; 390 } 391 } 392 393 static void restore_context(WinDumpHeader *h, bool x64, 394 struct saved_context *saved_ctx) 395 { 396 int i; 397 398 for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) { 399 if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr, 400 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) { 401 warn_report("win-dump: failed to restore CPU #%d context", i); 402 } 403 } 404 } 405 406 void create_win_dump(DumpState *s, Error **errp) 407 { 408 WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE); 409 X86CPU *first_x86_cpu = X86_CPU(first_cpu); 410 uint64_t saved_cr3 = first_x86_cpu->env.cr[3]; 411 struct saved_context *saved_ctx = NULL; 412 Error *local_err = NULL; 413 bool x64 = true; 414 size_t hdr_size; 415 416 if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 && 417 s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) { 418 error_setg(errp, "win-dump: invalid vmcoreinfo note size"); 419 return; 420 } 421 422 if (!check_header(h, &x64, &local_err)) { 423 error_propagate(errp, local_err); 424 return; 425 } 426 427 hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32); 428 429 /* 430 * Further access to kernel structures by virtual addresses 431 * should be made from system context. 432 */ 433 434 first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase); 435 436 check_kdbg(h, x64, &local_err); 437 if (local_err) { 438 error_propagate(errp, local_err); 439 goto out_cr3; 440 } 441 442 patch_header(h, x64); 443 444 saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors)); 445 446 /* 447 * Always patch context because there is no way 448 * to determine if the system-saved context is valid 449 */ 450 451 patch_and_save_context(h, x64, saved_ctx, &local_err); 452 if (local_err) { 453 error_propagate(errp, local_err); 454 goto out_free; 455 } 456 457 s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace); 458 459 s->written_size = qemu_write_full(s->fd, h, hdr_size); 460 if (s->written_size != hdr_size) { 461 error_setg(errp, QERR_IO_ERROR); 462 goto out_restore; 463 } 464 465 write_runs(s, h, x64, &local_err); 466 if (local_err) { 467 error_propagate(errp, local_err); 468 goto out_restore; 469 } 470 471 out_restore: 472 restore_context(h, x64, saved_ctx); 473 out_free: 474 g_free(saved_ctx); 475 out_cr3: 476 first_x86_cpu->env.cr[3] = saved_cr3; 477 478 return; 479 } 480 481 #else /* !TARGET_X86_64 */ 482 483 bool win_dump_available(Error **errp) 484 { 485 error_setg(errp, "Windows dump is only available for x86-64"); 486 487 return false; 488 } 489 490 void create_win_dump(DumpState *s, Error **errp) 491 { 492 win_dump_available(errp); 493 } 494 495 #endif 496