1 /* 2 * Windows crashdump (target specific implementations) 3 * 4 * Copyright (c) 2018 Virtuozzo International GmbH 5 * 6 * This work is licensed under the terms of the GNU GPL, version 2 or later. 7 * See the COPYING file in the top-level directory. 8 * 9 */ 10 11 #include "qemu/osdep.h" 12 #include "sysemu/dump.h" 13 #include "qapi/error.h" 14 #include "qemu/error-report.h" 15 #include "exec/cpu-defs.h" 16 #include "hw/core/cpu.h" 17 #include "qemu/win_dump_defs.h" 18 #include "win_dump.h" 19 #include "cpu.h" 20 21 #if defined(TARGET_X86_64) 22 23 bool win_dump_available(Error **errp) 24 { 25 return true; 26 } 27 28 static size_t win_dump_ptr_size(bool x64) 29 { 30 return x64 ? sizeof(uint64_t) : sizeof(uint32_t); 31 } 32 33 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f) 34 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field) 35 36 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f) 37 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field) 38 39 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f)) 40 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field) 41 42 static size_t win_dump_ctx_size(bool x64) 43 { 44 return x64 ? sizeof(WinContext64) : sizeof(WinContext32); 45 } 46 47 static size_t write_run(uint64_t base_page, uint64_t page_count, 48 int fd, Error **errp) 49 { 50 void *buf; 51 uint64_t addr = base_page << TARGET_PAGE_BITS; 52 uint64_t size = page_count << TARGET_PAGE_BITS; 53 uint64_t len, l; 54 int eno; 55 size_t total = 0; 56 57 while (size) { 58 len = size; 59 60 buf = cpu_physical_memory_map(addr, &len, false); 61 if (!buf) { 62 error_setg(errp, "win-dump: failed to map physical range" 63 " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1); 64 return 0; 65 } 66 67 l = qemu_write_full(fd, buf, len); 68 eno = errno; 69 cpu_physical_memory_unmap(buf, addr, false, len); 70 if (l != len) { 71 error_setg_errno(errp, eno, "win-dump: failed to save memory"); 72 return 0; 73 } 74 75 addr += l; 76 size -= l; 77 total += l; 78 } 79 80 return total; 81 } 82 83 static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp) 84 { 85 uint64_t BasePage, PageCount; 86 Error *local_err = NULL; 87 int i; 88 89 for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) { 90 BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage); 91 PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount); 92 s->written_size += write_run(BasePage, PageCount, s->fd, &local_err); 93 if (local_err) { 94 error_propagate(errp, local_err); 95 return; 96 } 97 } 98 } 99 100 static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr) 101 { 102 int ret; 103 uint32_t ptr32; 104 uint64_t ptr64; 105 106 ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32, 107 win_dump_ptr_size(x64), 0); 108 109 *ptr = x64 ? ptr64 : ptr32; 110 111 return ret; 112 } 113 114 static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp) 115 { 116 if (cpu_memory_rw_debug(first_cpu, 117 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET, 118 WIN_DUMP_FIELD_PTR(PfnDatabase), 119 WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) { 120 error_setg(errp, "win-dump: failed to read MmPfnDatabase"); 121 return; 122 } 123 } 124 125 static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp) 126 { 127 uint64_t KiBugcheckData; 128 129 if (cpu_read_ptr(x64, first_cpu, 130 WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET, 131 &KiBugcheckData)) { 132 error_setg(errp, "win-dump: failed to read KiBugcheckData"); 133 return; 134 } 135 136 if (cpu_memory_rw_debug(first_cpu, KiBugcheckData, 137 WIN_DUMP_FIELD(BugcheckData), 138 WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) { 139 error_setg(errp, "win-dump: failed to read bugcheck data"); 140 return; 141 } 142 143 /* 144 * If BugcheckCode wasn't saved, we consider guest OS as alive. 145 */ 146 147 if (!WIN_DUMP_FIELD(BugcheckCode)) { 148 *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP; 149 } 150 } 151 152 /* 153 * This routine tries to correct mistakes in crashdump header. 154 */ 155 static void patch_header(WinDumpHeader *h, bool x64) 156 { 157 Error *local_err = NULL; 158 159 if (x64) { 160 h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) + 161 (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS); 162 h->x64.PhysicalMemoryBlock.unused = 0; 163 h->x64.unused1 = 0; 164 } else { 165 h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) + 166 (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS); 167 } 168 169 patch_mm_pfn_database(h, x64, &local_err); 170 if (local_err) { 171 warn_report_err(local_err); 172 local_err = NULL; 173 } 174 patch_bugcheck_data(h, x64, &local_err); 175 if (local_err) { 176 warn_report_err(local_err); 177 } 178 } 179 180 static bool check_header(WinDumpHeader *h, bool *x64, Error **errp) 181 { 182 const char Signature[] = "PAGE"; 183 184 if (memcmp(h->Signature, Signature, sizeof(h->Signature))) { 185 error_setg(errp, "win-dump: invalid header, expected '%.4s'," 186 " got '%.4s'", Signature, h->Signature); 187 return false; 188 } 189 190 if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) { 191 *x64 = false; 192 } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) { 193 *x64 = true; 194 } else { 195 error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64'," 196 " got '%.4s'", h->ValidDump); 197 return false; 198 } 199 200 return true; 201 } 202 203 static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp) 204 { 205 const char OwnerTag[] = "KDBG"; 206 char read_OwnerTag[4]; 207 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock); 208 bool try_fallback = true; 209 210 try_again: 211 if (cpu_memory_rw_debug(first_cpu, 212 KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET, 213 (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) { 214 error_setg(errp, "win-dump: failed to read OwnerTag"); 215 return; 216 } 217 218 if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) { 219 if (try_fallback) { 220 /* 221 * If attempt to use original KDBG failed 222 * (most likely because of its encryption), 223 * we try to use KDBG obtained by guest driver. 224 */ 225 226 KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1); 227 try_fallback = false; 228 goto try_again; 229 } else { 230 error_setg(errp, "win-dump: invalid KDBG OwnerTag," 231 " expected '%.4s', got '%.4s'", 232 OwnerTag, read_OwnerTag); 233 return; 234 } 235 } 236 237 if (x64) { 238 h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock; 239 } else { 240 h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock; 241 } 242 } 243 244 struct saved_context { 245 WinContext ctx; 246 uint64_t addr; 247 }; 248 249 static void patch_and_save_context(WinDumpHeader *h, bool x64, 250 struct saved_context *saved_ctx, 251 Error **errp) 252 { 253 uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock); 254 uint64_t KiProcessorBlock; 255 uint16_t OffsetPrcbContext; 256 CPUState *cpu; 257 int i = 0; 258 259 if (cpu_read_ptr(x64, first_cpu, 260 KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET, 261 &KiProcessorBlock)) { 262 error_setg(errp, "win-dump: failed to read KiProcessorBlock"); 263 return; 264 } 265 266 if (cpu_memory_rw_debug(first_cpu, 267 KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET, 268 (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) { 269 error_setg(errp, "win-dump: failed to read OffsetPrcbContext"); 270 return; 271 } 272 273 CPU_FOREACH(cpu) { 274 X86CPU *x86_cpu = X86_CPU(cpu); 275 CPUX86State *env = &x86_cpu->env; 276 uint64_t Prcb; 277 uint64_t Context; 278 WinContext ctx; 279 280 if (i >= WIN_DUMP_FIELD(NumberProcessors)) { 281 warn_report("win-dump: number of QEMU CPUs is bigger than" 282 " NumberProcessors (%u) in guest Windows", 283 WIN_DUMP_FIELD(NumberProcessors)); 284 return; 285 } 286 287 if (cpu_read_ptr(x64, first_cpu, 288 KiProcessorBlock + i * win_dump_ptr_size(x64), 289 &Prcb)) { 290 error_setg(errp, "win-dump: failed to read" 291 " CPU #%d PRCB location", i); 292 return; 293 } 294 295 if (cpu_read_ptr(x64, first_cpu, 296 Prcb + OffsetPrcbContext, 297 &Context)) { 298 error_setg(errp, "win-dump: failed to read" 299 " CPU #%d ContextFrame location", i); 300 return; 301 } 302 303 saved_ctx[i].addr = Context; 304 305 if (x64) { 306 ctx.x64 = (WinContext64){ 307 .ContextFlags = WIN_CTX64_ALL, 308 .MxCsr = env->mxcsr, 309 310 .SegEs = env->segs[0].selector, 311 .SegCs = env->segs[1].selector, 312 .SegSs = env->segs[2].selector, 313 .SegDs = env->segs[3].selector, 314 .SegFs = env->segs[4].selector, 315 .SegGs = env->segs[5].selector, 316 .EFlags = cpu_compute_eflags(env), 317 318 .Dr0 = env->dr[0], 319 .Dr1 = env->dr[1], 320 .Dr2 = env->dr[2], 321 .Dr3 = env->dr[3], 322 .Dr6 = env->dr[6], 323 .Dr7 = env->dr[7], 324 325 .Rax = env->regs[R_EAX], 326 .Rbx = env->regs[R_EBX], 327 .Rcx = env->regs[R_ECX], 328 .Rdx = env->regs[R_EDX], 329 .Rsp = env->regs[R_ESP], 330 .Rbp = env->regs[R_EBP], 331 .Rsi = env->regs[R_ESI], 332 .Rdi = env->regs[R_EDI], 333 .R8 = env->regs[8], 334 .R9 = env->regs[9], 335 .R10 = env->regs[10], 336 .R11 = env->regs[11], 337 .R12 = env->regs[12], 338 .R13 = env->regs[13], 339 .R14 = env->regs[14], 340 .R15 = env->regs[15], 341 342 .Rip = env->eip, 343 .FltSave = { 344 .MxCsr = env->mxcsr, 345 }, 346 }; 347 } else { 348 ctx.x32 = (WinContext32){ 349 .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG, 350 351 .SegEs = env->segs[0].selector, 352 .SegCs = env->segs[1].selector, 353 .SegSs = env->segs[2].selector, 354 .SegDs = env->segs[3].selector, 355 .SegFs = env->segs[4].selector, 356 .SegGs = env->segs[5].selector, 357 .EFlags = cpu_compute_eflags(env), 358 359 .Dr0 = env->dr[0], 360 .Dr1 = env->dr[1], 361 .Dr2 = env->dr[2], 362 .Dr3 = env->dr[3], 363 .Dr6 = env->dr[6], 364 .Dr7 = env->dr[7], 365 366 .Eax = env->regs[R_EAX], 367 .Ebx = env->regs[R_EBX], 368 .Ecx = env->regs[R_ECX], 369 .Edx = env->regs[R_EDX], 370 .Esp = env->regs[R_ESP], 371 .Ebp = env->regs[R_EBP], 372 .Esi = env->regs[R_ESI], 373 .Edi = env->regs[R_EDI], 374 375 .Eip = env->eip, 376 }; 377 } 378 379 if (cpu_memory_rw_debug(first_cpu, Context, 380 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) { 381 error_setg(errp, "win-dump: failed to save CPU #%d context", i); 382 return; 383 } 384 385 if (cpu_memory_rw_debug(first_cpu, Context, 386 &ctx, win_dump_ctx_size(x64), 1)) { 387 error_setg(errp, "win-dump: failed to write CPU #%d context", i); 388 return; 389 } 390 391 i++; 392 } 393 } 394 395 static void restore_context(WinDumpHeader *h, bool x64, 396 struct saved_context *saved_ctx) 397 { 398 int i; 399 400 for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) { 401 if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr, 402 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) { 403 warn_report("win-dump: failed to restore CPU #%d context", i); 404 } 405 } 406 } 407 408 void create_win_dump(DumpState *s, Error **errp) 409 { 410 WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE); 411 X86CPU *first_x86_cpu = X86_CPU(first_cpu); 412 uint64_t saved_cr3 = first_x86_cpu->env.cr[3]; 413 struct saved_context *saved_ctx = NULL; 414 Error *local_err = NULL; 415 bool x64 = true; 416 size_t hdr_size; 417 418 if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 && 419 s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) { 420 error_setg(errp, "win-dump: invalid vmcoreinfo note size"); 421 return; 422 } 423 424 if (!check_header(h, &x64, &local_err)) { 425 error_propagate(errp, local_err); 426 return; 427 } 428 429 hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32); 430 431 /* 432 * Further access to kernel structures by virtual addresses 433 * should be made from system context. 434 */ 435 436 first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase); 437 438 check_kdbg(h, x64, &local_err); 439 if (local_err) { 440 error_propagate(errp, local_err); 441 goto out_cr3; 442 } 443 444 patch_header(h, x64); 445 446 saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors)); 447 448 /* 449 * Always patch context because there is no way 450 * to determine if the system-saved context is valid 451 */ 452 453 patch_and_save_context(h, x64, saved_ctx, &local_err); 454 if (local_err) { 455 error_propagate(errp, local_err); 456 goto out_free; 457 } 458 459 s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace); 460 461 s->written_size = qemu_write_full(s->fd, h, hdr_size); 462 if (s->written_size != hdr_size) { 463 error_setg_errno(errp, errno, "win-dump: failed to write header"); 464 goto out_restore; 465 } 466 467 write_runs(s, h, x64, &local_err); 468 if (local_err) { 469 error_propagate(errp, local_err); 470 goto out_restore; 471 } 472 473 out_restore: 474 restore_context(h, x64, saved_ctx); 475 out_free: 476 g_free(saved_ctx); 477 out_cr3: 478 first_x86_cpu->env.cr[3] = saved_cr3; 479 480 return; 481 } 482 483 #else /* !TARGET_X86_64 */ 484 485 bool win_dump_available(Error **errp) 486 { 487 error_setg(errp, "Windows dump is only available for x86-64"); 488 489 return false; 490 } 491 492 void create_win_dump(DumpState *s, Error **errp) 493 { 494 win_dump_available(errp); 495 } 496 497 #endif 498