dump/win_dump.c

   1 /*
   2  * Windows crashdump (target specific implementations)
   3  *
   4  * Copyright (c) 2018 Virtuozzo International GmbH
   5  *
   6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   7  * See the COPYING file in the top-level directory.
   8  *
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "sysemu/dump.h"
  13 #include "qapi/error.h"
  14 #include "qemu/error-report.h"
  15 #include "qapi/qmp/qerror.h"
  16 #include "exec/cpu-defs.h"
  17 #include "hw/core/cpu.h"
  18 #include "qemu/win_dump_defs.h"
  19 #include "win_dump.h"
  20 #include "cpu.h"
  21
  22 #if defined(TARGET_X86_64)
  23
  24 bool win_dump_available(Error **errp)
  25 {
  26     return true;
  27 }
  28
  29 static size_t win_dump_ptr_size(bool x64)
  30 {
  31     return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
  32 }
  33
  34 #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
  35 #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
  36
  37 #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
  38 #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
  39
  40 #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
  41 #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
  42
  43 static size_t win_dump_ctx_size(bool x64)
  44 {
  45     return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
  46 }
  47
  48 static size_t write_run(uint64_t base_page, uint64_t page_count,
  49         int fd, Error **errp)
  50 {
  51     void *buf;
  52     uint64_t addr = base_page << TARGET_PAGE_BITS;
  53     uint64_t size = page_count << TARGET_PAGE_BITS;
  54     uint64_t len, l;
  55     size_t total = 0;
  56
  57     while (size) {
  58         len = size;
  59
  60         buf = cpu_physical_memory_map(addr, &len, false);
  61         if (!buf) {
  62             error_setg(errp, "win-dump: failed to map physical range"
  63                              " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
  64             return 0;
  65         }
  66
  67         l = qemu_write_full(fd, buf, len);
  68         cpu_physical_memory_unmap(buf, addr, false, len);
  69         if (l != len) {
  70             error_setg(errp, QERR_IO_ERROR);
  71             return 0;
  72         }
  73
  74         addr += l;
  75         size -= l;
  76         total += l;
  77     }
  78
  79     return total;
  80 }
  81
  82 static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp)
  83 {
  84     uint64_t BasePage, PageCount;
  85     Error *local_err = NULL;
  86     int i;
  87
  88     for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) {
  89         BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage);
  90         PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount);
  91         s->written_size += write_run(BasePage, PageCount, s->fd, &local_err);
  92         if (local_err) {
  93             error_propagate(errp, local_err);
  94             return;
  95         }
  96     }
  97 }
  98
  99 static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr)
 100 {
 101     int ret;
 102     uint32_t ptr32;
 103     uint64_t ptr64;
 104
 105     ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32,
 106             win_dump_ptr_size(x64), 0);
 107
 108     *ptr = x64 ? ptr64 : ptr32;
 109
 110     return ret;
 111 }
 112
 113 static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp)
 114 {
 115     if (cpu_memory_rw_debug(first_cpu,
 116             WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
 117             WIN_DUMP_FIELD_PTR(PfnDatabase),
 118             WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
 119         error_setg(errp, "win-dump: failed to read MmPfnDatabase");
 120         return;
 121     }
 122 }
 123
 124 static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp)
 125 {
 126     uint64_t KiBugcheckData;
 127
 128     if (cpu_read_ptr(x64, first_cpu,
 129             WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
 130             &KiBugcheckData)) {
 131         error_setg(errp, "win-dump: failed to read KiBugcheckData");
 132         return;
 133     }
 134
 135     if (cpu_memory_rw_debug(first_cpu, KiBugcheckData,
 136             WIN_DUMP_FIELD(BugcheckData),
 137             WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) {
 138         error_setg(errp, "win-dump: failed to read bugcheck data");
 139         return;
 140     }
 141
 142     /*
 143      * If BugcheckCode wasn't saved, we consider guest OS as alive.
 144      */
 145
 146     if (!WIN_DUMP_FIELD(BugcheckCode)) {
 147         *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP;
 148     }
 149 }
 150
 151 /*
 152  * This routine tries to correct mistakes in crashdump header.
 153  */
 154 static void patch_header(WinDumpHeader *h, bool x64)
 155 {
 156     Error *local_err = NULL;
 157
 158     if (x64) {
 159         h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
 160             (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 161         h->x64.PhysicalMemoryBlock.unused = 0;
 162         h->x64.unused1 = 0;
 163     } else {
 164         h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
 165             (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
 166     }
 167
 168     patch_mm_pfn_database(h, x64, &local_err);
 169     if (local_err) {
 170         warn_report_err(local_err);
 171         local_err = NULL;
 172     }
 173     patch_bugcheck_data(h, x64, &local_err);
 174     if (local_err) {
 175         warn_report_err(local_err);
 176     }
 177 }
 178
 179 static bool check_header(WinDumpHeader *h, bool *x64, Error **errp)
 180 {
 181     const char Signature[] = "PAGE";
 182
 183     if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
 184         error_setg(errp, "win-dump: invalid header, expected '%.4s',"
 185                          " got '%.4s'", Signature, h->Signature);
 186         return false;
 187     }
 188
 189     if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
 190         *x64 = false;
 191     } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
 192         *x64 = true;
 193     } else {
 194         error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
 195                    " got '%.4s'", h->ValidDump);
 196         return false;
 197     }
 198
 199     return true;
 200 }
 201
 202 static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp)
 203 {
 204     const char OwnerTag[] = "KDBG";
 205     char read_OwnerTag[4];
 206     uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
 207     bool try_fallback = true;
 208
 209 try_again:
 210     if (cpu_memory_rw_debug(first_cpu,
 211             KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
 212             (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
 213         error_setg(errp, "win-dump: failed to read OwnerTag");
 214         return;
 215     }
 216
 217     if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
 218         if (try_fallback) {
 219             /*
 220              * If attempt to use original KDBG failed
 221              * (most likely because of its encryption),
 222              * we try to use KDBG obtained by guest driver.
 223              */
 224
 225             KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1);
 226             try_fallback = false;
 227             goto try_again;
 228         } else {
 229             error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
 230                              " expected '%.4s', got '%.4s'",
 231                              OwnerTag, read_OwnerTag);
 232             return;
 233         }
 234     }
 235
 236     if (x64) {
 237         h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
 238     } else {
 239         h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
 240     }
 241 }
 242
 243 struct saved_context {
 244     WinContext ctx;
 245     uint64_t addr;
 246 };
 247
 248 static void patch_and_save_context(WinDumpHeader *h, bool x64,
 249                                    struct saved_context *saved_ctx,
 250                                    Error **errp)
 251 {
 252     uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
 253     uint64_t KiProcessorBlock;
 254     uint16_t OffsetPrcbContext;
 255     CPUState *cpu;
 256     int i = 0;
 257
 258     if (cpu_read_ptr(x64, first_cpu,
 259             KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
 260             &KiProcessorBlock)) {
 261         error_setg(errp, "win-dump: failed to read KiProcessorBlock");
 262         return;
 263     }
 264
 265     if (cpu_memory_rw_debug(first_cpu,
 266             KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
 267             (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
 268         error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
 269         return;
 270     }
 271
 272     CPU_FOREACH(cpu) {
 273         X86CPU *x86_cpu = X86_CPU(cpu);
 274         CPUX86State *env = &x86_cpu->env;
 275         uint64_t Prcb;
 276         uint64_t Context;
 277         WinContext ctx;
 278
 279         if (i >= WIN_DUMP_FIELD(NumberProcessors)) {
 280             warn_report("win-dump: number of QEMU CPUs is bigger than"
 281                         " NumberProcessors (%u) in guest Windows",
 282                         WIN_DUMP_FIELD(NumberProcessors));
 283             return;
 284         }
 285
 286         if (cpu_read_ptr(x64, first_cpu,
 287                 KiProcessorBlock + i * win_dump_ptr_size(x64),
 288                 &Prcb)) {
 289             error_setg(errp, "win-dump: failed to read"
 290                              " CPU #%d PRCB location", i);
 291             return;
 292         }
 293
 294         if (cpu_read_ptr(x64, first_cpu,
 295                 Prcb + OffsetPrcbContext,
 296                 &Context)) {
 297             error_setg(errp, "win-dump: failed to read"
 298                              " CPU #%d ContextFrame location", i);
 299             return;
 300         }
 301
 302         saved_ctx[i].addr = Context;
 303
 304         if (x64) {
 305             ctx.x64 = (WinContext64){
 306                 .ContextFlags = WIN_CTX64_ALL,
 307                 .MxCsr = env->mxcsr,
 308
 309                 .SegEs = env->segs[0].selector,
 310                 .SegCs = env->segs[1].selector,
 311                 .SegSs = env->segs[2].selector,
 312                 .SegDs = env->segs[3].selector,
 313                 .SegFs = env->segs[4].selector,
 314                 .SegGs = env->segs[5].selector,
 315                 .EFlags = cpu_compute_eflags(env),
 316
 317                 .Dr0 = env->dr[0],
 318                 .Dr1 = env->dr[1],
 319                 .Dr2 = env->dr[2],
 320                 .Dr3 = env->dr[3],
 321                 .Dr6 = env->dr[6],
 322                 .Dr7 = env->dr[7],
 323
 324                 .Rax = env->regs[R_EAX],
 325                 .Rbx = env->regs[R_EBX],
 326                 .Rcx = env->regs[R_ECX],
 327                 .Rdx = env->regs[R_EDX],
 328                 .Rsp = env->regs[R_ESP],
 329                 .Rbp = env->regs[R_EBP],
 330                 .Rsi = env->regs[R_ESI],
 331                 .Rdi = env->regs[R_EDI],
 332                 .R8  = env->regs[8],
 333                 .R9  = env->regs[9],
 334                 .R10 = env->regs[10],
 335                 .R11 = env->regs[11],
 336                 .R12 = env->regs[12],
 337                 .R13 = env->regs[13],
 338                 .R14 = env->regs[14],
 339                 .R15 = env->regs[15],
 340
 341                 .Rip = env->eip,
 342                 .FltSave = {
 343                     .MxCsr = env->mxcsr,
 344                 },
 345             };
 346         } else {
 347             ctx.x32 = (WinContext32){
 348                 .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG,
 349
 350                 .SegEs = env->segs[0].selector,
 351                 .SegCs = env->segs[1].selector,
 352                 .SegSs = env->segs[2].selector,
 353                 .SegDs = env->segs[3].selector,
 354                 .SegFs = env->segs[4].selector,
 355                 .SegGs = env->segs[5].selector,
 356                 .EFlags = cpu_compute_eflags(env),
 357
 358                 .Dr0 = env->dr[0],
 359                 .Dr1 = env->dr[1],
 360                 .Dr2 = env->dr[2],
 361                 .Dr3 = env->dr[3],
 362                 .Dr6 = env->dr[6],
 363                 .Dr7 = env->dr[7],
 364
 365                 .Eax = env->regs[R_EAX],
 366                 .Ebx = env->regs[R_EBX],
 367                 .Ecx = env->regs[R_ECX],
 368                 .Edx = env->regs[R_EDX],
 369                 .Esp = env->regs[R_ESP],
 370                 .Ebp = env->regs[R_EBP],
 371                 .Esi = env->regs[R_ESI],
 372                 .Edi = env->regs[R_EDI],
 373
 374                 .Eip = env->eip,
 375             };
 376         }
 377
 378         if (cpu_memory_rw_debug(first_cpu, Context,
 379                 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
 380             error_setg(errp, "win-dump: failed to save CPU #%d context", i);
 381             return;
 382         }
 383
 384         if (cpu_memory_rw_debug(first_cpu, Context,
 385                 &ctx, win_dump_ctx_size(x64), 1)) {
 386             error_setg(errp, "win-dump: failed to write CPU #%d context", i);
 387             return;
 388         }
 389
 390         i++;
 391     }
 392 }
 393
 394 static void restore_context(WinDumpHeader *h, bool x64,
 395                             struct saved_context *saved_ctx)
 396 {
 397     int i;
 398
 399     for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
 400         if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
 401                 &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
 402             warn_report("win-dump: failed to restore CPU #%d context", i);
 403         }
 404     }
 405 }
 406
 407 void create_win_dump(DumpState *s, Error **errp)
 408 {
 409     WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
 410     X86CPU *first_x86_cpu = X86_CPU(first_cpu);
 411     uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
 412     struct saved_context *saved_ctx = NULL;
 413     Error *local_err = NULL;
 414     bool x64 = true;
 415     size_t hdr_size;
 416
 417     if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
 418             s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
 419         error_setg(errp, "win-dump: invalid vmcoreinfo note size");
 420         return;
 421     }
 422
 423     if (!check_header(h, &x64, &local_err)) {
 424         error_propagate(errp, local_err);
 425         return;
 426     }
 427
 428     hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);
 429
 430     /*
 431      * Further access to kernel structures by virtual addresses
 432      * should be made from system context.
 433      */
 434
 435     first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);
 436
 437     check_kdbg(h, x64, &local_err);
 438     if (local_err) {
 439         error_propagate(errp, local_err);
 440         goto out_cr3;
 441     }
 442
 443     patch_header(h, x64);
 444
 445     saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));
 446
 447     /*
 448      * Always patch context because there is no way
 449      * to determine if the system-saved context is valid
 450      */
 451
 452     patch_and_save_context(h, x64, saved_ctx, &local_err);
 453     if (local_err) {
 454         error_propagate(errp, local_err);
 455         goto out_free;
 456     }
 457
 458     s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);
 459
 460     s->written_size = qemu_write_full(s->fd, h, hdr_size);
 461     if (s->written_size != hdr_size) {
 462         error_setg(errp, QERR_IO_ERROR);
 463         goto out_restore;
 464     }
 465
 466     write_runs(s, h, x64, &local_err);
 467     if (local_err) {
 468         error_propagate(errp, local_err);
 469         goto out_restore;
 470     }
 471
 472 out_restore:
 473     restore_context(h, x64, saved_ctx);
 474 out_free:
 475     g_free(saved_ctx);
 476 out_cr3:
 477     first_x86_cpu->env.cr[3] = saved_cr3;
 478
 479     return;
 480 }
 481
 482 #else /* !TARGET_X86_64 */
 483
 484 bool win_dump_available(Error **errp)
 485 {
 486     error_setg(errp, "Windows dump is only available for x86-64");
 487
 488     return false;
 489 }
 490
 491 void create_win_dump(DumpState *s, Error **errp)
 492 {
 493     win_dump_available(errp);
 494 }
 495
 496 #endif