[mirror_qemu.git] / dump / win_dump.c

/*
 * Windows crashdump (target specific implementations)
 *
 * Copyright (c) 2018 Virtuozzo International GmbH
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */

#include "qemu/osdep.h"
#include "sysemu/dump.h"
#include "qapi/error.h"
#include "qemu/error-report.h"
#include "qapi/qmp/qerror.h"
#include "exec/cpu-defs.h"
#include "hw/core/cpu.h"
#include "qemu/win_dump_defs.h"
#include "win_dump.h"
#include "cpu.h"

#if defined(TARGET_X86_64)

bool win_dump_available(Error **errp)
{
    return true;
}

static size_t win_dump_ptr_size(bool x64)
{
    return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
}

#define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
#define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)

#define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
#define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)

#define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
#define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)

static size_t win_dump_ctx_size(bool x64)
{
    return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
}

static size_t write_run(uint64_t base_page, uint64_t page_count,
        int fd, Error **errp)
{
    void *buf;
    uint64_t addr = base_page << TARGET_PAGE_BITS;
    uint64_t size = page_count << TARGET_PAGE_BITS;
    uint64_t len, l;
    size_t total = 0;

    while (size) {
        len = size;

        buf = cpu_physical_memory_map(addr, &len, false);
        if (!buf) {
            error_setg(errp, "win-dump: failed to map physical range"
                             " 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
            return 0;
        }

        l = qemu_write_full(fd, buf, len);
        cpu_physical_memory_unmap(buf, addr, false, len);
        if (l != len) {
            error_setg(errp, QERR_IO_ERROR);
            return 0;
        }

        addr += l;
        size -= l;
        total += l;
    }

    return total;
}

static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp)
{
    uint64_t BasePage, PageCount;
    Error *local_err = NULL;
    int i;

    for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) {
        BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage);
        PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount);
        s->written_size += write_run(BasePage, PageCount, s->fd, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
            return;
        }
    }
}

static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr)
{
    int ret;
    uint32_t ptr32;
    uint64_t ptr64;

    ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32,
            win_dump_ptr_size(x64), 0);

    *ptr = x64 ? ptr64 : ptr32;

    return ret;
}

static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp)
{
    if (cpu_memory_rw_debug(first_cpu,
            WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
            WIN_DUMP_FIELD_PTR(PfnDatabase),
            WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
        error_setg(errp, "win-dump: failed to read MmPfnDatabase");
        return;
    }
}

static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp)
{
    uint64_t KiBugcheckData;

    if (cpu_read_ptr(x64, first_cpu,
            WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
            &KiBugcheckData)) {
        error_setg(errp, "win-dump: failed to read KiBugcheckData");
        return;
    }

    if (cpu_memory_rw_debug(first_cpu, KiBugcheckData,
            WIN_DUMP_FIELD(BugcheckData),
            WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) {
        error_setg(errp, "win-dump: failed to read bugcheck data");
        return;
    }

    /*
     * If BugcheckCode wasn't saved, we consider guest OS as alive.
     */

    if (!WIN_DUMP_FIELD(BugcheckCode)) {
        *(uint32_t *)WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP;
    }
}

/*
 * This routine tries to correct mistakes in crashdump header.
 */
static void patch_header(WinDumpHeader *h, bool x64)
{
    Error *local_err = NULL;

    if (x64) {
        h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
            (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
        h->x64.PhysicalMemoryBlock.unused = 0;
        h->x64.unused1 = 0;
    } else {
        h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
            (h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
    }

    patch_mm_pfn_database(h, x64, &local_err);
    if (local_err) {
        warn_report_err(local_err);
        local_err = NULL;
    }
    patch_bugcheck_data(h, x64, &local_err);
    if (local_err) {
        warn_report_err(local_err);
    }
}

static bool check_header(WinDumpHeader *h, bool *x64, Error **errp)
{
    const char Signature[] = "PAGE";

    if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
        error_setg(errp, "win-dump: invalid header, expected '%.4s',"
                         " got '%.4s'", Signature, h->Signature);
        return false;
    }

    if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
        *x64 = false;
    } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
        *x64 = true;
    } else {
        error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
                   " got '%.4s'", h->ValidDump);
        return false;
    }

    return true;
}

static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp)
{
    const char OwnerTag[] = "KDBG";
    char read_OwnerTag[4];
    uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
    bool try_fallback = true;

try_again:
    if (cpu_memory_rw_debug(first_cpu,
            KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
            (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
        error_setg(errp, "win-dump: failed to read OwnerTag");
        return;
    }

    if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
        if (try_fallback) {
            /*
             * If attempt to use original KDBG failed
             * (most likely because of its encryption),
             * we try to use KDBG obtained by guest driver.
             */

            KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1);
            try_fallback = false;
            goto try_again;
        } else {
            error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
                             " expected '%.4s', got '%.4s'",
                             OwnerTag, read_OwnerTag);
            return;
        }
    }

    if (x64) {
        h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
    } else {
        h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
    }
}

struct saved_context {
    WinContext ctx;
    uint64_t addr;
};

static void patch_and_save_context(WinDumpHeader *h, bool x64,
                                   struct saved_context *saved_ctx,
                                   Error **errp)
{
    uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
    uint64_t KiProcessorBlock;
    uint16_t OffsetPrcbContext;
    CPUState *cpu;
    int i = 0;

    if (cpu_read_ptr(x64, first_cpu,
            KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
            &KiProcessorBlock)) {
        error_setg(errp, "win-dump: failed to read KiProcessorBlock");
        return;
    }

    if (cpu_memory_rw_debug(first_cpu,
            KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
            (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
        error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
        return;
    }

    CPU_FOREACH(cpu) {
        X86CPU *x86_cpu = X86_CPU(cpu);
        CPUX86State *env = &x86_cpu->env;
        uint64_t Prcb;
        uint64_t Context;
        WinContext ctx;

        if (i >= WIN_DUMP_FIELD(NumberProcessors)) {
            warn_report("win-dump: number of QEMU CPUs is bigger than"
                        " NumberProcessors (%u) in guest Windows",
                        WIN_DUMP_FIELD(NumberProcessors));
            return;
        }

        if (cpu_read_ptr(x64, first_cpu,
                KiProcessorBlock + i * win_dump_ptr_size(x64),
                &Prcb)) {
            error_setg(errp, "win-dump: failed to read"
                             " CPU #%d PRCB location", i);
            return;
        }

        if (cpu_read_ptr(x64, first_cpu,
                Prcb + OffsetPrcbContext,
                &Context)) {
            error_setg(errp, "win-dump: failed to read"
                             " CPU #%d ContextFrame location", i);
            return;
        }

        saved_ctx[i].addr = Context;

        if (x64) {
            ctx.x64 = (WinContext64){
                .ContextFlags = WIN_CTX64_ALL,
                .MxCsr = env->mxcsr,

                .SegEs = env->segs[0].selector,
                .SegCs = env->segs[1].selector,
                .SegSs = env->segs[2].selector,
                .SegDs = env->segs[3].selector,
                .SegFs = env->segs[4].selector,
                .SegGs = env->segs[5].selector,
                .EFlags = cpu_compute_eflags(env),

                .Dr0 = env->dr[0],
                .Dr1 = env->dr[1],
                .Dr2 = env->dr[2],
                .Dr3 = env->dr[3],
                .Dr6 = env->dr[6],
                .Dr7 = env->dr[7],

                .Rax = env->regs[R_EAX],
                .Rbx = env->regs[R_EBX],
                .Rcx = env->regs[R_ECX],
                .Rdx = env->regs[R_EDX],
                .Rsp = env->regs[R_ESP],
                .Rbp = env->regs[R_EBP],
                .Rsi = env->regs[R_ESI],
                .Rdi = env->regs[R_EDI],
                .R8  = env->regs[8],
                .R9  = env->regs[9],
                .R10 = env->regs[10],
                .R11 = env->regs[11],
                .R12 = env->regs[12],
                .R13 = env->regs[13],
                .R14 = env->regs[14],
                .R15 = env->regs[15],

                .Rip = env->eip,
                .FltSave = {
                    .MxCsr = env->mxcsr,
                },
            };
        } else {
            ctx.x32 = (WinContext32){
                .ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG,

                .SegEs = env->segs[0].selector,
                .SegCs = env->segs[1].selector,
                .SegSs = env->segs[2].selector,
                .SegDs = env->segs[3].selector,
                .SegFs = env->segs[4].selector,
                .SegGs = env->segs[5].selector,
                .EFlags = cpu_compute_eflags(env),

                .Dr0 = env->dr[0],
                .Dr1 = env->dr[1],
                .Dr2 = env->dr[2],
                .Dr3 = env->dr[3],
                .Dr6 = env->dr[6],
                .Dr7 = env->dr[7],

                .Eax = env->regs[R_EAX],
                .Ebx = env->regs[R_EBX],
                .Ecx = env->regs[R_ECX],
                .Edx = env->regs[R_EDX],
                .Esp = env->regs[R_ESP],
                .Ebp = env->regs[R_EBP],
                .Esi = env->regs[R_ESI],
                .Edi = env->regs[R_EDI],

                .Eip = env->eip,
            };
        }

        if (cpu_memory_rw_debug(first_cpu, Context,
                &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
            error_setg(errp, "win-dump: failed to save CPU #%d context", i);
            return;
        }

        if (cpu_memory_rw_debug(first_cpu, Context,
                &ctx, win_dump_ctx_size(x64), 1)) {
            error_setg(errp, "win-dump: failed to write CPU #%d context", i);
            return;
        }

        i++;
    }
}

static void restore_context(WinDumpHeader *h, bool x64,
                            struct saved_context *saved_ctx)
{
    int i;

    for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
        if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
                &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
            warn_report("win-dump: failed to restore CPU #%d context", i);
        }
    }
}

void create_win_dump(DumpState *s, Error **errp)
{
    WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
    X86CPU *first_x86_cpu = X86_CPU(first_cpu);
    uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
    struct saved_context *saved_ctx = NULL;
    Error *local_err = NULL;
    bool x64 = true;
    size_t hdr_size;

    if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
            s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
        error_setg(errp, "win-dump: invalid vmcoreinfo note size");
        return;
    }

    if (!check_header(h, &x64, &local_err)) {
        error_propagate(errp, local_err);
        return;
    }

    hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);

    /*
     * Further access to kernel structures by virtual addresses
     * should be made from system context.
     */

    first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);

    check_kdbg(h, x64, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto out_cr3;
    }

    patch_header(h, x64);

    saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));

    /*
     * Always patch context because there is no way
     * to determine if the system-saved context is valid
     */

    patch_and_save_context(h, x64, saved_ctx, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto out_free;
    }

    s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);

    s->written_size = qemu_write_full(s->fd, h, hdr_size);
    if (s->written_size != hdr_size) {
        error_setg(errp, QERR_IO_ERROR);
        goto out_restore;
    }

    write_runs(s, h, x64, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto out_restore;
    }

out_restore:
    restore_context(h, x64, saved_ctx);
out_free:
    g_free(saved_ctx);
out_cr3:
    first_x86_cpu->env.cr[3] = saved_cr3;

    return;
}

#else /* !TARGET_X86_64 */

bool win_dump_available(Error **errp)
{
    error_setg(errp, "Windows dump is only available for x86-64");

    return false;
}

void create_win_dump(DumpState *s, Error **errp)
{
    win_dump_available(errp);
}

#endif
Commit	Line	Data
2da91b54	1	/*
ac978771	2	* Windows crashdump (target specific implementations)
2da91b54 VP	3	*
	4	* Copyright (c) 2018 Virtuozzo International GmbH
	5	*
	6	* This work is licensed under the terms of the GNU GPL, version 2 or later.
	7	* See the COPYING file in the top-level directory.
	8	*
	9	*/
	10
	11	#include "qemu/osdep.h"
2da91b54	12	#include "sysemu/dump.h"
2da91b54	13	#include "qapi/error.h"
cc37d98b	14	#include "qemu/error-report.h"
2da91b54	15	#include "qapi/qmp/qerror.h"
ac978771 PMD	16	#include "exec/cpu-defs.h"
	17	#include "hw/core/cpu.h"
	18	#include "qemu/win_dump_defs.h"
2da91b54	19	#include "win_dump.h"
ac978771	20	#include "cpu.h"
2da91b54	21
efc3146a PMD	22	#if defined(TARGET_X86_64)
	23
	24	bool win_dump_available(Error **errp)
	25	{
	26	return true;
	27	}
	28
f5daa829 VP	29	static size_t win_dump_ptr_size(bool x64)
	30	{
	31	return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
	32	}
fb21efe9	33
f5daa829	34	#define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
fb21efe9 VP	35	#define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
fb21efe9 VP	36
f5daa829	37	#define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void )&h->x64.f : (void )&h->x32.f)
fb21efe9 VP	38	#define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
fb21efe9 VP	39
f5daa829	40	#define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
fb21efe9 VP	41	#define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
fb21efe9 VP	42
f5daa829 VP	43	static size_t win_dump_ctx_size(bool x64)
	44	{
	45	return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
	46	}
fb21efe9 VP	47
	48	static size_t write_run(uint64_t base_page, uint64_t page_count,
	49	int fd, Error **errp)
2da91b54 VP	50	{
2da91b54 VP	51	void *buf;
fb21efe9 VP	52	uint64_t addr = base_page << TARGET_PAGE_BITS;
fb21efe9 VP	53	uint64_t size = page_count << TARGET_PAGE_BITS;
7184de64 VP	54	uint64_t len, l;
7184de64 VP	55	size_t total = 0;
2da91b54	56
7184de64 VP	57	while (size) {
7184de64 VP	58	len = size;
2da91b54	59
7184de64 VP	60	buf = cpu_physical_memory_map(addr, &len, false);
	61	if (!buf) {
	62	error_setg(errp, "win-dump: failed to map physical range"
	63	" 0x%016" PRIx64 "-0x%016" PRIx64, addr, addr + size - 1);
	64	return 0;
	65	}
2da91b54	66
7184de64 VP	67	l = qemu_write_full(fd, buf, len);
	68	cpu_physical_memory_unmap(buf, addr, false, len);
	69	if (l != len) {
	70	error_setg(errp, QERR_IO_ERROR);
	71	return 0;
	72	}
	73
	74	addr += l;
	75	size -= l;
	76	total += l;
	77	}
2da91b54	78
7184de64	79	return total;
2da91b54 VP	80	}
2da91b54 VP	81
f5daa829	82	static void write_runs(DumpState s, WinDumpHeader h, bool x64, Error **errp)
2da91b54	83	{
fb21efe9	84	uint64_t BasePage, PageCount;
2da91b54 VP	85	Error *local_err = NULL;
	86	int i;
	87
fb21efe9 VP	88	for (i = 0; i < WIN_DUMP_FIELD(PhysicalMemoryBlock.NumberOfRuns); i++) {
	89	BasePage = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].BasePage);
	90	PageCount = WIN_DUMP_FIELD(PhysicalMemoryBlock.Run[i].PageCount);
	91	s->written_size += write_run(BasePage, PageCount, s->fd, &local_err);
2da91b54 VP	92	if (local_err) {
	93	error_propagate(errp, local_err);
	94	return;
	95	}
	96	}
	97	}
	98
f5daa829	99	static int cpu_read_ptr(bool x64, CPUState cpu, uint64_t addr, uint64_t ptr)
fb21efe9 VP	100	{
fb21efe9 VP	101	int ret;
f5daa829	102	uint32_t ptr32;
fb21efe9 VP	103	uint64_t ptr64;
fb21efe9 VP	104
f5daa829 VP	105	ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void )&ptr64 : (void )&ptr32,
f5daa829 VP	106	win_dump_ptr_size(x64), 0);
fb21efe9	107
f5daa829	108	*ptr = x64 ? ptr64 : ptr32;
fb21efe9 VP	109
	110	return ret;
	111	}
	112
f5daa829	113	static void patch_mm_pfn_database(WinDumpHeader h, bool x64, Error *errp)
2da91b54 VP	114	{
2da91b54 VP	115	if (cpu_memory_rw_debug(first_cpu,
f5daa829	116	WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
fb21efe9 VP	117	WIN_DUMP_FIELD_PTR(PfnDatabase),
fb21efe9 VP	118	WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
2da91b54 VP	119	error_setg(errp, "win-dump: failed to read MmPfnDatabase");
	120	return;
	121	}
	122	}
	123
f5daa829	124	static void patch_bugcheck_data(WinDumpHeader h, bool x64, Error *errp)
2da91b54 VP	125	{
	126	uint64_t KiBugcheckData;
	127
f5daa829 VP	128	if (cpu_read_ptr(x64, first_cpu,
f5daa829 VP	129	WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
fb21efe9	130	&KiBugcheckData)) {
2da91b54 VP	131	error_setg(errp, "win-dump: failed to read KiBugcheckData");
	132	return;
	133	}
	134
fb21efe9 VP	135	if (cpu_memory_rw_debug(first_cpu, KiBugcheckData,
	136	WIN_DUMP_FIELD(BugcheckData),
	137	WIN_DUMP_FIELD_SIZE(BugcheckData), 0)) {
2da91b54 VP	138	error_setg(errp, "win-dump: failed to read bugcheck data");
	139	return;
	140	}
2ad9b50f VP	141
	142	/*
	143	* If BugcheckCode wasn't saved, we consider guest OS as alive.
	144	*/
	145
fb21efe9 VP	146	if (!WIN_DUMP_FIELD(BugcheckCode)) {
fb21efe9 VP	147	(uint32_t )WIN_DUMP_FIELD_PTR(BugcheckCode) = LIVE_SYSTEM_DUMP;
2ad9b50f	148	}
2da91b54 VP	149	}
	150
	151	/*
	152	* This routine tries to correct mistakes in crashdump header.
	153	*/
f5daa829	154	static void patch_header(WinDumpHeader *h, bool x64)
2da91b54 VP	155	{
	156	Error *local_err = NULL;
	157
f5daa829 VP	158	if (x64) {
	159	h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
	160	(h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
	161	h->x64.PhysicalMemoryBlock.unused = 0;
	162	h->x64.unused1 = 0;
	163	} else {
	164	h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
	165	(h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
	166	}
2da91b54	167
f5daa829	168	patch_mm_pfn_database(h, x64, &local_err);
2da91b54 VP	169	if (local_err) {
	170	warn_report_err(local_err);
	171	local_err = NULL;
	172	}
f5daa829	173	patch_bugcheck_data(h, x64, &local_err);
2da91b54 VP	174	if (local_err) {
	175	warn_report_err(local_err);
	176	}
	177	}
	178
f5daa829	179	static bool check_header(WinDumpHeader h, bool x64, Error **errp)
2da91b54 VP	180	{
2da91b54 VP	181	const char Signature[] = "PAGE";
2da91b54 VP	182
	183	if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
	184	error_setg(errp, "win-dump: invalid header, expected '%.4s',"
	185	" got '%.4s'", Signature, h->Signature);
f5daa829	186	return false;
2da91b54 VP	187	}
2da91b54 VP	188
f5daa829 VP	189	if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
	190	*x64 = false;
	191	} else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
	192	*x64 = true;
	193	} else {
	194	error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
	195	" got '%.4s'", h->ValidDump);
	196	return false;
2da91b54	197	}
f5daa829 VP	198
f5daa829 VP	199	return true;
2da91b54 VP	200	}
2da91b54 VP	201
f5daa829	202	static void check_kdbg(WinDumpHeader h, bool x64, Error *errp)
2da91b54 VP	203	{
	204	const char OwnerTag[] = "KDBG";
	205	char read_OwnerTag[4];
fb21efe9	206	uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
2ababfcc	207	bool try_fallback = true;
2da91b54	208
2ababfcc	209	try_again:
2da91b54	210	if (cpu_memory_rw_debug(first_cpu,
f5daa829	211	KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
2da91b54 VP	212	(uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
	213	error_setg(errp, "win-dump: failed to read OwnerTag");
	214	return;
	215	}
	216
	217	if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) {
2ababfcc VP	218	if (try_fallback) {
	219	/*
	220	* If attempt to use original KDBG failed
	221	* (most likely because of its encryption),
	222	* we try to use KDBG obtained by guest driver.
	223	*/
	224
fb21efe9	225	KdDebuggerDataBlock = WIN_DUMP_FIELD(BugcheckParameter1);
2ababfcc VP	226	try_fallback = false;
	227	goto try_again;
	228	} else {
	229	error_setg(errp, "win-dump: invalid KDBG OwnerTag,"
	230	" expected '%.4s', got '%.4s'",
	231	OwnerTag, read_OwnerTag);
	232	return;
	233	}
2da91b54	234	}
2ababfcc	235
f5daa829 VP	236	if (x64) {
	237	h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
	238	} else {
	239	h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
	240	}
2da91b54 VP	241	}
2da91b54 VP	242
2ad9b50f	243	struct saved_context {
f5daa829	244	WinContext ctx;
2ad9b50f VP	245	uint64_t addr;
	246	};
	247
f5daa829	248	static void patch_and_save_context(WinDumpHeader *h, bool x64,
2ad9b50f VP	249	struct saved_context *saved_ctx,
	250	Error **errp)
	251	{
fb21efe9	252	uint64_t KdDebuggerDataBlock = WIN_DUMP_FIELD(KdDebuggerDataBlock);
2ad9b50f VP	253	uint64_t KiProcessorBlock;
	254	uint16_t OffsetPrcbContext;
	255	CPUState *cpu;
	256	int i = 0;
	257
f5daa829 VP	258	if (cpu_read_ptr(x64, first_cpu,
f5daa829 VP	259	KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
fb21efe9	260	&KiProcessorBlock)) {
2ad9b50f VP	261	error_setg(errp, "win-dump: failed to read KiProcessorBlock");
	262	return;
	263	}
	264
	265	if (cpu_memory_rw_debug(first_cpu,
f5daa829	266	KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
2ad9b50f VP	267	(uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
	268	error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
	269	return;
	270	}
	271
	272	CPU_FOREACH(cpu) {
	273	X86CPU *x86_cpu = X86_CPU(cpu);
	274	CPUX86State *env = &x86_cpu->env;
	275	uint64_t Prcb;
	276	uint64_t Context;
f5daa829	277	WinContext ctx;
2ad9b50f	278
e38c24cb VP	279	if (i >= WIN_DUMP_FIELD(NumberProcessors)) {
	280	warn_report("win-dump: number of QEMU CPUs is bigger than"
	281	" NumberProcessors (%u) in guest Windows",
	282	WIN_DUMP_FIELD(NumberProcessors));
	283	return;
	284	}
	285
f5daa829 VP	286	if (cpu_read_ptr(x64, first_cpu,
f5daa829 VP	287	KiProcessorBlock + i * win_dump_ptr_size(x64),
fb21efe9	288	&Prcb)) {
2ad9b50f VP	289	error_setg(errp, "win-dump: failed to read"
	290	" CPU #%d PRCB location", i);
	291	return;
	292	}
	293
f5daa829	294	if (cpu_read_ptr(x64, first_cpu,
2ad9b50f	295	Prcb + OffsetPrcbContext,
fb21efe9	296	&Context)) {
2ad9b50f VP	297	error_setg(errp, "win-dump: failed to read"
	298	" CPU #%d ContextFrame location", i);
	299	return;
	300	}
	301
	302	saved_ctx[i].addr = Context;
	303
f5daa829 VP	304	if (x64) {
	305	ctx.x64 = (WinContext64){
	306	.ContextFlags = WIN_CTX64_ALL,
2ad9b50f	307	.MxCsr = env->mxcsr,
f5daa829 VP	308
	309	.SegEs = env->segs[0].selector,
	310	.SegCs = env->segs[1].selector,
	311	.SegSs = env->segs[2].selector,
	312	.SegDs = env->segs[3].selector,
	313	.SegFs = env->segs[4].selector,
	314	.SegGs = env->segs[5].selector,
	315	.EFlags = cpu_compute_eflags(env),
	316
	317	.Dr0 = env->dr[0],
	318	.Dr1 = env->dr[1],
	319	.Dr2 = env->dr[2],
	320	.Dr3 = env->dr[3],
	321	.Dr6 = env->dr[6],
	322	.Dr7 = env->dr[7],
	323
	324	.Rax = env->regs[R_EAX],
	325	.Rbx = env->regs[R_EBX],
	326	.Rcx = env->regs[R_ECX],
	327	.Rdx = env->regs[R_EDX],
	328	.Rsp = env->regs[R_ESP],
	329	.Rbp = env->regs[R_EBP],
	330	.Rsi = env->regs[R_ESI],
	331	.Rdi = env->regs[R_EDI],
	332	.R8 = env->regs[8],
	333	.R9 = env->regs[9],
	334	.R10 = env->regs[10],
	335	.R11 = env->regs[11],
	336	.R12 = env->regs[12],
	337	.R13 = env->regs[13],
	338	.R14 = env->regs[14],
	339	.R15 = env->regs[15],
	340
	341	.Rip = env->eip,
	342	.FltSave = {
	343	.MxCsr = env->mxcsr,
	344	},
	345	};
	346	} else {
	347	ctx.x32 = (WinContext32){
	348	.ContextFlags = WIN_CTX32_FULL \| WIN_CTX_DBG,
	349
	350	.SegEs = env->segs[0].selector,
	351	.SegCs = env->segs[1].selector,
	352	.SegSs = env->segs[2].selector,
	353	.SegDs = env->segs[3].selector,
	354	.SegFs = env->segs[4].selector,
	355	.SegGs = env->segs[5].selector,
	356	.EFlags = cpu_compute_eflags(env),
	357
	358	.Dr0 = env->dr[0],
	359	.Dr1 = env->dr[1],
	360	.Dr2 = env->dr[2],
	361	.Dr3 = env->dr[3],
	362	.Dr6 = env->dr[6],
	363	.Dr7 = env->dr[7],
	364
	365	.Eax = env->regs[R_EAX],
	366	.Ebx = env->regs[R_EBX],
	367	.Ecx = env->regs[R_ECX],
	368	.Edx = env->regs[R_EDX],
	369	.Esp = env->regs[R_ESP],
	370	.Ebp = env->regs[R_EBP],
	371	.Esi = env->regs[R_ESI],
372	.Edi = env->regs[R_EDI],
373
374	.Eip = env->eip,
375	};
376	}
2ad9b50f VP	377
2ad9b50f VP	378	if (cpu_memory_rw_debug(first_cpu, Context,
f5daa829	379	&saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
2ad9b50f VP	380	error_setg(errp, "win-dump: failed to save CPU #%d context", i);
	381	return;
	382	}
	383
	384	if (cpu_memory_rw_debug(first_cpu, Context,
f5daa829	385	&ctx, win_dump_ctx_size(x64), 1)) {
2ad9b50f VP	386	error_setg(errp, "win-dump: failed to write CPU #%d context", i);
	387	return;
	388	}
	389
	390	i++;
	391	}
	392	}
	393
f5daa829	394	static void restore_context(WinDumpHeader *h, bool x64,
2ad9b50f VP	395	struct saved_context *saved_ctx)
	396	{
	397	int i;
2ad9b50f	398
fb21efe9	399	for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
2ad9b50f	400	if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
f5daa829	401	&saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
b0e70950	402	warn_report("win-dump: failed to restore CPU #%d context", i);
2ad9b50f VP	403	}
	404	}
	405	}
	406
2da91b54 VP	407	void create_win_dump(DumpState s, Error *errp)
2da91b54 VP	408	{
f5daa829	409	WinDumpHeader h = (void )(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
92d1b3d5 VP	410	X86CPU *first_x86_cpu = X86_CPU(first_cpu);
92d1b3d5 VP	411	uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
2ad9b50f	412	struct saved_context *saved_ctx = NULL;
2da91b54	413	Error *local_err = NULL;
f5daa829 VP	414	bool x64 = true;
f5daa829 VP	415	size_t hdr_size;
2da91b54	416
f5daa829 VP	417	if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
f5daa829 VP	418	s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
2da91b54 VP	419	error_setg(errp, "win-dump: invalid vmcoreinfo note size");
	420	return;
	421	}
	422
f5daa829	423	if (!check_header(h, &x64, &local_err)) {
2da91b54 VP	424	error_propagate(errp, local_err);
	425	return;
	426	}
	427
f5daa829 VP	428	hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);
f5daa829 VP	429
92d1b3d5 VP	430	/*
	431	* Further access to kernel structures by virtual addresses
	432	* should be made from system context.
	433	*/
	434
fb21efe9	435	first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);
92d1b3d5	436
f5daa829	437	check_kdbg(h, x64, &local_err);
2da91b54 VP	438	if (local_err) {
2da91b54 VP	439	error_propagate(errp, local_err);
92d1b3d5	440	goto out_cr3;
2da91b54 VP	441	}
2da91b54 VP	442
f5daa829	443	patch_header(h, x64);
2da91b54	444
fb21efe9	445	saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));
2ad9b50f VP	446
	447	/*
	448	* Always patch context because there is no way
	449	* to determine if the system-saved context is valid
	450	*/
	451
f5daa829	452	patch_and_save_context(h, x64, saved_ctx, &local_err);
2ad9b50f VP	453	if (local_err) {
	454	error_propagate(errp, local_err);
	455	goto out_free;
	456	}
	457
fb21efe9	458	s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);
2da91b54	459
f5daa829 VP	460	s->written_size = qemu_write_full(s->fd, h, hdr_size);
f5daa829 VP	461	if (s->written_size != hdr_size) {
2da91b54	462	error_setg(errp, QERR_IO_ERROR);
2ad9b50f	463	goto out_restore;
2da91b54 VP	464	}
2da91b54 VP	465
f5daa829	466	write_runs(s, h, x64, &local_err);
2da91b54 VP	467	if (local_err) {
2da91b54 VP	468	error_propagate(errp, local_err);
2ad9b50f	469	goto out_restore;
2da91b54	470	}
92d1b3d5	471
2ad9b50f	472	out_restore:
f5daa829	473	restore_context(h, x64, saved_ctx);
2ad9b50f VP	474	out_free:
2ad9b50f VP	475	g_free(saved_ctx);
92d1b3d5 VP	476	out_cr3:
	477	first_x86_cpu->env.cr[3] = saved_cr3;
	478
	479	return;
2da91b54	480	}
efc3146a PMD	481
	482	#else /* !TARGET_X86_64 */
	483
	484	bool win_dump_available(Error **errp)
	485	{
	486	error_setg(errp, "Windows dump is only available for x86-64");
	487
	488	return false;
	489	}
	490
97244862 PMD	491	void create_win_dump(DumpState s, Error *errp)
	492	{
	493	win_dump_available(errp);
	494	}
	495
efc3146a	496	#endif