ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dump/win_dump: add 32-bit guest Windows support 

Before this patch, 'dump-guest-memory -w' was accepting only 64-bit
dump header provided by guest through vmcoreinfo and thus was unable
to produce 32-bit guest Windows dump. So, add 32-bit guest Windows
dumping support.

Signed-off-by: Viktor Prutyanov <viktor.prutyanov@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
[ misc error handling fixes to avoid compiler warning ]
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220406171558.199263-5-viktor.prutyanov@redhat.com>
This commit is contained in:
Viktor Prutyanov 2022-04-06 20:15:58 +03:00 committed by Marc-André Lureau
parent c4fe30921f
commit f5daa8293b
2 changed files with 154 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

251
dump/win_dump.c
View File

@ -23,18 +23,24 @@
#include "hw/misc/vmcoreinfo.h" #include "hw/misc/vmcoreinfo.h"
#include "win_dump.h" #include "win_dump.h"
#define WIN_DUMP_PTR_SIZE sizeof(uint64_t) static size_t win_dump_ptr_size(bool x64)
{
return x64 ? sizeof(uint64_t) : sizeof(uint32_t);
}
#define _WIN_DUMP_FIELD(f) (h->f) #define _WIN_DUMP_FIELD(f) (x64 ? h->x64.f : h->x32.f)
#define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field) #define WIN_DUMP_FIELD(field) _WIN_DUMP_FIELD(field)
#define _WIN_DUMP_FIELD_PTR(f) ((void *)&h->f) #define _WIN_DUMP_FIELD_PTR(f) (x64 ? (void *)&h->x64.f : (void *)&h->x32.f)
#define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field) #define WIN_DUMP_FIELD_PTR(field) _WIN_DUMP_FIELD_PTR(field)
#define _WIN_DUMP_FIELD_SIZE(f) sizeof(h->f) #define _WIN_DUMP_FIELD_SIZE(f) (x64 ? sizeof(h->x64.f) : sizeof(h->x32.f))
#define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field) #define WIN_DUMP_FIELD_SIZE(field) _WIN_DUMP_FIELD_SIZE(field)
#define WIN_DUMP_CTX_SIZE sizeof(WinContext64) static size_t win_dump_ctx_size(bool x64)
{
return x64 ? sizeof(WinContext64) : sizeof(WinContext32);
}
static size_t write_run(uint64_t base_page, uint64_t page_count, static size_t write_run(uint64_t base_page, uint64_t page_count,
int fd, Error **errp) int fd, Error **errp)
@ -70,7 +76,7 @@ static size_t write_run(uint64_t base_page, uint64_t page_count,
return total; return total;
} }
static void write_runs(DumpState *s, WinDumpHeader64 *h, Error **errp) static void write_runs(DumpState *s, WinDumpHeader *h, bool x64, Error **errp)
{ {
uint64_t BasePage, PageCount; uint64_t BasePage, PageCount;
Error *local_err = NULL; Error *local_err = NULL;
@ -87,22 +93,24 @@ static void write_runs(DumpState *s, WinDumpHeader64 *h, Error **errp)
} }
} }
static int cpu_read_ptr(CPUState *cpu, uint64_t addr, uint64_t *ptr) static int cpu_read_ptr(bool x64, CPUState *cpu, uint64_t addr, uint64_t *ptr)
{ {
int ret; int ret;
uint32_t ptr32;
uint64_t ptr64; uint64_t ptr64;
ret = cpu_memory_rw_debug(cpu, addr, &ptr64, WIN_DUMP_PTR_SIZE, 0); ret = cpu_memory_rw_debug(cpu, addr, x64 ? (void *)&ptr64 : (void *)&ptr32,
win_dump_ptr_size(x64), 0);
*ptr = ptr64; *ptr = x64 ? ptr64 : ptr32;
return ret; return ret;
} }
static void patch_mm_pfn_database(WinDumpHeader64 *h, Error **errp) static void patch_mm_pfn_database(WinDumpHeader *h, bool x64, Error **errp)
{ {
if (cpu_memory_rw_debug(first_cpu, if (cpu_memory_rw_debug(first_cpu,
WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET64, WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_MM_PFN_DATABASE_OFFSET,
WIN_DUMP_FIELD_PTR(PfnDatabase), WIN_DUMP_FIELD_PTR(PfnDatabase),
WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) { WIN_DUMP_FIELD_SIZE(PfnDatabase), 0)) {
error_setg(errp, "win-dump: failed to read MmPfnDatabase"); error_setg(errp, "win-dump: failed to read MmPfnDatabase");
@ -110,13 +118,12 @@ static void patch_mm_pfn_database(WinDumpHeader64 *h, Error **errp)
} }
} }
static void patch_bugcheck_data(WinDumpHeader64 *h, Error **errp) static void patch_bugcheck_data(WinDumpHeader *h, bool x64, Error **errp)
{ {
uint64_t KiBugcheckData; uint64_t KiBugcheckData;
if (cpu_read_ptr(first_cpu, if (cpu_read_ptr(x64, first_cpu,
WIN_DUMP_FIELD(KdDebuggerDataBlock) + WIN_DUMP_FIELD(KdDebuggerDataBlock) + KDBG_KI_BUGCHECK_DATA_OFFSET,
KDBG_KI_BUGCHECK_DATA_OFFSET64,
&KiBugcheckData)) { &KiBugcheckData)) {
error_setg(errp, "win-dump: failed to read KiBugcheckData"); error_setg(errp, "win-dump: failed to read KiBugcheckData");
return; return;
@ -141,45 +148,55 @@ static void patch_bugcheck_data(WinDumpHeader64 *h, Error **errp)
/* /*
* This routine tries to correct mistakes in crashdump header. * This routine tries to correct mistakes in crashdump header.
*/ */
static void patch_header(WinDumpHeader64 *h) static void patch_header(WinDumpHeader *h, bool x64)
{ {
Error *local_err = NULL; Error *local_err = NULL;
h->RequiredDumpSpace = sizeof(WinDumpHeader64) + if (x64) {
(h->PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS); h->x64.RequiredDumpSpace = sizeof(WinDumpHeader64) +
h->PhysicalMemoryBlock.unused = 0; (h->x64.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
h->unused1 = 0; h->x64.PhysicalMemoryBlock.unused = 0;
h->x64.unused1 = 0;
} else {
h->x32.RequiredDumpSpace = sizeof(WinDumpHeader32) +
(h->x32.PhysicalMemoryBlock.NumberOfPages << TARGET_PAGE_BITS);
}
patch_mm_pfn_database(h, &local_err); patch_mm_pfn_database(h, x64, &local_err);
if (local_err) { if (local_err) {
warn_report_err(local_err); warn_report_err(local_err);
local_err = NULL; local_err = NULL;
} }
patch_bugcheck_data(h, &local_err); patch_bugcheck_data(h, x64, &local_err);
if (local_err) { if (local_err) {
warn_report_err(local_err); warn_report_err(local_err);
} }
} }
static void check_header(WinDumpHeader64 *h, Error **errp) static bool check_header(WinDumpHeader *h, bool *x64, Error **errp)
{ {
const char Signature[] = "PAGE"; const char Signature[] = "PAGE";
const char ValidDump[] = "DU64";
if (memcmp(h->Signature, Signature, sizeof(h->Signature))) { if (memcmp(h->Signature, Signature, sizeof(h->Signature))) {
error_setg(errp, "win-dump: invalid header, expected '%.4s'," error_setg(errp, "win-dump: invalid header, expected '%.4s',"
" got '%.4s'", Signature, h->Signature); " got '%.4s'", Signature, h->Signature);
return; return false;
} }
if (memcmp(h->ValidDump, ValidDump, sizeof(h->ValidDump))) { if (!memcmp(h->ValidDump, "DUMP", sizeof(h->ValidDump))) {
error_setg(errp, "win-dump: invalid header, expected '%.4s'," *x64 = false;
" got '%.4s'", ValidDump, h->ValidDump); } else if (!memcmp(h->ValidDump, "DU64", sizeof(h->ValidDump))) {
return; *x64 = true;
} else {
error_setg(errp, "win-dump: invalid header, expected 'DUMP' or 'DU64',"
" got '%.4s'", h->ValidDump);
return false;
} }
return true;
} }
static void check_kdbg(WinDumpHeader64 *h, Error **errp) static void check_kdbg(WinDumpHeader *h, bool x64, Error **errp)
{ {
const char OwnerTag[] = "KDBG"; const char OwnerTag[] = "KDBG";
char read_OwnerTag[4]; char read_OwnerTag[4];
@ -188,7 +205,7 @@ static void check_kdbg(WinDumpHeader64 *h, Error **errp)
try_again: try_again:
if (cpu_memory_rw_debug(first_cpu, if (cpu_memory_rw_debug(first_cpu,
KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64, KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET,
(uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) { (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) {
error_setg(errp, "win-dump: failed to read OwnerTag"); error_setg(errp, "win-dump: failed to read OwnerTag");
return; return;
@ -213,15 +230,19 @@ try_again:
} }
} }
h->KdDebuggerDataBlock = KdDebuggerDataBlock; if (x64) {
h->x64.KdDebuggerDataBlock = KdDebuggerDataBlock;
} else {
h->x32.KdDebuggerDataBlock = KdDebuggerDataBlock;
}
} }
struct saved_context { struct saved_context {
WinContext64 ctx; WinContext ctx;
uint64_t addr; uint64_t addr;
}; };
static void patch_and_save_context(WinDumpHeader64 *h, static void patch_and_save_context(WinDumpHeader *h, bool x64,
struct saved_context *saved_ctx, struct saved_context *saved_ctx,
Error **errp) Error **errp)
{ {
@ -231,15 +252,15 @@ static void patch_and_save_context(WinDumpHeader64 *h,
CPUState *cpu; CPUState *cpu;
int i = 0; int i = 0;
if (cpu_read_ptr(first_cpu, if (cpu_read_ptr(x64, first_cpu,
KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET64, KdDebuggerDataBlock + KDBG_KI_PROCESSOR_BLOCK_OFFSET,
&KiProcessorBlock)) { &KiProcessorBlock)) {
error_setg(errp, "win-dump: failed to read KiProcessorBlock"); error_setg(errp, "win-dump: failed to read KiProcessorBlock");
return; return;
} }
if (cpu_memory_rw_debug(first_cpu, if (cpu_memory_rw_debug(first_cpu,
KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET64, KdDebuggerDataBlock + KDBG_OFFSET_PRCB_CONTEXT_OFFSET,
(uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) { (uint8_t *)&OffsetPrcbContext, sizeof(OffsetPrcbContext), 0)) {
error_setg(errp, "win-dump: failed to read OffsetPrcbContext"); error_setg(errp, "win-dump: failed to read OffsetPrcbContext");
return; return;
@ -250,17 +271,17 @@ static void patch_and_save_context(WinDumpHeader64 *h,
CPUX86State *env = &x86_cpu->env; CPUX86State *env = &x86_cpu->env;
uint64_t Prcb; uint64_t Prcb;
uint64_t Context; uint64_t Context;
WinContext64 ctx; WinContext ctx;
if (cpu_read_ptr(first_cpu, if (cpu_read_ptr(x64, first_cpu,
KiProcessorBlock + i * WIN_DUMP_PTR_SIZE, KiProcessorBlock + i * win_dump_ptr_size(x64),
&Prcb)) { &Prcb)) {
error_setg(errp, "win-dump: failed to read" error_setg(errp, "win-dump: failed to read"
" CPU #%d PRCB location", i); " CPU #%d PRCB location", i);
return; return;
} }
if (cpu_read_ptr(first_cpu, if (cpu_read_ptr(x64, first_cpu,
Prcb + OffsetPrcbContext, Prcb + OffsetPrcbContext,
&Context)) { &Context)) {
error_setg(errp, "win-dump: failed to read" error_setg(errp, "win-dump: failed to read"
@ -270,56 +291,88 @@ static void patch_and_save_context(WinDumpHeader64 *h,
saved_ctx[i].addr = Context; saved_ctx[i].addr = Context;
ctx = (WinContext64){ if (x64) {
.ContextFlags = WIN_CTX64_ALL, ctx.x64 = (WinContext64){
.MxCsr = env->mxcsr, .ContextFlags = WIN_CTX64_ALL,
.SegEs = env->segs[0].selector,
.SegCs = env->segs[1].selector,
.SegSs = env->segs[2].selector,
.SegDs = env->segs[3].selector,
.SegFs = env->segs[4].selector,
.SegGs = env->segs[5].selector,
.EFlags = cpu_compute_eflags(env),
.Dr0 = env->dr[0],
.Dr1 = env->dr[1],
.Dr2 = env->dr[2],
.Dr3 = env->dr[3],
.Dr6 = env->dr[6],
.Dr7 = env->dr[7],
.Rax = env->regs[R_EAX],
.Rbx = env->regs[R_EBX],
.Rcx = env->regs[R_ECX],
.Rdx = env->regs[R_EDX],
.Rsp = env->regs[R_ESP],
.Rbp = env->regs[R_EBP],
.Rsi = env->regs[R_ESI],
.Rdi = env->regs[R_EDI],
.R8 = env->regs[8],
.R9 = env->regs[9],
.R10 = env->regs[10],
.R11 = env->regs[11],
.R12 = env->regs[12],
.R13 = env->regs[13],
.R14 = env->regs[14],
.R15 = env->regs[15],
.Rip = env->eip,
.FltSave = {
.MxCsr = env->mxcsr, .MxCsr = env->mxcsr,
},
}; .SegEs = env->segs[0].selector,
.SegCs = env->segs[1].selector,
.SegSs = env->segs[2].selector,
.SegDs = env->segs[3].selector,
.SegFs = env->segs[4].selector,
.SegGs = env->segs[5].selector,
.EFlags = cpu_compute_eflags(env),
.Dr0 = env->dr[0],
.Dr1 = env->dr[1],
.Dr2 = env->dr[2],
.Dr3 = env->dr[3],
.Dr6 = env->dr[6],
.Dr7 = env->dr[7],
.Rax = env->regs[R_EAX],
.Rbx = env->regs[R_EBX],
.Rcx = env->regs[R_ECX],
.Rdx = env->regs[R_EDX],
.Rsp = env->regs[R_ESP],
.Rbp = env->regs[R_EBP],
.Rsi = env->regs[R_ESI],
.Rdi = env->regs[R_EDI],
.R8 = env->regs[8],
.R9 = env->regs[9],
.R10 = env->regs[10],
.R11 = env->regs[11],
.R12 = env->regs[12],
.R13 = env->regs[13],
.R14 = env->regs[14],
.R15 = env->regs[15],
.Rip = env->eip,
.FltSave = {
.MxCsr = env->mxcsr,
},
};
} else {
ctx.x32 = (WinContext32){
.ContextFlags = WIN_CTX32_FULL | WIN_CTX_DBG,
.SegEs = env->segs[0].selector,
.SegCs = env->segs[1].selector,
.SegSs = env->segs[2].selector,
.SegDs = env->segs[3].selector,
.SegFs = env->segs[4].selector,
.SegGs = env->segs[5].selector,
.EFlags = cpu_compute_eflags(env),
.Dr0 = env->dr[0],
.Dr1 = env->dr[1],
.Dr2 = env->dr[2],
.Dr3 = env->dr[3],
.Dr6 = env->dr[6],
.Dr7 = env->dr[7],
.Eax = env->regs[R_EAX],
.Ebx = env->regs[R_EBX],
.Ecx = env->regs[R_ECX],
.Edx = env->regs[R_EDX],
.Esp = env->regs[R_ESP],
.Ebp = env->regs[R_EBP],
.Esi = env->regs[R_ESI],
.Edi = env->regs[R_EDI],
.Eip = env->eip,
};
}
if (cpu_memory_rw_debug(first_cpu, Context, if (cpu_memory_rw_debug(first_cpu, Context,
&saved_ctx[i].ctx, WIN_DUMP_CTX_SIZE, 0)) { &saved_ctx[i].ctx, win_dump_ctx_size(x64), 0)) {
error_setg(errp, "win-dump: failed to save CPU #%d context", i); error_setg(errp, "win-dump: failed to save CPU #%d context", i);
return; return;
} }
if (cpu_memory_rw_debug(first_cpu, Context, if (cpu_memory_rw_debug(first_cpu, Context,
&ctx, WIN_DUMP_CTX_SIZE, 1)) { &ctx, win_dump_ctx_size(x64), 1)) {
error_setg(errp, "win-dump: failed to write CPU #%d context", i); error_setg(errp, "win-dump: failed to write CPU #%d context", i);
return; return;
} }
@ -328,14 +381,14 @@ static void patch_and_save_context(WinDumpHeader64 *h,
} }
} }
static void restore_context(WinDumpHeader64 *h, static void restore_context(WinDumpHeader *h, bool x64,
struct saved_context *saved_ctx) struct saved_context *saved_ctx)
{ {
int i; int i;
for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) { for (i = 0; i < WIN_DUMP_FIELD(NumberProcessors); i++) {
if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr, if (cpu_memory_rw_debug(first_cpu, saved_ctx[i].addr,
&saved_ctx[i].ctx, WIN_DUMP_CTX_SIZE, 1)) { &saved_ctx[i].ctx, win_dump_ctx_size(x64), 1)) {
warn_report("win-dump: failed to restore CPU #%d context", i); warn_report("win-dump: failed to restore CPU #%d context", i);
} }
} }
@ -343,25 +396,27 @@ static void restore_context(WinDumpHeader64 *h,
void create_win_dump(DumpState *s, Error **errp) void create_win_dump(DumpState *s, Error **errp)
{ {
WinDumpHeader64 *h = (WinDumpHeader64 *)(s->guest_note + WinDumpHeader *h = (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_SIZE);
VMCOREINFO_ELF_NOTE_HDR_SIZE);
X86CPU *first_x86_cpu = X86_CPU(first_cpu); X86CPU *first_x86_cpu = X86_CPU(first_cpu);
uint64_t saved_cr3 = first_x86_cpu->env.cr[3]; uint64_t saved_cr3 = first_x86_cpu->env.cr[3];
struct saved_context *saved_ctx = NULL; struct saved_context *saved_ctx = NULL;
Error *local_err = NULL; Error *local_err = NULL;
bool x64 = true;
size_t hdr_size;
if (s->guest_note_size != sizeof(WinDumpHeader64) + if (s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE32 &&
VMCOREINFO_ELF_NOTE_HDR_SIZE) { s->guest_note_size != VMCOREINFO_WIN_DUMP_NOTE_SIZE64) {
error_setg(errp, "win-dump: invalid vmcoreinfo note size"); error_setg(errp, "win-dump: invalid vmcoreinfo note size");
return; return;
} }
check_header(h, &local_err); if (!check_header(h, &x64, &local_err)) {
if (local_err) {
error_propagate(errp, local_err); error_propagate(errp, local_err);
return; return;
} }
hdr_size = x64 ? sizeof(WinDumpHeader64) : sizeof(WinDumpHeader32);
/* /*
* Further access to kernel structures by virtual addresses * Further access to kernel structures by virtual addresses
* should be made from system context. * should be made from system context.
@ -369,13 +424,13 @@ void create_win_dump(DumpState *s, Error **errp)
first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase); first_x86_cpu->env.cr[3] = WIN_DUMP_FIELD(DirectoryTableBase);
check_kdbg(h, &local_err); check_kdbg(h, x64, &local_err);
if (local_err) { if (local_err) {
error_propagate(errp, local_err); error_propagate(errp, local_err);
goto out_cr3; goto out_cr3;
} }
patch_header(h); patch_header(h, x64);
saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors)); saved_ctx = g_new(struct saved_context, WIN_DUMP_FIELD(NumberProcessors));
@ -384,7 +439,7 @@ void create_win_dump(DumpState *s, Error **errp)
* to determine if the system-saved context is valid * to determine if the system-saved context is valid
*/ */
patch_and_save_context(h, saved_ctx, &local_err); patch_and_save_context(h, x64, saved_ctx, &local_err);
if (local_err) { if (local_err) {
error_propagate(errp, local_err); error_propagate(errp, local_err);
goto out_free; goto out_free;
@ -392,20 +447,20 @@ void create_win_dump(DumpState *s, Error **errp)
s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace); s->total_size = WIN_DUMP_FIELD(RequiredDumpSpace);
s->written_size = qemu_write_full(s->fd, h, sizeof(*h)); s->written_size = qemu_write_full(s->fd, h, hdr_size);
if (s->written_size != sizeof(*h)) { if (s->written_size != hdr_size) {
error_setg(errp, QERR_IO_ERROR); error_setg(errp, QERR_IO_ERROR);
goto out_restore; goto out_restore;
} }
write_runs(s, h, &local_err); write_runs(s, h, x64, &local_err);
if (local_err) { if (local_err) {
error_propagate(errp, local_err); error_propagate(errp, local_err);
goto out_restore; goto out_restore;
} }
out_restore: out_restore:
restore_context(h, saved_ctx); restore_context(h, x64, saved_ctx);
out_free: out_free:
g_free(saved_ctx); g_free(saved_ctx);
out_cr3: out_cr3:

2
hmp-commands.hx
View File

@ -1064,7 +1064,7 @@ ERST
"-l: dump in kdump-compressed format, with lzo compression.\n\t\t\t" "-l: dump in kdump-compressed format, with lzo compression.\n\t\t\t"
"-s: dump in kdump-compressed format, with snappy compression.\n\t\t\t" "-s: dump in kdump-compressed format, with snappy compression.\n\t\t\t"
"-w: dump in Windows crashdump format (can be used instead of ELF-dump converting),\n\t\t\t" "-w: dump in Windows crashdump format (can be used instead of ELF-dump converting),\n\t\t\t"
" for Windows x64 guests with vmcoreinfo driver only.\n\t\t\t" " for Windows x86 and x64 guests with vmcoreinfo driver only.\n\t\t\t"
"begin: the starting physical address.\n\t\t\t" "begin: the starting physical address.\n\t\t\t"
"length: the memory size, in bytes.", "length: the memory size, in bytes.",
.cmd = hmp_dump_guest_memory, .cmd = hmp_dump_guest_memory,