[qemu.git] / win_dump.h

/*
 * Windows crashdump
 *
 * Copyright (c) 2018 Virtuozzo International GmbH
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */

typedef struct WinDumpPhyMemRun64 {
    uint64_t BasePage;
    uint64_t PageCount;
} QEMU_PACKED WinDumpPhyMemRun64;

typedef struct WinDumpPhyMemDesc64 {
    uint32_t NumberOfRuns;
    uint32_t unused;
    uint64_t NumberOfPages;
    WinDumpPhyMemRun64 Run[43];
} QEMU_PACKED WinDumpPhyMemDesc64;

typedef struct WinDumpExceptionRecord {
    uint32_t ExceptionCode;
    uint32_t ExceptionFlags;
    uint64_t ExceptionRecord;
    uint64_t ExceptionAddress;
    uint32_t NumberParameters;
    uint32_t unused;
    uint64_t ExceptionInformation[15];
} QEMU_PACKED WinDumpExceptionRecord;

typedef struct WinDumpHeader64 {
    char Signature[4];
    char ValidDump[4];
    uint32_t MajorVersion;
    uint32_t MinorVersion;
    uint64_t DirectoryTableBase;
    uint64_t PfnDatabase;
    uint64_t PsLoadedModuleList;
    uint64_t PsActiveProcessHead;
    uint32_t MachineImageType;
    uint32_t NumberProcessors;
    union {
        struct {
            uint32_t BugcheckCode;
            uint32_t unused0;
            uint64_t BugcheckParameter1;
            uint64_t BugcheckParameter2;
            uint64_t BugcheckParameter3;
            uint64_t BugcheckParameter4;
        };
        uint8_t BugcheckData[40];
    };
    uint8_t VersionUser[32];
    uint64_t KdDebuggerDataBlock;
    union {
        WinDumpPhyMemDesc64 PhysicalMemoryBlock;
        uint8_t PhysicalMemoryBlockBuffer[704];
    };
    union {
        uint8_t ContextBuffer[3000];
    };
    WinDumpExceptionRecord Exception;
    uint32_t DumpType;
    uint32_t unused1;
    uint64_t RequiredDumpSpace;
    uint64_t SystemTime;
    char Comment[128];
    uint64_t SystemUpTime;
    uint32_t MiniDumpFields;
    uint32_t SecondaryDataState;
    uint32_t ProductType;
    uint32_t SuiteMask;
    uint32_t WriterStatus;
    uint8_t unused2;
    uint8_t KdSecondaryVersion;
    uint8_t reserved[4018];
} QEMU_PACKED WinDumpHeader64;

void create_win_dump(DumpState *s, Error **errp);

#define KDBG_OWNER_TAG_OFFSET64             0x10
#define KDBG_MM_PFN_DATABASE_OFFSET64       0xC0
#define KDBG_KI_BUGCHECK_DATA_OFFSET64      0x88
#define KDBG_KI_PROCESSOR_BLOCK_OFFSET64    0x218
#define KDBG_OFFSET_PRCB_CONTEXT_OFFSET64   0x338

#define VMCOREINFO_ELF_NOTE_HDR_SIZE    24

#define WIN_CTX_X64 0x00100000L

#define WIN_CTX_CTL 0x00000001L
#define WIN_CTX_INT 0x00000002L
#define WIN_CTX_SEG 0x00000004L
#define WIN_CTX_FP  0x00000008L
#define WIN_CTX_DBG 0x00000010L

#define WIN_CTX_FULL    (WIN_CTX_X64 | WIN_CTX_CTL | WIN_CTX_INT | WIN_CTX_FP)
#define WIN_CTX_ALL     (WIN_CTX_FULL | WIN_CTX_SEG | WIN_CTX_DBG)

#define LIVE_SYSTEM_DUMP    0x00000161

typedef struct WinM128A {
    uint64_t low;
    int64_t high;
} QEMU_ALIGNED(16) WinM128A;

typedef struct WinContext {
    uint64_t PHome[6];

    uint32_t ContextFlags;
    uint32_t MxCsr;

    uint16_t SegCs;
    uint16_t SegDs;
    uint16_t SegEs;
    uint16_t SegFs;
    uint16_t SegGs;
    uint16_t SegSs;
    uint32_t EFlags;

    uint64_t Dr0;
    uint64_t Dr1;
    uint64_t Dr2;
    uint64_t Dr3;
    uint64_t Dr6;
    uint64_t Dr7;

    uint64_t Rax;
    uint64_t Rcx;
    uint64_t Rdx;
    uint64_t Rbx;
    uint64_t Rsp;
    uint64_t Rbp;
    uint64_t Rsi;
    uint64_t Rdi;
    uint64_t R8;
    uint64_t R9;
    uint64_t R10;
    uint64_t R11;
    uint64_t R12;
    uint64_t R13;
    uint64_t R14;
    uint64_t R15;

    uint64_t Rip;

    struct {
        uint16_t ControlWord;
        uint16_t StatusWord;
        uint8_t TagWord;
        uint8_t Reserved1;
        uint16_t ErrorOpcode;
        uint32_t ErrorOffset;
        uint16_t ErrorSelector;
        uint16_t Reserved2;
        uint32_t DataOffset;
        uint16_t DataSelector;
        uint16_t Reserved3;
        uint32_t MxCsr;
        uint32_t MxCsr_Mask;
        WinM128A FloatRegisters[8];
        WinM128A XmmRegisters[16];
        uint8_t Reserved4[96];
    } FltSave;

    WinM128A VectorRegister[26];
    uint64_t VectorControl;

    uint64_t DebugControl;
    uint64_t LastBranchToRip;
    uint64_t LastBranchFromRip;
    uint64_t LastExceptionToRip;
    uint64_t LastExceptionFromRip;
} QEMU_ALIGNED(16) WinContext;
Commit	Line	Data
2da91b54 VP	1	/*
	2	* Windows crashdump
	3	*
	4	* Copyright (c) 2018 Virtuozzo International GmbH
	5	*
	6	* This work is licensed under the terms of the GNU GPL, version 2 or later.
	7	* See the COPYING file in the top-level directory.
	8	*
	9	*/
	10
	11	typedef struct WinDumpPhyMemRun64 {
	12	uint64_t BasePage;
	13	uint64_t PageCount;
	14	} QEMU_PACKED WinDumpPhyMemRun64;
	15
	16	typedef struct WinDumpPhyMemDesc64 {
	17	uint32_t NumberOfRuns;
	18	uint32_t unused;
	19	uint64_t NumberOfPages;
	20	WinDumpPhyMemRun64 Run[43];
	21	} QEMU_PACKED WinDumpPhyMemDesc64;
	22
	23	typedef struct WinDumpExceptionRecord {
	24	uint32_t ExceptionCode;
	25	uint32_t ExceptionFlags;
	26	uint64_t ExceptionRecord;
	27	uint64_t ExceptionAddress;
	28	uint32_t NumberParameters;
	29	uint32_t unused;
	30	uint64_t ExceptionInformation[15];
	31	} QEMU_PACKED WinDumpExceptionRecord;
	32
	33	typedef struct WinDumpHeader64 {
	34	char Signature[4];
	35	char ValidDump[4];
	36	uint32_t MajorVersion;
	37	uint32_t MinorVersion;
	38	uint64_t DirectoryTableBase;
	39	uint64_t PfnDatabase;
	40	uint64_t PsLoadedModuleList;
	41	uint64_t PsActiveProcessHead;
	42	uint32_t MachineImageType;
	43	uint32_t NumberProcessors;
	44	union {
	45	struct {
	46	uint32_t BugcheckCode;
	47	uint32_t unused0;
	48	uint64_t BugcheckParameter1;
	49	uint64_t BugcheckParameter2;
	50	uint64_t BugcheckParameter3;
	51	uint64_t BugcheckParameter4;
	52	};
	53	uint8_t BugcheckData[40];
	54	};
	55	uint8_t VersionUser[32];
	56	uint64_t KdDebuggerDataBlock;
	57	union {
	58	WinDumpPhyMemDesc64 PhysicalMemoryBlock;
	59	uint8_t PhysicalMemoryBlockBuffer[704];
	60	};
	61	union {
	62	uint8_t ContextBuffer[3000];
	63	};
	64	WinDumpExceptionRecord Exception;
65	uint32_t DumpType;
66	uint32_t unused1;
67	uint64_t RequiredDumpSpace;
68	uint64_t SystemTime;
69	char Comment[128];
70	uint64_t SystemUpTime;
71	uint32_t MiniDumpFields;
72	uint32_t SecondaryDataState;
73	uint32_t ProductType;
74	uint32_t SuiteMask;
75	uint32_t WriterStatus;
76	uint8_t unused2;
77	uint8_t KdSecondaryVersion;
78	uint8_t reserved[4018];
79	} QEMU_PACKED WinDumpHeader64;
80
81	void create_win_dump(DumpState s, Error *errp);
82
2ad9b50f VP	83	#define KDBG_OWNER_TAG_OFFSET64 0x10
	84	#define KDBG_MM_PFN_DATABASE_OFFSET64 0xC0
	85	#define KDBG_KI_BUGCHECK_DATA_OFFSET64 0x88
	86	#define KDBG_KI_PROCESSOR_BLOCK_OFFSET64 0x218
	87	#define KDBG_OFFSET_PRCB_CONTEXT_OFFSET64 0x338
2da91b54 VP	88
2da91b54 VP	89	#define VMCOREINFO_ELF_NOTE_HDR_SIZE 24
2ad9b50f VP	90
	91	#define WIN_CTX_X64 0x00100000L
	92
	93	#define WIN_CTX_CTL 0x00000001L
	94	#define WIN_CTX_INT 0x00000002L
	95	#define WIN_CTX_SEG 0x00000004L
	96	#define WIN_CTX_FP 0x00000008L
	97	#define WIN_CTX_DBG 0x00000010L
	98
	99	#define WIN_CTX_FULL (WIN_CTX_X64 \| WIN_CTX_CTL \| WIN_CTX_INT \| WIN_CTX_FP)
	100	#define WIN_CTX_ALL (WIN_CTX_FULL \| WIN_CTX_SEG \| WIN_CTX_DBG)
	101
	102	#define LIVE_SYSTEM_DUMP 0x00000161
	103
	104	typedef struct WinM128A {
	105	uint64_t low;
	106	int64_t high;
	107	} QEMU_ALIGNED(16) WinM128A;
	108
	109	typedef struct WinContext {
	110	uint64_t PHome[6];
	111
	112	uint32_t ContextFlags;
	113	uint32_t MxCsr;
	114
	115	uint16_t SegCs;
	116	uint16_t SegDs;
	117	uint16_t SegEs;
	118	uint16_t SegFs;
	119	uint16_t SegGs;
	120	uint16_t SegSs;
	121	uint32_t EFlags;
	122
	123	uint64_t Dr0;
	124	uint64_t Dr1;
	125	uint64_t Dr2;
	126	uint64_t Dr3;
	127	uint64_t Dr6;
	128	uint64_t Dr7;
	129
	130	uint64_t Rax;
	131	uint64_t Rcx;
	132	uint64_t Rdx;
	133	uint64_t Rbx;
	134	uint64_t Rsp;
	135	uint64_t Rbp;
	136	uint64_t Rsi;
	137	uint64_t Rdi;
	138	uint64_t R8;
	139	uint64_t R9;
	140	uint64_t R10;
	141	uint64_t R11;
	142	uint64_t R12;
	143	uint64_t R13;
	144	uint64_t R14;
	145	uint64_t R15;
	146
	147	uint64_t Rip;
	148
	149	struct {
	150	uint16_t ControlWord;
	151	uint16_t StatusWord;
	152	uint8_t TagWord;
	153	uint8_t Reserved1;
154	uint16_t ErrorOpcode;
155	uint32_t ErrorOffset;
156	uint16_t ErrorSelector;
157	uint16_t Reserved2;
158	uint32_t DataOffset;
159	uint16_t DataSelector;
160	uint16_t Reserved3;
161	uint32_t MxCsr;
162	uint32_t MxCsr_Mask;
163	WinM128A FloatRegisters[8];
164	WinM128A XmmRegisters[16];
165	uint8_t Reserved4[96];
166	} FltSave;
167
168	WinM128A VectorRegister[26];
169	uint64_t VectorControl;
170
171	uint64_t DebugControl;
172	uint64_t LastBranchToRip;
173	uint64_t LastBranchFromRip;
174	uint64_t LastExceptionToRip;
175	uint64_t LastExceptionFromRip;
176	} QEMU_ALIGNED(16) WinContext;