aboutsummaryrefslogtreecommitdiff
path: root/contrib/elf2dmp
diff options
context:
space:
mode:
Diffstat (limited to 'contrib/elf2dmp')
-rw-r--r--contrib/elf2dmp/Makefile.objs1
-rw-r--r--contrib/elf2dmp/addrspace.c104
-rw-r--r--contrib/elf2dmp/addrspace.h13
-rw-r--r--contrib/elf2dmp/download.c30
-rw-r--r--contrib/elf2dmp/download.h2
-rw-r--r--contrib/elf2dmp/kdbg.h12
-rw-r--r--contrib/elf2dmp/main.c403
-rw-r--r--contrib/elf2dmp/meson.build5
-rw-r--r--contrib/elf2dmp/pdb.c139
-rw-r--r--contrib/elf2dmp/pdb.h8
-rw-r--r--contrib/elf2dmp/pe.h119
-rw-r--r--contrib/elf2dmp/qemu_elf.c252
-rw-r--r--contrib/elf2dmp/qemu_elf.h15
13 files changed, 649 insertions, 454 deletions
diff --git a/contrib/elf2dmp/Makefile.objs b/contrib/elf2dmp/Makefile.objs
deleted file mode 100644
index e3140f58cf..0000000000
--- a/contrib/elf2dmp/Makefile.objs
+++ /dev/null
@@ -1 +0,0 @@
-elf2dmp-obj-y = main.o addrspace.o download.o pdb.o qemu_elf.o
diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
index 8a76069cb5..81295a1153 100644
--- a/contrib/elf2dmp/addrspace.c
+++ b/contrib/elf2dmp/addrspace.c
@@ -11,9 +11,10 @@
static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
{
size_t i;
+
for (i = 0; i < ps->block_nr; i++) {
if (ps->block[i].paddr <= pa &&
- pa <= ps->block[i].paddr + ps->block[i].size) {
+ pa < ps->block[i].paddr + ps->block[i].size) {
return ps->block + i;
}
}
@@ -21,7 +22,7 @@ static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
return NULL;
}
-static uint8_t *pa_space_resolve(struct pa_space *ps, uint64_t pa)
+static void *pa_space_resolve(struct pa_space *ps, uint64_t pa)
{
struct pa_block *block = pa_space_find_block(ps, pa);
@@ -32,7 +33,44 @@ static uint8_t *pa_space_resolve(struct pa_space *ps, uint64_t pa)
return block->addr + (pa - block->paddr);
}
-int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
+static bool pa_space_read64(struct pa_space *ps, uint64_t pa, uint64_t *value)
+{
+ uint64_t *resolved = pa_space_resolve(ps, pa);
+
+ if (!resolved) {
+ return false;
+ }
+
+ *value = *resolved;
+
+ return true;
+}
+
+static void pa_block_align(struct pa_block *b)
+{
+ uint64_t low_align = ((b->paddr - 1) | ELF2DMP_PAGE_MASK) + 1 - b->paddr;
+ uint64_t high_align = (b->paddr + b->size) & ELF2DMP_PAGE_MASK;
+
+ if (low_align == 0 && high_align == 0) {
+ return;
+ }
+
+ if (low_align + high_align < b->size) {
+ printf("Block 0x%"PRIx64"+:0x%"PRIx64" will be aligned to "
+ "0x%"PRIx64"+:0x%"PRIx64"\n", b->paddr, b->size,
+ b->paddr + low_align, b->size - low_align - high_align);
+ b->size -= low_align + high_align;
+ } else {
+ printf("Block 0x%"PRIx64"+:0x%"PRIx64" is too small to align\n",
+ b->paddr, b->size);
+ b->size = 0;
+ }
+
+ b->addr += low_align;
+ b->paddr += low_align;
+}
+
+void pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
{
Elf64_Half phdr_nr = elf_getphdrnum(qemu_elf->map);
Elf64_Phdr *phdr = elf64_getphdr(qemu_elf->map);
@@ -47,29 +85,28 @@ int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
}
}
- ps->block = malloc(sizeof(*ps->block) * ps->block_nr);
- if (!ps->block) {
- return 1;
- }
+ ps->block = g_new(struct pa_block, ps->block_nr);
for (i = 0; i < phdr_nr; i++) {
- if (phdr[i].p_type == PT_LOAD) {
+ if (phdr[i].p_type == PT_LOAD && phdr[i].p_offset < qemu_elf->size) {
ps->block[block_i] = (struct pa_block) {
.addr = (uint8_t *)qemu_elf->map + phdr[i].p_offset,
.paddr = phdr[i].p_paddr,
- .size = phdr[i].p_filesz,
+ .size = MIN(phdr[i].p_filesz,
+ qemu_elf->size - phdr[i].p_offset),
};
- block_i++;
+ pa_block_align(&ps->block[block_i]);
+ block_i = ps->block[block_i].size ? (block_i + 1) : block_i;
}
}
- return 0;
+ ps->block_nr = block_i;
}
void pa_space_destroy(struct pa_space *ps)
{
ps->block_nr = 0;
- free(ps->block);
+ g_free(ps->block);
}
void va_space_set_dtb(struct va_space *vs, uint64_t dtb)
@@ -83,19 +120,20 @@ void va_space_create(struct va_space *vs, struct pa_space *ps, uint64_t dtb)
va_space_set_dtb(vs, dtb);
}
-static uint64_t get_pml4e(struct va_space *vs, uint64_t va)
+static bool get_pml4e(struct va_space *vs, uint64_t va, uint64_t *value)
{
uint64_t pa = (vs->dtb & 0xffffffffff000) | ((va & 0xff8000000000) >> 36);
- return *(uint64_t *)pa_space_resolve(vs->ps, pa);
+ return pa_space_read64(vs->ps, pa, value);
}
-static uint64_t get_pdpi(struct va_space *vs, uint64_t va, uint64_t pml4e)
+static bool get_pdpi(struct va_space *vs, uint64_t va, uint64_t pml4e,
+ uint64_t *value)
{
uint64_t pdpte_paddr = (pml4e & 0xffffffffff000) |
((va & 0x7FC0000000) >> 27);
- return *(uint64_t *)pa_space_resolve(vs->ps, pdpte_paddr);
+ return pa_space_read64(vs->ps, pdpte_paddr, value);
}
static uint64_t pde_index(uint64_t va)
@@ -108,11 +146,12 @@ static uint64_t pdba_base(uint64_t pdpe)
return pdpe & 0xFFFFFFFFFF000;
}
-static uint64_t get_pgd(struct va_space *vs, uint64_t va, uint64_t pdpe)
+static bool get_pgd(struct va_space *vs, uint64_t va, uint64_t pdpe,
+ uint64_t *value)
{
uint64_t pgd_entry = pdba_base(pdpe) + pde_index(va) * 8;
- return *(uint64_t *)pa_space_resolve(vs->ps, pgd_entry);
+ return pa_space_read64(vs->ps, pgd_entry, value);
}
static uint64_t pte_index(uint64_t va)
@@ -125,11 +164,12 @@ static uint64_t ptba_base(uint64_t pde)
return pde & 0xFFFFFFFFFF000;
}
-static uint64_t get_pte(struct va_space *vs, uint64_t va, uint64_t pgd)
+static bool get_pte(struct va_space *vs, uint64_t va, uint64_t pgd,
+ uint64_t *value)
{
uint64_t pgd_val = ptba_base(pgd) + pte_index(va) * 8;
- return *(uint64_t *)pa_space_resolve(vs->ps, pgd_val);
+ return pa_space_read64(vs->ps, pgd_val, value);
}
static uint64_t get_paddr(uint64_t va, uint64_t pte)
@@ -161,13 +201,11 @@ static uint64_t va_space_va2pa(struct va_space *vs, uint64_t va)
{
uint64_t pml4e, pdpe, pgd, pte;
- pml4e = get_pml4e(vs, va);
- if (!is_present(pml4e)) {
+ if (!get_pml4e(vs, va, &pml4e) || !is_present(pml4e)) {
return INVALID_PA;
}
- pdpe = get_pdpi(vs, va, pml4e);
- if (!is_present(pdpe)) {
+ if (!get_pdpi(vs, va, pml4e, &pdpe) || !is_present(pdpe)) {
return INVALID_PA;
}
@@ -175,8 +213,7 @@ static uint64_t va_space_va2pa(struct va_space *vs, uint64_t va)
return get_1GB_paddr(va, pdpe);
}
- pgd = get_pgd(vs, va, pdpe);
- if (!is_present(pgd)) {
+ if (!get_pgd(vs, va, pdpe, &pgd) || !is_present(pgd)) {
return INVALID_PA;
}
@@ -184,8 +221,7 @@ static uint64_t va_space_va2pa(struct va_space *vs, uint64_t va)
return get_2MB_paddr(va, pgd);
}
- pte = get_pte(vs, va, pgd);
- if (!is_present(pte)) {
+ if (!get_pte(vs, va, pgd, &pte) || !is_present(pte)) {
return INVALID_PA;
}
@@ -203,19 +239,19 @@ void *va_space_resolve(struct va_space *vs, uint64_t va)
return pa_space_resolve(vs->ps, pa);
}
-int va_space_rw(struct va_space *vs, uint64_t addr,
- void *buf, size_t size, int is_write)
+bool va_space_rw(struct va_space *vs, uint64_t addr,
+ void *buf, size_t size, int is_write)
{
while (size) {
- uint64_t page = addr & PFN_MASK;
- size_t s = (page + PAGE_SIZE) - addr;
+ uint64_t page = addr & ELF2DMP_PFN_MASK;
+ size_t s = (page + ELF2DMP_PAGE_SIZE) - addr;
void *ptr;
s = (s > size) ? size : s;
ptr = va_space_resolve(vs, addr);
if (!ptr) {
- return 1;
+ return false;
}
if (is_write) {
@@ -229,5 +265,5 @@ int va_space_rw(struct va_space *vs, uint64_t addr,
addr += s;
}
- return 0;
+ return true;
}
diff --git a/contrib/elf2dmp/addrspace.h b/contrib/elf2dmp/addrspace.h
index d87f6a18c6..2ad30a9da4 100644
--- a/contrib/elf2dmp/addrspace.h
+++ b/contrib/elf2dmp/addrspace.h
@@ -10,9 +10,10 @@
#include "qemu_elf.h"
-#define PAGE_BITS 12
-#define PAGE_SIZE (1ULL << PAGE_BITS)
-#define PFN_MASK (~(PAGE_SIZE - 1))
+#define ELF2DMP_PAGE_BITS 12
+#define ELF2DMP_PAGE_SIZE (1ULL << ELF2DMP_PAGE_BITS)
+#define ELF2DMP_PAGE_MASK (ELF2DMP_PAGE_SIZE - 1)
+#define ELF2DMP_PFN_MASK (~(ELF2DMP_PAGE_SIZE - 1))
#define INVALID_PA UINT64_MAX
@@ -32,13 +33,13 @@ struct va_space {
struct pa_space *ps;
};
-int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf);
+void pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf);
void pa_space_destroy(struct pa_space *ps);
void va_space_create(struct va_space *vs, struct pa_space *ps, uint64_t dtb);
void va_space_set_dtb(struct va_space *vs, uint64_t dtb);
void *va_space_resolve(struct va_space *vs, uint64_t va);
-int va_space_rw(struct va_space *vs, uint64_t addr,
- void *buf, size_t size, int is_write);
+bool va_space_rw(struct va_space *vs, uint64_t addr,
+ void *buf, size_t size, int is_write);
#endif /* ADDRSPACE_H */
diff --git a/contrib/elf2dmp/download.c b/contrib/elf2dmp/download.c
index d09e607431..21306b3fd4 100644
--- a/contrib/elf2dmp/download.c
+++ b/contrib/elf2dmp/download.c
@@ -9,39 +9,35 @@
#include <curl/curl.h>
#include "download.h"
-int download_url(const char *name, const char *url)
+bool download_url(const char *name, const char *url)
{
- int err = 0;
+ bool success = false;
FILE *file;
CURL *curl = curl_easy_init();
if (!curl) {
- return 1;
+ return false;
}
file = fopen(name, "wb");
if (!file) {
- err = 1;
goto out_curl;
}
- curl_easy_setopt(curl, CURLOPT_URL, url);
- curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL);
- curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
- curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
- curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0);
-
- if (curl_easy_perform(curl) != CURLE_OK) {
- err = 1;
- fclose(file);
+ if (curl_easy_setopt(curl, CURLOPT_URL, url) != CURLE_OK
+ || curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL) != CURLE_OK
+ || curl_easy_setopt(curl, CURLOPT_WRITEDATA, file) != CURLE_OK
+ || curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1) != CURLE_OK
+ || curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK
+ || curl_easy_perform(curl) != CURLE_OK) {
unlink(name);
- goto out_curl;
+ fclose(file);
+ } else {
+ success = !fclose(file);
}
- err = fclose(file);
-
out_curl:
curl_easy_cleanup(curl);
- return err;
+ return success;
}
diff --git a/contrib/elf2dmp/download.h b/contrib/elf2dmp/download.h
index 5c274925f7..f65adb5d08 100644
--- a/contrib/elf2dmp/download.h
+++ b/contrib/elf2dmp/download.h
@@ -8,6 +8,6 @@
#ifndef DOWNLOAD_H
#define DOWNLOAD_H
-int download_url(const char *name, const char *url);
+bool download_url(const char *name, const char *url);
#endif /* DOWNLOAD_H */
diff --git a/contrib/elf2dmp/kdbg.h b/contrib/elf2dmp/kdbg.h
index 851b57c321..002e3d0cd5 100644
--- a/contrib/elf2dmp/kdbg.h
+++ b/contrib/elf2dmp/kdbg.h
@@ -25,11 +25,15 @@ typedef struct DBGKD_GET_VERSION64 {
uint64_t DebuggerDataList;
} DBGKD_GET_VERSION64;
+#ifndef _WIN32
+typedef struct LIST_ENTRY64 {
+ struct LIST_ENTRY64 *Flink;
+ struct LIST_ENTRY64 *Blink;
+} LIST_ENTRY64;
+#endif
+
typedef struct DBGKD_DEBUG_DATA_HEADER64 {
- struct LIST_ENTRY64 {
- struct LIST_ENTRY64 *Flink;
- struct LIST_ENTRY64 *Blink;
- } List;
+ LIST_ENTRY64 List;
uint32_t OwnerTag;
uint32_t Size;
} DBGKD_DEBUG_DATA_HEADER64;
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index 7115b0d6d0..d046a72ae6 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -6,6 +6,8 @@
*/
#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+
#include "err.h"
#include "addrspace.h"
#include "pe.h"
@@ -16,8 +18,10 @@
#define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
#define PDB_NAME "ntkrnlmp.pdb"
+#define PE_NAME "ntoskrnl.exe"
#define INITIAL_MXCSR 0x1f80
+#define MAX_NUMBER_OF_RUNS 42
typedef struct idt_desc {
uint16_t offset1; /* offset bits 0..15 */
@@ -41,12 +45,8 @@ static const uint64_t SharedUserData = 0xfffff78000000000;
#define KUSD_OFFSET_PRODUCT_TYPE 0x264
#define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
- s ? printf(#s" = 0x%016lx\n", s) : eprintf("Failed to resolve "#s"\n"), s)
-
-static uint64_t rol(uint64_t x, uint64_t y)
-{
- return (x << y) | (x >> (64 - y));
-}
+ s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
+ eprintf("Failed to resolve "#s"\n"), s)
/*
* Decoding algorithm can be found in Volatility project
@@ -60,7 +60,7 @@ static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
uint64_t block;
block = src[i];
- block = rol(block ^ kwn, (uint8_t)kwn);
+ block = rol64(block ^ kwn, kwn);
block = __builtin_bswap64(block ^ kdbe) ^ kwa;
dst[i] = block;
}
@@ -75,9 +75,9 @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
bool decode = false;
uint64_t kwn, kwa, KdpDataBlockEncoded;
- if (va_space_rw(vs,
- KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
- &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
+ if (!va_space_rw(vs,
+ KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
+ &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
eprintf("Failed to extract KDBG header\n");
return NULL;
}
@@ -93,13 +93,13 @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
return NULL;
}
- if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
- va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
+ if (!va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
+ !va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
return NULL;
}
- printf("[KiWaitNever] = 0x%016lx\n", kwn);
- printf("[KiWaitAlways] = 0x%016lx\n", kwa);
+ printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
+ printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
/*
* If KDBG header can be decoded, KDBG size is available
@@ -116,13 +116,11 @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
}
}
- kdbg = malloc(kdbg_hdr.Size);
- if (!kdbg) {
- return NULL;
- }
+ kdbg = g_malloc(kdbg_hdr.Size);
- if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
+ if (!va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
eprintf("Failed to extract entire KDBG\n");
+ g_free(kdbg);
return NULL;
}
@@ -139,10 +137,10 @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
return kdbg;
}
-static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
+static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
QEMUCPUState *s)
{
- WinContext win_ctx = (WinContext){
+ WinContext64 win_ctx = (WinContext64){
.ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
.MxCsr = INITIAL_MXCSR,
@@ -184,13 +182,13 @@ static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
* Finds paging-structure hierarchy base,
* if previously set doesn't give access to kernel structures
*/
-static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
+static bool fix_dtb(struct va_space *vs, QEMU_Elf *qe)
{
/*
* Firstly, test previously set DTB.
*/
if (va_space_resolve(vs, SharedUserData)) {
- return 0;
+ return true;
}
/*
@@ -202,9 +200,9 @@ static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
if (is_system(s)) {
va_space_set_dtb(vs, s->cr[3]);
- printf("DTB 0x%016lx has been found from CPU #%zu"
+ printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
" as system task CR3\n", vs->dtb, i);
- return !(va_space_resolve(vs, SharedUserData));
+ return va_space_resolve(vs, SharedUserData);
}
}
@@ -218,21 +216,58 @@ static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
if (!cr3) {
- return 1;
+ return false;
}
va_space_set_dtb(vs, *cr3);
- printf("DirectoryTableBase = 0x%016lx has been found from CPU #0"
+ printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
" as interrupt handling CR3\n", vs->dtb);
- return !(va_space_resolve(vs, SharedUserData));
+ return va_space_resolve(vs, SharedUserData);
}
- return 1;
+ return true;
}
-static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
- struct va_space *vs, uint64_t KdDebuggerDataBlock,
- KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
+static void try_merge_runs(struct pa_space *ps,
+ WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
+{
+ unsigned int merge_cnt = 0, run_idx = 0;
+
+ PhysicalMemoryBlock->NumberOfRuns = 0;
+
+ for (size_t idx = 0; idx < ps->block_nr; idx++) {
+ struct pa_block *blk = ps->block + idx;
+ struct pa_block *next = blk + 1;
+
+ PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;
+
+ if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
+ printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
+ " merged\n", idx, blk->paddr, blk->size, merge_cnt);
+ merge_cnt++;
+ } else {
+ struct pa_block *first_merged = blk - merge_cnt;
+
+ printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
+ " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
+ idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
+ blk->paddr + blk->size - first_merged->paddr, run_idx);
+ PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
+ .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
+ .PageCount = (blk->paddr + blk->size - first_merged->paddr) /
+ ELF2DMP_PAGE_SIZE,
+ };
+ PhysicalMemoryBlock->NumberOfRuns++;
+ run_idx++;
+ merge_cnt = 0;
+ }
+ }
+}
+
+static bool fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
+ struct va_space *vs, uint64_t KdDebuggerDataBlock,
+ KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock,
+ int nr_cpus)
{
uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
KUSD_OFFSET_SUITE_MASK);
@@ -240,18 +275,17 @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
KUSD_OFFSET_PRODUCT_TYPE);
DBGKD_GET_VERSION64 kvb;
WinDumpHeader64 h;
- size_t i;
- QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= PAGE_SIZE);
- QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= PAGE_SIZE);
+ QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
+ QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
if (!suite_mask || !product_type) {
- return 1;
+ return false;
}
- if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
+ if (!va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
eprintf("Failed to extract KdVersionBlock\n");
- return 1;
+ return false;
}
h = (WinDumpHeader64) {
@@ -278,64 +312,116 @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
.RequiredDumpSpace = sizeof(h),
};
- for (i = 0; i < ps->block_nr; i++) {
- h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / PAGE_SIZE;
- h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
- .BasePage = ps->block[i].paddr / PAGE_SIZE,
- .PageCount = ps->block[i].size / PAGE_SIZE,
- };
+ if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
+ for (size_t idx = 0; idx < ps->block_nr; idx++) {
+ h.PhysicalMemoryBlock.NumberOfPages +=
+ ps->block[idx].size / ELF2DMP_PAGE_SIZE;
+ h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
+ .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
+ .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
+ };
+ }
+ } else {
+ try_merge_runs(ps, &h.PhysicalMemoryBlock);
}
- h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << PAGE_BITS;
+ h.RequiredDumpSpace +=
+ h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
*hdr = h;
- return 0;
+ return true;
}
-static int fill_context(KDDEBUGGER_DATA64 *kdbg,
- struct va_space *vs, QEMU_Elf *qe)
+/*
+ * fill_context() continues even if it fails to fill contexts of some CPUs.
+ * A dump may still contain valuable information even if it lacks contexts of
+ * some CPUs due to dump corruption or a failure before starting CPUs.
+ */
+static void fill_context(KDDEBUGGER_DATA64 *kdbg,
+ struct va_space *vs, QEMU_Elf *qe)
{
- int i;
+ int i;
+
for (i = 0; i < qe->state_nr; i++) {
uint64_t Prcb;
uint64_t Context;
- WinContext ctx;
+ WinContext64 ctx;
QEMUCPUState *s = qe->state[i];
- if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
- &Prcb, sizeof(Prcb), 0)) {
+ if (!va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
+ &Prcb, sizeof(Prcb), 0)) {
eprintf("Failed to read CPU #%d PRCB location\n", i);
- return 1;
+ continue;
+ }
+
+ if (!Prcb) {
+ eprintf("Context for CPU #%d is missing\n", i);
+ continue;
}
- if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
- &Context, sizeof(Context), 0)) {
+ if (!va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
+ &Context, sizeof(Context), 0)) {
eprintf("Failed to read CPU #%d ContextFrame location\n", i);
- return 1;
+ continue;
}
printf("Filling context for CPU #%d...\n", i);
win_context_init_from_qemu_cpu_state(&ctx, s);
- if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
+ if (!va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
eprintf("Failed to fill CPU #%d context\n", i);
- return 1;
+ continue;
}
}
+}
- return 0;
+static bool pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
+ void *entry, size_t size, struct va_space *vs)
+{
+ const char e_magic[2] = "MZ";
+ const char Signature[4] = "PE\0\0";
+ IMAGE_DOS_HEADER *dos_hdr = start_addr;
+ IMAGE_NT_HEADERS64 nt_hdrs;
+ IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
+ IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
+ IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
+
+ QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
+
+ if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
+ return false;
+ }
+
+ if (!va_space_rw(vs, base + dos_hdr->e_lfanew,
+ &nt_hdrs, sizeof(nt_hdrs), 0)) {
+ return false;
+ }
+
+ if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
+ file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
+ return false;
+ }
+
+ if (!va_space_rw(vs, base + data_dir[idx].VirtualAddress, entry, size, 0)) {
+ return false;
+ }
+
+ printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
+ (uint32_t)data_dir[idx].VirtualAddress);
+
+ return true;
}
-static int write_dump(struct pa_space *ps,
- WinDumpHeader64 *hdr, const char *name)
+static bool write_dump(struct pa_space *ps,
+ WinDumpHeader64 *hdr, const char *name)
{
FILE *dmp_file = fopen(name, "wb");
size_t i;
if (!dmp_file) {
eprintf("Failed to open output file \'%s\'\n", name);
- return 1;
+ return false;
}
printf("Writing header to file...\n");
@@ -343,118 +429,86 @@ static int write_dump(struct pa_space *ps,
if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
eprintf("Failed to write dump header\n");
fclose(dmp_file);
- return 1;
+ return false;
}
for (i = 0; i < ps->block_nr; i++) {
struct pa_block *b = &ps->block[i];
- printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
+ printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
+ ps->block_nr, b->size);
if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
- eprintf("Failed to write dump header\n");
+ eprintf("Failed to write block\n");
fclose(dmp_file);
- return 1;
+ return false;
}
}
- return fclose(dmp_file);
+ return !fclose(dmp_file);
}
-static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
- char *hash, struct va_space *vs)
+static bool pe_check_pdb_name(uint64_t base, void *start_addr,
+ struct va_space *vs, OMFSignatureRSDS *rsds)
{
- const char e_magic[2] = "MZ";
- const char Signature[4] = "PE\0\0";
const char sign_rsds[4] = "RSDS";
- IMAGE_DOS_HEADER *dos_hdr = start_addr;
- IMAGE_NT_HEADERS64 nt_hdrs;
- IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
- IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
- IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
IMAGE_DEBUG_DIRECTORY debug_dir;
- OMFSignatureRSDS rsds;
- char *pdb_name;
- size_t pdb_name_sz;
- size_t i;
+ char pdb_name[sizeof(PDB_NAME)];
- QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= PAGE_SIZE);
-
- if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
- return 1;
- }
-
- if (va_space_rw(vs, base + dos_hdr->e_lfanew,
- &nt_hdrs, sizeof(nt_hdrs), 0)) {
- return 1;
- }
-
- if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
- file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
- return 1;
- }
-
- printf("Debug Directory RVA = 0x%016x\n",
- data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
-
- if (va_space_rw(vs,
- base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
- &debug_dir, sizeof(debug_dir), 0)) {
- return 1;
+ if (!pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
+ &debug_dir, sizeof(debug_dir), vs)) {
+ eprintf("Failed to get Debug Directory\n");
+ return false;
}
if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
- return 1;
+ eprintf("Debug Directory type is not CodeView\n");
+ return false;
}
- if (va_space_rw(vs,
- base + debug_dir.AddressOfRawData,
- &rsds, sizeof(rsds), 0)) {
- return 1;
+ if (!va_space_rw(vs, base + debug_dir.AddressOfRawData,
+ rsds, sizeof(*rsds), 0)) {
+ eprintf("Failed to resolve OMFSignatureRSDS\n");
+ return false;
}
- printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
-
- if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
- return 1;
+ if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
+ eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
+ rsds->Signature, sign_rsds);
+ return false;
}
- pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
- pdb_name = malloc(pdb_name_sz);
- if (!pdb_name) {
- return 1;
+ if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
+ eprintf("PDB name size doesn't match\n");
+ return false;
}
- if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
- offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
- free(pdb_name);
- return 1;
+ if (!va_space_rw(vs, base + debug_dir.AddressOfRawData +
+ offsetof(OMFSignatureRSDS, name),
+ pdb_name, sizeof(PDB_NAME), 0)) {
+ eprintf("Failed to resolve PDB name\n");
+ return false;
}
printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
- if (strcmp(pdb_name, PDB_NAME)) {
- eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
- free(pdb_name);
- return 1;
- }
-
- free(pdb_name);
+ return !strcmp(pdb_name, PDB_NAME);
+}
- sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
- rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
+static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash)
+{
+ sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
+ rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
hash += 20;
- for (i = 0; i < 6; i++, hash += 2) {
- sprintf(hash, "%.02x", rsds.guid.e[i]);
+ for (unsigned int i = 0; i < 6; i++, hash += 2) {
+ sprintf(hash, "%.02x", rsds->guid.e[i]);
}
- sprintf(hash, "%.01x", rsds.age);
-
- return 0;
+ sprintf(hash, "%.01x", rsds->age);
}
int main(int argc, char *argv[])
{
- int err = 0;
+ int err = 1;
QEMU_Elf qemu_elf;
struct pa_space ps;
struct va_space vs;
@@ -470,119 +524,112 @@ int main(int argc, char *argv[])
uint64_t KdDebuggerDataBlock;
KDDEBUGGER_DATA64 *kdbg;
uint64_t KdVersionBlock;
+ bool kernel_found = false;
+ OMFSignatureRSDS rsds;
if (argc != 3) {
eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
return 1;
}
- if (QEMU_Elf_init(&qemu_elf, argv[1])) {
+ if (!QEMU_Elf_init(&qemu_elf, argv[1])) {
eprintf("Failed to initialize QEMU ELF dump\n");
return 1;
}
- if (pa_space_create(&ps, &qemu_elf)) {
- eprintf("Failed to initialize physical address space\n");
- err = 1;
- goto out_elf;
- }
+ pa_space_create(&ps, &qemu_elf);
state = qemu_elf.state[0];
- printf("CPU #0 CR3 is 0x%016lx\n", state->cr[3]);
+ printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
va_space_create(&vs, &ps, state->cr[3]);
- if (fix_dtb(&vs, &qemu_elf)) {
+ if (!fix_dtb(&vs, &qemu_elf)) {
eprintf("Failed to find paging base\n");
- err = 1;
- goto out_elf;
+ goto out_ps;
}
- printf("CPU #0 IDT is at 0x%016lx\n", state->idt.base);
+ printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
- if (va_space_rw(&vs, state->idt.base,
- &first_idt_desc, sizeof(first_idt_desc), 0)) {
+ if (!va_space_rw(&vs, state->idt.base,
+ &first_idt_desc, sizeof(first_idt_desc), 0)) {
eprintf("Failed to get CPU #0 IDT[0]\n");
- err = 1;
goto out_ps;
}
- printf("CPU #0 IDT[0] -> 0x%016lx\n", idt_desc_addr(first_idt_desc));
+ printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
- KernBase = idt_desc_addr(first_idt_desc) & ~(PAGE_SIZE - 1);
- printf("Searching kernel downwards from 0x%16lx...\n", KernBase);
+ KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
+ printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
- for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) {
+ for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
nt_start_addr = va_space_resolve(&vs, KernBase);
if (!nt_start_addr) {
continue;
}
if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
- break;
+ printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
+ if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
+ kernel_found = true;
+ break;
+ }
}
}
- printf("KernBase = 0x%16lx, signature is \'%.2s\'\n", KernBase,
- (char *)nt_start_addr);
-
- if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
- eprintf("Failed to get PDB symbol store hash\n");
- err = 1;
+ if (!kernel_found) {
+ eprintf("Failed to find NT kernel image\n");
goto out_ps;
}
+ printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
+ (char *)nt_start_addr);
+
+ pe_get_pdb_symstore_hash(&rsds, pdb_hash);
+
sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
printf("PDB URL is %s\n", pdb_url);
- if (download_url(PDB_NAME, pdb_url)) {
+ if (!download_url(PDB_NAME, pdb_url)) {
eprintf("Failed to download PDB file\n");
- err = 1;
goto out_ps;
}
- if (pdb_init_from_file(PDB_NAME, &pdb)) {
+ if (!pdb_init_from_file(PDB_NAME, &pdb)) {
eprintf("Failed to initialize PDB reader\n");
- err = 1;
goto out_pdb_file;
}
if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
!SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
- err = 1;
goto out_pdb;
}
kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
if (!kdbg) {
- err = 1;
goto out_pdb;
}
- if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
- KdVersionBlock, qemu_elf.state_nr)) {
- err = 1;
- goto out_pdb;
+ if (!fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
+ KdVersionBlock, qemu_elf.state_nr)) {
+ goto out_kdbg;
}
- if (fill_context(kdbg, &vs, &qemu_elf)) {
- err = 1;
- goto out_pdb;
- }
+ fill_context(kdbg, &vs, &qemu_elf);
- if (write_dump(&ps, &header, argv[2])) {
+ if (!write_dump(&ps, &header, argv[2])) {
eprintf("Failed to save dump\n");
- err = 1;
goto out_kdbg;
}
+ err = 0;
+
out_kdbg:
- free(kdbg);
+ g_free(kdbg);
out_pdb:
pdb_exit(&pdb);
out_pdb_file:
unlink(PDB_NAME);
out_ps:
pa_space_destroy(&ps);
-out_elf:
QEMU_Elf_exit(&qemu_elf);
return err;
diff --git a/contrib/elf2dmp/meson.build b/contrib/elf2dmp/meson.build
new file mode 100644
index 0000000000..6707d43c4f
--- /dev/null
+++ b/contrib/elf2dmp/meson.build
@@ -0,0 +1,5 @@
+if curl.found()
+ executable('elf2dmp', files('main.c', 'addrspace.c', 'download.c', 'pdb.c', 'qemu_elf.c'), genh,
+ dependencies: [glib, curl],
+ install: true)
+endif
diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
index bcb01b414f..492aca4434 100644
--- a/contrib/elf2dmp/pdb.c
+++ b/contrib/elf2dmp/pdb.c
@@ -19,11 +19,17 @@
*/
#include "qemu/osdep.h"
+#include "qemu/bswap.h"
+
#include "pdb.h"
#include "err.h"
static uint32_t pdb_get_file_size(const struct pdb_reader *r, unsigned idx)
{
+ if (idx >= r->ds.toc->num_files) {
+ return 0;
+ }
+
return r->ds.toc->file_size[idx];
}
@@ -66,7 +72,7 @@ uint64_t pdb_find_public_v3_symbol(struct pdb_reader *r, const char *name)
uint32_t sect_rva = segment->dword[1];
uint64_t rva = sect_rva + sym->public_v3.offset;
- printf("%s: 0x%016x(%d:\'%.8s\') + 0x%08x = 0x%09lx\n", name,
+ printf("%s: 0x%016x(%d:\'%.8s\') + 0x%08x = 0x%09"PRIx64"\n", name,
sect_rva, sym->public_v3.segment,
((char *)segment - 8), sym->public_v3.offset, rva);
return rva;
@@ -89,18 +95,18 @@ uint64_t pdb_resolve(uint64_t img_base, struct pdb_reader *r, const char *name)
static void pdb_reader_ds_exit(struct pdb_reader *r)
{
- free(r->ds.toc);
+ g_free(r->ds.toc);
}
static void pdb_exit_symbols(struct pdb_reader *r)
{
- free(r->modimage);
- free(r->symbols);
+ g_free(r->modimage);
+ g_free(r->symbols);
}
static void pdb_exit_segments(struct pdb_reader *r)
{
- free(r->segs);
+ g_free(r->segs);
}
static void *pdb_ds_read(const PDB_DS_HEADER *header,
@@ -115,10 +121,7 @@ static void *pdb_ds_read(const PDB_DS_HEADER *header,
nBlocks = (size + header->block_size - 1) / header->block_size;
- buffer = malloc(nBlocks * header->block_size);
- if (!buffer) {
- return NULL;
- }
+ buffer = g_malloc(nBlocks * header->block_size);
for (i = 0; i < nBlocks; i++) {
memcpy(buffer + i * header->block_size, (const char *)header +
@@ -156,167 +159,145 @@ static void *pdb_ds_read_file(struct pdb_reader* r, uint32_t file_number)
return pdb_ds_read(r->ds.header, block_list, file_size[file_number]);
}
-static int pdb_init_segments(struct pdb_reader *r)
+static bool pdb_init_segments(struct pdb_reader *r)
{
- char *segs;
- unsigned stream_idx = r->sidx.segments;
+ unsigned stream_idx = r->segments;
- segs = pdb_ds_read_file(r, stream_idx);
- if (!segs) {
- return 1;
+ r->segs = pdb_ds_read_file(r, stream_idx);
+ if (!r->segs) {
+ return false;
}
- r->segs = segs;
r->segs_size = pdb_get_file_size(r, stream_idx);
+ if (!r->segs_size) {
+ return false;
+ }
- return 0;
+ return true;
}
-static int pdb_init_symbols(struct pdb_reader *r)
+static bool pdb_init_symbols(struct pdb_reader *r)
{
- int err = 0;
PDB_SYMBOLS *symbols;
- PDB_STREAM_INDEXES *sidx = &r->sidx;
-
- memset(sidx, -1, sizeof(*sidx));
symbols = pdb_ds_read_file(r, 3);
if (!symbols) {
- return 1;
+ return false;
}
r->symbols = symbols;
- if (symbols->stream_index_size != sizeof(PDB_STREAM_INDEXES)) {
- err = 1;
- goto out_symbols;
- }
-
- memcpy(sidx, (const char *)symbols + sizeof(PDB_SYMBOLS) +
+ r->segments = lduw_le_p((const char *)symbols + sizeof(PDB_SYMBOLS) +
symbols->module_size + symbols->offset_size +
symbols->hash_size + symbols->srcmodule_size +
- symbols->pdbimport_size + symbols->unknown2_size, sizeof(*sidx));
+ symbols->pdbimport_size + symbols->unknown2_size +
+ offsetof(PDB_STREAM_INDEXES, segments));
/* Read global symbol table */
r->modimage = pdb_ds_read_file(r, symbols->gsym_file);
if (!r->modimage) {
- err = 1;
goto out_symbols;
}
- return 0;
+ return true;
out_symbols:
- free(symbols);
+ g_free(symbols);
- return err;
+ return false;
}
-static int pdb_reader_ds_init(struct pdb_reader *r, PDB_DS_HEADER *hdr)
+static bool pdb_reader_ds_init(struct pdb_reader *r, PDB_DS_HEADER *hdr)
{
+ if (hdr->block_size == 0) {
+ return false;
+ }
+
memset(r->file_used, 0, sizeof(r->file_used));
r->ds.header = hdr;
r->ds.toc = pdb_ds_read(hdr, (uint32_t *)((uint8_t *)hdr +
hdr->toc_page * hdr->block_size), hdr->toc_size);
if (!r->ds.toc) {
- return 1;
+ return false;
}
- return 0;
+ return true;
}
-static int pdb_reader_init(struct pdb_reader *r, void *data)
+static bool pdb_reader_init(struct pdb_reader *r, void *data)
{
- int err = 0;
const char pdb7[] = "Microsoft C/C++ MSF 7.00";
if (memcmp(data, pdb7, sizeof(pdb7) - 1)) {
- return 1;
+ return false;
}
- if (pdb_reader_ds_init(r, data)) {
- return 1;
+ if (!pdb_reader_ds_init(r, data)) {
+ return false;
}
r->ds.root = pdb_ds_read_file(r, 1);
if (!r->ds.root) {
- err = 1;
goto out_ds;
}
- if (pdb_init_symbols(r)) {
- err = 1;
+ if (!pdb_init_symbols(r)) {
goto out_root;
}
- if (pdb_init_segments(r)) {
- err = 1;
+ if (!pdb_init_segments(r)) {
goto out_sym;
}
- return 0;
+ return true;
out_sym:
pdb_exit_symbols(r);
out_root:
- free(r->ds.root);
+ g_free(r->ds.root);
out_ds:
pdb_reader_ds_exit(r);
- return err;
+ return false;
}
static void pdb_reader_exit(struct pdb_reader *r)
{
pdb_exit_segments(r);
pdb_exit_symbols(r);
- free(r->ds.root);
+ g_free(r->ds.root);
pdb_reader_ds_exit(r);
}
-int pdb_init_from_file(const char *name, struct pdb_reader *reader)
+bool pdb_init_from_file(const char *name, struct pdb_reader *reader)
{
- int err = 0;
- int fd;
+ GError *gerr = NULL;
void *map;
- struct stat st;
- fd = open(name, O_RDONLY, 0);
- if (fd == -1) {
- eprintf("Failed to open PDB file \'%s\'\n", name);
- return 1;
+ reader->gmf = g_mapped_file_new(name, TRUE, &gerr);
+ if (gerr) {
+ eprintf("Failed to map PDB file \'%s\'\n", name);
+ g_error_free(gerr);
+ return false;
}
- reader->fd = fd;
-
- fstat(fd, &st);
- reader->file_size = st.st_size;
- map = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
- if (map == MAP_FAILED) {
- eprintf("Failed to map PDB file\n");
- err = 1;
- goto out_fd;
- }
-
- if (pdb_reader_init(reader, map)) {
- err = 1;
+ reader->file_size = g_mapped_file_get_length(reader->gmf);
+ map = g_mapped_file_get_contents(reader->gmf);
+ if (!pdb_reader_init(reader, map)) {
goto out_unmap;
}
- return 0;
+ return true;
out_unmap:
- munmap(map, st.st_size);
-out_fd:
- close(fd);
+ g_mapped_file_unref(reader->gmf);
- return err;
+ return false;
}
void pdb_exit(struct pdb_reader *reader)
{
- munmap(reader->ds.header, reader->file_size);
- close(reader->fd);
+ g_mapped_file_unref(reader->gmf);
pdb_reader_exit(reader);
}
diff --git a/contrib/elf2dmp/pdb.h b/contrib/elf2dmp/pdb.h
index a3a3cac2c1..feddf1862f 100644
--- a/contrib/elf2dmp/pdb.h
+++ b/contrib/elf2dmp/pdb.h
@@ -9,12 +9,14 @@
#define PDB_H
+#ifndef _WIN32
typedef struct GUID {
unsigned int Data1;
unsigned short Data2;
unsigned short Data3;
unsigned char Data4[8];
} GUID;
+#endif
struct PDB_FILE {
uint32_t size;
@@ -216,7 +218,7 @@ typedef struct pdb_seg {
#define IMAGE_FILE_MACHINE_AMD64 0x8664
struct pdb_reader {
- int fd;
+ GMappedFile *gmf;
size_t file_size;
struct {
PDB_DS_HEADER *header;
@@ -225,13 +227,13 @@ struct pdb_reader {
} ds;
uint32_t file_used[1024];
PDB_SYMBOLS *symbols;
- PDB_STREAM_INDEXES sidx;
+ uint16_t segments;
uint8_t *modimage;
char *segs;
size_t segs_size;
};
-int pdb_init_from_file(const char *name, struct pdb_reader *reader);
+bool pdb_init_from_file(const char *name, struct pdb_reader *reader);
void pdb_exit(struct pdb_reader *reader);
uint64_t pdb_resolve(uint64_t img_base, struct pdb_reader *r, const char *name);
uint64_t pdb_find_public_v3_symbol(struct pdb_reader *reader, const char *name);
diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index dafb26afbb..71126af1ac 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -9,6 +9,7 @@
#define PE_H
+#ifndef _WIN32
typedef struct IMAGE_DOS_HEADER {
uint16_t e_magic; /* 0x00: MZ Header signature */
uint16_t e_cblp; /* 0x02: Bytes on last page of file */
@@ -32,75 +33,91 @@ typedef struct IMAGE_DOS_HEADER {
} __attribute__ ((packed)) IMAGE_DOS_HEADER;
typedef struct IMAGE_FILE_HEADER {
- uint16_t Machine;
- uint16_t NumberOfSections;
- uint32_t TimeDateStamp;
- uint32_t PointerToSymbolTable;
- uint32_t NumberOfSymbols;
- uint16_t SizeOfOptionalHeader;
- uint16_t Characteristics;
+ uint16_t Machine;
+ uint16_t NumberOfSections;
+ uint32_t TimeDateStamp;
+ uint32_t PointerToSymbolTable;
+ uint32_t NumberOfSymbols;
+ uint16_t SizeOfOptionalHeader;
+ uint16_t Characteristics;
} __attribute__ ((packed)) IMAGE_FILE_HEADER;
typedef struct IMAGE_DATA_DIRECTORY {
- uint32_t VirtualAddress;
- uint32_t Size;
+ uint32_t VirtualAddress;
+ uint32_t Size;
} __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
typedef struct IMAGE_OPTIONAL_HEADER64 {
- uint16_t Magic; /* 0x20b */
- uint8_t MajorLinkerVersion;
- uint8_t MinorLinkerVersion;
- uint32_t SizeOfCode;
- uint32_t SizeOfInitializedData;
- uint32_t SizeOfUninitializedData;
- uint32_t AddressOfEntryPoint;
- uint32_t BaseOfCode;
- uint64_t ImageBase;
- uint32_t SectionAlignment;
- uint32_t FileAlignment;
- uint16_t MajorOperatingSystemVersion;
- uint16_t MinorOperatingSystemVersion;
- uint16_t MajorImageVersion;
- uint16_t MinorImageVersion;
- uint16_t MajorSubsystemVersion;
- uint16_t MinorSubsystemVersion;
- uint32_t Win32VersionValue;
- uint32_t SizeOfImage;
- uint32_t SizeOfHeaders;
- uint32_t CheckSum;
- uint16_t Subsystem;
- uint16_t DllCharacteristics;
- uint64_t SizeOfStackReserve;
- uint64_t SizeOfStackCommit;
- uint64_t SizeOfHeapReserve;
- uint64_t SizeOfHeapCommit;
- uint32_t LoaderFlags;
- uint32_t NumberOfRvaAndSizes;
- IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+ uint16_t Magic; /* 0x20b */
+ uint8_t MajorLinkerVersion;
+ uint8_t MinorLinkerVersion;
+ uint32_t SizeOfCode;
+ uint32_t SizeOfInitializedData;
+ uint32_t SizeOfUninitializedData;
+ uint32_t AddressOfEntryPoint;
+ uint32_t BaseOfCode;
+ uint64_t ImageBase;
+ uint32_t SectionAlignment;
+ uint32_t FileAlignment;
+ uint16_t MajorOperatingSystemVersion;
+ uint16_t MinorOperatingSystemVersion;
+ uint16_t MajorImageVersion;
+ uint16_t MinorImageVersion;
+ uint16_t MajorSubsystemVersion;
+ uint16_t MinorSubsystemVersion;
+ uint32_t Win32VersionValue;
+ uint32_t SizeOfImage;
+ uint32_t SizeOfHeaders;
+ uint32_t CheckSum;
+ uint16_t Subsystem;
+ uint16_t DllCharacteristics;
+ uint64_t SizeOfStackReserve;
+ uint64_t SizeOfStackCommit;
+ uint64_t SizeOfHeapReserve;
+ uint64_t SizeOfHeapCommit;
+ uint32_t LoaderFlags;
+ uint32_t NumberOfRvaAndSizes;
+ IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
typedef struct IMAGE_NT_HEADERS64 {
- uint32_t Signature;
- IMAGE_FILE_HEADER FileHeader;
- IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+ uint32_t Signature;
+ IMAGE_FILE_HEADER FileHeader;
+ IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} __attribute__ ((packed)) IMAGE_NT_HEADERS64;
-#define IMAGE_FILE_DEBUG_DIRECTORY 6
+typedef struct IMAGE_EXPORT_DIRECTORY {
+ uint32_t Characteristics;
+ uint32_t TimeDateStamp;
+ uint16_t MajorVersion;
+ uint16_t MinorVersion;
+ uint32_t Name;
+ uint32_t Base;
+ uint32_t NumberOfFunctions;
+ uint32_t NumberOfNames;
+ uint32_t AddressOfFunctions;
+ uint32_t AddressOfNames;
+ uint32_t AddressOfNameOrdinals;
+} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
typedef struct IMAGE_DEBUG_DIRECTORY {
- uint32_t Characteristics;
- uint32_t TimeDateStamp;
- uint16_t MajorVersion;
- uint16_t MinorVersion;
- uint32_t Type;
- uint32_t SizeOfData;
- uint32_t AddressOfRawData;
- uint32_t PointerToRawData;
+ uint32_t Characteristics;
+ uint32_t TimeDateStamp;
+ uint16_t MajorVersion;
+ uint16_t MinorVersion;
+ uint32_t Type;
+ uint32_t SizeOfData;
+ uint32_t AddressOfRawData;
+ uint32_t PointerToRawData;
} __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
#define IMAGE_DEBUG_TYPE_CODEVIEW 2
+#endif
+
+#define IMAGE_FILE_EXPORT_DIRECTORY 0
+#define IMAGE_FILE_DEBUG_DIRECTORY 6
typedef struct guid_t {
uint32_t a;
diff --git a/contrib/elf2dmp/qemu_elf.c b/contrib/elf2dmp/qemu_elf.c
index e9c0d2534a..c9bad6e82c 100644
--- a/contrib/elf2dmp/qemu_elf.c
+++ b/contrib/elf2dmp/qemu_elf.c
@@ -6,6 +6,7 @@
*/
#include "qemu/osdep.h"
+#include "qemu/host-utils.h"
#include "err.h"
#include "qemu_elf.h"
@@ -15,36 +16,11 @@
#define ROUND_UP(n, d) (((n) + (d) - 1) & -(0 ? (n) : (d)))
#endif
-#ifndef DIV_ROUND_UP
-#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
-#endif
-
-#define ELF_NOTE_SIZE(hdr_size, name_size, desc_size) \
- ((DIV_ROUND_UP((hdr_size), 4) + \
- DIV_ROUND_UP((name_size), 4) + \
- DIV_ROUND_UP((desc_size), 4)) * 4)
-
int is_system(QEMUCPUState *s)
{
return s->gs.base >> 63;
}
-static char *nhdr_get_name(Elf64_Nhdr *nhdr)
-{
- return (char *)nhdr + ROUND_UP(sizeof(*nhdr), 4);
-}
-
-static void *nhdr_get_desc(Elf64_Nhdr *nhdr)
-{
- return nhdr_get_name(nhdr) + ROUND_UP(nhdr->n_namesz, 4);
-}
-
-static Elf64_Nhdr *nhdr_get_next(Elf64_Nhdr *nhdr)
-{
- return (void *)((uint8_t *)nhdr + ELF_NOTE_SIZE(sizeof(*nhdr),
- nhdr->n_namesz, nhdr->n_descsz));
-}
-
Elf64_Phdr *elf64_getphdr(void *map)
{
Elf64_Ehdr *ehdr = map;
@@ -60,105 +36,235 @@ Elf64_Half elf_getphdrnum(void *map)
return ehdr->e_phnum;
}
-static int init_states(QEMU_Elf *qe)
+static bool advance_note_offset(uint64_t *offsetp, uint64_t size, uint64_t end)
+{
+ uint64_t offset = *offsetp;
+
+ if (uadd64_overflow(offset, size, &offset) || offset > UINT64_MAX - 3) {
+ return false;
+ }
+
+ offset = ROUND_UP(offset, 4);
+
+ if (offset > end) {
+ return false;
+ }
+
+ *offsetp = offset;
+
+ return true;
+}
+
+static bool init_states(QEMU_Elf *qe)
{
Elf64_Phdr *phdr = elf64_getphdr(qe->map);
- Elf64_Nhdr *start = (void *)((uint8_t *)qe->map + phdr[0].p_offset);
- Elf64_Nhdr *end = (void *)((uint8_t *)start + phdr[0].p_memsz);
Elf64_Nhdr *nhdr;
- size_t cpu_nr = 0;
+ GPtrArray *states;
+ QEMUCPUState *state;
+ uint32_t state_size;
+ uint64_t offset;
+ uint64_t end_offset;
+ char *name;
if (phdr[0].p_type != PT_NOTE) {
eprintf("Failed to find PT_NOTE\n");
- return 1;
+ return false;
}
qe->has_kernel_gs_base = 1;
+ offset = phdr[0].p_offset;
+ states = g_ptr_array_new();
+
+ if (uadd64_overflow(offset, phdr[0].p_memsz, &end_offset) ||
+ end_offset > qe->size) {
+ end_offset = qe->size;
+ }
- for (nhdr = start; nhdr < end; nhdr = nhdr_get_next(nhdr)) {
- if (!strcmp(nhdr_get_name(nhdr), QEMU_NOTE_NAME)) {
- QEMUCPUState *state = nhdr_get_desc(nhdr);
+ while (offset < end_offset) {
+ nhdr = (void *)((uint8_t *)qe->map + offset);
+
+ if (!advance_note_offset(&offset, sizeof(*nhdr), end_offset)) {
+ break;
+ }
+
+ name = (char *)qe->map + offset;
+
+ if (!advance_note_offset(&offset, nhdr->n_namesz, end_offset)) {
+ break;
+ }
- if (state->size < sizeof(*state)) {
- eprintf("CPU #%zu: QEMU CPU state size %u doesn't match\n",
- cpu_nr, state->size);
+ state = (void *)((uint8_t *)qe->map + offset);
+
+ if (!advance_note_offset(&offset, nhdr->n_descsz, end_offset)) {
+ break;
+ }
+
+ if (!strcmp(name, QEMU_NOTE_NAME) &&
+ nhdr->n_descsz >= offsetof(QEMUCPUState, kernel_gs_base)) {
+ state_size = MIN(state->size, nhdr->n_descsz);
+
+ if (state_size < sizeof(*state)) {
+ eprintf("CPU #%u: QEMU CPU state size %u doesn't match\n",
+ states->len, state_size);
/*
* We assume either every QEMU CPU state has KERNEL_GS_BASE or
* no one has.
*/
qe->has_kernel_gs_base = 0;
}
- cpu_nr++;
+ g_ptr_array_add(states, state);
}
}
- printf("%zu CPU states has been found\n", cpu_nr);
+ printf("%u CPU states has been found\n", states->len);
+
+ qe->state_nr = states->len;
+ qe->state = (void *)g_ptr_array_free(states, FALSE);
- qe->state = malloc(sizeof(*qe->state) * cpu_nr);
- if (!qe->state) {
- return 1;
+ return true;
+}
+
+static void exit_states(QEMU_Elf *qe)
+{
+ g_free(qe->state);
+}
+
+static bool check_ehdr(QEMU_Elf *qe)
+{
+ Elf64_Ehdr *ehdr = qe->map;
+ uint64_t phendoff;
+
+ if (sizeof(Elf64_Ehdr) > qe->size) {
+ eprintf("Invalid input dump file size\n");
+ return false;
}
- cpu_nr = 0;
+ if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) {
+ eprintf("Invalid ELF signature, input file is not ELF\n");
+ return false;
+ }
- for (nhdr = start; nhdr < end; nhdr = nhdr_get_next(nhdr)) {
- if (!strcmp(nhdr_get_name(nhdr), QEMU_NOTE_NAME)) {
- qe->state[cpu_nr] = nhdr_get_desc(nhdr);
- cpu_nr++;
- }
+ if (ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
+ ehdr->e_ident[EI_DATA] != ELFDATA2LSB) {
+ eprintf("Invalid ELF class or byte order, must be 64-bit LE\n");
+ return false;
}
- qe->state_nr = cpu_nr;
+ if (ehdr->e_ident[EI_VERSION] != EV_CURRENT) {
+ eprintf("Invalid ELF version\n");
+ return false;
+ }
- return 0;
-}
+ if (ehdr->e_machine != EM_X86_64) {
+ eprintf("Invalid input dump architecture, only x86_64 is supported\n");
+ return false;
+ }
-static void exit_states(QEMU_Elf *qe)
-{
- free(qe->state);
+ if (ehdr->e_type != ET_CORE) {
+ eprintf("Invalid ELF type, must be core file\n");
+ return false;
+ }
+
+ /*
+ * ELF dump file must contain one PT_NOTE and at least one PT_LOAD to
+ * restore physical address space.
+ */
+ if (ehdr->e_phnum < 2) {
+ eprintf("Invalid number of ELF program headers\n");
+ return false;
+ }
+
+ if (umul64_overflow(ehdr->e_phnum, sizeof(Elf64_Phdr), &phendoff) ||
+ uadd64_overflow(phendoff, ehdr->e_phoff, &phendoff) ||
+ phendoff > qe->size) {
+ eprintf("phdrs do not fit in file\n");
+ return false;
+ }
+
+ return true;
}
-int QEMU_Elf_init(QEMU_Elf *qe, const char *filename)
+static bool QEMU_Elf_map(QEMU_Elf *qe, const char *filename)
{
- int err = 0;
+#ifdef CONFIG_LINUX
struct stat st;
+ int fd;
- qe->fd = open(filename, O_RDONLY, 0);
- if (qe->fd == -1) {
+ printf("Using Linux mmap\n");
+
+ fd = open(filename, O_RDONLY, 0);
+ if (fd == -1) {
eprintf("Failed to open ELF dump file \'%s\'\n", filename);
- return 1;
+ return false;
}
- fstat(qe->fd, &st);
+ if (fstat(fd, &st)) {
+ eprintf("Failed to get size of ELF dump file\n");
+ close(fd);
+ return false;
+ }
qe->size = st.st_size;
qe->map = mmap(NULL, qe->size, PROT_READ | PROT_WRITE,
- MAP_PRIVATE, qe->fd, 0);
+ MAP_PRIVATE | MAP_NORESERVE, fd, 0);
if (qe->map == MAP_FAILED) {
eprintf("Failed to map ELF file\n");
- err = 1;
- goto out_fd;
+ close(fd);
+ return false;
}
- if (init_states(qe)) {
- eprintf("Failed to extract QEMU CPU states\n");
- err = 1;
- goto out_unmap;
+ close(fd);
+#else
+ GError *gerr = NULL;
+
+ printf("Using GLib mmap\n");
+
+ qe->gmf = g_mapped_file_new(filename, TRUE, &gerr);
+ if (gerr) {
+ eprintf("Failed to map ELF dump file \'%s\'\n", filename);
+ g_error_free(gerr);
+ return false;
}
- return 0;
+ qe->map = g_mapped_file_get_contents(qe->gmf);
+ qe->size = g_mapped_file_get_length(qe->gmf);
+#endif
-out_unmap:
+ return true;
+}
+
+static void QEMU_Elf_unmap(QEMU_Elf *qe)
+{
+#ifdef CONFIG_LINUX
munmap(qe->map, qe->size);
-out_fd:
- close(qe->fd);
+#else
+ g_mapped_file_unref(qe->gmf);
+#endif
+}
- return err;
+bool QEMU_Elf_init(QEMU_Elf *qe, const char *filename)
+{
+ if (!QEMU_Elf_map(qe, filename)) {
+ return false;
+ }
+
+ if (!check_ehdr(qe)) {
+ eprintf("Input file has the wrong format\n");
+ QEMU_Elf_unmap(qe);
+ return false;
+ }
+
+ if (!init_states(qe)) {
+ eprintf("Failed to extract QEMU CPU states\n");
+ QEMU_Elf_unmap(qe);
+ return false;
+ }
+
+ return true;
}
void QEMU_Elf_exit(QEMU_Elf *qe)
{
exit_states(qe);
- munmap(qe->map, qe->size);
- close(qe->fd);
+ QEMU_Elf_unmap(qe);
}
diff --git a/contrib/elf2dmp/qemu_elf.h b/contrib/elf2dmp/qemu_elf.h
index 86e6e688fb..adc50238b4 100644
--- a/contrib/elf2dmp/qemu_elf.h
+++ b/contrib/elf2dmp/qemu_elf.h
@@ -2,13 +2,12 @@
* Copyright (c) 2018 Virtuozzo International GmbH
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
- *
*/
-#ifndef QEMU_ELF_H
-#define QEMU_ELF_H
+#ifndef ELF2DMP_QEMU_ELF_H
+#define ELF2DMP_QEMU_ELF_H
-#include <elf.h>
+#include "elf.h"
typedef struct QEMUCPUSegment {
uint32_t selector;
@@ -33,7 +32,9 @@ typedef struct QEMUCPUState {
int is_system(QEMUCPUState *s);
typedef struct QEMU_Elf {
- int fd;
+#ifndef CONFIG_LINUX
+ GMappedFile *gmf;
+#endif
size_t size;
void *map;
QEMUCPUState **state;
@@ -41,10 +42,10 @@ typedef struct QEMU_Elf {
int has_kernel_gs_base;
} QEMU_Elf;
-int QEMU_Elf_init(QEMU_Elf *qe, const char *filename);
+bool QEMU_Elf_init(QEMU_Elf *qe, const char *filename);
void QEMU_Elf_exit(QEMU_Elf *qe);
Elf64_Phdr *elf64_getphdr(void *map);
Elf64_Half elf_getphdrnum(void *map);
-#endif /* QEMU_ELF_H */
+#endif /* ELF2DMP_QEMU_ELF_H */
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-27 08:53:46 +0000