From 2ababfcc0e5e778c9005abb57f4bf6a036145a57 Mon Sep 17 00:00:00 2001 From: Viktor Prutyanov Date: Thu, 17 May 2018 19:23:41 +0300 Subject: [PATCH] dump: add fallback KDBG using in Windows dump KdDebuggerDataBlock may be encrypted in guest memory and dump will be useless in this case. But guest driver can obtain decrypted KDBG and expose its address through BugcheckParameter1 field in raw header. After this patch, QEMU will be able to use fallback KdDebuggerDataBlock. Signed-off-by: Viktor Prutyanov Message-Id: <20180517162342.4330-4-viktor.prutyanov@virtuozzo.com> Signed-off-by: Paolo Bonzini --- win_dump.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/win_dump.c b/win_dump.c index 7d956ca996..2d9afb514e 100644 --- a/win_dump.c +++ b/win_dump.c @@ -144,21 +144,37 @@ static void check_kdbg(WinDumpHeader64 *h, Error **errp) { const char OwnerTag[] = "KDBG"; char read_OwnerTag[4]; + uint64_t KdDebuggerDataBlock = h->KdDebuggerDataBlock; + bool try_fallback = true; +try_again: if (cpu_memory_rw_debug(first_cpu, - h->KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64, + KdDebuggerDataBlock + KDBG_OWNER_TAG_OFFSET64, (uint8_t *)&read_OwnerTag, sizeof(read_OwnerTag), 0)) { error_setg(errp, "win-dump: failed to read OwnerTag"); return; } if (memcmp(read_OwnerTag, OwnerTag, sizeof(read_OwnerTag))) { - error_setg(errp, "win-dump: invalid KDBG OwnerTag," - " expected '%.4s', got '%.4s'," - " KdDebuggerDataBlock seems to be encrypted", - OwnerTag, read_OwnerTag); - return; + if (try_fallback) { + /* + * If attempt to use original KDBG failed + * (most likely because of its encryption), + * we try to use KDBG obtained by guest driver. + */ + + KdDebuggerDataBlock = h->BugcheckParameter1; + try_fallback = false; + goto try_again; + } else { + error_setg(errp, "win-dump: invalid KDBG OwnerTag," + " expected '%.4s', got '%.4s'", + OwnerTag, read_OwnerTag); + return; + } } + + h->KdDebuggerDataBlock = KdDebuggerDataBlock; } void create_win_dump(DumpState *s, Error **errp)