1 | /* |
---|---|
2 | * Windows crashdump definitions |
3 | * |
4 | * Copyright (c) 2018 Virtuozzo International GmbH |
5 | * |
6 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
7 | * See the COPYING file in the top-level directory. |
8 | * |
9 | */ |
10 | |
11 | #ifndef QEMU_WIN_DUMP_DEFS_H |
12 | #define QEMU_WIN_DUMP_DEFS_H |
13 | |
14 | typedef struct WinDumpPhyMemRun64 { |
15 | uint64_t BasePage; |
16 | uint64_t PageCount; |
17 | } QEMU_PACKED WinDumpPhyMemRun64; |
18 | |
19 | typedef struct WinDumpPhyMemDesc64 { |
20 | uint32_t NumberOfRuns; |
21 | uint32_t unused; |
22 | uint64_t NumberOfPages; |
23 | WinDumpPhyMemRun64 Run[43]; |
24 | } QEMU_PACKED WinDumpPhyMemDesc64; |
25 | |
26 | typedef struct WinDumpExceptionRecord { |
27 | uint32_t ExceptionCode; |
28 | uint32_t ExceptionFlags; |
29 | uint64_t ExceptionRecord; |
30 | uint64_t ExceptionAddress; |
31 | uint32_t NumberParameters; |
32 | uint32_t unused; |
33 | uint64_t ExceptionInformation[15]; |
34 | } QEMU_PACKED WinDumpExceptionRecord; |
35 | |
36 | typedef struct WinDumpHeader64 { |
37 | char Signature[4]; |
38 | char ValidDump[4]; |
39 | uint32_t MajorVersion; |
40 | uint32_t MinorVersion; |
41 | uint64_t DirectoryTableBase; |
42 | uint64_t PfnDatabase; |
43 | uint64_t PsLoadedModuleList; |
44 | uint64_t PsActiveProcessHead; |
45 | uint32_t MachineImageType; |
46 | uint32_t NumberProcessors; |
47 | union { |
48 | struct { |
49 | uint32_t BugcheckCode; |
50 | uint32_t unused0; |
51 | uint64_t BugcheckParameter1; |
52 | uint64_t BugcheckParameter2; |
53 | uint64_t BugcheckParameter3; |
54 | uint64_t BugcheckParameter4; |
55 | }; |
56 | uint8_t BugcheckData[40]; |
57 | }; |
58 | uint8_t VersionUser[32]; |
59 | uint64_t KdDebuggerDataBlock; |
60 | union { |
61 | WinDumpPhyMemDesc64 PhysicalMemoryBlock; |
62 | uint8_t PhysicalMemoryBlockBuffer[704]; |
63 | }; |
64 | union { |
65 | uint8_t ContextBuffer[3000]; |
66 | }; |
67 | WinDumpExceptionRecord Exception; |
68 | uint32_t DumpType; |
69 | uint32_t unused1; |
70 | uint64_t RequiredDumpSpace; |
71 | uint64_t SystemTime; |
72 | char Comment[128]; |
73 | uint64_t SystemUpTime; |
74 | uint32_t MiniDumpFields; |
75 | uint32_t SecondaryDataState; |
76 | uint32_t ProductType; |
77 | uint32_t SuiteMask; |
78 | uint32_t WriterStatus; |
79 | uint8_t unused2; |
80 | uint8_t KdSecondaryVersion; |
81 | uint8_t reserved[4018]; |
82 | } QEMU_PACKED WinDumpHeader64; |
83 | |
84 | #define KDBG_OWNER_TAG_OFFSET64 0x10 |
85 | #define KDBG_MM_PFN_DATABASE_OFFSET64 0xC0 |
86 | #define KDBG_KI_BUGCHECK_DATA_OFFSET64 0x88 |
87 | #define KDBG_KI_PROCESSOR_BLOCK_OFFSET64 0x218 |
88 | #define KDBG_OFFSET_PRCB_CONTEXT_OFFSET64 0x338 |
89 | |
90 | #define VMCOREINFO_ELF_NOTE_HDR_SIZE 24 |
91 | |
92 | #define WIN_CTX_X64 0x00100000L |
93 | |
94 | #define WIN_CTX_CTL 0x00000001L |
95 | #define WIN_CTX_INT 0x00000002L |
96 | #define WIN_CTX_SEG 0x00000004L |
97 | #define WIN_CTX_FP 0x00000008L |
98 | #define WIN_CTX_DBG 0x00000010L |
99 | |
100 | #define WIN_CTX_FULL (WIN_CTX_X64 | WIN_CTX_CTL | WIN_CTX_INT | WIN_CTX_FP) |
101 | #define WIN_CTX_ALL (WIN_CTX_FULL | WIN_CTX_SEG | WIN_CTX_DBG) |
102 | |
103 | #define LIVE_SYSTEM_DUMP 0x00000161 |
104 | |
105 | typedef struct WinM128A { |
106 | uint64_t low; |
107 | int64_t high; |
108 | } QEMU_ALIGNED(16) WinM128A; |
109 | |
110 | typedef struct WinContext { |
111 | uint64_t PHome[6]; |
112 | |
113 | uint32_t ContextFlags; |
114 | uint32_t MxCsr; |
115 | |
116 | uint16_t SegCs; |
117 | uint16_t SegDs; |
118 | uint16_t SegEs; |
119 | uint16_t SegFs; |
120 | uint16_t SegGs; |
121 | uint16_t SegSs; |
122 | uint32_t EFlags; |
123 | |
124 | uint64_t Dr0; |
125 | uint64_t Dr1; |
126 | uint64_t Dr2; |
127 | uint64_t Dr3; |
128 | uint64_t Dr6; |
129 | uint64_t Dr7; |
130 | |
131 | uint64_t Rax; |
132 | uint64_t Rcx; |
133 | uint64_t Rdx; |
134 | uint64_t Rbx; |
135 | uint64_t Rsp; |
136 | uint64_t Rbp; |
137 | uint64_t Rsi; |
138 | uint64_t Rdi; |
139 | uint64_t R8; |
140 | uint64_t R9; |
141 | uint64_t R10; |
142 | uint64_t R11; |
143 | uint64_t R12; |
144 | uint64_t R13; |
145 | uint64_t R14; |
146 | uint64_t R15; |
147 | |
148 | uint64_t Rip; |
149 | |
150 | struct { |
151 | uint16_t ControlWord; |
152 | uint16_t StatusWord; |
153 | uint8_t TagWord; |
154 | uint8_t Reserved1; |
155 | uint16_t ErrorOpcode; |
156 | uint32_t ErrorOffset; |
157 | uint16_t ErrorSelector; |
158 | uint16_t Reserved2; |
159 | uint32_t DataOffset; |
160 | uint16_t DataSelector; |
161 | uint16_t Reserved3; |
162 | uint32_t MxCsr; |
163 | uint32_t MxCsr_Mask; |
164 | WinM128A FloatRegisters[8]; |
165 | WinM128A XmmRegisters[16]; |
166 | uint8_t Reserved4[96]; |
167 | } FltSave; |
168 | |
169 | WinM128A VectorRegister[26]; |
170 | uint64_t VectorControl; |
171 | |
172 | uint64_t DebugControl; |
173 | uint64_t LastBranchToRip; |
174 | uint64_t LastBranchFromRip; |
175 | uint64_t LastExceptionToRip; |
176 | uint64_t LastExceptionFromRip; |
177 | } QEMU_ALIGNED(16) WinContext; |
178 | |
179 | #endif /* QEMU_WIN_DUMP_DEFS_H */ |
180 |