--- /dev/null
+# This python script adds a new gdb command, "dump-guest-memory". It
+# should be loaded with "source dump-guest-memory.py" at the (gdb)
+# prompt.
+#
+# Copyright (C) 2013, Red Hat, Inc.
+#
+# Authors:
+# Laszlo Ersek <lersek@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or later. See
+# the COPYING file in the top-level directory.
+#
+# The leading docstring doesn't have idiomatic Python formatting. It is
+# printed by gdb's "help" command (the first line is printed in the
+# "help data" summary), and it should match how other help texts look in
+# gdb.
+
+import struct
+
+class DumpGuestMemory(gdb.Command):
+ """Extract guest vmcore from qemu process coredump.
+
+The sole argument is FILE, identifying the target file to write the
+guest vmcore to.
+
+This GDB command reimplements the dump-guest-memory QMP command in
+python, using the representation of guest memory as captured in the qemu
+coredump. The qemu process that has been dumped must have had the
+command line option "-machine dump-guest-core=on".
+
+For simplicity, the "paging", "begin" and "end" parameters of the QMP
+command are not supported -- no attempt is made to get the guest's
+internal paging structures (ie. paging=false is hard-wired), and guest
+memory is always fully dumped.
+
+Only x86_64 guests are supported.
+
+The CORE/NT_PRSTATUS and QEMU notes (that is, the VCPUs' statuses) are
+not written to the vmcore. Preparing these would require context that is
+only present in the KVM host kernel module when the guest is alive. A
+fake ELF note is written instead, only to keep the ELF parser of "crash"
+happy.
+
+Dependent on how busted the qemu process was at the time of the
+coredump, this command might produce unpredictable results. If qemu
+deliberately called abort(), or it was dumped in response to a signal at
+a halfway fortunate point, then its coredump should be in reasonable
+shape and this command should mostly work."""
+
+ TARGET_PAGE_SIZE = 0x1000
+ TARGET_PAGE_MASK = 0xFFFFFFFFFFFFF000
+
+ # Various ELF constants
+ EM_X86_64 = 62 # AMD x86-64 target machine
+ ELFDATA2LSB = 1 # little endian
+ ELFCLASS64 = 2
+ ELFMAG = "\x7FELF"
+ EV_CURRENT = 1
+ ET_CORE = 4
+ PT_LOAD = 1
+ PT_NOTE = 4
+
+ # Special value for e_phnum. This indicates that the real number of
+ # program headers is too large to fit into e_phnum. Instead the real
+ # value is in the field sh_info of section 0.
+ PN_XNUM = 0xFFFF
+
+ # Format strings for packing and header size calculation.
+ ELF64_EHDR = ("4s" # e_ident/magic
+ "B" # e_ident/class
+ "B" # e_ident/data
+ "B" # e_ident/version
+ "B" # e_ident/osabi
+ "8s" # e_ident/pad
+ "H" # e_type
+ "H" # e_machine
+ "I" # e_version
+ "Q" # e_entry
+ "Q" # e_phoff
+ "Q" # e_shoff
+ "I" # e_flags
+ "H" # e_ehsize
+ "H" # e_phentsize
+ "H" # e_phnum
+ "H" # e_shentsize
+ "H" # e_shnum
+ "H" # e_shstrndx
+ )
+ ELF64_PHDR = ("I" # p_type
+ "I" # p_flags
+ "Q" # p_offset
+ "Q" # p_vaddr
+ "Q" # p_paddr
+ "Q" # p_filesz
+ "Q" # p_memsz
+ "Q" # p_align
+ )
+
+ def __init__(self):
+ super(DumpGuestMemory, self).__init__("dump-guest-memory",
+ gdb.COMMAND_DATA,
+ gdb.COMPLETE_FILENAME)
+ self.uintptr_t = gdb.lookup_type("uintptr_t")
+ self.elf64_ehdr_le = struct.Struct("<%s" % self.ELF64_EHDR)
+ self.elf64_phdr_le = struct.Struct("<%s" % self.ELF64_PHDR)
+
+ def int128_get64(self, val):
+ assert (val["hi"] == 0)
+ return val["lo"]
+
+ def qlist_foreach(self, head, field_str):
+ var_p = head["lh_first"]
+ while (var_p != 0):
+ var = var_p.dereference()
+ yield var
+ var_p = var[field_str]["le_next"]
+
+ def qemu_get_ram_block(self, ram_addr):
+ ram_blocks = gdb.parse_and_eval("ram_list.blocks")
+ for block in self.qlist_foreach(ram_blocks, "next"):
+ if (ram_addr - block["offset"] < block["length"]):
+ return block
+ raise gdb.GdbError("Bad ram offset %x" % ram_addr)
+
+ def qemu_get_ram_ptr(self, ram_addr):
+ block = self.qemu_get_ram_block(ram_addr)
+ return block["host"] + (ram_addr - block["offset"])
+
+ def memory_region_get_ram_ptr(self, mr):
+ if (mr["alias"] != 0):
+ return (self.memory_region_get_ram_ptr(mr["alias"].dereference()) +
+ mr["alias_offset"])
+ return self.qemu_get_ram_ptr(mr["ram_addr"] & self.TARGET_PAGE_MASK)
+
+ def guest_phys_blocks_init(self):
+ self.guest_phys_blocks = []
+
+ def guest_phys_blocks_append(self):
+ print "guest RAM blocks:"
+ print ("target_start target_end host_addr message "
+ "count")
+ print ("---------------- ---------------- ---------------- ------- "
+ "-----")
+
+ current_map_p = gdb.parse_and_eval("address_space_memory.current_map")
+ current_map = current_map_p.dereference()
+ for cur in range(current_map["nr"]):
+ flat_range = (current_map["ranges"] + cur).dereference()
+ mr = flat_range["mr"].dereference()
+
+ # we only care about RAM
+ if (not mr["ram"]):
+ continue
+
+ section_size = self.int128_get64(flat_range["addr"]["size"])
+ target_start = self.int128_get64(flat_range["addr"]["start"])
+ target_end = target_start + section_size
+ host_addr = (self.memory_region_get_ram_ptr(mr) +
+ flat_range["offset_in_region"])
+ predecessor = None
+
+ # find continuity in guest physical address space
+ if (len(self.guest_phys_blocks) > 0):
+ predecessor = self.guest_phys_blocks[-1]
+ predecessor_size = (predecessor["target_end"] -
+ predecessor["target_start"])
+
+ # the memory API guarantees monotonically increasing
+ # traversal
+ assert (predecessor["target_end"] <= target_start)
+
+ # we want continuity in both guest-physical and
+ # host-virtual memory
+ if (predecessor["target_end"] < target_start or
+ predecessor["host_addr"] + predecessor_size != host_addr):
+ predecessor = None
+
+ if (predecessor is None):
+ # isolated mapping, add it to the list
+ self.guest_phys_blocks.append({"target_start": target_start,
+ "target_end" : target_end,
+ "host_addr" : host_addr})
+ message = "added"
+ else:
+ # expand predecessor until @target_end; predecessor's
+ # start doesn't change
+ predecessor["target_end"] = target_end
+ message = "joined"
+
+ print ("%016x %016x %016x %-7s %5u" %
+ (target_start, target_end, host_addr.cast(self.uintptr_t),
+ message, len(self.guest_phys_blocks)))
+
+ def cpu_get_dump_info(self):
+ # We can't synchronize the registers with KVM post-mortem, and
+ # the bits in (first_x86_cpu->env.hflags) seem to be stale; they
+ # may not reflect long mode for example. Hence just assume the
+ # most common values. This also means that instruction pointer
+ # etc. will be bogus in the dump, but at least the RAM contents
+ # should be valid.
+ self.dump_info = {"d_machine": self.EM_X86_64,
+ "d_endian" : self.ELFDATA2LSB,
+ "d_class" : self.ELFCLASS64}
+
+ def encode_elf64_ehdr_le(self):
+ return self.elf64_ehdr_le.pack(
+ self.ELFMAG, # e_ident/magic
+ self.dump_info["d_class"], # e_ident/class
+ self.dump_info["d_endian"], # e_ident/data
+ self.EV_CURRENT, # e_ident/version
+ 0, # e_ident/osabi
+ "", # e_ident/pad
+ self.ET_CORE, # e_type
+ self.dump_info["d_machine"], # e_machine
+ self.EV_CURRENT, # e_version
+ 0, # e_entry
+ self.elf64_ehdr_le.size, # e_phoff
+ 0, # e_shoff
+ 0, # e_flags
+ self.elf64_ehdr_le.size, # e_ehsize
+ self.elf64_phdr_le.size, # e_phentsize
+ self.phdr_num, # e_phnum
+ 0, # e_shentsize
+ 0, # e_shnum
+ 0 # e_shstrndx
+ )
+
+ def encode_elf64_note_le(self):
+ return self.elf64_phdr_le.pack(self.PT_NOTE, # p_type
+ 0, # p_flags
+ (self.memory_offset -
+ len(self.note)), # p_offset
+ 0, # p_vaddr
+ 0, # p_paddr
+ len(self.note), # p_filesz
+ len(self.note), # p_memsz
+ 0 # p_align
+ )
+
+ def encode_elf64_load_le(self, offset, start_hwaddr, range_size):
+ return self.elf64_phdr_le.pack(self.PT_LOAD, # p_type
+ 0, # p_flags
+ offset, # p_offset
+ 0, # p_vaddr
+ start_hwaddr, # p_paddr
+ range_size, # p_filesz
+ range_size, # p_memsz
+ 0 # p_align
+ )
+
+ def note_init(self, name, desc, type):
+ # name must include a trailing NUL
+ namesz = (len(name) + 1 + 3) / 4 * 4
+ descsz = (len(desc) + 3) / 4 * 4
+ fmt = ("<" # little endian
+ "I" # n_namesz
+ "I" # n_descsz
+ "I" # n_type
+ "%us" # name
+ "%us" # desc
+ % (namesz, descsz))
+ self.note = struct.pack(fmt,
+ len(name) + 1, len(desc), type, name, desc)
+
+ def dump_init(self):
+ self.guest_phys_blocks_init()
+ self.guest_phys_blocks_append()
+ self.cpu_get_dump_info()
+ # we have no way to retrieve the VCPU status from KVM
+ # post-mortem
+ self.note_init("NONE", "EMPTY", 0)
+
+ # Account for PT_NOTE.
+ self.phdr_num = 1
+
+ # We should never reach PN_XNUM for paging=false dumps: there's
+ # just a handful of discontiguous ranges after merging.
+ self.phdr_num += len(self.guest_phys_blocks)
+ assert (self.phdr_num < self.PN_XNUM)
+
+ # Calculate the ELF file offset where the memory dump commences:
+ #
+ # ELF header
+ # PT_NOTE
+ # PT_LOAD: 1
+ # PT_LOAD: 2
+ # ...
+ # PT_LOAD: len(self.guest_phys_blocks)
+ # ELF note
+ # memory dump
+ self.memory_offset = (self.elf64_ehdr_le.size +
+ self.elf64_phdr_le.size * self.phdr_num +
+ len(self.note))
+
+ def dump_begin(self, vmcore):
+ vmcore.write(self.encode_elf64_ehdr_le())
+ vmcore.write(self.encode_elf64_note_le())
+ running = self.memory_offset
+ for block in self.guest_phys_blocks:
+ range_size = block["target_end"] - block["target_start"]
+ vmcore.write(self.encode_elf64_load_le(running,
+ block["target_start"],
+ range_size))
+ running += range_size
+ vmcore.write(self.note)
+
+ def dump_iterate(self, vmcore):
+ qemu_core = gdb.inferiors()[0]
+ for block in self.guest_phys_blocks:
+ cur = block["host_addr"]
+ left = block["target_end"] - block["target_start"]
+ print ("dumping range at %016x for length %016x" %
+ (cur.cast(self.uintptr_t), left))
+ while (left > 0):
+ chunk_size = min(self.TARGET_PAGE_SIZE, left)
+ chunk = qemu_core.read_memory(cur, chunk_size)
+ vmcore.write(chunk)
+ cur += chunk_size
+ left -= chunk_size
+
+ def create_vmcore(self, filename):
+ vmcore = open(filename, "wb")
+ self.dump_begin(vmcore)
+ self.dump_iterate(vmcore)
+ vmcore.close()
+
+ def invoke(self, args, from_tty):
+ # Unwittingly pressing the Enter key after the command should
+ # not dump the same multi-gig coredump to the same file.
+ self.dont_repeat()
+
+ argv = gdb.string_to_argv(args)
+ if (len(argv) != 1):
+ raise gdb.GdbError("usage: dump-guest-memory FILE")
+
+ self.dump_init()
+ self.create_vmcore(argv[0])
+
+DumpGuestMemory()
Code Review / kvmfornfv.git / blobdiff