dumpctl.c File Reference

#include "iop.h"
#include "ntddft.h"
#include <inbv.h>
#include <windef.h>

Go to the source code of this file.

Defines
#define	min3(_a, _b, _c)   ( min ( min ((_a), (_b)), min ((_a), (_c))) )
#define	IO_DUMP_MAXIMUM_TRANSFER_SIZE   ( 1024 * 64 )
#define	IO_DUMP_MINIMUM_TRANSFER_SIZE   ( 1024 * 32 )
#define	IO_DUMP_MINIMUM_FILE_SIZE   ( PAGE_SIZE * 256 )
#define	MAX_UNICODE_LENGTH   ( 512 )
#define	DEFAULT_DRIVER_PATH   L"\\SystemRoot\\System32\\Drivers\\"
#define	DEFAULT_DUMP_DRIVER   L"\\SystemRoot\\System32\\Drivers\\diskdump.sys"
#define	SCSIPORT_DRIVER_NAME   L"scsiport.sys"
#define	MAX_TRIAGE_STACK_SIZE   ( 16 * 1024 )
#define	DEFAULT_TRIAGE_DUMP_FLAGS   (0xFFFFFFFF)
#define	IoDebugPrint(X)
#define	DmpPoolStringSize(DumpString)   (sizeof (DUMP_STRING) + sizeof (WCHAR) * ( DumpString->Length + 1 ))
#define	DmpNextPoolString(DumpString)
#define	ALIGN_8(_x)   ALIGN_UP(_x, DWORDLONG)
#define	IndexByByte(Pointer, Index)   (&(((BYTE*) (Pointer)) [Index]))
Functions
NTSTATUS	IopWriteTriageDump (IN ULONG FieldsToWrite, IN PDUMP_DRIVER_WRITE WriteRoutine, IN OUT PLARGE_INTEGER Mcb, IN OUT PMDL Mdl, IN ULONG DiverTransferSize, IN PCONTEXT Context, IN LPBYTE Buffer, IN ULONG BufferSize, IN ULONG ServicePackBuild, IN ULONG TriageOptions)
NTSTATUS	IopWriteSummaryDump (IN PRTL_BITMAP PageMap, IN PDUMP_DRIVER_WRITE WriteRoutine, IN PANSI_STRING ProgressMessage, IN PUCHAR MessageBuffer, IN OUT PLARGE_INTEGER Mcb, IN ULONG DiverTransferSize)
NTSTATUS	IopWriteToDisk (IN PVOID Buffer, IN ULONG WriteLength, IN PDUMP_DRIVER_WRITE DriverWriteRoutine, IN OUT PLARGE_INTEGER *Mcb, IN OUT PMDL Mdl, IN ULONG DriverTransferSize)
VOID	IopMapPhysicalMemory (IN OUT PMDL Mdl, IN ULONG_PTR MemoryAddress, IN PPHYSICAL_MEMORY_RUN PhysicalMemoryRun, IN ULONG Length)
NTSTATUS	IopLoadDumpDriver (IN OUT PDUMP_STACK_CONTEXT DumpStack, IN PWCHAR DriverNameString, IN PWCHAR NewBaseNameString)
NTSTATUS	IoSetCrashDumpState (IN SYSTEM_CRASH_STATE_INFORMATION *pDumpState)
PSUMMARY_DUMP_HEADER	IopInitializeSummaryDump (IN PDUMP_CONTROL_BLOCK pDcb)
NTSTATUS	IopWriteSummaryHeader (IN PSUMMARY_DUMP_HEADER pSummaryHeader, IN PDUMP_DRIVER_WRITE pfWrite, IN OUT PLARGE_INTEGER *pMcbBuffer, IN OUT PMDL pMdl, IN ULONG dwWriteSize, IN ULONG dwLength)
VOID	IopMapVirtualToPhysicalMdl (IN OUT PMDL pMdl, IN ULONG_PTR dwMemoryAddress, IN ULONG dwLength)
ULONG	IopCreateSummaryDump (IN PSUMMARY_DUMP_HEADER pHeader)
VOID	IopDeleteNonExistentMemory (PSUMMARY_DUMP_HEADER pHeader, PPHYSICAL_MEMORY_DESCRIPTOR MmPhysicalMemoryBlock)
NTSTATUS	IopGetDumpStack (IN PWCHAR ModulePrefix, OUT PDUMP_STACK_CONTEXT *pDumpStack, IN PUNICODE_STRING pUniDeviceName, IN PWSTR pDumpDriverName, IN DEVICE_USAGE_NOTIFICATION_TYPE UsageType, IN ULONG IgnoreDeviceUsageFailure)
BOOLEAN	IopInitializeDCB ()
LARGE_INTEGER	IopCalculateRequiredDumpSpace (IN ULONG dwDmpFlags, IN ULONG dwHeaderSize, IN PFN_NUMBER dwMaxPages, IN PFN_NUMBER dwMaxSummaryPages)
NTSTATUS	IopCompleteDumpInitialization (IN HANDLE FileHandle)
BOOLEAN	IopIsAddressRangeValid (IN PVOID VirtualAddress, IN SIZE_T Length)
NTSTATUS	IoGetDumpStack (IN PWCHAR ModulePrefix, OUT PDUMP_STACK_CONTEXT *pDumpStack, IN DEVICE_USAGE_NOTIFICATION_TYPE UsageType, IN ULONG IgnoreDeviceUsageFailure)
NTSTATUS	IopGetDumpStack (IN PWCHAR ModulePrefix, OUT PDUMP_STACK_CONTEXT *pDumpStack, IN PUNICODE_STRING pUniDeviceName, IN PWCHAR pDumpDriverName, IN DEVICE_USAGE_NOTIFICATION_TYPE UsageType, IN ULONG IgnoreDeviceUsageFailure)
ULONG	IopGetDumpControlBlockCheck (IN PDUMP_CONTROL_BLOCK Dcb)
NTSTATUS	IoInitializeDumpStack (IN PDUMP_STACK_CONTEXT DumpStack, IN PUCHAR MessageBuffer OPTIONAL)
VOID	IoGetDumpHiberRanges (IN PVOID HiberContext, IN PDUMP_STACK_CONTEXT DumpStack)
VOID	IoFreeDumpStack (IN PDUMP_STACK_CONTEXT DumpStack)
NTSTATUS	IopInitializeDumpSpaceAndType (IN PDUMP_CONTROL_BLOCK dcb, IN OUT PULONG block, IN PSUMMARY_DUMP_HEADER pSummaryHeader)
BOOLEAN	IoWriteCrashDump (IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4, IN PVOID ContextSave)
VOID	IopAddPageToPageMap (IN ULONG dwMaxPage, IN PRTL_BITMAP pBitMapHeader, IN ULONG dwPageFrameIndex, IN ULONG dwNumberOfPages)
VOID	IopRemovePageFromPageMap (IN ULONG dwMaxPage, IN PRTL_BITMAP pBitMapHeader, IN ULONG dwPageFrameIndex, IN ULONG dwNumberOfPages)
NTKERNELAPI NTSTATUS	IoGetCrashDumpInformation (OUT PSYSTEM_CRASH_DUMP_INFORMATION pCrashDumpInfo)
NTKERNELAPI NTSTATUS	IoGetCrashDumpStateInformation (OUT PSYSTEM_CRASH_STATE_INFORMATION pCrashDumpState)
NTSTATUS	IoSetDumpRange (IN PVOID DumpContext, IN PVOID StartVa, IN ULONG_PTR Pages, IN BOOLEAN IsPhysicalAddress)
NTSTATUS	IoFreeDumpRange (IN PVOID DumpContext, IN PVOID StartVa, IN ULONG_PTR Pages, IN BOOLEAN IsPhysicalAddress)
NTSTATUS	IopGetLoadedDriverInfo (OUT ULONG *lpDriverCount, OUT ULONG *lpSizeOfStringData)
NTSTATUS	IopWriteDriverList (IN ULONG_PTR BufferAddress, IN ULONG BufferSize, IN ULONG DriverListOffset, IN ULONG StringPoolOffset)
NTSTATUS	IopWriteTriageDump (IN ULONG Fields, IN PDUMP_DRIVER_WRITE DriverWriteRoutine, IN OUT PLARGE_INTEGER Mcb, IN OUT PMDL Mdl, IN ULONG DriverTransferSize, IN PCONTEXT Context, IN BYTE *Buffer, IN ULONG BufferSize, IN ULONG ServicePackBuild, IN ULONG TriageOptions)
NTSTATUS	IopWritePageToDisk (IN PDUMP_DRIVER_WRITE DriverWrite, IN OUT PLARGE_INTEGER *McbBuffer, IN OUT ULONG DriverTransferSize, IN PFN_NUMBER PageFrameIndex)
NTSTATUS	IopWriteSummaryDump (IN PRTL_BITMAP PageMap, IN PDUMP_DRIVER_WRITE DriverWriteRoutine, IN PANSI_STRING ProgressMessage, IN PUCHAR MessageBuffer, IN OUT PLARGE_INTEGER Mcb, IN OUT ULONG DriverTransferSize)
VOID	IopFreeDCB (BOOLEAN FreeDCB)
VOID	IopReadDumpRegistry (OUT PULONG dumpControl, OUT PULONG numberOfHeaderPages, OUT PULONG autoReboot, OUT PULONG dumpFileSize)
BOOLEAN	IopConfigureCrashDump (IN HANDLE hPageFile)
Variables
PVOID	MmPfnDatabase
PFN_NUMBER	MmHighestPossiblePhysicalPage
NTSTATUS	IopFinalCrashDumpStatus = -1
ULONG	IopCrashDumpStateChange = 0
BOOLEAN	IopDumpFileContainsNewDump = FALSE

---

Define Documentation

#define ALIGN_8 (  _x   )     ALIGN_UP(_x, DWORDLONG)

Definition at line 2672 of file dumpctl.c. Referenced by IopWriteTriageDump().

#define DEFAULT_DRIVER_PATH   L"\\SystemRoot\\System32\\Drivers\\"

Definition at line 91 of file dumpctl.c.

#define DEFAULT_DUMP_DRIVER   L"\\SystemRoot\\System32\\Drivers\\diskdump.sys"

Definition at line 92 of file dumpctl.c. Referenced by IoGetDumpStack().

#define DEFAULT_TRIAGE_DUMP_FLAGS   (0xFFFFFFFF)

Definition at line 95 of file dumpctl.c. Referenced by IopInitializeDCB().

#define DmpNextPoolString (  DumpString   )

Value: (PDUMP_STRING) ( \ ALIGN_UP_POINTER( \ ((LPBYTE) DumpString) + DmpPoolStringSize (DumpString), \ ULONGLONG \ ) \ ) Definition at line 2664 of file dumpctl.c. Referenced by IopWriteDriverList().

#define DmpPoolStringSize (  DumpString   )     (sizeof (DUMP_STRING) + sizeof (WCHAR) * ( DumpString->Length + 1 ))

Definition at line 2661 of file dumpctl.c.

#define IndexByByte (  Pointer, Index   )     (&(((BYTE*) (Pointer)) [Index]))

Definition at line 2676 of file dumpctl.c. Referenced by IopWriteTriageDump(), TriageGetLoaderEntry(), TriageGetMmInformation(), TriagepGetTriagePointer(), and TriagepVerifyDump().

#define IO_DUMP_MAXIMUM_TRANSFER_SIZE   ( 1024 * 64 )

Definition at line 86 of file dumpctl.c. Referenced by IopWriteToDisk(), and IoWriteCrashDump().

#define IO_DUMP_MINIMUM_FILE_SIZE   ( PAGE_SIZE * 256 )

Definition at line 88 of file dumpctl.c. Referenced by IopCalculateRequiredDumpSpace().

#define IO_DUMP_MINIMUM_TRANSFER_SIZE   ( 1024 * 32 )

Definition at line 87 of file dumpctl.c. Referenced by IopWriteToDisk(), and IoWriteCrashDump().

#define IoDebugPrint (  X   )

Definition at line 231 of file dumpctl.c. Referenced by IoFreeDumpRange(), IoInitializeDumpStack(), IopConfigureCrashDump(), IopCreateSummaryDump(), IopDeleteNonExistentMemory(), IopFreeDCB(), IopGetDumpStack(), IopInitializeDCB(), IopInitializeDumpSpaceAndType(), IopInitializeSummaryDump(), IopLoadDumpDriver(), IopMapVirtualToPhysicalMdl(), IopReadDumpRegistry(), IopRemovePageFromPageMap(), IopWriteSummaryDump(), IopWriteSummaryHeader(), IopWriteToDisk(), IopWriteTriageDump(), and IoWriteCrashDump().

#define MAX_TRIAGE_STACK_SIZE   ( 16 * 1024 )

Definition at line 94 of file dumpctl.c. Referenced by IopWriteTriageDump().

#define MAX_UNICODE_LENGTH   ( 512 )

Definition at line 89 of file dumpctl.c.

#define min3 (  _a, _b, _c   )     ( min ( min ((_a), (_b)), min ((_a), (_c))) )

Definition at line 68 of file dumpctl.c. Referenced by IopWritePageToDisk().

#define SCSIPORT_DRIVER_NAME   L"scsiport.sys"

Definition at line 93 of file dumpctl.c. Referenced by IopGetDumpStack().

---

Function Documentation

NTSTATUS IoFreeDumpRange (  IN PVOID  DumpContext, IN PVOID  StartVa, IN ULONG_PTR  Pages, IN BOOLEAN  IsPhysicalAddress )

Definition at line 2400 of file dumpctl.c. References ASSERT, IoDebugPrint, IopRemovePageFromPageMap(), MmGetPhysicalAddress(), MmIsAddressValid(), PAGE_SHIFT, and PAGE_SIZE. Referenced by MmSetKernelDumpRange(). : This routine excludes this range of memory in the dump. Arguments: DumpContext - dump context StartVa - Starting VA Pages - The number of pages to include IsPhysicalAddress - true if direct physical address translation Return Value: STATUS_SUCCESS - On success. NTSTATUS - Error. --*/ { PCHAR Va; PRTL_BITMAP pBitMapHeader; PHYSICAL_ADDRESS phyAddr; PSUMMARY_DUMP_HEADER pHeader; // // Round to page size. // Va = StartVa; pHeader = (PSUMMARY_DUMP_HEADER)DumpContext; pBitMapHeader = (PRTL_BITMAP)(pHeader + 1); // // Win64 can have really large page addresses. This dump code does // not handle that yet. Note that before this assert is removed // the casts of Pages to ULONG must be removed. // ASSERT (Pages <= MAXULONG); if (IsPhysicalAddress) { phyAddr = MmGetPhysicalAddress(Va); IopRemovePageFromPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)(phyAddr.QuadPart >> PAGE_SHIFT), (ULONG) Pages ); } else { while (Pages) { // // Only do a translation for valid pages. // if ( MmIsAddressValid (Va) ) { phyAddr = MmGetPhysicalAddress (Va); IoDebugPrint((3,"IoFreeDumpRange:Va: %x Pages: %x IsPhysical: %x phyAddr %I64x\n", StartVa,Pages,IsPhysicalAddress, phyAddr.QuadPart)); IopRemovePageFromPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)(phyAddr.QuadPart >> PAGE_SHIFT), 1); } Va += PAGE_SIZE; Pages--; } } return STATUS_SUCCESS; }

VOID IoFreeDumpStack (  IN PDUMP_STACK_CONTEXT  DumpStack  )

Definition at line 1300 of file dumpctl.c. References _INITIALIZATION_CONTEXT::AdapterObject, ASSERT, _INITIALIZATION_CONTEXT::CommonBuffer, DeviceUsageTypeUndefined, Event(), Executive, ExFreePool(), FALSE, _IO_STACK_LOCATION::FileObject, HalFreeCommonBuffer(), IoBuildDeviceIoControlRequest(), IoCallDriver, IoGetNextIrpStackLocation, IoGetRelatedDeviceObject(), IopSynchronousCall(), Irp, IRP_MJ_PNP, IRP_MN_DEVICE_USAGE_NOTIFICATION, KeInitializeEvent, KernelMode, KeWaitForSingleObject(), _IO_STACK_LOCATION::MajorFunction, _IO_STACK_LOCATION::MinorFunction, MmFreeContiguousMemory(), MmUnloadSystemImage(), NTSTATUS(), NULL, ObDereferenceObject, PAGED_CODE, _IO_STACK_LOCATION::Parameters, PDUMP_STACK_IMAGE, _INITIALIZATION_CONTEXT::PhysicalAddress, Status, and VOID(). Referenced by IopFreeDCB(), and IopGetDumpStack(). : Free the dump driver stack referenced by DumpStack Arguments: DumpStack - Dump driver stack being initialized Return Value: None --*/ { PINITIALIZATION_CONTEXT DumpInit; PDUMP_STACK_IMAGE DumpImage; PDEVICE_OBJECT DeviceObject; PIO_STACK_LOCATION IrpSp; IO_STATUS_BLOCK IoStatus; PIRP Irp; KEVENT Event; NTSTATUS Status; ULONG i; PFILE_OBJECT FileObject; IO_STACK_LOCATION irpSp; ULONG information; PAGED_CODE(); DumpInit = &DumpStack->Init; // // Release the claim to this file as a specific device usage path. // FileObject = DumpStack->FileObject; if (FileObject) { DeviceObject = IoGetRelatedDeviceObject (FileObject); RtlZeroMemory (&irpSp, sizeof (IO_STACK_LOCATION)); irpSp.MajorFunction = IRP_MJ_PNP; irpSp.MinorFunction = IRP_MN_DEVICE_USAGE_NOTIFICATION; irpSp.Parameters.UsageNotification.Type = DumpStack->UsageType; irpSp.Parameters.UsageNotification.InPath = FALSE; irpSp.FileObject = FileObject; if (DeviceUsageTypeUndefined != DumpStack->UsageType) { Status = IopSynchronousCall (DeviceObject, &irpSp, (VOID **) &information); ASSERT (0 == information); } else { Status = STATUS_SUCCESS; } } // // Free any common buffers which where allocated // for (i=0; i < 2; i++) { if (DumpInit->CommonBuffer[i]) { if (DumpInit->AdapterObject) { #if !defined(NO_LEGACY_DRIVERS) HalFreeCommonBuffer ( DumpInit->AdapterObject, ((PDUMP_POINTERS)DumpStack->DumpPointers)->CommonBufferSize, DumpInit->PhysicalAddress[i], DumpInit->CommonBuffer[i], FALSE ); #else (*((PDMA_ADAPTER)DumpInit->AdapterObject)->DmaOperations-> FreeCommonBuffer )( (PDMA_ADAPTER)DumpInit->AdapterObject, ((PDUMP_POINTERS)DumpStack->DumpPointers)->CommonBufferSize, DumpInit->PhysicalAddress[i], DumpInit->CommonBuffer[i], FALSE ); #endif // NO_LEGACY_DRIVERS } else { MmFreeContiguousMemory (DumpInit->CommonBuffer[i]); } } DumpInit->CommonBuffer[i] = NULL; } // // Unload the dump drivers // while (!IsListEmpty(&DumpStack->DriverList)) { DumpImage = CONTAINING_RECORD(DumpStack->DriverList.Blink, DUMP_STACK_IMAGE, Link); RemoveEntryList (&DumpImage->Link); MmUnloadSystemImage (DumpImage->Image); ExFreePool (DumpImage); } // // Inform the driver stack that the dump registartion is over // if (DumpStack->FileObject) { DeviceObject = IoGetRelatedDeviceObject ((PFILE_OBJECT) DumpStack->FileObject); KeInitializeEvent( &Event, NotificationEvent, FALSE ); Irp = IoBuildDeviceIoControlRequest( IOCTL_SCSI_FREE_DUMP_POINTERS, DeviceObject, DumpStack->DumpPointers, sizeof (DUMP_POINTERS), NULL, 0, FALSE, &Event, &IoStatus ); IrpSp = IoGetNextIrpStackLocation (Irp); IrpSp->FileObject = DumpStack->FileObject; Status = IoCallDriver( DeviceObject, Irp ); if (Status == STATUS_PENDING) { KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL); Status = IoStatus.Status; } ObDereferenceObject( DumpStack->FileObject ); } // // Free the target address if it exists // if (DumpStack->Init.TargetAddress) { ExFreePool( DumpStack->Init.TargetAddress); } // // Free the dump stack context // ExFreePool (DumpStack); }

NTKERNELAPI NTSTATUS IoGetCrashDumpInformation (  OUT PSYSTEM_CRASH_DUMP_INFORMATION  pCrashDumpInfo  )

Definition at line 2217 of file dumpctl.c. References IopDumpControlBlock, and NULL. Referenced by NtQuerySystemInformation(). : This function checks to see if an open crash dump section exists and if so creates a handle to the section and returns that value in the CrashDumpInformation structure. Arguments: CrashInfo - Supplies a pointer to the crash dump information structure. Return Value: Status of the operation. A handle value of zero indicates no crash dump was located. --*/ { if (!IopDumpControlBlock) { return STATUS_NOT_FOUND; } // // NB: The section object is for direct dump support, which has been // removed. // pCrashDumpInfo->hDumpSection = NULL; return STATUS_SUCCESS; }

NTKERNELAPI NTSTATUS IoGetCrashDumpStateInformation (  OUT PSYSTEM_CRASH_STATE_INFORMATION  pCrashDumpState  )

Definition at line 2260 of file dumpctl.c. References FALSE. Referenced by NtQuerySystemInformation(). : This routine returns sets the state variable for direct dump (fast dump) Arguments: CrashInfo - Supplies a pointer to the crash dump state information structure. Return Value: Status of the operation. A handle value of zero indicates no crash dump was located. --*/ { pCrashDumpState->ValidDirectDump = FALSE; return STATUS_SUCCESS; }

VOID IoGetDumpHiberRanges (  IN PVOID  HiberContext, IN PDUMP_STACK_CONTEXT  DumpStack )

Definition at line 1233 of file dumpctl.c. References PDUMP_STACK_IMAGE, PO_MEM_CL_OR_NCHK, and PoSetHiberRange(). : Adds the dump driver stack storage to the hibernate range list, to inform the hibernate procedure which pages need cloned, discarded or not checksumed as they are in use by the dump stack. Arguments: HiberContext - Pointer to the hiber context structure DumpStack - Dump driver stack being initialized Return Value: None --*/ { PDUMP_POINTERS DumpPointers; PDUMP_STACK_IMAGE DumpImage; PLIST_ENTRY Link; DumpPointers = DumpStack->DumpPointers; // // Report the common buffer // if (DumpPointers->CommonBufferVa) { PoSetHiberRange ( HiberContext, PO_MEM_CL_OR_NCHK, DumpPointers->CommonBufferVa, DumpPointers->CommonBufferSize, 'fubc' ); } // // Dump the entire image of the dump drivers // for (Link = DumpStack->DriverList.Flink; Link != &DumpStack->DriverList; Link = Link->Flink) { DumpImage = CONTAINING_RECORD(Link, DUMP_STACK_IMAGE, Link); PoSetHiberRange ( HiberContext, PO_MEM_CL_OR_NCHK, DumpImage->ImageBase, DumpImage->SizeOfImage, 'gmID' ); } }

NTSTATUS IoGetDumpStack (  IN PWCHAR  ModulePrefix, OUT PDUMP_STACK_CONTEXT *  pDumpStack, IN DEVICE_USAGE_NOTIFICATION_TYPE  UsageType, IN ULONG  IgnoreDeviceUsageFailure )

Definition at line 335 of file dumpctl.c. References DEFAULT_DUMP_DRIVER, IoArcBootDeviceName, IopGetDumpStack(), and PAGED_CODE. Referenced by IopConfigureCrashDump(). : This routine loads a dump stack instance and returns an allocated context structure to track the loaded dumps stack. Arguments: ModePrefix - The prefix to prepent to BaseName during the load operation. This allows loading the same drivers multiple times with different virtual names and linkages. pDumpStack - The returned dump stack context structure UsageType - The Device Notification Usage Type for this file, that this routine will send as to the device object once the file has been successfully created and initialized. IgnoreDeviceUsageFailure - If the Device Usage Notification Irp fails, allow this to succeed anyway. Return Value: Status --*/ { PAGED_CODE(); return IopGetDumpStack(ModulePrefix, pDumpStack, &IoArcBootDeviceName, DEFAULT_DUMP_DRIVER, UsageType, IgnoreDeviceUsageFailure ); }

NTSTATUS IoInitializeDumpStack (  IN PDUMP_STACK_CONTEXT  DumpStack, IN PUCHAR MessageBuffer  OPTIONAL )

Definition at line 1142 of file dumpctl.c. References InbvDisplayString(), IoDebugPrint, NT_SUCCESS, NTSTATUS(), NULL, _INITIALIZATION_CONTEXT::OpenRoutine, PDRIVER_INITIALIZE, PDUMP_STACK_IMAGE, and Status. Referenced by IoWriteCrashDump(). : Initialize the dump driver stack referenced by DumpStack to perform IO. Arguments: DumpStack - Dump driver stack being initialized Return Value: Status --*/ { PINITIALIZATION_CONTEXT DumpInit; PLIST_ENTRY Link; ULONG Check; NTSTATUS Status; PDRIVER_INITIALIZE DriverInit; PDUMP_STACK_IMAGE DumpImage; DumpInit = &DumpStack->Init; // // Verify checksum on DumpStack structure // // BUGBUG: later // // Initializes the dump drivers // for (Link = DumpStack->DriverList.Flink; Link != &DumpStack->DriverList; Link = Link->Flink) { DumpImage = CONTAINING_RECORD(Link, DUMP_STACK_IMAGE, Link); // // Call this driver's driver init. Only the first driver gets the // dump initialization context // DriverInit = DumpImage->Image->EntryPoint; Status = DriverInit (NULL, (PUNICODE_STRING) DumpInit); DumpInit = NULL; if (!NT_SUCCESS(Status)) { IoDebugPrint ((0, "IODUMP: Unable to initialize driver; error = %x\n", Status )); return Status; } } DumpInit = &DumpStack->Init; // // Display string we are starting // if (MessageBuffer) { InbvDisplayString (MessageBuffer); } // // Open the partition from which the system was booted. // This returns TRUE if the disk w/the appropriate signature was found, // otherwise a NULL, in which case there is no way to continue. // if (!DumpInit->OpenRoutine (DumpStack->PartitionOffset)) { IoDebugPrint (( 0, "IODUMP: Could not find/open partition offset\n" )); return STATUS_UNSUCCESSFUL; } return STATUS_SUCCESS; }

VOID IopAddPageToPageMap (  IN ULONG  dwMaxPage, IN PRTL_BITMAP  pBitMapHeader, IN ULONG  dwPageFrameIndex, IN ULONG  dwNumberOfPages )

Definition at line 2172 of file dumpctl.c. References RtlSetBits(). Referenced by IoSetDumpRange(). { // // Sometimes we get PFNs that are out of range. Just ignore them. // if (dwPageFrameIndex >= dwMaxPage) { return; } RtlSetBits (pBitMapHeader, dwPageFrameIndex, dwNumberOfPages); }

LARGE_INTEGER IopCalculateRequiredDumpSpace (  IN ULONG  dwDmpFlags, IN ULONG  dwHeaderSize, IN PFN_NUMBER  dwMaxPages, IN PFN_NUMBER  dwMaxSummaryPages )

Definition at line 2492 of file dumpctl.c. References DCB_DUMP_ENABLED, DCB_DUMP_HEADER_ENABLED, DCB_SUMMARY_DUMP_ENABLED, DCB_SUMMARY_ENABLED, DCB_TRIAGE_DUMP_ENABLED, IO_DUMP_MINIMUM_FILE_SIZE, MmVirtualBias, PAGE_SHIFT, PAGE_SIZE, and ROUND_TO_PAGES. Referenced by IopConfigureCrashDump(), and IopInitializeDumpSpaceAndType(). : This routine is used to calcuate required dump space 1. Crash dump summary must be at least 1 page in length. 2. Summary dump must be large enough for kernel memory plus header, plus summary header. 3. Full dump must be large enough for header plus all physical memory. Arguments: dwDmpFlags - Dump Control Block (DCB) flags. dwHeaderSize - The size of the dump header. dwMaxPages - All physical memory. dwMaxSummaryPages - Maximum pages in summary dump. Return Value: Size of the dump file --*/ { LARGE_INTEGER maxMemorySize; // // Dump header or dump summary. // if ( (dwDmpFlags & DCB_DUMP_HEADER_ENABLED) || ( !( dwDmpFlags & DCB_DUMP_ENABLED ) && ( dwDmpFlags & DCB_SUMMARY_ENABLED ) ) ) { maxMemorySize.QuadPart = IO_DUMP_MINIMUM_FILE_SIZE; return maxMemorySize; } if (dwDmpFlags & DCB_TRIAGE_DUMP_ENABLED) { maxMemorySize.QuadPart = TRIAGE_DUMP_SIZE; return maxMemorySize; } if (dwDmpFlags & DCB_SUMMARY_DUMP_ENABLED) { ULONG summaryHeaderSize; ULONG dwGB; maxMemorySize.QuadPart = (dwMaxSummaryPages) * PAGE_SIZE; // // If biased then max kernel memory is 1GB otherwise it is 2GB // dwGB = 1024 * 1024 * 1024; if (maxMemorySize.QuadPart > (2 * dwGB) ) { if (MmVirtualBias) { maxMemorySize.QuadPart = dwGB; } else { maxMemorySize.QuadPart = (2 * dwGB); } } // // Calculate the summary header size. Includes the header plus bitmap // summaryHeaderSize = (ULONG) ROUND_TO_PAGES( sizeof(SUMMARY_DUMP_HEADER) + sizeof(RTL_BITMAP) + ( ( (maxMemorySize.QuadPart >> PAGE_SHIFT ) >> 5 ) << 2 ) + dwHeaderSize ); maxMemorySize.QuadPart+= summaryHeaderSize; return maxMemorySize; } // // Full memory dump is #pages * pagesize plus 1 page for the dump header. // maxMemorySize.QuadPart = (dwMaxPages * PAGE_SIZE) + dwHeaderSize; return maxMemorySize; }

NTSTATUS IopCompleteDumpInitialization (  IN HANDLE  FileHandle  )

Definition at line 4061 of file dumpctl.c. References ASSERT, DO_SYSTEM_BOOT_PARTITION, _DUMP_CONTROL_BLOCK::DumpFileSize, Executive, FALSE, _DUMP_CONTROL_BLOCK::FileDescriptorArray, _DUMP_CONTROL_BLOCK::FileDescriptorSize, _DEVICE_OBJECT::Flags, IoFileObjectType, IopDumpControlBlock, IopDumpControlBlockChecksum, IopGetDumpControlBlockCheck(), IopLogErrorEvent(), KernelMode, KeWaitForSingleObject(), NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, ObReferenceObjectByHandle(), and Status. Referenced by IopConfigureCrashDump(). : This routine is invoked after the dump file is created. The purpose is to obtain the retrieval pointers so that they can then be used later to write the dump. The last step is to checksum the IopDumpControlBlock. Fields in the IopDumpControlBlock are updated if necessary and the IopDumpControlBlockChecksum is initialized. This is the final step in dump initialization. Arguments: FileHandle - Handle to the dump file just created. Return Value: STATUS_SUCCESS - Indicates success. Other NTSTATUS - Failure. --*/ { NTSTATUS Status; NTSTATUS ErrorToLog; ULONG i; LARGE_INTEGER RequestedFileSize; PLARGE_INTEGER mcb; PFILE_OBJECT FileObject; PDEVICE_OBJECT DeviceObject; IO_STATUS_BLOCK IoStatusBlock; FILE_STANDARD_INFORMATION StandardFileInfo; Status = STATUS_UNSUCCESSFUL; ErrorToLog = STATUS_SUCCESS; // No error FileObject = NULL; DeviceObject = NULL; Status = ObReferenceObjectByHandle( FileHandle, 0, IoFileObjectType, KernelMode, (PVOID *) &FileObject, NULL ); if ( !NT_SUCCESS (Status) ) { ASSERT (FALSE); goto Cleanup; } DeviceObject = FileObject->DeviceObject; // // If this device object represents the boot partition then query // the retrieval pointers for the file. // if ( !(DeviceObject->Flags & DO_SYSTEM_BOOT_PARTITION) ) { KdPrint (("IODUMP: Cannot dump to pagefile on non-system partition.\n")); goto Cleanup; } Status = ZwQueryInformationFile( FileHandle, &IoStatusBlock, &StandardFileInfo, sizeof (StandardFileInfo), FileStandardInformation ); if (Status == STATUS_PENDING) { Status = KeWaitForSingleObject( &FileObject->Event, Executive, KernelMode, FALSE, NULL ); Status = IoStatusBlock.Status; } if ( !NT_SUCCESS (Status) ) { KdPrint (("CRASHDUMP: Failed ZwQueryInformationFile\n")); goto Cleanup; } // // Do not ask for more space than is in the pagefile. // RequestedFileSize = IopDumpControlBlock->DumpFileSize; if (RequestedFileSize.QuadPart > StandardFileInfo.EndOfFile.QuadPart) { RequestedFileSize = StandardFileInfo.EndOfFile; } Status = ZwFsControlFile( FileHandle, NULL, NULL, NULL, &IoStatusBlock, FSCTL_QUERY_RETRIEVAL_POINTERS, &RequestedFileSize, sizeof( LARGE_INTEGER ), &mcb, sizeof( PVOID ) ); if (Status == STATUS_PENDING) { Status = KeWaitForSingleObject( &FileObject->Event, Executive, KernelMode, FALSE, NULL ); Status = IoStatusBlock.Status; } // // NOTE: If you fail here, put a BP on ntfs!NtfsQueryRetrievalPointers // or FatQueryRetrievalPointers and see why you failed. // if ( !NT_SUCCESS (Status) ) { KdPrint (("CRASHDUMP: ZwFsControlFile returnd %d\n", Status)); ErrorToLog = IO_DUMP_POINTER_FAILURE; goto Cleanup; } // // This paging file is on the system boot partition, and // the retrieval pointers for the file were just successfully // queried. Walk the MCB to size it, and then checksum it. // for (i = 0; mcb [i].QuadPart; i++) { NOTHING; } // // Write back fields of the IopDumpControlBlock. // IopDumpControlBlock->FileDescriptorArray = mcb; IopDumpControlBlock->FileDescriptorSize = (i + 1) * sizeof (LARGE_INTEGER); IopDumpControlBlock->DumpFileSize = RequestedFileSize; IopDumpControlBlockChecksum = IopGetDumpControlBlockCheck ( IopDumpControlBlock ); Status = STATUS_SUCCESS; Cleanup: if (Status != STATUS_SUCCESS && ErrorToLog != STATUS_SUCCESS ) { IopLogErrorEvent (0, 4, STATUS_SUCCESS, ErrorToLog, 0, NULL, 0, NULL ); } DeviceObject = NULL; if ( FileObject ) { ObDereferenceObject( FileObject ); FileObject = NULL; } return Status; }

BOOLEAN IopConfigureCrashDump (  IN HANDLE  hPageFile  )

Definition at line 4746 of file dumpctl.c. References DCB_DUMP_ENABLED, DCB_SUMMARY_ENABLED, DeviceUsageTypeDumpFile, DO_SYSTEM_BOOT_PARTITION, _DUMP_CONTROL_BLOCK::DumpFileSize, _DUMP_CONTROL_BLOCK::DumpStack, ExAllocatePoolWithTag, FALSE, _DUMP_CONTROL_BLOCK::Flags, _DEVICE_OBJECT::Flags, _DUMP_CONTROL_BLOCK::HeaderSize, IO_DUMP_MEMORY_BLOCK_PAGES, IoDebugPrint, IoFileObjectType, IoGetDumpStack(), IopCalculateRequiredDumpSpace(), IopCompleteDumpInitialization(), IopDumpControlBlock, IopFreeDCB(), IopInitializeDCB(), IopLogErrorEvent(), KernelMode, L, _DUMP_CONTROL_BLOCK::MemoryDescriptor, NonPagedPool, NT_SUCCESS, NULL, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfPages, ObDereferenceObject, ObReferenceObjectByHandle(), PAGE_SIZE, and TRUE. Referenced by IoPageFileCreated(). : This routine configures the system for crash dump. The following things are done: 1. Initialize the dump control block and init registry crashdump parameters. 2. Configure either page or fast dump. 3. Complete dump file initialization. This routine is called as each page file is created. A return value of TRUE tells the caller (i.e., NtCreatePagingFiles, IoPageFileCreated) that crash dump has been configured. Arguments: hPageFile - Handle to the paging file Return Value: TRUE - Configuration complete (or crash dump not enabled). FALSE - Error, retry PageFile is not on boot partition. --*/ { ULONG dwStatus; PFILE_OBJECT fileObject; PDEVICE_OBJECT deviceObject; // // Only Init DCB Once. // if (!IopDumpControlBlock) { if (!IopInitializeDCB()) { return TRUE; } } // // Return crash dump not enabled // if (!IopDumpControlBlock){ return TRUE; } // // Only autoreboot? // if ( !( IopDumpControlBlock->Flags & (DCB_DUMP_ENABLED | DCB_SUMMARY_ENABLED) ) ) { return TRUE; } // // Configure the paging file for crash dump. // IoDebugPrint((2,"[IoPageFileCreated]: Page file dump\n")); dwStatus = ObReferenceObjectByHandle( hPageFile, 0, IoFileObjectType, KernelMode, (PVOID *) &fileObject, NULL ); if (!NT_SUCCESS( dwStatus )) { IoDebugPrint((1,"[IoPageFileCreated]: ObReferenceObjectByHandle for Paging file failed status = %x\n",dwStatus)); goto error_return; } // // Get a pointer to the device object for this file. Note that it // cannot go away, since there is an open handle to it, so it is // OK to dereference it and then use it. // deviceObject = fileObject->DeviceObject; ObDereferenceObject( fileObject ); // // If this device object does not represents the boot partition return // FALSE so MM will try again. // if ( ! (deviceObject->Flags & DO_SYSTEM_BOOT_PARTITION) ) { return FALSE; } // // Load paging file dump stack // dwStatus = IoGetDumpStack (L"dump_", &IopDumpControlBlock->DumpStack, DeviceUsageTypeDumpFile, FALSE); if (!NT_SUCCESS(dwStatus)) { IoDebugPrint((1, "IoPageFileCreated: Could not load dump stack status = %x\n",dwStatus) ); goto error_return; } IopDumpControlBlock->DumpStack->Init.CrashDump = TRUE; IopDumpControlBlock->DumpStack->Init.MemoryBlock = ExAllocatePoolWithTag ( NonPagedPool, IO_DUMP_MEMORY_BLOCK_PAGES * PAGE_SIZE, 'pmuD' ); if (!IopDumpControlBlock->DumpStack->Init.MemoryBlock) { dwStatus = STATUS_NO_MEMORY; goto error_return; } // // Calculate the amount of space required for the dump // IopDumpControlBlock->DumpFileSize =IopCalculateRequiredDumpSpace( IopDumpControlBlock->Flags, IopDumpControlBlock->HeaderSize, IopDumpControlBlock->MemoryDescriptor->NumberOfPages, IopDumpControlBlock->MemoryDescriptor->NumberOfPages ); // // Complete dump initialization // dwStatus = IopCompleteDumpInitialization(hPageFile); error_return: // // The BOOT partition paging file could not be configured. // 1. Log an error message // 2. Return TRUE so that MM does not try again // if (!NT_SUCCESS(dwStatus)) { IoDebugPrint((1,"IopPageFileCreated: Page File dump init FAILED status = %x\n",dwStatus)); IopLogErrorEvent(0,3,STATUS_SUCCESS,IO_DUMP_PAGE_CONFIG_FAILED,0,NULL,0,NULL); IopFreeDCB(FALSE); } return TRUE; }

ULONG IopCreateSummaryDump (  IN PSUMMARY_DUMP_HEADER  pHeader  )

Definition at line 3815 of file dumpctl.c. References FALSE, _DUMP_CONTROL_BLOCK::HeaderPage, _DUMP_CONTROL_BLOCK::HeaderSize, IoDebugPrint, IopDeleteNonExistentMemory(), IopDumpControlBlock, IoSetDumpRange(), MmHighestUserAddress, MmIsAddressValid(), MmPhysicalMemoryBlock, MmSetKernelDumpRange(), NT_SUCCESS, PAGE_SHIFT, PAGE_SIZE, RtlClearAllBits(), and RtlNumberOfSetBits(). Referenced by IopInitializeSummaryDump(). : This routine determines the kernel memory and data structures to include in the summary memory dump. NOTE: This function uses MmGetPhysicalAddress. MmGetPhysicalAddress does not acquire any locks. It uses a set of macros for translation. Arguments: pHeader - Pointer to the dump header pDcb - Dump control block Return Value: Status --*/ { PRTL_BITMAP pBitMapHeader = (PRTL_BITMAP)(pHeader+1); ULONG Pages; PCHAR VA; ULONG UserPages; PHYSICAL_ADDRESS PhyAddr; ULONG i; PULONG pBitMapBuffer; PUCHAR pBitMapBytes; LARGE_INTEGER dumpFileSize; PULONG block; ULONG numDumpPages; // // The bitmap is the last structure in the header. The // buffer is allocated directly after the bitmap header. // // Initialize Bit Map, set the size and buffer address. // pBitMapHeader->SizeOfBitMap = pHeader->BitmapSize; pBitMapBuffer = (PULONG)( pBitMapHeader + 1); pBitMapHeader->Buffer = pBitMapBuffer; pBitMapBytes = (PUCHAR)pBitMapBuffer; // // Clear all bits // RtlClearAllBits (pBitMapHeader); // // Have MM initialize the kernel memory to dump // MmSetKernelDumpRange(pHeader); // // Exclude non-existent memory // IopDeleteNonExistentMemory(pHeader, MmPhysicalMemoryBlock); Pages = RtlNumberOfSetBits ( pBitMapHeader ); IoDebugPrint((2,"IopLocalSetBits = %x\n",Pages)); // // See If we have room to Include user va for the current process // block = IopDumpControlBlock->HeaderPage; dumpFileSize.LowPart= block [DH_REQUIRED_DUMP_SPACE]; dumpFileSize.HighPart= block [DH_REQUIRED_DUMP_SPACE + 1]; dumpFileSize.QuadPart -= IopDumpControlBlock->HeaderSize; // // Total physical pages will not exceed 2<<32 for sometime // numDumpPages= (ULONG)(dumpFileSize.QuadPart >> PAGE_SHIFT); IoDebugPrint ((2,"IopCreateSummaryDump: numDumpPages: %x Pages : %x\n", numDumpPages,Pages)); // // Only copy user virtual if there is enough room in the dump file. // UserPages = 0; if (Pages < numDumpPages ) { // // Stride through user VA and include all valid pages // for (VA = 0; VA < (PCHAR)MmHighestUserAddress; VA+=PAGE_SIZE ) { if ( MmIsAddressValid( VA ) ) { if ( NT_SUCCESS(IoSetDumpRange(pHeader,VA, 1, FALSE ) ) ) { UserPages++; // // Break if there is no more room in the dump file // if (UserPages+Pages >= numDumpPages ) { break; } } } } } Pages+= UserPages; IoDebugPrint((2,"IopCreateSummaryDump number of user mode pages = %x\n",UserPages)); IoDebugPrint((2, "SummaryDump: Dump SummaryDumpHeader\n")); IoDebugPrint((2, "SdBitmapSize =%x\n", pHeader->BitmapSize)); IoDebugPrint((2, "SdAllBits =%x\n", Pages)); IoDebugPrint((2, "&SdBitmapBuffer[0]=%x\n", pBitMapHeader->Buffer)); return Pages; }

VOID IopDeleteNonExistentMemory (  PSUMMARY_DUMP_HEADER  pHeader, PPHYSICAL_MEMORY_DESCRIPTOR  MmPhysicalMemoryBlock )

Definition at line 3953 of file dumpctl.c. References _PHYSICAL_MEMORY_RUN::BasePage, IoDebugPrint, IopRemovePageFromPageMap(), MmPhysicalMemoryBlock, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfRuns, _PHYSICAL_MEMORY_RUN::PageCount, and _PHYSICAL_MEMORY_DESCRIPTOR::Run. Referenced by IopCreateSummaryDump(). : This deletes non existent memory. Non existent memory is defined as the unassigned memory between memory runs. For example, memory between (run[0].base + size) and run[1].base. Arguments: pHeader - This is a pointer to the summary dump header. dwStartingIndex - The starting bit index in the bitmap (starting page). dwMemoryAddress - Pseudo-virtual address being mapped. dwByteCount - The number of bytes to copy. dwMaxBitmapBit - The limit or the highest possible valid bit in the bitmap. pMdl - The MDL to create. Return Value: (none) --*/ { PPHYSICAL_MEMORY_RUN Run; ULONG NumberOfRuns; ULONG i; PFN_NUMBER CurrentPageFrame, NextPageFrame; PRTL_BITMAP pBitMapHeader; NumberOfRuns = MmPhysicalMemoryBlock->NumberOfRuns; Run = &MmPhysicalMemoryBlock->Run[0]; pBitMapHeader = (PRTL_BITMAP)(pHeader + 1); i = 0; CurrentPageFrame = 1; NextPageFrame = Run->BasePage; // // Remove the gap from 0 till the first run. // if (NextPageFrame > CurrentPageFrame) { IoDebugPrint( (2,"DeleteNonExistentMemory: %x - %x\n", CurrentPageFrame, (NextPageFrame - CurrentPageFrame) ) ); // // FIXFIX - handle page frame numbers greater than 32 bits. // IopRemovePageFromPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)CurrentPageFrame, (ULONG)(NextPageFrame-CurrentPageFrame) ); } // // Remove the gaps between runs. // while (i < NumberOfRuns - 1) { CurrentPageFrame = Run->BasePage + Run->PageCount; IoDebugPrint((2, "Run[%x]: Base=%x, Pages=%x\n", i, Run->BasePage, Run->PageCount)); i++; Run++; // // Get the next starting BasePage. // NextPageFrame = Run->BasePage; if (NextPageFrame != CurrentPageFrame) { IoDebugPrint((2, "DeleteNonExistentMemory: %x - %x\n", NextPageFrame, CurrentPageFrame)); // // FIXFIX - handle page frame numbers greater than 32 bits. // IopRemovePageFromPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)CurrentPageFrame, (ULONG)(NextPageFrame - CurrentPageFrame) ); } } }

VOID IopFreeDCB (  BOOLEAN  FreeDCB  )

Definition at line 4252 of file dumpctl.c. References DCB_AUTO_REBOOT, _DUMP_CONTROL_BLOCK::DumpStack, ExFreePool(), _DUMP_CONTROL_BLOCK::FileDescriptorArray, _DUMP_CONTROL_BLOCK::Flags, _DUMP_CONTROL_BLOCK::HeaderPage, IoDebugPrint, IoFreeDumpStack(), IopDumpControlBlock, _DUMP_CONTROL_BLOCK::MemoryDescriptor, NTSTATUS(), and NULL. Referenced by IopConfigureCrashDump(), and IoSetCrashDumpState(). : Free dump control block storage. Arguments: FreeDCB - Implictly free storage for the dump control block. Return Value: None --*/ { PDUMP_CONTROL_BLOCK dcb; NTSTATUS dwStatus; BOOLEAN ShouldFreeDCB; dcb = IopDumpControlBlock; if (dcb) { if (dcb->MemoryDescriptor) { ExFreePool (dcb->MemoryDescriptor); dcb->MemoryDescriptor = NULL; } if (dcb->HeaderPage) { ExFreePool (dcb->HeaderPage); dcb->HeaderPage = NULL; } if (dcb->FileDescriptorArray) { ExFreePool (dcb->FileDescriptorArray); dcb->FileDescriptorArray = NULL; } if (dcb->DumpStack) { IoFreeDumpStack (dcb->DumpStack); dcb->DumpStack = NULL; } ShouldFreeDCB = FreeDCB | !( dcb->Flags & DCB_AUTO_REBOOT); // // Disable all options that require dump file access // dcb->Flags = dcb->Flags & DCB_AUTO_REBOOT; IoDebugPrint((2,"[IopFreeDCB] Should Free DCB = %s\n",(ShouldFreeDCB ? "TRUE" : "FALSE"))); if (ShouldFreeDCB) { IopDumpControlBlock = NULL; ExFreePool( dcb ); IoDebugPrint((2,"[IopFreeDCB]: Freeing Dump Control Block\n")); } } IoDebugPrint((2,"[IopFreeDCB]: CRASH DUMP DISABLED\n")); }

ULONG IopGetDumpControlBlockCheck (  IN PDUMP_CONTROL_BLOCK  Dcb  )

Definition at line 1062 of file dumpctl.c. References DUMP_CONTROL_BLOCK, NULL, PDUMP_STACK_CONTEXT, PDUMP_STACK_IMAGE, and PoSimpleCheck(). Referenced by IopCompleteDumpInitialization(), and IoWriteCrashDump(). : Return the current checksum total for the Dcb Arguments: DumpStack - Dump driver stack to checksum Return Value: Checksum value --*/ { ULONG Check; PLIST_ENTRY Link; PDUMP_STACK_IMAGE DumpImage; PMAPPED_ADDRESS MappedAddress; PDUMP_STACK_CONTEXT DumpStack; // // Check the DCB, memory descriptor array, and the FileDescriptorArray // Check = PoSimpleCheck(0, Dcb, sizeof(DUMP_CONTROL_BLOCK)); Check = PoSimpleCheck( Check, Dcb->MemoryDescriptor, Dcb->MemoryDescriptorLength ); Check = PoSimpleCheck(Check, Dcb->FileDescriptorArray, Dcb->FileDescriptorSize); DumpStack = Dcb->DumpStack; if (DumpStack) { // // Include the dump stack context structure, and dump driver images // Check = PoSimpleCheck(Check, DumpStack, sizeof(DUMP_STACK_CONTEXT)); Check = PoSimpleCheck(Check, DumpStack->DumpPointers, DumpStack->PointersLength); for (Link = DumpStack->DriverList.Flink; Link != &DumpStack->DriverList; Link = Link->Flink) { DumpImage = CONTAINING_RECORD(Link, DUMP_STACK_IMAGE, Link); Check = PoSimpleCheck(Check, DumpImage, sizeof(DUMP_STACK_IMAGE)); Check = PoSimpleCheck(Check, DumpImage->ImageBase, DumpImage->SizeOfImage); } // // Include the mapped addresses // // If this is non-null it is treated as a PMAPPED_ADDRESS * (see scsiport and atdisk) // if (DumpStack->Init.MappedRegisterBase != NULL) { MappedAddress = *(PMAPPED_ADDRESS *)DumpStack->Init.MappedRegisterBase; } else { MappedAddress = NULL; } while (MappedAddress) { Check = PoSimpleCheck (Check, MappedAddress, sizeof(MAPPED_ADDRESS)); MappedAddress = MappedAddress->NextMappedAddress; } } return Check; }

NTSTATUS IopGetDumpStack (  IN PWCHAR  ModulePrefix, OUT PDUMP_STACK_CONTEXT *  pDumpStack, IN PUNICODE_STRING  pUniDeviceName, IN PWCHAR  pDumpDriverName, IN DEVICE_USAGE_NOTIFICATION_TYPE  UsageType, IN ULONG  IgnoreDeviceUsageFailure )

Definition at line 384 of file dumpctl.c. References _INITIALIZATION_CONTEXT::AdapterObject, ASSERT, Buffer, _INITIALIZATION_CONTEXT::CommonBuffer, _INITIALIZATION_CONTEXT::CommonBufferSize, _DRIVER_OBJECT::DeviceObject, DeviceUsageTypeUndefined, _INITIALIZATION_CONTEXT::DiskSignature, _DRIVER_OBJECT::DriverName, _DEVICE_OBJECT::DriverObject, Event(), ExAllocatePoolWithTag, Executive, ExFreePool(), FALSE, _IO_STACK_LOCATION::FileObject, HalAllocateCommonBuffer(), INITIALIZATION_CONTEXT, IO_DUMP_COMMON_BUFFER_SIZE, IO_STACK_LOCATION, IoBuildDeviceIoControlRequest(), IoCallDriver, IoDebugPrint, IoFileObjectType, IoFreeDumpStack(), IoGetNextIrpStackLocation, IoGetRelatedDeviceObject(), IopLoadDumpDriver(), IopLogErrorEvent(), IopSynchronousCall(), Irp, IRP_MJ_PNP, IRP_MN_DEVICE_USAGE_NOTIFICATION, KeGetBugMessageText(), KeInitializeEvent, KernelMode, KeStallExecutionProcessor(), KeWaitForSingleObject(), L, _INITIALIZATION_CONTEXT::Length, _IO_STACK_LOCATION::MajorFunction, _INITIALIZATION_CONTEXT::MappedRegisterBase, _IO_STACK_LOCATION::MinorFunction, MmAllocateContiguousMemory(), MmAllocateNonCachedMemory(), MmGetPhysicalAddress(), NonPagedPool, NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, ObjectAttributes, ObReferenceObjectByHandle(), PAGE_SIZE, PagedPool, _IO_STACK_LOCATION::Parameters, PDMA_ADAPTER, PDUMP_STACK_CONTEXT, _INITIALIZATION_CONTEXT::PhysicalAddress, PINITIALIZATION_CONTEXT, _INITIALIZATION_CONTEXT::PortConfiguration, RtlAnsiStringToUnicodeString(), RtlFreeUnicodeString(), RtlInitAnsiString(), SCSIPORT_DRIVER_NAME, sprintf(), _INITIALIZATION_CONTEXT::StallRoutine, Status, _INITIALIZATION_CONTEXT::TargetAddress, TRUE, VOID(), and ZwOpenFile(). Referenced by IoGetDumpStack(). : This routine loads a dump stack instance and returns an allocated context structure to track the loaded dumps stack. Arguments: ModePrefix - The prefix to prepent to BaseName during the load operation. This allows loading the same drivers multiple times with different virtual names and linkages. pDumpStack - The returned dump stack context structure pDeviceName - The name of the target dump device pDumpDriverName - The name of the target dump driver UsageType - The Device Notification Usage Type for this file, that this routine will send as to the device object once the file has been successfully created and initialized. IgnoreDeviceUsageFailure - If the Device Usage Notification Irp fails, allow this to succeed anyway. Return Value: Status --*/ { PDUMP_STACK_CONTEXT DumpStack; PUCHAR Buffer; PUCHAR PartitionName; ANSI_STRING AnsiString; UNICODE_STRING TempName; OBJECT_ATTRIBUTES ObjectAttributes; NTSTATUS Status; HANDLE DeviceHandle; SCSI_ADDRESS ScsiAddress; BOOLEAN ScsiDump; PARTITION_INFORMATION PartitionInfo; PFILE_OBJECT FileObject; PDEVICE_OBJECT DeviceObject; PINITIALIZATION_CONTEXT DumpInit; PDUMP_POINTERS DumpPointers; UNICODE_STRING DriverName; PDRIVER_OBJECT DriverObject; PIRP Irp; PIO_STACK_LOCATION IrpSp; IO_STATUS_BLOCK IoStatus; PWCHAR DumpName, NameOffset; KEVENT Event; PVOID p1; PHYSICAL_ADDRESS pa; ULONG i; IO_STACK_LOCATION irpSp; ULONG information; IoDebugPrint((2,"IopGetDumpStack: Prefix:%ws stk: %x device:%ws driver:%ws\n", ModulePrefix, pDumpStack, pUniDeviceName->Buffer,pDumpDriverName)); ASSERT (DeviceUsageTypeUndefined != UsageType); DumpStack = ExAllocatePoolWithTag ( NonPagedPool, sizeof (DUMP_STACK_CONTEXT) + sizeof (DUMP_POINTERS), 'pmuD' ); if (!DumpStack) { return STATUS_INSUFFICIENT_RESOURCES; } RtlZeroMemory(DumpStack, sizeof(DUMP_STACK_CONTEXT)+sizeof(DUMP_POINTERS)); DumpInit = &DumpStack->Init; DumpPointers = (PDUMP_POINTERS) (DumpStack + 1); DumpStack->DumpPointers = DumpPointers; InitializeListHead (&DumpStack->DriverList); DumpName = NULL; // // Allocate scratch buffer // Buffer = ExAllocatePoolWithTag (PagedPool, PAGE_SIZE, 'pmuD'); if (!Buffer) { ExFreePool (DumpStack); return STATUS_INSUFFICIENT_RESOURCES; } if (!KeGetBugMessageText(BUGCODE_PSS_CRASH_INIT, &DumpStack->InitMsg) || !KeGetBugMessageText(BUGCODE_PSS_CRASH_PROGRESS, &DumpStack->ProgMsg) || !KeGetBugMessageText(BUGCODE_PSS_CRASH_DONE, &DumpStack->DoneMsg)) { Status = STATUS_UNSUCCESSFUL; goto Done; } InitializeObjectAttributes( &ObjectAttributes, pUniDeviceName, 0, NULL, NULL ); Status = ZwOpenFile( &DeviceHandle, FILE_READ_DATA | SYNCHRONIZE, &ObjectAttributes, &IoStatus, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_NON_DIRECTORY_FILE ); if (!NT_SUCCESS(Status)) { IoDebugPrint ((0, "IODUMP: Could not open boot device partition, %s\n", Buffer )); goto Done; } // // Check to see whether or not the system was booted from a SCSI device. // Status = ZwDeviceIoControlFile ( DeviceHandle, NULL, NULL, NULL, &IoStatus, IOCTL_SCSI_GET_ADDRESS, NULL, 0, &ScsiAddress, sizeof( SCSI_ADDRESS ) ); if (Status == STATUS_PENDING) { ZwWaitForSingleObject ( DeviceHandle, FALSE, NULL ); Status = IoStatus.Status; } ScsiDump = (BOOLEAN) (NT_SUCCESS(Status)); // // If SCSI then allocate storage to contain the target address information. // DumpInit->TargetAddress = NULL; if (ScsiDump) { DumpInit->TargetAddress = ExAllocatePoolWithTag ( NonPagedPool, sizeof (SCSI_ADDRESS), 'pmuD' ); // // It is ok If the allocation fails. The scsi dump driver will scan // all devices if the targetaddress information does not exist // if (DumpInit->TargetAddress) { RtlCopyMemory(DumpInit->TargetAddress,&ScsiAddress,sizeof(SCSI_ADDRESS)); } } // // Determine the disk signature for the device from which the system was // booted and get the partition offset. // Status = ZwDeviceIoControlFile( DeviceHandle, NULL, NULL, NULL, &IoStatus, IOCTL_DISK_GET_PARTITION_INFO, NULL, 0, &PartitionInfo, sizeof( PARTITION_INFORMATION ) ); if (Status == STATUS_PENDING) { ZwWaitForSingleObject ( DeviceHandle, FALSE, NULL ); Status = IoStatus.Status; } IoDebugPrint((2,"Partition Type = %x\n",PartitionInfo.PartitionType)); IoDebugPrint((2,"Boot Indicator = %x\n",PartitionInfo.BootIndicator)); Status = ZwDeviceIoControlFile( DeviceHandle, NULL, NULL, NULL, &IoStatus, IOCTL_DISK_GET_DRIVE_LAYOUT, NULL, 0, Buffer, PAGE_SIZE ); if (Status == STATUS_PENDING) { ZwWaitForSingleObject ( DeviceHandle, FALSE, NULL ); Status = IoStatus.Status; } DumpInit->DiskSignature = ((PDRIVE_LAYOUT_INFORMATION) Buffer)->Signature; // // Get the adapter object and base mapping registers for the disk from // the disk driver. These will be used to call the HAL once the system // system has crashed, since it is not possible at that point to recreate // them from scratch. // ObReferenceObjectByHandle ( DeviceHandle, 0, IoFileObjectType, KernelMode, (PVOID *) &FileObject, NULL ); DeviceObject = IoGetRelatedDeviceObject (FileObject); KeInitializeEvent( &Event, NotificationEvent, FALSE ); Irp = IoBuildDeviceIoControlRequest( IOCTL_SCSI_GET_DUMP_POINTERS, DeviceObject, NULL, 0, DumpPointers, sizeof (DUMP_POINTERS), FALSE, &Event, &IoStatus ); if (!Irp) { ObDereferenceObject (FileObject); ZwClose (DeviceHandle); Status = STATUS_INSUFFICIENT_RESOURCES; goto Done; } IrpSp = IoGetNextIrpStackLocation (Irp); IrpSp->FileObject = FileObject; Status = IoCallDriver( DeviceObject, Irp ); if (Status == STATUS_PENDING) { KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL); Status = IoStatus.Status; } if (!NT_SUCCESS(Status) || IoStatus.Information < FIELD_OFFSET(DUMP_POINTERS, DeviceObject)) { IoDebugPrint ((0, "IODUMP: Could not get dump pointers; error = %x, length %x\n", Status, IoStatus.Information )); ObDereferenceObject (FileObject); // NtClose (DeviceHandle); ZwClose (DeviceHandle); goto Done; } DumpStack->PointersLength = (ULONG) IoStatus.Information; // // If the driver returned a pointer to a device object, that is the // object for the dump driver (non-scsi case) // DeviceObject = (PDEVICE_OBJECT) DumpPointers->DeviceObject; if (DeviceObject) { DriverObject = DeviceObject->DriverObject; // // Loop through the name of the driver looking for the end of the name, // which is the name of the dump image. // DumpName = DriverObject->DriverName.Buffer; while ( NameOffset = wcsstr( DumpName, L"\\" )) { DumpName = ++NameOffset; } ScsiDump = FALSE; } // // Release the handle, but keep the reference to the file object as it // will be needed at free dump dump driver time // DumpStack->FileObject = FileObject; ZwClose (DeviceHandle); // // Fill in some DumpInit results // DumpInit->Length = sizeof (INITIALIZATION_CONTEXT); DumpInit->StallRoutine = &KeStallExecutionProcessor; DumpInit->AdapterObject = DumpPointers->AdapterObject; DumpInit->MappedRegisterBase = DumpPointers->MappedRegisterBase; DumpInit->PortConfiguration = DumpPointers->DumpData; DumpStack->ModulePrefix = ModulePrefix; DumpStack->PartitionOffset = PartitionInfo.StartingOffset; DumpStack->UsageType = DeviceUsageTypeUndefined; // // The minimum common buffer size is IO_DUMP_COMMON_BUFFER_SIZE (compatability) // This is used by the dump driver for SRB extension, CachedExtension, and sense buffer // if (DumpPointers->CommonBufferSize < IO_DUMP_COMMON_BUFFER_SIZE) { DumpPointers->CommonBufferSize = IO_DUMP_COMMON_BUFFER_SIZE; } DumpInit->CommonBufferSize = DumpPointers->CommonBufferSize; // // Allocate the required common buffers // if (DumpPointers->AllocateCommonBuffers) { pa.QuadPart = 0x1000000 - 1; for (i=0; i < 2; i++) { if (DumpInit->AdapterObject) { #if !defined(NO_LEGACY_DRIVERS) p1 = HalAllocateCommonBuffer( DumpInit->AdapterObject, DumpPointers->CommonBufferSize, &pa, FALSE ); #else p1 = (*((PDMA_ADAPTER)DumpInit->AdapterObject)->DmaOperations-> AllocateCommonBuffer)( (PDMA_ADAPTER)DumpInit->AdapterObject, DumpPointers->CommonBufferSize, &pa, FALSE ); #endif // NO_LEGACY_DRIVERS } else { p1 = MmAllocateContiguousMemory ( DumpPointers->CommonBufferSize, pa ); if (!p1) { p1 = MmAllocateNonCachedMemory (DumpPointers->CommonBufferSize); } pa = MmGetPhysicalAddress(p1); } if (!p1) { IoDebugPrint ((0, "IODUMP: Could not allocate common buffers for dump\n")); Status = STATUS_INSUFFICIENT_RESOURCES; goto Done; } DumpInit->CommonBuffer[i] = p1; DumpInit->PhysicalAddress[i] = pa; } } // // Determine whether or not the system booted from SCSI. // if (ScsiDump) { // // Load the boot disk and port driver to be used by the various // miniports for writing memory to the disk. // Status = IopLoadDumpDriver ( DumpStack, pDumpDriverName, SCSIPORT_DRIVER_NAME ); if (!NT_SUCCESS(Status)) { IopLogErrorEvent(0,9,STATUS_SUCCESS,IO_DUMP_DRIVER_LOAD_FAILURE,0,NULL,0,NULL); goto Done; } // // The disk and port dump driver has been loaded. Load the appropriate // miniport driver as well so that the boot device can be accessed. // DriverName.Length = 0; DriverName.Buffer = (PVOID) Buffer; DriverName.MaximumLength = PAGE_SIZE; // // The system was booted from SCSI. Get the name of the appropriate // miniport driver and load it. // sprintf(Buffer, "\\Device\\ScsiPort%d", ScsiAddress.PortNumber ); RtlInitAnsiString( &AnsiString, Buffer ); RtlAnsiStringToUnicodeString( &TempName, &AnsiString, TRUE ); InitializeObjectAttributes( &ObjectAttributes, &TempName, 0, NULL, NULL ); Status = ZwOpenFile( &DeviceHandle, FILE_READ_ATTRIBUTES, &ObjectAttributes, &IoStatus, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_NON_DIRECTORY_FILE ); RtlFreeUnicodeString( &TempName ); if (!NT_SUCCESS( Status )) { IoDebugPrint ((0, "IODUMP: Could not open SCSI port %d, error = %x\n", ScsiAddress.PortNumber, Status )); goto Done; } // // Convert the file handle into a pointer to the device object, and // get the name of the driver from its driver object. // ObReferenceObjectByHandle( DeviceHandle, 0, IoFileObjectType, KernelMode, (PVOID *) &FileObject, NULL ); DriverObject = FileObject->DeviceObject->DriverObject; ObDereferenceObject( FileObject ); ZwClose( DeviceHandle ); // // Loop through the name of the driver looking for the end of the name, // which is the name of the miniport image. // DumpName = DriverObject->DriverName.Buffer; while ( NameOffset = wcsstr( DumpName, L"\\" )) { DumpName = ++NameOffset; } } // // Load the dump driver // if (!DumpName) { Status = STATUS_NOT_SUPPORTED; goto Done; } swprintf ((PWCHAR) Buffer, L"\\SystemRoot\\System32\\Drivers\\%s.sys", DumpName); Status = IopLoadDumpDriver ( DumpStack, (PWCHAR) Buffer, NULL ); if (!NT_SUCCESS(Status)) { IopLogErrorEvent(0,10,STATUS_SUCCESS,IO_DUMP_DRIVER_LOAD_FAILURE,0,NULL,0,NULL); goto Done; } // // Claim the file as part of specific device usage path. // FileObject = DumpStack->FileObject; DeviceObject = IoGetRelatedDeviceObject (FileObject); RtlZeroMemory (&irpSp, sizeof (IO_STACK_LOCATION)); irpSp.MajorFunction = IRP_MJ_PNP; irpSp.MinorFunction = IRP_MN_DEVICE_USAGE_NOTIFICATION; irpSp.Parameters.UsageNotification.Type = UsageType; irpSp.Parameters.UsageNotification.InPath = TRUE; irpSp.FileObject = FileObject; Status = IopSynchronousCall (DeviceObject, &irpSp, (VOID **) &information); ASSERT (0 == information); if (!NT_SUCCESS(Status) && IgnoreDeviceUsageFailure) { IoDebugPrint ((0, "IopGetDumpStack: DEVICE_USAGE_NOTIFICATION " "Error ignored (%x)\n", Status)); Status = STATUS_SUCCESS; } if (NT_SUCCESS(Status)) { DumpStack->UsageType = UsageType; } Done: if (NT_SUCCESS(Status)) { *pDumpStack = DumpStack; } else { IoFreeDumpStack (DumpStack); } ExFreePool (Buffer); return Status; }

NTSTATUS IopGetDumpStack (  IN PWCHAR  ModulePrefix, OUT PDUMP_STACK_CONTEXT *  pDumpStack, IN PUNICODE_STRING  pUniDeviceName, IN PWSTR  pDumpDriverName, IN DEVICE_USAGE_NOTIFICATION_TYPE  UsageType, IN ULONG  IgnoreDeviceUsageFailure )

NTSTATUS IopGetLoadedDriverInfo (  OUT ULONG *  lpDriverCount, OUT ULONG *  lpSizeOfStringData )

Definition at line 2602 of file dumpctl.c. References DriverEntry(), IopIsAddressRangeValid(), and PsLoadedModuleList. Referenced by IopWriteTriageDump(). : Get information about all loaded drivers. Arguments: lpDriverCount - Buffer to return the count of all the drivers that are currently loaded in the system. lpSizeOfStringData - Buffer to return the sum of the sizes of all driver name strings (FullDllName). This does not include the size of the UNICODE_STRING structure or a trailing NULL byte. Return Values: NTSTATUS --*/ { ULONG DriverCount = 0; ULONG SizeOfStringData = 0; PLIST_ENTRY NextEntry; PLDR_DATA_TABLE_ENTRY DriverEntry; NextEntry = PsLoadedModuleList.Flink; while (NextEntry != &PsLoadedModuleList) { DriverEntry = CONTAINING_RECORD (NextEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks ); if (!IopIsAddressRangeValid (DriverEntry, sizeof (*DriverEntry)) || !IopIsAddressRangeValid (DriverEntry->BaseDllName.Buffer, DriverEntry->BaseDllName.Length)) { return STATUS_UNSUCCESSFUL; } DriverCount++; SizeOfStringData += DriverEntry->FullDllName.Length; NextEntry = NextEntry->Flink; } *lpDriverCount = DriverCount; *lpSizeOfStringData = SizeOfStringData; return STATUS_SUCCESS; }

BOOLEAN IopInitializeDCB (   )

Definition at line 4580 of file dumpctl.c. References _DUMP_CONTROL_BLOCK::BuildNumber, CmNtCSDVersion, DCB_AUTO_REBOOT, DCB_SUMMARY_ENABLED, DCB_TRIAGE_DUMP_ENABLED, DEFAULT_TRIAGE_DUMP_FLAGS, _DUMP_CONTROL_BLOCK::DumpFileSize, ExAllocatePoolWithTag, ExFreePool(), FALSE, _DUMP_CONTROL_BLOCK::Flags, _DUMP_CONTROL_BLOCK::HeaderPage, _DUMP_CONTROL_BLOCK::HeaderPfn, _DUMP_CONTROL_BLOCK::HeaderSize, IO_TYPE_DCB, IoDebugPrint, IopDumpControlBlock, IopLogErrorEvent(), IopReadDumpRegistry(), KeNumberProcessors, KeProcessorArchitecture, _DUMP_CONTROL_BLOCK::MajorVersion, _DUMP_CONTROL_BLOCK::MemoryDescriptor, _DUMP_CONTROL_BLOCK::MemoryDescriptorLength, MINIPORT_NODE, _DUMP_CONTROL_BLOCK::MinorVersion, MmGetPhysicalAddress(), MmPhysicalMemoryBlock, NonPagedPool, NtBuildNumber, NTSTATUS(), NULL, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfRuns, _DUMP_CONTROL_BLOCK::NumberProcessors, PAGE_SHIFT, PAGE_SIZE, _DUMP_CONTROL_BLOCK::ProcessorArchitecture, _DUMP_CONTROL_BLOCK::Size, _DUMP_CONTROL_BLOCK::TriageDumpBuffer, _DUMP_CONTROL_BLOCK::TriageDumpBufferSize, _DUMP_CONTROL_BLOCK::TriageDumpFlags, TRUE, _DUMP_CONTROL_BLOCK::Type, and USHORT. Referenced by IopConfigureCrashDump(). : This routine initializes the Dump Control Block (DCB). It allocates the DCB and reads the crashdump parameters from the registry. Arguments: Return Value: The final function value is TRUE if everything worked, else FALSE. --*/ { HANDLE keyHandle; HANDLE crashHandle; LOGICAL crashHandleOpened; UNICODE_STRING keyName; NTSTATUS status; PKEY_VALUE_FULL_INFORMATION keyValueInformation; PDUMP_CONTROL_BLOCK dcb; ULONG dumpControl; ULONG handleValue; ULONG autoReboot; PCHAR partitionName; ULONG dcbSize; LARGE_INTEGER page; ULONG numberOfHeaderPages; ULONG dumpFileSize; // // Read all the registry default values first. // IopReadDumpRegistry ( &dumpControl, &numberOfHeaderPages, &autoReboot, &dumpFileSize); // // If we aren't crashing or auto rebooting then return now. // if (dumpControl == 0 && autoReboot == 0) { // // At some point, we will conditionally on system size, type, etc, // set dump defaults like the below and skip over the return. // // *dumpControl = (DCB_DUMP_ENABLED | DCB_TRIAGE_DUMP_ENABLED); // *autoReboot = 1; // *dumpFileSize = ? // return TRUE; } if (dumpControl & DCB_TRIAGE_DUMP_ENABLED) { dumpControl &= ~DCB_SUMMARY_ENABLED; dumpFileSize = TRIAGE_DUMP_SIZE; } // // Allocate and initialize the structures necessary to describe and control // the post-bugcheck code. // dcbSize = sizeof( DUMP_CONTROL_BLOCK ) + sizeof( MINIPORT_NODE ); dcb = ExAllocatePoolWithTag( NonPagedPool, dcbSize, 'pmuD' ); if (!dcb) { IoDebugPrint((1, "IopInitializeDCB: Not enough pool to allocate DCB0\n" )); IopLogErrorEvent(0,1,STATUS_SUCCESS,IO_DUMP_INITIALIZATION_FAILURE,0,NULL,0,NULL); return FALSE; } RtlZeroMemory( dcb, dcbSize ); dcb->Type = IO_TYPE_DCB; dcb->Size = (USHORT) dcbSize; dcb->Flags = (UCHAR) (dumpControl | (autoReboot ? DCB_AUTO_REBOOT : 0)); dcb->NumberProcessors = KeNumberProcessors; dcb->ProcessorArchitecture = KeProcessorArchitecture; dcb->MinorVersion = (USHORT) NtBuildNumber; dcb->MajorVersion = (USHORT) ((NtBuildNumber >> 28) & 0xfffffff); dcb->BuildNumber = CmNtCSDVersion; dcb->TriageDumpFlags = DEFAULT_TRIAGE_DUMP_FLAGS; dcb->DumpFileSize.QuadPart = dumpFileSize; // // Allocate memory descriptors. // dcb->MemoryDescriptorLength = sizeof( PHYSICAL_MEMORY_DESCRIPTOR ) - sizeof( PHYSICAL_MEMORY_RUN ) + (MmPhysicalMemoryBlock->NumberOfRuns * sizeof( PHYSICAL_MEMORY_RUN )); dcb->MemoryDescriptor = ExAllocatePoolWithTag ( NonPagedPool, dcb->MemoryDescriptorLength, 'pmuD' ); if (!dcb->MemoryDescriptor) { ExFreePool (dcb); IoDebugPrint((1, "IopInitializeDCB: Not enough pool to allocate DCB1\n" )); IopLogErrorEvent(0,1,STATUS_SUCCESS,IO_DUMP_INITIALIZATION_FAILURE,0,NULL,0,NULL); return FALSE; } RtlCopyMemory ( dcb->MemoryDescriptor, MmPhysicalMemoryBlock, dcb->MemoryDescriptorLength ); // // Allocate header page. // dcb->HeaderSize = numberOfHeaderPages * PAGE_SIZE; dcb->HeaderPage = ExAllocatePoolWithTag( NonPagedPool, dcb->HeaderSize, 'pmuD' ); if (!dcb->HeaderPage) { ExFreePool (dcb->MemoryDescriptor); ExFreePool (dcb); IoDebugPrint((1, "IopInitializeDCB: Not enough pool to allocate DCB2\n" )); IopLogErrorEvent(0,1,STATUS_SUCCESS,IO_DUMP_INITIALIZATION_FAILURE,0,NULL,0,NULL); return FALSE; } page = MmGetPhysicalAddress( dcb->HeaderPage ); dcb->HeaderPfn = (ULONG)(page.QuadPart >> PAGE_SHIFT); // // Allocate the triage-dump buffer. // if (dumpControl & DCB_TRIAGE_DUMP_ENABLED) { dcb->TriageDumpBuffer = ExAllocatePoolWithTag ( NonPagedPool, dumpFileSize, 'pmuD' ); if (!dcb->TriageDumpBuffer) { ExFreePool (dcb->HeaderPage); ExFreePool (dcb->MemoryDescriptor); ExFreePool (dcb); IoDebugPrint((1, "IopInitializeDCB: Not enough pool to allocate DCB3\n" )); IopLogErrorEvent(0,1,STATUS_SUCCESS,IO_DUMP_INITIALIZATION_FAILURE,0,NULL,0,NULL); return FALSE; } dcb->TriageDumpBufferSize = dumpFileSize; } IopDumpControlBlock = dcb; return TRUE; }

NTSTATUS IopInitializeDumpSpaceAndType (  IN PDUMP_CONTROL_BLOCK  dcb, IN OUT PULONG  block, IN PSUMMARY_DUMP_HEADER  pSummaryHeader )

Definition at line 1452 of file dumpctl.c. References DCB_DUMP_HEADER_ENABLED, DCB_SUMMARY_DUMP_ENABLED, DCB_TRIAGE_DUMP_ENABLED, IoDebugPrint, IopCalculateRequiredDumpSpace(), and Space. Referenced by IoWriteCrashDump(). { LARGE_INTEGER Space; Space.QuadPart = 0; if (dcb->Flags & DCB_TRIAGE_DUMP_ENABLED) { // // Fixed size dump for triage-dumps. // block [ DH_DUMP_TYPE ] = DUMP_TYPE_TRIAGE; Space.QuadPart = TRIAGE_DUMP_SIZE; } else if (dcb->Flags & DCB_SUMMARY_DUMP_ENABLED) { block [ DH_DUMP_TYPE ] = DUMP_TYPE_SUMMARY; Space = IopCalculateRequiredDumpSpace( dcb->Flags, dcb->HeaderSize, dcb->MemoryDescriptor->NumberOfPages, pSummaryHeader->Pages ); } else { if (dcb->Flags & DCB_DUMP_HEADER_ENABLED) { block [ DH_DUMP_TYPE ] = DUMP_TYPE_HEADER; } Space = IopCalculateRequiredDumpSpace( dcb->Flags, dcb->HeaderSize, dcb->MemoryDescriptor->NumberOfPages, dcb->MemoryDescriptor->NumberOfPages ); } // // If the calculated size is larger than the pagefile, truncate it to // the pagefile size. // if (Space.QuadPart > dcb->DumpFileSize.QuadPart) { Space.QuadPart = dcb->DumpFileSize.QuadPart; } block [ DH_REQUIRED_DUMP_SPACE ] = Space.LowPart; block [ DH_REQUIRED_DUMP_SPACE + 1 ] = Space.HighPart; IoDebugPrint((2,"IODUMP: dcb File Size %x Block Size %x\n", block [DH_REQUIRED_DUMP_SPACE], (ULONG)dcb->DumpFileSize.LowPart )); return STATUS_SUCCESS; }

PSUMMARY_DUMP_HEADER IopInitializeSummaryDump (  IN PDUMP_CONTROL_BLOCK  pDcb  )

Definition at line 3442 of file dumpctl.c. References _PHYSICAL_MEMORY_RUN::BasePage, IoDebugPrint, IopCreateSummaryDump(), MmPhysicalMemoryBlock, NULL, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfRuns, _PHYSICAL_MEMORY_RUN::PageCount, and _PHYSICAL_MEMORY_DESCRIPTOR::Run. Referenced by IoWriteCrashDump(). : This routine creates a summary dump header. In particular it initializes a bitmap that contains a map of kernel memory. Arguments: PDUMP_CONTROL_BLOCK - A pointer to the dump control block. Return Value: Non-NULL - A pointer to the summary dump header NULL - Error --*/ { PULONG pdwBlock; PSUMMARY_DUMP_HEADER pSummaryHeader; ULONG dwActualPages; // // Get the dump header page. // pdwBlock = pDcb->HeaderPage; // // The summary dump starts 1 page after the header. // pSummaryHeader = (PSUMMARY_DUMP_HEADER)&pdwBlock[ DH_SUMMARY_DUMP_RECORD ]; // // Fill the header with signatures. // RtlFillMemoryUlong( pSummaryHeader, sizeof(SUMMARY_DUMP_HEADER), 'PMDS' ); // // Set the size and valid signature. // pSummaryHeader->BitmapSize = (ULONG)( MmPhysicalMemoryBlock->Run[MmPhysicalMemoryBlock->NumberOfRuns-1].BasePage + MmPhysicalMemoryBlock->Run[MmPhysicalMemoryBlock->NumberOfRuns-1].PageCount ); pSummaryHeader->ValidDump = 'PMUD'; // // Construct the kernel memory bitmap. // dwActualPages = IopCreateSummaryDump(pSummaryHeader); IoDebugPrint((2,"[IopInitializeSummaryDump]: Kernel Pages = %x\n",dwActualPages)); if (!dwActualPages) { return NULL; } // // Set the actual number of physical pages in the summary dump // pSummaryHeader->Pages = dwActualPages; pSummaryHeader->HeaderSize = pDcb->HeaderSize; return pSummaryHeader; }

BOOLEAN IopIsAddressRangeValid (  IN PVOID  VirtualAddress, IN SIZE_T  Length )

Definition at line 287 of file dumpctl.c. References COMPUTE_PAGES_SPANNED, FALSE, LPVOID, MmIsAddressValid(), PAGE_ALIGN, PAGE_SIZE, and TRUE. Referenced by IopGetLoadedDriverInfo(), and IopWriteDriverList(). 00294 : 00295 00296 Validate a range of addresses. 00297 00298 Arguments: 00299 00300 Virtual Address - Beginning of of memory block to validate. 00301 00302 Length - Length of memory block to validate. 00303 00304 Return Value: 00305 00306 TRUE - Address range is valid. 00307 00308 FALSE - Address range is not valid. 00309 00310 --*/ 00311 00312 { 00313 UINT_PTR Va; 00314 ULONG Pages; 00315 00316 Va = (UINT_PTR) PAGE_ALIGN (VirtualAddress); 00317 Pages = COMPUTE_PAGES_SPANNED (VirtualAddress, Length); 00318 00319 while (Pages) { 00320 00321 if (!MmIsAddressValid ( (LPVOID) Va)) { 00322 return FALSE; 00323 } 00324 00325 Va += PAGE_SIZE; 00326 Pages--; 00327 } 00328 00329 return TRUE; 00330 }

NTSTATUS IopLoadDumpDriver (  IN OUT PDUMP_STACK_CONTEXT  DumpStack, IN PWCHAR  DriverNameString, IN PWCHAR  NewBaseNameString )

Definition at line 954 of file dumpctl.c. References BaseName, ExAllocatePoolWithTag, ExFreePool(), IoDebugPrint, MmLoadAndLockSystemImage(), NonPagedPool, NT_SUCCESS, NTSTATUS(), NULL, PDUMP_STACK_IMAGE, RtlAppendUnicodeStringToString(), RtlAppendUnicodeToString(), RtlInitUnicodeString(), and Status. Referenced by IopGetDumpStack(). : Worker function for IoGetDumpStack to load a particular driver into the current DumpStack being created Arguments: DumpStack - Dump driver stack being built DriverNameString - The string name of the driver to load NewBaseNameString - The modified basename of the driver once loaded Return Value: Status --*/ { NTSTATUS Status; PDUMP_STACK_IMAGE DumpImage; PLDR_DATA_TABLE_ENTRY ImageLdrInfo; UNICODE_STRING DriverName; UNICODE_STRING BaseName; UNICODE_STRING Prefix; PUNICODE_STRING LoadBaseName; // // Allocate space to track this dump driver // DumpImage = ExAllocatePoolWithTag ( NonPagedPool, sizeof (DUMP_STACK_IMAGE), 'pmuD' ); if (!DumpImage) { return STATUS_INSUFFICIENT_RESOURCES; } // // Load the system image // RtlInitUnicodeString (&DriverName, DriverNameString); RtlInitUnicodeString (&Prefix, DumpStack->ModulePrefix); LoadBaseName = NULL; if (NewBaseNameString) { LoadBaseName = &BaseName; RtlInitUnicodeString (&BaseName, NewBaseNameString); BaseName.MaximumLength = Prefix.Length + BaseName.Length; BaseName.Buffer = ExAllocatePoolWithTag ( NonPagedPool, BaseName.MaximumLength, 'pmuD' ); if (!BaseName.Buffer) { ExFreePool (DumpImage); return STATUS_INSUFFICIENT_RESOURCES; } BaseName.Length = 0; RtlAppendUnicodeStringToString (&BaseName, &Prefix); RtlAppendUnicodeToString (&BaseName, NewBaseNameString); } Status = MmLoadAndLockSystemImage( &DriverName, &Prefix, LoadBaseName, &DumpImage->Image, &DumpImage->ImageBase ); if (NewBaseNameString) { ExFreePool (BaseName.Buffer); } if (!NT_SUCCESS (Status)) { IoDebugPrint ((0, "IODUMP: Could not load %wZ; error = %x\n", &DriverName, Status)); ExFreePool (DumpImage); return Status; } // // Put this driver on the list of drivers to be processed at crash time // DumpImage->SizeOfImage = DumpImage->Image->SizeOfImage; InsertTailList (&DumpStack->DriverList, &DumpImage->Link); return STATUS_SUCCESS; }

VOID IopMapPhysicalMemory (  IN OUT PMDL  Mdl, IN ULONG_PTR  MemoryAddress, IN PPHYSICAL_MEMORY_RUN  PhysicalMemoryRun, IN ULONG  Length )

Definition at line 2081 of file dumpctl.c. References _PHYSICAL_MEMORY_RUN::BasePage, COMPUTE_PAGES_SPANNED, MmGetMdlPfnArray, MmMapMemoryDumpMdl(), PAGE_ALIGN, PAGE_SHIFT, PAGE_SIZE, and _PHYSICAL_MEMORY_RUN::PageCount. Referenced by IoWriteCrashDump(). : This routine is invoked to fill in the specified MDL (Memory Descriptor List) w/the appropriate information to map the specified memory address range. Arguments: Mdl - Address of the MDL to be filled in. MemoryAddress - Pseudo-virtual address being mapped. PhysicalMemoryRun - Base address of the physical memory run list. Length - Length of transfer to be mapped. Return Value: None. --*/ { PPHYSICAL_MEMORY_RUN pmr = PhysicalMemoryRun; PPFN_NUMBER page; PFN_NUMBER pages; PFN_NUMBER base; PFN_NUMBER currentBase; // // Begin by determining the base physical page of the start of the address // range and filling in the MDL appropriately. // Mdl->StartVa = PAGE_ALIGN( (PVOID) (MemoryAddress) ); Mdl->ByteOffset = (ULONG)(MemoryAddress & (PAGE_SIZE - 1)); Mdl->ByteCount = Length; // // Get the page frame index for the base address. // base = (PFN_NUMBER) ((ULONG_PTR)(Mdl->StartVa) >> PAGE_SHIFT); pages = COMPUTE_PAGES_SPANNED(MemoryAddress, Length); currentBase = pmr->BasePage; page = MmGetMdlPfnArray(Mdl); // // Map all of the pages for this transfer until there are no more remaining // to be mapped. // while (pages) { // // Find the memory run that maps the beginning of this transfer. // while (currentBase + pmr->PageCount <= base) { currentBase += pmr->PageCount; pmr++; } // // The current memory run maps the start of this transfer. Capture // the base page for the start of the transfer. // *page++ = pmr->BasePage + (PFN_NUMBER)(base++ - currentBase); pages--; } // // All of the PFNs for the address range have been filled in so map the // physical memory into virtual address space. // MmMapMemoryDumpMdl( Mdl ); }

VOID IopMapVirtualToPhysicalMdl (  IN OUT PMDL  pMdl, IN ULONG_PTR  dwMemoryAddress, IN ULONG  dwLength )

Definition at line 3759 of file dumpctl.c. References COMPUTE_PAGES_SPANNED, IoDebugPrint, MDL_MAPPED_TO_SYSTEM_VA, MmGetMdlPfnArray, MmGetPhysicalAddress(), PAGE_ALIGN, PAGE_SHIFT, and PAGE_SIZE. Referenced by IopWriteSummaryHeader(), and IopWriteToDisk(). { PPFN_NUMBER pdwPage; ULONG dwPages; ULONG dwBase; ULONG dwCurrentBase; ULONG_PTR dwBaseVa; PHYSICAL_ADDRESS PhysicalAddress; // // Begin by determining the base physical page of the start of the address // range and filling in the MDL appropriately. // pMdl->StartVa = PAGE_ALIGN((PVOID)dwMemoryAddress); pMdl->ByteOffset= (ULONG)(dwMemoryAddress & (PAGE_SIZE - 1)); pMdl->ByteCount = dwLength; dwBaseVa = dwMemoryAddress & ~(PAGE_SIZE -1); pMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA; // // Compute the number of pages spanned // dwPages = COMPUTE_PAGES_SPANNED( dwMemoryAddress, dwLength ); pdwPage = MmGetMdlPfnArray(pMdl); // // Map all of the pages for this transfer until there are no more remaining // to be mapped. // IoDebugPrint((3,"MapVirtualToPhysical: VA: %08x off: %08x Len:%08x base: %08x \n",pMdl->StartVa,pMdl->ByteOffset,pMdl->ByteCount,dwBaseVa)); while (dwPages) { PhysicalAddress = MmGetPhysicalAddress( (PVOID)dwBaseVa ); IoDebugPrint( (3,"Physical Frame: %08x Adr: %08x\n",( PhysicalAddress.QuadPart >> PAGE_SHIFT),dwBaseVa ) ); *pdwPage++ = (PFN_NUMBER)(PhysicalAddress.QuadPart >> PAGE_SHIFT); dwBaseVa +=PAGE_SIZE; dwPages--; } // // All of the PFNs for the address range have been filled in so map the // physical memory into virtual address space using crash dump PTE. // // MmMapMemoryDumpMdl( pMdl ); }

VOID IopReadDumpRegistry (  OUT PULONG  dumpControl, OUT PULONG  numberOfHeaderPages, OUT PULONG  autoReboot, OUT PULONG  dumpFileSize )

Definition at line 4379 of file dumpctl.c. References BYTES_TO_PAGES, DCB_DUMP_ENABLED, DCB_SUMMARY_DUMP_ENABLED, DCB_SUMMARY_ENABLED, DCB_TRIAGE_DUMP_ACT_UPON_ENABLED, DCB_TRIAGE_DUMP_ENABLED, ExFreePool(), FALSE, IoDebugPrint, IopGetRegistryValue(), IopOpenRegistryKey(), L, MmPhysicalMemoryBlock, NT_SUCCESS, NtClose(), NTSTATUS(), NULL, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfPages, PAGE_SHIFT, PAGE_SIZE, RtlInitUnicodeString(), and TRUE. Referenced by IopInitializeDCB(). : This routine reads the dump parameters from the registry. Arguments: dumpControl - Supplies a pointer to the dumpControl flags to set. Return Value: None. --*/ { HANDLE keyHandle; HANDLE crashHandle; LOGICAL crashHandleOpened; UNICODE_STRING keyName; NTSTATUS status; PKEY_VALUE_FULL_INFORMATION keyValueInformation; PDUMP_CONTROL_BLOCK dcb; ULONG handleValue; *dumpControl = 0; *autoReboot = 0; *dumpFileSize = 0; *numberOfHeaderPages = 1; // Dump header // // Begin by opening the path to the control for dumping memory. Note // that if it does not exist, then no dumps will occur. // crashHandleOpened = FALSE; RtlInitUnicodeString( &keyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control" ); status = IopOpenRegistryKey( &keyHandle, (HANDLE) NULL, &keyName, KEY_READ, FALSE ); if (!NT_SUCCESS( status )) { return; } RtlInitUnicodeString( &keyName, L"CrashControl" ); status = IopOpenRegistryKey( &crashHandle, keyHandle, &keyName, KEY_READ, FALSE ); NtClose( keyHandle ); if (!NT_SUCCESS( status )) { return; } crashHandleOpened = TRUE; // // Now get the value of the crash control to determine whether or not // dumping is enabled. // status = IopGetRegistryValue( crashHandle, L"CrashDumpEnabled", &keyValueInformation ); if (NT_SUCCESS (status)) { if (keyValueInformation->DataLength) { handleValue = * ((PULONG) ((PUCHAR) keyValueInformation + keyValueInformation->DataOffset)); ExFreePool( keyValueInformation ); if (handleValue) { *dumpControl |= DCB_DUMP_ENABLED; // // If handleValue equals summary dump or the amount of physical // memory is greater than 2GB, then enable summary dump // if ( handleValue == 3 ) { *dumpControl |= DCB_TRIAGE_DUMP_ENABLED; } else if ( handleValue == 4 ) { *dumpControl |= ( DCB_TRIAGE_DUMP_ENABLED | DCB_TRIAGE_DUMP_ACT_UPON_ENABLED ); } else if ( ( handleValue == 2 ) || ( MmPhysicalMemoryBlock->NumberOfPages >= ( 0x80000000 >> PAGE_SHIFT ) ) ) { *dumpControl |= DCB_SUMMARY_DUMP_ENABLED; IoDebugPrint((2,"IopInitializeDCB: SUMMARY DUMP ENABLED \n")); // // Allocate enough storage for the dump header, summary // dump header and bitmap. // *numberOfHeaderPages = BYTES_TO_PAGES( PAGE_SIZE + ( ( MmPhysicalMemoryBlock->NumberOfPages >> 5) << 2 ) + sizeof(SUMMARY_DUMP_HEADER) ); IoDebugPrint((2,"IopInitializeDCB: NumberOfHeader Pages = %x\n",numberOfHeaderPages)); } } } } status = IopGetRegistryValue( crashHandle, L"LogEvent", &keyValueInformation ); if (NT_SUCCESS( status )) { if (keyValueInformation->DataLength) { handleValue = * ((PULONG) ((PUCHAR) keyValueInformation + keyValueInformation->DataOffset)); ExFreePool( keyValueInformation); if (handleValue) { *dumpControl |= DCB_SUMMARY_ENABLED; } } } status = IopGetRegistryValue( crashHandle, L"SendAlert", &keyValueInformation ); if (NT_SUCCESS( status )) { if (keyValueInformation->DataLength) { handleValue = * ((PULONG) ((PUCHAR) keyValueInformation + keyValueInformation->DataOffset)); ExFreePool( keyValueInformation); if (handleValue) { *dumpControl |= DCB_SUMMARY_ENABLED; } } } // // Now determine whether or not automatic reboot is enabled. // status = IopGetRegistryValue( crashHandle, L"AutoReboot", &keyValueInformation ); if (NT_SUCCESS( status )) { if (keyValueInformation->DataLength) { *autoReboot = * ((PULONG) ((PUCHAR) keyValueInformation + keyValueInformation->DataOffset)); } ExFreePool( keyValueInformation ); } // // If we aren't auto rebooting or crashing then return now. // if (*dumpControl == 0 && *autoReboot == 0) { if (crashHandleOpened == TRUE) { NtClose( crashHandle ); } return; } status = IopGetRegistryValue( crashHandle, L"DumpFileSize", &keyValueInformation ); if (NT_SUCCESS( status )) { if (keyValueInformation->DataLength) { *dumpFileSize = * ((PULONG) ((PUCHAR) keyValueInformation + keyValueInformation->DataOffset)); } ExFreePool( keyValueInformation ); } return; }

VOID IopRemovePageFromPageMap (  IN ULONG  dwMaxPage, IN PRTL_BITMAP  pBitMapHeader, IN ULONG  dwPageFrameIndex, IN ULONG  dwNumberOfPages )

Definition at line 2193 of file dumpctl.c. References IoDebugPrint, and RtlClearBits(). Referenced by IoFreeDumpRange(), and IopDeleteNonExistentMemory(). { // // Sometimes we get PFNs that are out of range. Just ignore them. // if (dwPageFrameIndex >= dwMaxPage) { return; } IoDebugPrint( (6, "RtlClearBits max:%x pfn:%x, pages:%x\n",(dwMaxPage), (dwPageFrameIndex), (dwNumberOfPages) )); \ RtlClearBits (pBitMapHeader, dwPageFrameIndex, dwNumberOfPages); }

NTSTATUS IopWriteDriverList (  IN ULONG_PTR  BufferAddress, IN ULONG  BufferSize, IN ULONG  DriverListOffset, IN ULONG  StringPoolOffset )

Definition at line 2681 of file dumpctl.c. References ASSERT, DmpNextPoolString, DriverEntry(), IopIsAddressRangeValid(), MmDbgReadCheck(), NULL, PsLoadedModuleList, and RtlImageNtHeader(). Referenced by IopWriteTriageDump(). : Write the triage dump driver list to the buffer. Arguments: BufferAddress - The address of the buffer. BufferSize - The size of the buffer. DriverListOffset - The offset within the buffer where the driver list should be written. StringPoolOffset - The offset within the buffer where the driver list's string pool should start. If there are no other strings for the triage dump other than driver name strings, this will be the string pool offset. Return Value: NTSTATUS --*/ { ULONG i = 0; PLIST_ENTRY NextEntry; PLDR_DATA_TABLE_ENTRY DriverEntry; PDUMP_DRIVER_ENTRY DumpImageArray; PDUMP_STRING DumpStringName = NULL; PIMAGE_NT_HEADERS NtHeaders; ASSERT (DriverListOffset != 0); ASSERT (StringPoolOffset != 0); DumpImageArray = (PDUMP_DRIVER_ENTRY) (BufferAddress + DriverListOffset); DumpStringName = (PDUMP_STRING) (BufferAddress + StringPoolOffset); NextEntry = PsLoadedModuleList.Flink; while (NextEntry != &PsLoadedModuleList) { DriverEntry = CONTAINING_RECORD (NextEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks); // // Verify the memory is valid before reading anything from it. // if (!IopIsAddressRangeValid (DriverEntry, sizeof (*DriverEntry)) || !IopIsAddressRangeValid (DriverEntry->BaseDllName.Buffer, DriverEntry->BaseDllName.Length)) { return STATUS_UNSUCCESSFUL; } // // Build the entry in the string pool. We guarantee all strings are // NULL terminated as well as length prefixed. // DumpStringName->Length = DriverEntry->BaseDllName.Length / 2; RtlCopyMemory (DumpStringName->Buffer, DriverEntry->BaseDllName.Buffer, DumpStringName->Length * sizeof (WCHAR) ); DumpStringName->Buffer[ DumpStringName->Length ] = '\000'; RtlCopyMemory (&DumpImageArray [i].LdrEntry, DriverEntry, sizeof (DumpImageArray [i].LdrEntry) ); // // Add the time/date stamp. // DumpImageArray[i].LdrEntry.TimeDateStamp = 0; DumpImageArray[i].LdrEntry.SizeOfImage = 0; if ( MmDbgReadCheck (DriverEntry->DllBase ) != NULL ) { NtHeaders = RtlImageNtHeader (DriverEntry->DllBase); ASSERT ( NtHeaders ); DumpImageArray[i].LdrEntry.TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp; DumpImageArray[i].LdrEntry.SizeOfImage = NtHeaders->OptionalHeader.SizeOfImage; } DumpImageArray [i].DriverNameOffset = (ULONG)((ULONG_PTR) DumpStringName - BufferAddress); i++; DumpStringName = DmpNextPoolString (DumpStringName); NextEntry = NextEntry->Flink; } return STATUS_SUCCESS; }

NTSTATUS IopWritePageToDisk (  IN PDUMP_DRIVER_WRITE  DriverWrite, IN OUT PLARGE_INTEGER *  McbBuffer, IN OUT ULONG  DriverTransferSize, IN PFN_NUMBER  PageFrameIndex )

Definition at line 3183 of file dumpctl.c. References ASSERT, _MDL::ByteCount, _MDL::ByteOffset, _MDL::MappedSystemVa, MDL_MAPPED_TO_SYSTEM_VA, MDL_PAGES_LOCKED, _MDL::MdlFlags, min3, MmGetMdlPfnArray, MmInitializeMdl, MmMapMemoryDumpMdl(), NT_SUCCESS, NTSTATUS(), NULL, PAGE_ALIGN, PAGE_SIZE, _MDL::StartVa, and Status. Referenced by IopWriteSummaryDump(). : Write the page described by PageFrameIndex to the disk/file (DriverWrite, McbBuffer) and update the MCB buffer to reflect the new position in the file. Arguments: DriverWrite - The driver write routine. McbBuffer - A pointer to the MCB array. This array is terminated by a zero-length MCB entry. On success, this pointer is updated to reflect the new position in the MCB array. NB: MCB[0] is the size and MCB[1] is the offset. DriverTransferSize - The maximum transfer size for this driver. PageFrameIndex - The page to be written. Return Values: NTSTATUS code. --*/ { NTSTATUS Status; PFN_NUMBER MdlHack [ (sizeof (MDL) / sizeof (PFN_NUMBER)) + 1]; PPFN_NUMBER PfnArray; PLARGE_INTEGER Mcb; ULONG ByteCount; ULONG ByteOffset; ULONG BytesToWrite; PMDL TempMdl; ASSERT ( DriverWrite ); ASSERT ( McbBuffer ); ASSERT ( DriverTransferSize && DriverTransferSize >= PAGE_SIZE ); // // Initialization // TempMdl = (PMDL) &MdlHack; Mcb = *McbBuffer; BytesToWrite = PAGE_SIZE; // // Initialze the MDL to point to this page. // MmInitializeMdl (TempMdl, NULL, PAGE_SIZE); PfnArray = MmGetMdlPfnArray ( TempMdl ); PfnArray[0] = PageFrameIndex; // // We loop for the cases when the space remaining in this block (Mcb [0]) // is less than one page. Generally the Mcb will be large enough to hold // the entire page and this loop will only be executed once. When Mcb[0] // is less than a page, we will write the first part of the page to this // Mcb then increment the Mcb and write the remaining part to the next // page. // ByteOffset = 0; while ( BytesToWrite ) { ASSERT ( Mcb[0].QuadPart != 0 ); ByteCount = (ULONG) min3 ((LONGLONG) BytesToWrite, (LONGLONG) DriverTransferSize, Mcb[0].QuadPart ); ASSERT ( ByteCount != 0 ); // // Update the MDL byte count and byte offset. // TempMdl->ByteCount = ByteCount; TempMdl->ByteOffset = ByteOffset; // // Map the MDL. The flags are updated to show that MappedSsytemVa is // valid, which should probably be done in MmMapMemoryDumpMdl. // MmMapMemoryDumpMdl ( TempMdl ); TempMdl->MdlFlags |= ( MDL_PAGES_LOCKED | MDL_MAPPED_TO_SYSTEM_VA ); TempMdl->StartVa = PAGE_ALIGN (TempMdl->MappedSystemVa); Status = DriverWrite ( &Mcb[1], TempMdl ); if (!NT_SUCCESS (Status)) { return Status; } BytesToWrite -= ByteCount; ByteOffset += ByteCount; Mcb[0].QuadPart -= ByteCount; Mcb[1].QuadPart += ByteCount; // // If there is no more room for this MCB, go to the next one. // if ( Mcb[0].QuadPart == 0 ) { Mcb += 2; // // We have filled up all the space in the paging file. // if ( Mcb[0].QuadPart == 0) { return STATUS_END_OF_FILE; } } } *McbBuffer = Mcb; return Status; }

NTSTATUS IopWriteSummaryDump (  IN PRTL_BITMAP  PageMap, IN PDUMP_DRIVER_WRITE  DriverWriteRoutine, IN PANSI_STRING  ProgressMessage, IN PUCHAR  MessageBuffer, IN OUT PLARGE_INTEGER  Mcb, IN OUT ULONG  DriverTransferSize )

Definition at line 3329 of file dumpctl.c. References ASSERT, InbvDisplayString(), IoDebugPrint, IopWritePageToDisk(), NT_SUCCESS, NTSTATUS(), NULL, RtlNumberOfSetBits(), sprintf(), and Status. Referenced by IoWriteCrashDump(). : Write a summary dump to the disk. Arguments: PageMap - A bitmap of the pages that need to be written. DriverWriteRoutine - The driver's write routine. ProgressMessage - The "Percent Complete" message. MessageBuffer - A message buffer we can use to update percentage complete status. Mcb - Message Control Block where the data is to be written. DriverTransferSize - The maximum transfer size for the driver. Return Values: NTSTATUS code. --*/ { PVOID Va; PFN_NUMBER PageFrameIndex; PHYSICAL_ADDRESS PhysicalAddress; NTSTATUS Status; ULONG WriteCount; ULONG MaxWriteCount; ULONG Step; ASSERT ( DriverWriteRoutine != NULL ); ASSERT ( Mcb != NULL ); ASSERT ( DriverTransferSize != 0 ); MaxWriteCount = RtlNumberOfSetBits ( PageMap ); Step = MaxWriteCount / 100; IoDebugPrint ((1, "IODUMP: Summary Dump\n" " Writing %x pages to disk from a total of %x\n", MaxWriteCount, PageMap->SizeOfBitMap)); // // Loop over all pages in the system and write those that are set // in the bitmap. // WriteCount = 0; for ( PageFrameIndex = 0; PageFrameIndex < PageMap->SizeOfBitMap; PageFrameIndex++) { // // If this page needs to be included in the dump file. // if ( RtlCheckBit (PageMap, PageFrameIndex) ) { if (++WriteCount % Step == 0) { sprintf (MessageBuffer, "%Z: %3d\r", ProgressMessage, (WriteCount * 100) / MaxWriteCount); InbvDisplayString ( MessageBuffer ); } ASSERT ( WriteCount <= MaxWriteCount ); // // Write the page to disk. // Status = IopWritePageToDisk ( DriverWriteRoutine, &Mcb, DriverTransferSize, PageFrameIndex ); if (!NT_SUCCESS (Status)) { return STATUS_UNSUCCESSFUL; } } } return STATUS_SUCCESS; }

NTSTATUS IopWriteSummaryDump (  IN PRTL_BITMAP  PageMap, IN PDUMP_DRIVER_WRITE  WriteRoutine, IN PANSI_STRING  ProgressMessage, IN PUCHAR  MessageBuffer, IN OUT PLARGE_INTEGER  Mcb, IN ULONG  DiverTransferSize )

NTSTATUS IopWriteSummaryHeader (  IN PSUMMARY_DUMP_HEADER  pSummaryHeader, IN PDUMP_DRIVER_WRITE  pfWrite, IN OUT PLARGE_INTEGER *  pMcbBuffer, IN OUT PMDL  pMdl, IN ULONG  dwWriteSize, IN ULONG  dwLength )

Definition at line 3520 of file dumpctl.c. References IoDebugPrint, IopMapVirtualToPhysicalMdl(), NT_SUCCESS, NTSTATUS(), PAGE_SIZE, and Status. Referenced by IoWriteCrashDump(). : Write the summary dump header to the dump file. Arguments: pSummaryHeader - pointer to the summary dump bitmap pfWrite - dump driver write function McbBuffer - pointer to the MCB array. pMdl - Pointer to an MDL dwWriteSize - the max transfer size for the dump driver dwLength - the length of this transfer Return Value: Updated MCB --*/ { NTSTATUS Status; ULONG dwBytesRemaining; ULONG_PTR dwMemoryAddress; ULONG dwByteOffset; ULONG dwByteCount; PLARGE_INTEGER pMcb; dwBytesRemaining = dwLength; dwMemoryAddress = (ULONG_PTR) pSummaryHeader; pMcb = *McbBuffer; IoDebugPrint (( 0, "IoWriteCrashDump: Writing SUMMARY dump header to disk\n" )); while (dwBytesRemaining) { // Calculate byte offset dwByteOffset = (ULONG)(dwMemoryAddress & (PAGE_SIZE - 1)); // // See if the number of bytes to write is greator than the crash // drives max transfer. // if (dwBytesRemaining <= dwWriteSize) { dwByteCount = dwBytesRemaining; } else { dwByteCount = dwWriteSize; } // // If the byteCount is greater than the remaining mcb then correct it. // if (dwByteCount > pMcb[0].QuadPart) { dwByteCount = pMcb[0].LowPart; } pMdl->ByteCount = dwByteCount; pMdl->ByteOffset = dwByteOffset; pMdl->MappedSystemVa = (PVOID) dwMemoryAddress; // // Get the actual physical frame and create an mdl. // IopMapVirtualToPhysicalMdl(pMdl, dwMemoryAddress, dwByteCount); // // Write to disk. // Status = pfWrite( &pMcb[1], pMdl ); if ( !NT_SUCCESS (Status) ) { return Status; } // // Adjust bytes remaining. // dwBytesRemaining -= dwByteCount; dwMemoryAddress += dwByteCount; pMcb[0].QuadPart = pMcb[0].QuadPart - dwByteCount; pMcb[1].QuadPart = pMcb[1].QuadPart + dwByteCount; if (pMcb[0].QuadPart == 0) { pMcb += 2; } if (pMcb[0].QuadPart == 0) { return STATUS_END_OF_FILE; } } IoDebugPrint((2, "IoWriteCrashDump: Writing SUMMARY dump header to disk\n" )); *McbBuffer = pMcb; return STATUS_SUCCESS; }

NTSTATUS IopWriteToDisk (  IN PVOID  Buffer, IN ULONG  WriteLength, IN PDUMP_DRIVER_WRITE  DriverWriteRoutine, IN OUT PLARGE_INTEGER *  Mcb, IN OUT PMDL  Mdl, IN ULONG  DriverTransferSize )

Definition at line 3638 of file dumpctl.c. References ASSERT, Buffer, BYTE_OFFSET, _DUMP_CONTROL_BLOCK::FileDescriptorArray, _DUMP_CONTROL_BLOCK::FileDescriptorSize, IO_DUMP_MAXIMUM_TRANSFER_SIZE, IO_DUMP_MINIMUM_TRANSFER_SIZE, IoDebugPrint, IopDumpControlBlock, IopMapVirtualToPhysicalMdl(), min, and NT_SUCCESS. Referenced by IopWriteTriageDump(). : Write the summary dump header to the dump file. Arguments: Buffer - Pointer to the buffer to write. WriteLength - The length of this transfer. DriverWriteRoutine - Dump driver write function. McbBuffer - Pointer to the dump file Mapped Control Block. Mdl - Pointer to an MDL. DriverTransferSize - The max transfer size for the dump driver. Return Value: --*/ { ULONG dwBytesRemaining; ULONG_PTR dwMemoryAddress; ULONG dwByteOffset; ULONG dwByteCount; PLARGE_INTEGER Mcb; ASSERT (Buffer); ASSERT (WriteLength); ASSERT (DriverWriteRoutine); ASSERT (McbBuffer && *McbBuffer); ASSERT (Mdl); ASSERT (DriverTransferSize >= IO_DUMP_MINIMUM_TRANSFER_SIZE && DriverTransferSize <= IO_DUMP_MAXIMUM_TRANSFER_SIZE); Mcb = *McbBuffer; dwBytesRemaining = WriteLength; dwMemoryAddress = (ULONG_PTR) Buffer; IoDebugPrint(( 2, "IoWriteToDisk: Writing %d bytes to disk.\n", WriteLength )); while (dwBytesRemaining) { ASSERT (Mcb [0].QuadPart != 0); ASSERT (IopDumpControlBlock->FileDescriptorArray <= Mcb && (LPBYTE) Mcb < (LPBYTE) IopDumpControlBlock->FileDescriptorArray + IopDumpControlBlock->FileDescriptorSize ); dwByteOffset = BYTE_OFFSET (dwMemoryAddress); // // See if the number of bytes to write is greator than the crash // drives max transfer. // dwByteCount = min ( dwBytesRemaining, DriverTransferSize ); // // If the byteCount is greater than the remaining mcb then correct it. // if (dwByteCount > Mcb[0].QuadPart) { dwByteCount = Mcb[0].LowPart; } Mdl->ByteCount = dwByteCount; Mdl->ByteOffset = dwByteOffset; Mdl->MappedSystemVa = (PVOID) dwMemoryAddress; // // Get the actual physical frame and create an mdl. // IopMapVirtualToPhysicalMdl(Mdl, dwMemoryAddress, dwByteCount); if (!NT_SUCCESS( DriverWriteRoutine ( &Mcb[1], Mdl ) )) { IoDebugPrint ((1, "IopWriteToDisk: Failed write.\n")); return STATUS_UNSUCCESSFUL; } // // Adjust bytes remaining. // ASSERT (dwBytesRemaining >= dwByteCount); ASSERT (dwByteCount != 0); dwBytesRemaining -= dwByteCount; dwMemoryAddress += dwByteCount; Mcb[0].QuadPart -= dwByteCount; Mcb[1].QuadPart += dwByteCount; if (Mcb[0].QuadPart == 0) { Mcb += 2; } } IoDebugPrint ((2, "IopWriteToDisk: Successfully wrote %d bytes.\n", WriteLength)); *McbBuffer = Mcb; return STATUS_SUCCESS; }

NTSTATUS IopWriteTriageDump (  IN ULONG  Fields, IN PDUMP_DRIVER_WRITE  DriverWriteRoutine, IN OUT PLARGE_INTEGER  Mcb, IN OUT PMDL  Mdl, IN ULONG  DriverTransferSize, IN PCONTEXT  Context, IN BYTE *  Buffer, IN ULONG  BufferSize, IN ULONG  ServicePackBuild, IN ULONG  TriageOptions )

Definition at line 2795 of file dumpctl.c. References ALIGN_8, ALIGN_UP, ASSERT, Buffer, BufferSize, DriverEntry(), DWORD, IndexByByte, _KTHREAD::InitialStack, IoDebugPrint, IopGetLoadedDriverInfo(), IopWriteDriverList(), IopWriteToDisk(), KeGetCurrentPrcb, KeGetCurrentThread, _KTHREAD::KernelStackResident, LPVOID, MAX_TRIAGE_STACK_SIZE, min, MmSizeOfTriageInformation(), MmSizeOfUnloadedDriverInformation(), MmWriteTriageInformation(), MmWriteUnloadedDriverInformation(), NT_SUCCESS, NTSTATUS(), NULL, Offset, PAGE_SIZE, PsGetCurrentProcess, PsGetCurrentThread, Status, and _ETHREAD::Tcb. Referenced by IoWriteCrashDump(). : Write the Triage-Dump to the MCB. Arguments: Fields - The set of fields that should be written. DriverWriteRoutine - The write routine for the driver. Mcb - Message Control Block where the data is to be written. Mdl - A MDL descrbing the data to be written (??). DriverTransferSize - The maximum transfer size for the driver. Context - The context. Buffer - The buffer to use as a scratch buffer. BufferSize - The size of the buffer. ServicePackBuild - Service Pack BuildNumber. TriageOptions - Triage Options. Return Values: STATUS_SUCCESS - On success. NTSTATUS - Otherwise. Comments: This function assumes that exactly one header page was written. --*/ { ULONG SizeOfSection; ULONG SizeOfStringData; ULONG DriverCount = 0; LPVOID Address = NULL; ULONG BytesToWrite = 0; ULONG_PTR BufferAddress = 0; NTSTATUS Status; ULONG_PTR Offset; ULONG_PTR StartOfStackRegion = 0; PTRIAGE_DUMP_HEADER TriageDumpHeader = NULL; PLDR_DATA_TABLE_ENTRY DriverEntry = NULL; PDUMP_DRIVER_ENTRY DumpImageArray = NULL; PDUMP_STRING DumpStringName = NULL; PETHREAD Thread = NULL; IoDebugPrint ((0, "[IopWriteTriageDump] BufferSize = %#x ServicePackBuild = %d\n", BufferSize, ServicePackBuild)); // // Setup the triage-dump header. // if (BufferSize < sizeof (TRIAGE_DUMP_HEADER) + sizeof (DWORD)) { return STATUS_NO_MEMORY; } TriageDumpHeader = (PTRIAGE_DUMP_HEADER) Buffer; RtlZeroMemory (TriageDumpHeader, sizeof (*TriageDumpHeader)); // // The normal dump header is of size PAGE_SIZE. // TriageDumpHeader->SizeOfDump = BufferSize + PAGE_SIZE; // // Adjust the BufferSize so we can write the final status DWORD at the // end. // BufferSize -= sizeof (DWORD); RtlZeroMemory (IndexByByte (Buffer, BufferSize), sizeof (DWORD)); TriageDumpHeader->ValidOffset = ( TriageDumpHeader->SizeOfDump - sizeof (ULONG) ); TriageDumpHeader->ContextOffset = DH_CONTEXT_RECORD * sizeof (ULONG); TriageDumpHeader->ExceptionOffset = DH_EXCEPTION_RECORD * sizeof (ULONG); TriageDumpHeader->BrokenDriverOffset = 0; TriageDumpHeader->ServicePackBuild = ServicePackBuild; TriageDumpHeader->TriageOptions = TriageOptions; Offset = ALIGN_8 (PAGE_SIZE + sizeof (TRIAGE_DUMP_HEADER)); // // Set the Mm Offset, if necessary. // SizeOfSection = ALIGN_8 (MmSizeOfTriageInformation()); if (Offset + SizeOfSection < BufferSize) { TriageDumpHeader->MmOffset = (ULONG)Offset; Offset += SizeOfSection; } // // Set the Unloaded Drivers Offset, if necessary. // SizeOfSection = ALIGN_8 (MmSizeOfUnloadedDriverInformation()); if (Offset + SizeOfSection < BufferSize) { TriageDumpHeader->UnloadedDriversOffset = (ULONG)Offset; Offset += SizeOfSection; } // // Set the Prcb Offset, if necessary. // if (Fields & TRIAGE_DUMP_PRCB) { SizeOfSection = ALIGN_8 (sizeof (KPRCB)); if (Offset + SizeOfSection < BufferSize) { TriageDumpHeader->PrcbOffset = (ULONG)Offset; Offset += SizeOfSection; } } // // Set the Process Offset, if necessary. // if (Fields & TRIAGE_DUMP_PROCESS) { SizeOfSection = ALIGN_8 (sizeof (EPROCESS)); if (Offset + SizeOfSection < BufferSize) { TriageDumpHeader->ProcessOffset = (ULONG)Offset; Offset += SizeOfSection; } } // // Set the Thread Offset, if necessary. // if (Fields & TRIAGE_DUMP_THREAD) { SizeOfSection = ALIGN_8 (sizeof (ETHREAD)); if (Offset + SizeOfSection < BufferSize) { TriageDumpHeader->ThreadOffset = (ULONG)Offset; Offset += SizeOfSection; } } // // Set the CallStack Offset, if necessary. // Thread = PsGetCurrentThread (); if (Fields & TRIAGE_DUMP_STACK) { // // If there is a stack, calculate its size. // if (Thread->Tcb.KernelStackResident) { ULONG_PTR StackBase; StackBase = (ULONG_PTR) Thread->Tcb.InitialStack; ASSERT ( StackBase > STACK_POINTER (Context)); // // There is a valid stack. Note that we limit the size of // the triage dump stack to MAX_TRIAGE_STACK_SIZE (currently // 16 KB). // StartOfStackRegion = (ULONG_PTR) STACK_POINTER (Context); SizeOfSection = (ULONG) min ( StackBase - (ULONG_PTR) STACK_POINTER (Context), MAX_TRIAGE_STACK_SIZE ); ASSERT ( StartOfStackRegion + SizeOfSection <= StackBase); } else { // // There is not a valid stack. // SizeOfSection = 0; } if (SizeOfSection && Offset + SizeOfSection < BufferSize) { TriageDumpHeader->CallStackOffset = (ULONG)Offset; TriageDumpHeader->SizeOfCallStack = SizeOfSection; TriageDumpHeader->BaseOfStack = (ULONG) StartOfStackRegion; Offset += SizeOfSection; } } // // Set the Driver List Offset, if necessary. // Status = IopGetLoadedDriverInfo (&DriverCount, &SizeOfStringData); if (NT_SUCCESS (Status) && Fields & TRIAGE_DUMP_DRIVER_LIST) { SizeOfSection = ALIGN_8 (DriverCount * sizeof (DUMP_DRIVER_ENTRY)); if (SizeOfSection && (Offset + SizeOfSection < BufferSize)) { TriageDumpHeader->DriverListOffset = (ULONG)Offset; TriageDumpHeader->DriverCount = DriverCount; Offset += SizeOfSection; } } else { SizeOfSection = 0; SizeOfStringData = 0; } // // Set the String Pool offset. // SizeOfSection = ALIGN_8 (SizeOfStringData + DriverCount * (sizeof (WCHAR) + sizeof (DUMP_STRING))); if (SizeOfSection && (Offset + SizeOfSection < BufferSize)) { TriageDumpHeader->StringPoolOffset = (ULONG)Offset; TriageDumpHeader->StringPoolSize = SizeOfSection; Offset += SizeOfSection; } BytesToWrite = (ULONG)Offset; BufferAddress = ((ULONG_PTR) Buffer) - PAGE_SIZE ; // // Write the Mm information. // if (TriageDumpHeader->MmOffset) { Address = (LPVOID) (BufferAddress + TriageDumpHeader->MmOffset); MmWriteTriageInformation (Address); } if (TriageDumpHeader->UnloadedDriversOffset) { Address = (LPVOID) (BufferAddress + TriageDumpHeader->UnloadedDriversOffset); MmWriteUnloadedDriverInformation (Address); } // // Write the PRCB. // if (TriageDumpHeader->PrcbOffset) { Address = (LPVOID) (BufferAddress + TriageDumpHeader->PrcbOffset); RtlCopyMemory (Address, KeGetCurrentPrcb (), sizeof (KPRCB) ); } // // Write the EPROCESS. // if (TriageDumpHeader->ProcessOffset) { Address = (LPVOID) (BufferAddress + TriageDumpHeader->ProcessOffset); RtlCopyMemory (Address, PsGetCurrentProcess (), sizeof (EPROCESS) ); } // // Write the ETHREAD. // if (TriageDumpHeader->ThreadOffset) { Address = (LPVOID) (BufferAddress + TriageDumpHeader->ThreadOffset); RtlCopyMemory (Address, KeGetCurrentThread (), sizeof (ETHREAD) ); } // // Write the Call Stack. // if (TriageDumpHeader->CallStackOffset) { ASSERT (Thread); ASSERT (TriageDumpHeader->SizeOfCallStack != 0); Address = (LPVOID) (BufferAddress + TriageDumpHeader->CallStackOffset); RtlCopyMemory (Address, (PVOID) StartOfStackRegion, TriageDumpHeader->SizeOfCallStack ); } // // Write the Driver List. // if (TriageDumpHeader->DriverListOffset && TriageDumpHeader->StringPoolOffset) { Status = IopWriteDriverList (BufferAddress, BufferSize, TriageDumpHeader->DriverListOffset, TriageDumpHeader->StringPoolOffset ); if (!NT_SUCCESS (Status)) { TriageDumpHeader->DriverListOffset = 0; } } ASSERT (BytesToWrite < BufferSize); ASSERT (ALIGN_UP (BytesToWrite, PAGE_SIZE) < BufferSize); IoDebugPrint ((3, "TRIAGEDUMP: Calling IopWriteToDisk with:\n" "\tBytesToWrite = %#x\n" "\tBytesToWrite (Aligned) = %#x\n" "\tBufferSize = %#x\n", BytesToWrite, ALIGN_UP (BytesToWrite, PAGE_SIZE), BufferSize)); // // Write the valid status to the end of the dump. // *((ULONG *)IndexByByte (Buffer, BufferSize)) = TRIAGE_DUMP_VALID ; // // Re-adjust the buffer size. // BufferSize += sizeof (DWORD); // // NOTE: This routine writes the entire buffer, even if it is not // all required. // Status = IopWriteToDisk (Buffer, BufferSize, DriverWriteRoutine, &Mcb, Mdl, DriverTransferSize ); return Status; }

NTSTATUS IopWriteTriageDump (  IN ULONG  FieldsToWrite, IN PDUMP_DRIVER_WRITE  WriteRoutine, IN OUT PLARGE_INTEGER  Mcb, IN OUT PMDL  Mdl, IN ULONG  DiverTransferSize, IN PCONTEXT  Context, IN LPBYTE  Buffer, IN ULONG  BufferSize, IN ULONG  ServicePackBuild, IN ULONG  TriageOptions )

NTSTATUS IoSetCrashDumpState (  IN SYSTEM_CRASH_STATE_INFORMATION *  pDumpState  )

Referenced by NtSetSystemInformation().

NTSTATUS IoSetDumpRange (  IN PVOID  DumpContext, IN PVOID  StartVa, IN ULONG_PTR  Pages, IN BOOLEAN  IsPhysicalAddress )

Definition at line 2291 of file dumpctl.c. References ASSERT, FALSE, IopAddPageToPageMap(), MmGetPhysicalAddress(), MmIsAddressValid(), PAGE_SHIFT, PAGE_SIZE, and TRUE. Referenced by IopCreateSummaryDump(), and MmSetKernelDumpRange(). : This routine includes this range of memory in the dump Arguments: DumpContext - dump context StartVa - Starting VA Pages - The number of pages to include IsPhysicalAddress - true if direct physical address translation Return Value: STATUS_SUCCESS - On success. NTSTATUS - Error. --*/ { PCHAR Va; PRTL_BITMAP pBitMapHeader; PHYSICAL_ADDRESS phyAddr; PSUMMARY_DUMP_HEADER pHeader; BOOLEAN AllPagesSet; Va = StartVa; pHeader = (PSUMMARY_DUMP_HEADER) DumpContext; pBitMapHeader = (PRTL_BITMAP)(pHeader + 1); AllPagesSet = TRUE; // // Win64 can have really large page addresses. This dump code does // not handle that yet. Note that before this assert is removed // the casts of Pages to ULONG must be removed. // ASSERT(Pages <= MAXULONG); // // IsPhysicalAddress indicates that the va is virtually / physically // contiguous. // if (IsPhysicalAddress) { phyAddr = MmGetPhysicalAddress (Va); IopAddPageToPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)(phyAddr.QuadPart >> PAGE_SHIFT), (ULONG) Pages ); } else { // // Not physically contiguous. // while (Pages) { // // Only do a translation for valid pages. // if ( MmIsAddressValid(Va) ) { // // Get the physical mapping. Note: this does not require a lock // phyAddr = MmGetPhysicalAddress (Va); IopAddPageToPageMap (pHeader->BitmapSize, pBitMapHeader, (ULONG)(phyAddr.QuadPart >> PAGE_SHIFT), 1); if (phyAddr.QuadPart >> PAGE_SHIFT > pHeader->BitmapSize) { AllPagesSet = FALSE; } } Va += PAGE_SIZE; Pages--; } } if (AllPagesSet) { return STATUS_SUCCESS; } return STATUS_INVALID_ADDRESS; }

BOOLEAN IoWriteCrashDump (  IN ULONG  BugCheckCode, IN ULONG_PTR  BugCheckParameter1, IN ULONG_PTR  BugCheckParameter2, IN ULONG_PTR  BugCheckParameter3, IN ULONG_PTR  BugCheckParameter4, IN PVOID  ContextSave )

Definition at line 1519 of file dumpctl.c. References ASSERT, _PHYSICAL_MEMORY_RUN::BasePage, BitMap, _DUMP_CONTROL_BLOCK::BuildNumber, _MDL::ByteCount, _MDL::ByteOffset, DCB_AUTO_REBOOT, DCB_DUMP_ENABLED, DCB_DUMP_HEADER_ENABLED, DCB_SUMMARY_DUMP_ENABLED, DCB_SUMMARY_ENABLED, DCB_TRIAGE_DUMP_ENABLED, _DUMP_CONTROL_BLOCK::DumpStack, EXCEPTION_NONCONTINUABLE, FALSE, _DUMP_CONTROL_BLOCK::FileDescriptorArray, _DUMP_CONTROL_BLOCK::Flags, HalRebootRoutine, _DUMP_CONTROL_BLOCK::HeaderPage, _DUMP_CONTROL_BLOCK::HeaderPfn, _DUMP_CONTROL_BLOCK::HeaderSize, InbvDisplayString(), IO_DUMP_MAXIMUM_TRANSFER_SIZE, IO_DUMP_MINIMUM_TRANSFER_SIZE, IoDebugPrint, IoInitializeDumpStack(), IopDumpControlBlock, IopDumpControlBlockChecksum, IopFinalCrashDumpStatus, IopGetDumpControlBlockCheck(), IopInitializeDumpSpaceAndType(), IopInitializeSummaryDump(), IopMapPhysicalMemory(), IopWriteSummaryDump(), IopWriteSummaryHeader(), IopWriteTriageDump(), KdGetDataBlock(), KeGetCurrentThread, KeReturnToFirmware(), _DUMP_CONTROL_BLOCK::MajorVersion, _MDL::MappedSystemVa, MDL_MAPPED_TO_SYSTEM_VA, MDL_PAGES_LOCKED, _MDL::MdlFlags, _DUMP_CONTROL_BLOCK::MemoryDescriptor, _DUMP_CONTROL_BLOCK::MinorVersion, MmCreateMdl(), MmGetMdlPfnArray, MmPfnDatabase, NT_SUCCESS, NTSTATUS(), NULL, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfPages, _PHYSICAL_MEMORY_DESCRIPTOR::NumberOfRuns, _DUMP_CONTROL_BLOCK::NumberProcessors, PAGE_ALIGN, PAGE_SIZE, PDUMP_DRIVER_FINISH, PDUMP_DRIVER_WRITE, PDUMP_STACK_CONTEXT, PHYSICAL_MEMORY_DESCRIPTOR, PsActiveProcessHead, PsLoadedModuleList, _PHYSICAL_MEMORY_DESCRIPTOR::Run, sprintf(), _MDL::StartVa, _DUMP_CONTROL_BLOCK::TriageDumpBuffer, _DUMP_CONTROL_BLOCK::TriageDumpBufferSize, _DUMP_CONTROL_BLOCK::TriageDumpFlags, TRUE, and _DUMP_CONTROL_BLOCK::VersionUser. Referenced by KeBugCheckEx(). : This routine checks to see whether or not crash dumps are enabled and, if so, writes all of physical memory to the system disk's paging file. Arguments: BugCheckCode/ParameterN - Code and parameters w/which BugCheck was called. Return Value: None. --*/ { PDUMP_CONTROL_BLOCK dcb; PDUMP_STACK_CONTEXT dumpStack; PDUMP_DRIVER_WRITE write; PDUMP_DRIVER_FINISH finishUp; PDUMP_HEADER header; EXCEPTION_RECORD exception; PCONTEXT context = ContextSave; PULONG block; LARGE_INTEGER diskByteOffset; PPFN_NUMBER page; PFN_NUMBER localMdl[(sizeof( MDL )/sizeof(PFN_NUMBER)) + 17]; PMDL mdl; PLARGE_INTEGER mcb; ULONG_PTR memoryAddress; ULONG byteOffset; ULONG byteCount; ULONG bytesRemaining; NTSTATUS status; UCHAR messageBuffer[128]; PFN_NUMBER ActualPages; PSUMMARY_DUMP_HEADER pSummaryHeader; ULONG dwTransferSize; LARGE_INTEGER requiredDumpSpace; ULONG_PTR DirBasePage; // // Begin by determining whether or not crash dumps are enabled. If not, // check to see whether or not auto-rebooting is enabled. If not, return // immediately since there is nothing to do. // dcb = IopDumpControlBlock; if (!dcb) { return FALSE; } if (dcb->Flags & DCB_DUMP_ENABLED || dcb->Flags & DCB_SUMMARY_ENABLED) { IopFinalCrashDumpStatus = STATUS_PENDING; // // A dump is to be written to the paging file. Ensure that all of the // descriptor data for what needs to be done is valid, otherwise it // could be that part of the reason for the bugcheck is that this data // was corrupted. Or, it could be that no paging file was found yet, // or any number of other situations. // if (IopGetDumpControlBlockCheck(dcb) != IopDumpControlBlockChecksum) { IoDebugPrint (( 0, "CRASHDUMP: Disk dump routine returning due to DCB integrity error\n" " No dump will be created\n" )); IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } // // Message that we are starting the crashdump // dumpStack = dcb->DumpStack; sprintf( messageBuffer, "%Z\n", &dumpStack->InitMsg ); // // Initialize the dump stack // status = IoInitializeDumpStack (dumpStack, messageBuffer); if (!NT_SUCCESS( status )) { IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } // // Record the dump driver's entry points. // write = dumpStack->Init.WriteRoutine; finishUp = dumpStack->Init.FinishRoutine; dwTransferSize = dumpStack->Init.MaximumTransferSize; if ( ( !dwTransferSize ) || ( dwTransferSize > IO_DUMP_MAXIMUM_TRANSFER_SIZE ) ) { dwTransferSize = IO_DUMP_MINIMUM_TRANSFER_SIZE; } IoDebugPrint((2,"CRASHDUMP: Maximum Transfer Size = %x\n",dwTransferSize)); // // The boot partition was found, so put together a dump file header // and write it to the disk. // block = dcb->HeaderPage; header = (PDUMP_HEADER) block; RtlFillMemoryUlong( header, PAGE_SIZE, 'EGAP' ); header->ValidDump = 'PMUD'; header->BugCheckCode = BugCheckCode; header->BugCheckParameter1 = BugCheckParameter1; header->BugCheckParameter2 = BugCheckParameter2; header->BugCheckParameter3 = BugCheckParameter3; header->BugCheckParameter4 = BugCheckParameter4; #if defined (i386) // // Add the current page directory table page - don't use the directory // table base for the crashing process as we have switched cr3 on // stack overflow crashes, etc. // _asm { mov eax, cr3 mov DirBasePage, eax } header->DirectoryTableBase = DirBasePage; #else header->DirectoryTableBase = KeGetCurrentThread()->ApcState.Process->DirectoryTableBase[0]; #endif header->PfnDataBase = MmPfnDatabase; header->PsLoadedModuleList = &PsLoadedModuleList; header->PsActiveProcessHead = &PsActiveProcessHead; header->NumberProcessors = dcb->NumberProcessors; header->MajorVersion = dcb->MajorVersion; header->MinorVersion = dcb->MinorVersion; header->KdDebuggerDataBlock = KdGetDataBlock(); header->PaeEnabled = PaeEnabled (); header->MachineImageType = CURRENT_IMAGE_TYPE (); if (!(dcb->Flags & DCB_DUMP_ENABLED)) { dcb->MemoryDescriptor->NumberOfPages = 1; } strcpy( header->VersionUser, dcb->VersionUser ); RtlCopyMemory( &block[DH_PHYSICAL_MEMORY_BLOCK], dcb->MemoryDescriptor, sizeof( PHYSICAL_MEMORY_DESCRIPTOR ) + ((dcb->MemoryDescriptor->NumberOfRuns - 1) * sizeof( PHYSICAL_MEMORY_RUN )) ); RtlCopyMemory( &block[DH_CONTEXT_RECORD], context, sizeof( CONTEXT ) ); exception.ExceptionCode = STATUS_BREAKPOINT; exception.ExceptionRecord = (PEXCEPTION_RECORD) NULL; exception.NumberParameters = 0; exception.ExceptionFlags = EXCEPTION_NONCONTINUABLE; exception.ExceptionAddress = (PVOID) PROGRAM_COUNTER (context); RtlCopyMemory( &block[DH_EXCEPTION_RECORD], &exception, sizeof( EXCEPTION_RECORD ) ); // // Init dump type to FULL // block[DH_DUMP_TYPE] = DUMP_TYPE_FULL; // // Set the timestamp // #ifdef _WIN64 RtlCopyMemory( &block[DH_CRASH_DUMP_TIMESTAMP], (PCHAR)( &SharedUserData->SystemLowTime), sizeof( LARGE_INTEGER) ); #else RtlCopyMemory( &block[DH_CRASH_DUMP_TIMESTAMP], (PCHAR)( &SharedUserData->SystemTime), sizeof( LARGE_INTEGER) ); #endif // // Set the Required dump size in the dump header. In the case of // a summary dump the file allocation size can be significantly larger // then the amount of used space. // RtlZeroMemory( &block[DH_REQUIRED_DUMP_SPACE], sizeof(LARGE_INTEGER)); if (dcb->Flags & DCB_DUMP_ENABLED) { // // If summary dump try to create the dump header // if ( (dcb->Flags & DCB_SUMMARY_DUMP_ENABLED) ) { // // Initialize the summary dump // pSummaryHeader = IopInitializeSummaryDump(dcb); if ( !pSummaryHeader ) { // // No summary dump header so return. // IoDebugPrint((1,"IoWriteCrashDump: Error Null summary dump header\n")); IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } } IopInitializeDumpSpaceAndType (dcb, block, pSummaryHeader); } // // All of the pieces of the header file have been generated. Before // mapping or writing anything to the disk, the I- & D-stream caches // must be flushed so that page color coherency is kept. Sweep both // caches now. // KeSweepCurrentDcache(); KeSweepCurrentIcache(); // // Create MDL for dump. // mdl = (PMDL) &localMdl[0]; MmCreateMdl( mdl, NULL, PAGE_SIZE ); mdl->MdlFlags |= MDL_PAGES_LOCKED; mcb = dcb->FileDescriptorArray; page = MmGetMdlPfnArray(mdl); *page = dcb->HeaderPfn; mdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA; bytesRemaining = PAGE_SIZE; memoryAddress = (ULONG_PTR) dcb->HeaderPage; // // All of the pieces of the header file have been generated. Write // the header page to the paging file, using the appropriate drivers, // etc. // IoDebugPrint((2,"IoWriteCrashDump: Writing dump header to disk\n")); while (bytesRemaining) { if (mcb[0].QuadPart <= bytesRemaining) { byteCount = mcb[0].LowPart; } else { byteCount = bytesRemaining; } mdl->ByteCount = byteCount; mdl->ByteOffset = (ULONG)(memoryAddress & (PAGE_SIZE - 1)); mdl->MappedSystemVa = (PVOID) memoryAddress; mdl->StartVa = PAGE_ALIGN ((PVOID)memoryAddress); // // Write to disk. // if (!NT_SUCCESS( write( &mcb[1], mdl ) )) { IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } // // Adjust bytes remaining. // bytesRemaining -= byteCount; memoryAddress += byteCount; mcb[0].QuadPart = mcb[0].QuadPart - byteCount; mcb[1].QuadPart = mcb[1].QuadPart + byteCount; if (!mcb[0].QuadPart) { mcb += 2; } } IoDebugPrint((2,"IoWriteCrashDump: Header Page written\n")); // // If only requesting a header dump, we are now done. // if (dcb->Flags & DCB_DUMP_HEADER_ENABLED) { IoDebugPrint((2,"IoWriteCrashDump: Only Dumping Dump Header\n")); goto FinishDump; } // // The header page has been written. If this is a triage-dump, write // the dump information and bail. Otherwise, fall through and do the // full or summary dump. // if (dcb->Flags & DCB_TRIAGE_DUMP_ENABLED) { status = IopWriteTriageDump (dcb->TriageDumpFlags, write, mcb, mdl, dwTransferSize, context, dcb->TriageDumpBuffer, dcb->TriageDumpBufferSize - PAGE_SIZE, dcb->BuildNumber, dcb->Flags ); if (!NT_SUCCESS (status)) { IoDebugPrint((1, "IoWriteCrashDump: Failed to write triage-dump\n")); IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } IoDebugPrint((1, "IoWriteCrashDump: Successfully wrote triage-dump\n")); goto FinishDump; } // // The header page has been written to the paging file. If a full dump // of all of physical memory is to be written, write it now. // if (dcb->Flags & DCB_DUMP_ENABLED) { PFN_NUMBER pagesDoneSoFar = 0; ULONG currentPercentage = 0; ULONG maximumPercentage = 0; // // Actual Pages is the number of pages to dump. // ActualPages = dcb->MemoryDescriptor->NumberOfPages; if (dcb->Flags & DCB_SUMMARY_DUMP_ENABLED) { PRTL_BITMAP PageMap; ASSERT ( pSummaryHeader != NULL ); PageMap = (PRTL_BITMAP)(pSummaryHeader + 1); ASSERT (PageMap != NULL); // // At this point the dump header header has been sucessfully // written. Write the summary dump header. // status = IopWriteSummaryHeader( pSummaryHeader, write, &mcb, mdl, dwTransferSize, (dcb->HeaderSize - PAGE_SIZE) ); if (!NT_SUCCESS (status)) { IoDebugPrint((1,"IoWriteCrashDump: Error writing summary dump header\n")); IopFinalCrashDumpStatus = status; return FALSE; } IoDebugPrint((2,"IoWriteCrashDump: Sucessfully wrote summary dump header\n")); ActualPages = pSummaryHeader->Pages; } IoDebugPrint((2,"IoWriteCrashDump: Writing Memory Dump\n")); // // Set the virtual file offset and initialize loop variables and // constants. // memoryAddress = (ULONG_PTR)dcb->MemoryDescriptor->Run[0].BasePage * PAGE_SIZE; if ( dcb->Flags & DCB_SUMMARY_DUMP_ENABLED ) { PRTL_BITMAP BitMap; BitMap = (PRTL_BITMAP)(pSummaryHeader+1); status = IopWriteSummaryDump ( BitMap, write, &dumpStack->ProgMsg, messageBuffer, mcb, dwTransferSize ); if (!NT_SUCCESS (status)) { IoDebugPrint((1, "IoWriteCrashDump: Failed to write triage-dump\n")); IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } IoDebugPrint((1, "IoWriteCrashDump: Successfully wrote triage-dump\n")); goto FinishDump; } // // Now loop, writing all of physical memory to the paging file. // while (mcb[0].QuadPart) { diskByteOffset = mcb[1]; // // Calculate byte offset; // byteOffset = (ULONG)(memoryAddress & (PAGE_SIZE - 1)); if (dwTransferSize <= mcb[0].QuadPart) { byteCount = dwTransferSize - byteOffset; } else { byteCount = mcb[0].LowPart; } pagesDoneSoFar += byteCount / PAGE_SIZE; currentPercentage = (ULONG)((pagesDoneSoFar * 100) / ActualPages); if (currentPercentage > maximumPercentage) { maximumPercentage = currentPercentage; // // Update message on screen. // sprintf( messageBuffer, "%Z: %3d\r", &dumpStack->ProgMsg, maximumPercentage ); InbvDisplayString( messageBuffer ); } // // Map the physical memory and write it to the // current segment of the file. // IopMapPhysicalMemory( mdl, memoryAddress, &dcb->MemoryDescriptor->Run[0], byteCount ); // // Write the next segment. // if (!NT_SUCCESS( write( &diskByteOffset, mdl ) )) { IopFinalCrashDumpStatus = STATUS_UNSUCCESSFUL; return FALSE; } // // Adjust pointers for next part. // memoryAddress += byteCount; mcb[0].QuadPart = mcb[0].QuadPart - byteCount; mcb[1].QuadPart = mcb[1].QuadPart + byteCount; if (!mcb[0].QuadPart) { mcb += 2; } if (pagesDoneSoFar >= ActualPages) { break; } } IoDebugPrint((2,"IoWriteCrashDump: memory dump written\n")); } FinishDump: sprintf( messageBuffer, "%Z", &dumpStack->DoneMsg ); InbvDisplayString( messageBuffer ); // // Sweep the cache so the debugger will work. // KeSweepCurrentDcache(); KeSweepCurrentIcache(); // // Have the dump flush the adapter and disk caches. // finishUp(); // // Indicate to the debugger that the dump has been successfully // written. // IopFinalCrashDumpStatus = STATUS_SUCCESS; } // // Check to see whether or not auto-reboots are enabled and, if so, // reboot now. // if (dcb->Flags & DCB_AUTO_REBOOT) { IoDebugPrint (( 0, "IODUMP: Autorebooting\n" )); KeReturnToFirmware( HalRebootRoutine ); } return TRUE; }

---

Variable Documentation

ULONG IopCrashDumpStateChange = 0

Definition at line 79 of file dumpctl.c. Referenced by IoSetCrashDumpState().

BOOLEAN IopDumpFileContainsNewDump = FALSE

Definition at line 80 of file dumpctl.c.

NTSTATUS IopFinalCrashDumpStatus = -1

Definition at line 78 of file dumpctl.c. Referenced by IoWriteCrashDump().

PFN_NUMBER MmHighestPossiblePhysicalPage

Definition at line 76 of file dumpctl.c. Referenced by MiCleanPhysicalProcessPages(), MiInitMachineDependent(), MmAddPhysicalMemory(), MmRemovePhysicalMemory(), MmSetKernelDumpRange(), and NtAllocateUserPhysicalPages().

PVOID MmPfnDatabase

Definition at line 75 of file dumpctl.c. Referenced by IoWriteCrashDump(), MiCheckForCrashDump(), MiFreePoolPages(), MiInitMachineDependent(), MiRemovePhysicalPages(), MiUnlinkFreeOrZeroedPage(), MiUnlinkPageFromList(), MmAddPhysicalMemory(), MmAllocatePagesForMdl(), MmRemovePhysicalMemory(), and MmSetKernelDumpRange().

---