singrdk/base/Windows/Inc/Dump.h

389 lines
12 KiB
C
Raw Normal View History

2008-03-05 09:52:00 -05:00
////////////////////////////////////////////////////////////////////////////////
//
// Microsoft Research Singularity
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//
// File: Dump.h
//
// Note: Constants and types for kernel dump files.
//
#pragma warning(push)
#pragma warning(disable : 4200) // don't warn about zero-sized array in struct/union
#ifdef __cplusplus
extern "C" {
#endif
#define USERMODE_CRASHDUMP_SIGNATURE 'RESU'
#define USERMODE_CRASHDUMP_VALID_DUMP32 'PMUD'
#define USERMODE_CRASHDUMP_VALID_DUMP64 '46UD'
typedef struct _USERMODE_CRASHDUMP_HEADER64 {
ULONG Signature;
ULONG ValidDump;
ULONG MajorVersion;
ULONG MinorVersion;
ULONG MachineImageType;
ULONG ThreadCount;
ULONG ModuleCount;
ULONG MemoryRegionCount;
ULONGLONG ThreadOffset;
ULONGLONG ModuleOffset;
ULONGLONG DataOffset;
ULONGLONG MemoryRegionOffset;
ULONGLONG DebugEventOffset;
ULONGLONG ThreadStateOffset;
ULONGLONG VersionInfoOffset;
ULONGLONG Spare1;
} USERMODE_CRASHDUMP_HEADER64, *PUSERMODE_CRASHDUMP_HEADER64;
typedef struct _CRASH_MODULE64 {
ULONGLONG BaseOfImage;
ULONG SizeOfImage;
ULONG ImageNameLength;
CHAR ImageName[0];
} CRASH_MODULE64, *PCRASH_MODULE64;
typedef struct _CRASH_THREAD64 {
ULONG ThreadId;
ULONG SuspendCount;
ULONG PriorityClass;
ULONG Priority;
ULONGLONG Teb;
ULONGLONG Spare0;
ULONGLONG Spare1;
ULONGLONG Spare2;
ULONGLONG Spare3;
ULONGLONG Spare4;
ULONGLONG Spare5;
ULONGLONG Spare6;
} CRASH_THREAD64, *PCRASH_THREAD64;
typedef struct _CRASHDUMP_VERSION_INFO {
int IgnoreGuardPages; // Whether we should ignore GuardPages or not
ULONG PointerSize; // 32, 64 bit pointers
} CRASHDUMP_VERSION_INFO, *PCRASHDUMP_VERSION_INFO;
//
// usermode crash dump data types
//
#define DMP_EXCEPTION 1 // obsolete
#define DMP_MEMORY_BASIC_INFORMATION 2
#define DMP_THREAD_CONTEXT 3
#define DMP_MODULE 4
#define DMP_MEMORY_DATA 5
#define DMP_DEBUG_EVENT 6
#define DMP_THREAD_STATE 7
#define DMP_DUMP_FILE_HANDLE 8
//
// Define the information required to process memory dumps.
//
typedef enum _DUMP_TYPES {
DUMP_TYPE_INVALID = -1,
DUMP_TYPE_UNKNOWN = 0,
DUMP_TYPE_FULL = 1,
DUMP_TYPE_SUMMARY = 2,
DUMP_TYPE_HEADER = 3,
DUMP_TYPE_TRIAGE = 4,
} DUMP_TYPE;
//
// Signature and Valid fields.
//
#define DUMP_SIGNATURE32 ('EGAP')
#define DUMP_VALID_DUMP32 ('PMUD')
#define DUMP_SIGNATURE64 ('EGAP')
#define DUMP_VALID_DUMP64 ('46UD')
#define DUMP_SUMMARY_SIGNATURE ('PMDS')
#define DUMP_SUMMARY_VALID ('PMUD')
#define DUMP_SUMMARY_VALID_KERNEL_VA (1)
#define DUMP_SUMMARY_VALID_CURRENT_USER_VA (2)
//
//
// NOTE: The definition of PHYISCAL_MEMORY_RUN and PHYSICAL_MEMORY_DESCRIPTOR
// MUST be the same as in mm.h. The kernel portion of crashdump will
// verify that these structs are the same.
//
typedef struct _PHYSICAL_MEMORY_RUN64 {
ULONG64 BasePage;
ULONG64 PageCount;
} PHYSICAL_MEMORY_RUN64, *PPHYSICAL_MEMORY_RUN64;
typedef struct _PHYSICAL_MEMORY_DESCRIPTOR64 {
ULONG NumberOfRuns;
ULONG64 NumberOfPages;
PHYSICAL_MEMORY_RUN64 Run[1];
} PHYSICAL_MEMORY_DESCRIPTOR64, *PPHYSICAL_MEMORY_DESCRIPTOR64;
typedef struct _UNLOADED_DRIVERS64 {
UNICODE_STRING64 Name;
ULONG64 StartAddress;
ULONG64 EndAddress;
LARGE_INTEGER CurrentTime;
} UNLOADED_DRIVERS64, *PUNLOADED_DRIVERS64;
#define MAX_UNLOADED_NAME_LENGTH 24
typedef struct _DUMP_UNLOADED_DRIVERS64
{
UNICODE_STRING64 Name;
WCHAR DriverName[MAX_UNLOADED_NAME_LENGTH / sizeof (WCHAR)];
ULONG64 StartAddress;
ULONG64 EndAddress;
} DUMP_UNLOADED_DRIVERS64, *PDUMP_UNLOADED_DRIVERS64;
typedef struct _DUMP_MM_STORAGE64
{
ULONG Version;
ULONG Size;
ULONG MmSpecialPoolTag;
ULONG MiTriageActionTaken;
ULONG MmVerifyDriverLevel;
ULONG KernelVerifier;
ULONG64 MmMaximumNonPagedPool;
ULONG64 MmAllocatedNonPagedPool;
ULONG64 PagedPoolMaximum;
ULONG64 PagedPoolAllocated;
ULONG64 CommittedPages;
ULONG64 CommittedPagesPeak;
ULONG64 CommitLimitMaximum;
} DUMP_MM_STORAGE64, *PDUMP_MM_STORAGE64;
//
// Define the dump header structure. You cannot change these
// defines without breaking the debuggers, so don't.
//
#define DMP_PHYSICAL_MEMORY_BLOCK_SIZE_32 (700)
#define DMP_CONTEXT_RECORD_SIZE_32 (1200)
#define DMP_RESERVED_0_SIZE_32 (1768)
#define DMP_RESERVED_2_SIZE_32 (16)
#define DMP_RESERVED_3_SIZE_32 (56)
#define DMP_PHYSICAL_MEMORY_BLOCK_SIZE_64 (700)
#define DMP_CONTEXT_RECORD_SIZE_64 (3000)
#define DMP_RESERVED_0_SIZE_64 (4016)
#define DMP_HEADER_COMMENT_SIZE (128)
// Unset WriterStatus value from the header fill.
#define DUMP_WRITER_STATUS_UNINITIALIZED DUMP_SIGNATURE32
// WriterStatus codes for the dbgeng.dll dump writers.
enum
{
DUMP_DBGENG_SUCCESS,
DUMP_DBGENG_NO_MODULE_LIST,
DUMP_DBGENG_CORRUPT_MODULE_LIST,
};
typedef struct _DUMP_HEADER64 {
ULONG Signature;
ULONG ValidDump;
ULONG MajorVersion;
ULONG MinorVersion;
ULONG64 DirectoryTableBase;
ULONG64 PfnDataBase;
ULONG64 PsLoadedModuleList;
ULONG64 PsActiveProcessHead;
ULONG MachineImageType;
ULONG NumberProcessors;
ULONG BugCheckCode;
ULONG64 BugCheckParameter1;
ULONG64 BugCheckParameter2;
ULONG64 BugCheckParameter3;
ULONG64 BugCheckParameter4;
CHAR VersionUser[32];
ULONG64 KdDebuggerDataBlock;
union {
PHYSICAL_MEMORY_DESCRIPTOR64 PhysicalMemoryBlock;
UCHAR PhysicalMemoryBlockBuffer [ DMP_PHYSICAL_MEMORY_BLOCK_SIZE_64 ];
};
UCHAR ContextRecord [ DMP_CONTEXT_RECORD_SIZE_64 ];
EXCEPTION_RECORD64 Exception;
ULONG DumpType;
LARGE_INTEGER RequiredDumpSpace;
LARGE_INTEGER SystemTime;
CHAR Comment [ DMP_HEADER_COMMENT_SIZE ]; // May not be present.
LARGE_INTEGER SystemUpTime;
ULONG MiniDumpFields;
ULONG SecondaryDataState;
ULONG ProductType;
ULONG SuiteMask;
ULONG WriterStatus;
UCHAR Unused1;
UCHAR KdSecondaryVersion; // Present only for W2K3 SP1 and better
UCHAR Unused[2];
UCHAR _reserved0[ DMP_RESERVED_0_SIZE_64 ];
} DUMP_HEADER64, *PDUMP_HEADER64;
typedef struct _FULL_DUMP64 {
CHAR Memory[1]; // Variable length to the end of the dump file.
} FULL_DUMP64, *PFULL_DUMP64;
//
// ISSUE - 2000/02/17 - math: NT64 Summary dump.
//
// This is broken. The 64 bit summary dump should have a ULONG64 for
// the BitmapSize to match the size of the PFN_NUMBER.
//
typedef struct _SUMMARY_DUMP64 {
ULONG Signature;
ULONG ValidDump;
ULONG DumpOptions; // Summary Dump Options
ULONG HeaderSize; // Offset to the start of actual memory dump
ULONG BitmapSize; // Total bitmap size (i.e., maximum #bits)
ULONG Pages; // Total bits set in bitmap (i.e., total pages in sdump)
//
// ISSUE - 2000/02/17 - math: Win64
//
// With a 64-bit PFN, we should not have a 32-bit bitmap.
//
//
// These next three fields essentially form an on-disk RTL_BITMAP structure.
// The RESERVED field is stupidness introduced by the way the data is
// serialized to disk.
//
struct {
ULONG SizeOfBitMap;
ULONG64 _reserved0;
ULONG Buffer[];
} Bitmap;
} SUMMARY_DUMP64, * PSUMMARY_DUMP64;
typedef struct _TRIAGE_DUMP64 {
ULONG ServicePackBuild; // What service pack of NT was this ?
ULONG SizeOfDump; // Size in bytes of the dump
ULONG ValidOffset; // Offset valid ULONG
ULONG ContextOffset; // Offset of CONTEXT record
ULONG ExceptionOffset; // Offset of EXCEPTION record
ULONG MmOffset; // Offset of Mm information
ULONG UnloadedDriversOffset; // Offset of Unloaded Drivers
ULONG PrcbOffset; // Offset of KPRCB
ULONG ProcessOffset; // Offset of EPROCESS
ULONG ThreadOffset; // Offset of ETHREAD
ULONG CallStackOffset; // Offset of CallStack Pages
ULONG SizeOfCallStack; // Size in bytes of CallStack
ULONG DriverListOffset; // Offset of Driver List
ULONG DriverCount; // Number of Drivers in list
ULONG StringPoolOffset; // Offset to the string pool
ULONG StringPoolSize; // Size of the string pool
ULONG BrokenDriverOffset; // Offset into the driver of the driver that crashed
ULONG TriageOptions; // Triage options in effect at crashtime
ULONG64 TopOfStack; // The top (highest address) of the callstack
//
// Architecture Specific fields.
//
union {
//
// For IA64 we need to store the BStore as well.
//
struct {
ULONG BStoreOffset; // Offset of BStore region.
ULONG SizeOfBStore; // The size of the BStore region.
ULONG64 LimitOfBStore; // The limit (highest memory address)
} Ia64; // of the BStore region.
} ArchitectureSpecific;
ULONG64 DataPageAddress;
ULONG DataPageOffset;
ULONG DataPageSize;
ULONG DebuggerDataOffset;
ULONG DebuggerDataSize;
ULONG DataBlocksOffset;
ULONG DataBlocksCount;
} TRIAGE_DUMP64, * PTRIAGE_DUMP64;
typedef struct _MEMORY_DUMP64 {
DUMP_HEADER64 Header;
union {
FULL_DUMP64 Full; // DumpType == DUMP_TYPE_FULL
SUMMARY_DUMP64 Summary; // DumpType == DUMP_TYPE_SUMMARY
TRIAGE_DUMP64 Triage; // DumpType == DUMP_TYPE_TRIAGE
};
} MEMORY_DUMP64, *PMEMORY_DUMP64;
typedef struct _TRIAGE_DATA_BLOCK {
ULONG64 Address;
ULONG Offset;
ULONG Size;
} TRIAGE_DATA_BLOCK, *PTRIAGE_DATA_BLOCK;
//
// In the triage dump ValidFields field what portions of the triage-dump have
// been turned on.
//
#define TRIAGE_DUMP_CONTEXT (0x0001)
#define TRIAGE_DUMP_EXCEPTION (0x0002)
#define TRIAGE_DUMP_PRCB (0x0004)
#define TRIAGE_DUMP_PROCESS (0x0008)
#define TRIAGE_DUMP_THREAD (0x0010)
#define TRIAGE_DUMP_STACK (0x0020)
#define TRIAGE_DUMP_DRIVER_LIST (0x0040)
#define TRIAGE_DUMP_BROKEN_DRIVER (0x0080)
#define TRIAGE_DUMP_BASIC_INFO (0x00FF)
#define TRIAGE_DUMP_MMINFO (0x0100)
#define TRIAGE_DUMP_DATAPAGE (0x0200)
#define TRIAGE_DUMP_DEBUGGER_DATA (0x0400)
#define TRIAGE_DUMP_DATA_BLOCKS (0x0800)
#define TRIAGE_OPTION_OVERFLOWED (0x0100)
#define TRIAGE_DUMP_VALID ( 'DGRT' )
#define TRIAGE_DUMP_SIZE32 ( 0x1000 * 16 )
#define TRIAGE_DUMP_SIZE64 ( 0x2000 * 16 )
//
// The DUMP_STRING is guaranteed to be both NULL terminated and length prefixed
// (prefix does not include the NULL).
//
typedef struct _DUMP_STRING {
ULONG Length; // Length IN BYTES of the string.
WCHAR Buffer [0]; // Buffer.
} DUMP_STRING, * PDUMP_STRING;
#ifdef __cplusplus
}
#endif
#pragma warning(pop)