mirror of
https://github.com/reactos/reactos.git
synced 2024-07-11 07:05:12 +00:00
4ce819ca5a
CORE-17470 + KdpDebugLogInit: Add resources cleanup in failure code paths. Fix, in an NT-compatible manner, how (and when) the KD/KDBG BootPhase >=2 initialization steps are performed. These are necessary for any functionality KDBG needs, that would depend on the NT I/O Manager and the storage and filesystem stacks to be running. This includes, creating the debug log file, and for KDBG, loading its KDBinit initialization file. As a result, file debug logging is fixed. The old ReactOS-specific (NT-incompatible) callback we did in the middle of IoInitSystem() is removed, in favor of a runtime mechanism that should work on Windows as well. The idea for this new mechanism is loosely inspired by the TDL4 rootkit, see http://blog.w4kfu.com/public/tdl4_article/draft_tdl4article.html but contrary to it, a specific hook is used instead, as well as the technique of driver reinitialization: https://web.archive.org/web/20211021050515/https://driverentry.com.br/en/blog/?p=261 Its rationale is as follows: We want to be able to perform I/O-related initialization (starting a logger thread for file log debugging, loading KDBinit file for KDBG, etc.). A good place for this would be as early as possible, once the I/O Manager has started the storage and the boot filesystem drivers. Here is an overview of the initialization steps of the NT Kernel and Executive: ---- KiSystemStartup(KeLoaderBlock) if (Cpu == 0) KdInitSystem(0, KeLoaderBlock); KiSwitchToBootStack() -> KiSystemStartupBootStack() -> KiInitializeKernel() -> ExpInitializeExecutive(Cpu, KeLoaderBlock) (NOTE: Any unexpected debugger break will call KdInitSystem(0, NULL); ) KdInitSystem(0, LoaderBlock) -> KdDebuggerInitialize0(LoaderBlock); ExpInitializeExecutive(Cpu == 0): ExpInitializationPhase = 0; HalInitSystem(0, KeLoaderBlock); <-- Sets HalInitPnpDriver callback. ... PsInitSystem(LoaderBlock) PsCreateSystemThread(Phase1Initialization) Phase1Initialization(Discard): ExpInitializationPhase = 1; HalInitSystem(1, KeLoaderBlock); ... Early initialization of Ob, Ex, Ke. KdInitSystem(1, KeLoaderBlock); ... KdDebuggerInitialize1(LoaderBlock); ... IoInitSystem(LoaderBlock); ... ---- As we can see, KdDebuggerInitialize1() is the last KD initialization routine the kernel calls, and is called *before* the I/O Manager starts. Thus, direct Nt/ZwCreateFile ... calls done there would fail. Also, we want to do the I/O initialization as soon as possible. There does not seem to be any exported way to be notified about the I/O manager initialization steps... that is, unless we somehow become a driver and insert ourselves in the flow! Since we are not a regular driver, we need to invoke IoCreateDriver() to create one. However, remember that we are currently running *before* IoInitSystem(), the I/O subsystem is not initialized yet. Due to this, calling IoCreateDriver(), much like any other IO functions, would lead to a crash, because it calls ObCreateObject(..., IoDriverObjectType, ...), and IoDriverObjectType is non-initialized yet (it's NULL). The chosen solution is to hook a "known" exported callback: namely, the HalInitPnpDriver() callback (it initializes the "HAL Root Bus Driver"). It is set very early on by the HAL via the HalInitSystem(0, ...) call, and is called early on by IoInitSystem() before any driver is loaded, but after the I/O Manager has been minimally set up so that new drivers can be created. When the hook: KdpInitDriver() is called, we create our driver with IoCreateDriver(), specifying its entrypoint KdpDriverEntry(), then restore and call the original HalInitPnpDriver() callback. Another possible unexplored alternative, could be to insert ourselves in the KeLoaderBlock->LoadOrderListHead boot modules list, or in the KeLoaderBlock->BootDriverListHead boot-driver list. (Note that while we may be able to do this, because boot-drivers are resident in memory, much like we are, we cannot insert ourselves in the system-driver list however, since those drivers are expected to come from PE image files.) Once the KdpDriverEntry() driver entrypoint is called, we register KdpDriverReinit() for re-initialization with the I/O Manager, in order to provide more initialization points. KdpDriverReinit() calls the KD providers at BootPhase >= 2, and schedules further reinitializations (at most 3 more) if any of the providers request so.
200 lines
4 KiB
C
200 lines
4 KiB
C
#pragma once
|
|
|
|
#include <cportlib/cportlib.h>
|
|
|
|
//
|
|
// Kernel Debugger Port Definition
|
|
//
|
|
struct _KD_DISPATCH_TABLE;
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
KdPortInitializeEx(
|
|
PCPPORT PortInformation,
|
|
ULONG ComPortNumber
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
KdPortGetByteEx(
|
|
PCPPORT PortInformation,
|
|
PUCHAR ByteReceived);
|
|
|
|
VOID
|
|
NTAPI
|
|
KdPortPutByteEx(
|
|
PCPPORT PortInformation,
|
|
UCHAR ByteToSend
|
|
);
|
|
|
|
#ifdef _NTOSKRNL_
|
|
|
|
/* KD ROUTINES ***************************************************************/
|
|
|
|
typedef enum _KD_CONTINUE_TYPE
|
|
{
|
|
kdContinue = 0,
|
|
kdDoNotHandleException,
|
|
kdHandleException
|
|
} KD_CONTINUE_TYPE;
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(NTAPI *PKDP_INIT_ROUTINE)(
|
|
_In_ struct _KD_DISPATCH_TABLE *DispatchTable,
|
|
_In_ ULONG BootPhase);
|
|
|
|
typedef
|
|
VOID
|
|
(NTAPI*PKDP_PRINT_ROUTINE)(
|
|
PCHAR String,
|
|
ULONG Length
|
|
);
|
|
|
|
/* INIT ROUTINES *************************************************************/
|
|
|
|
KIRQL
|
|
NTAPI
|
|
KdbpAcquireLock(
|
|
_In_ PKSPIN_LOCK SpinLock);
|
|
|
|
VOID
|
|
NTAPI
|
|
KdbpReleaseLock(
|
|
_In_ PKSPIN_LOCK SpinLock,
|
|
_In_ KIRQL OldIrql);
|
|
|
|
VOID
|
|
KdpScreenAcquire(VOID);
|
|
|
|
VOID
|
|
KdpScreenRelease(VOID);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
KdpScreenInit(
|
|
_In_ struct _KD_DISPATCH_TABLE *DispatchTable,
|
|
_In_ ULONG BootPhase);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
KdpSerialInit(
|
|
_In_ struct _KD_DISPATCH_TABLE *DispatchTable,
|
|
_In_ ULONG BootPhase);
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
KdpDebugLogInit(
|
|
_In_ struct _KD_DISPATCH_TABLE *DispatchTable,
|
|
_In_ ULONG BootPhase);
|
|
|
|
#ifdef KDBG
|
|
#define KdpKdbgInit KdbInitialize
|
|
#endif
|
|
|
|
|
|
/* KD ROUTINES ***************************************************************/
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
KdpSafeReadMemory(
|
|
IN ULONG_PTR Addr,
|
|
IN LONG Len,
|
|
OUT PVOID Value
|
|
);
|
|
|
|
BOOLEAN
|
|
NTAPI
|
|
KdpSafeWriteMemory(
|
|
IN ULONG_PTR Addr,
|
|
IN LONG Len,
|
|
IN ULONGLONG Value
|
|
);
|
|
|
|
|
|
/* KD GLOBALS ***************************************************************/
|
|
|
|
/* Serial debug connection */
|
|
#define DEFAULT_DEBUG_PORT 2 /* COM2 */
|
|
#define DEFAULT_DEBUG_COM1_IRQ 4 /* COM1 IRQ */
|
|
#define DEFAULT_DEBUG_COM2_IRQ 3 /* COM2 IRQ */
|
|
#define DEFAULT_DEBUG_BAUD_RATE 115200 /* 115200 Baud */
|
|
|
|
/* KD Native Modes */
|
|
#define KdScreen 0
|
|
#define KdSerial 1
|
|
#define KdFile 2
|
|
#define KdKdbg 3
|
|
#define KdMax 4
|
|
|
|
/* KD Private Debug Modes */
|
|
typedef struct _KDP_DEBUG_MODE
|
|
{
|
|
union
|
|
{
|
|
struct
|
|
{
|
|
/* Native Modes */
|
|
UCHAR Screen :1;
|
|
UCHAR Serial :1;
|
|
UCHAR File :1;
|
|
};
|
|
|
|
/* Generic Value */
|
|
ULONG Value;
|
|
};
|
|
} KDP_DEBUG_MODE;
|
|
|
|
/* KD Internal Debug Services */
|
|
typedef enum _KDP_DEBUG_SERVICE
|
|
{
|
|
DumpNonPagedPool = 0x1e, /* a */
|
|
ManualBugCheck = 0x30, /* b */
|
|
DumpNonPagedPoolStats = 0x2e, /* c */
|
|
DumpNewNonPagedPool = 0x20, /* d */
|
|
DumpNewNonPagedPoolStats = 0x12, /* e */
|
|
DumpAllThreads = 0x21, /* f */
|
|
DumpUserThreads = 0x22, /* g */
|
|
KdSpare1 = 0x23, /* h */
|
|
KdSpare2 = 0x17, /* i */
|
|
KdSpare3 = 0x24, /* j */
|
|
EnterDebugger = 0x25, /* k */
|
|
ThatsWhatSheSaid = 69 /* FIGURE IT OUT */
|
|
} KDP_DEBUG_SERVICE;
|
|
|
|
/* Dispatch Table for Wrapper Functions */
|
|
typedef struct _KD_DISPATCH_TABLE
|
|
{
|
|
LIST_ENTRY KdProvidersList;
|
|
PKDP_INIT_ROUTINE KdpInitRoutine;
|
|
PKDP_PRINT_ROUTINE KdpPrintRoutine;
|
|
NTSTATUS InitStatus;
|
|
} KD_DISPATCH_TABLE, *PKD_DISPATCH_TABLE;
|
|
|
|
/* The current Debugging Mode */
|
|
extern KDP_DEBUG_MODE KdpDebugMode;
|
|
|
|
/* Port Information for the Serial Native Mode */
|
|
extern ULONG SerialPortNumber;
|
|
extern CPPORT SerialPortInfo;
|
|
|
|
/* Init Functions for Native Providers */
|
|
extern PKDP_INIT_ROUTINE InitRoutines[KdMax];
|
|
|
|
/* Dispatch Tables for Native Providers */
|
|
extern KD_DISPATCH_TABLE DispatchTable[KdMax];
|
|
|
|
/* The KD Native Provider List */
|
|
extern LIST_ENTRY KdProviders;
|
|
|
|
#endif // _NTOSKRNL_
|
|
|
|
#if DBG && defined(_M_IX86) && !defined(_WINKD_) // See ke/i386/traphdlr.c
|
|
#define ID_Win32PreServiceHook 'WSH0'
|
|
#define ID_Win32PostServiceHook 'WSH1'
|
|
typedef void (NTAPI *PKDBG_PRESERVICEHOOK)(ULONG, PULONG_PTR);
|
|
typedef ULONG_PTR (NTAPI *PKDBG_POSTSERVICEHOOK)(ULONG, ULONG_PTR);
|
|
extern PKDBG_PRESERVICEHOOK KeWin32PreServiceHook;
|
|
extern PKDBG_POSTSERVICEHOOK KeWin32PostServiceHook;
|
|
#endif
|