windows-server-2003/base/ntos/mm/triage.c

/*++

Copyright (c) 1999  Microsoft Corporation

Module Name:

   triage.c

Abstract:

    This module contains the Phase 0 code to triage bugchecks and
    automatically enable various system tracing components until the
    guilty party is found.

Author:

    Landy Wang 13-Jan-1999

Revision History:

--*/

#include "mi.h"
#include "ntiodump.h"

#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT,MiTriageSystem)
#pragma alloc_text(INIT,MiTriageAddDrivers)
#endif

//
// Always update this macro when adding triage support for additional bugchecks.
//

#define MI_CAN_TRIAGE_BUGCHECK(BugCheckCode) \
         ((BugCheckCode) == NO_MORE_SYSTEM_PTES || \
         (BugCheckCode) == BAD_POOL_HEADER || \
         (BugCheckCode) == DRIVER_CORRUPTED_SYSPTES || \
         (BugCheckCode) == DRIVER_CORRUPTED_EXPOOL || \
         (BugCheckCode) == DRIVER_CORRUPTED_MMPOOL)

//
// These are bugchecks that were presumably triggered by either autotriage or
// the admin's registry settings - so don't apply any new rules and in addition,
// keep the old ones unaltered so it can reproduce.
//

#define MI_HOLD_TRIAGE_BUGCHECK(BugCheckCode) \
        ((BugCheckCode) == DRIVER_USED_EXCESSIVE_PTES || \
         (BugCheckCode) == DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS || \
         (BugCheckCode) == PAGE_FAULT_IN_FREED_SPECIAL_POOL || \
         (BugCheckCode) == DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL || \
         (BugCheckCode) == PAGE_FAULT_BEYOND_END_OF_ALLOCATION || \
         (BugCheckCode) == DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION || \
         (BugCheckCode) == DRIVER_CAUGHT_MODIFYING_FREED_POOL || \
         (BugCheckCode) == SYSTEM_PTE_MISUSE)

#define MI_TRACKING_PTES                    0x00000002
#define MI_PROTECT_FREED_NONPAGED_POOL      0x00000004
#define MI_VERIFYING_PRENT5_DRIVERS         0x00000008
#define MI_KEEPING_PREVIOUS_SETTINGS        0x00000010

#ifdef ALLOC_DATA_PRAGMA
#pragma const_seg("INITCONST")
#pragma data_seg("INITDATA")
#endif
const PCHAR MiTriageActionStrings[] = {
    "Locked pages tracking",
    "System PTE usage tracking",
    "Making accesses to freed nonpaged pool cause bugchecks",
    "Driver Verifying Pre-Windows 2000 built drivers",
    "Keeping previous autotriage settings"
};

#if DBG
ULONG MiTriageDebug = 0;
BOOLEAN MiTriageRegardless = FALSE;
#endif

#ifdef ALLOC_DATA_PRAGMA
#pragma const_seg()
#pragma data_seg()
#endif

//
// N.B.  The debugger references this.
//

ULONG MmTriageActionTaken;

//
// The Version number must be incremented whenever the MI_TRIAGE_STORAGE
// structure is changed.  This enables usermode programs to decode the Mm
// portions of triage dumps regardless of which kernel revision created the
// dump.
//

typedef struct _MI_TRIAGE_STORAGE {
    ULONG Version;
    ULONG Size;
    ULONG MmSpecialPoolTag;
    ULONG MiTriageActionTaken;

    ULONG MmVerifyDriverLevel;
    ULONG KernelVerifier;
    ULONG_PTR MmMaximumNonPagedPool;
    ULONG_PTR MmAllocatedNonPagedPool;

    ULONG_PTR PagedPoolMaximum;
    ULONG_PTR PagedPoolAllocated;

    ULONG_PTR CommittedPages;
    ULONG_PTR CommittedPagesPeak;
    ULONG_PTR CommitLimitMaximum;

} MI_TRIAGE_STORAGE, *PMI_TRIAGE_STORAGE;

PKLDR_DATA_TABLE_ENTRY
TriageGetLoaderEntry (
    IN PVOID TriageDumpBlock,
    IN ULONG ModuleIndex
    );

LOGICAL
TriageActUpon(
    IN PVOID TriageDumpBlock
    );

PVOID
TriageGetMmInformation (
    IN PVOID TriageDumpBlock
    );


LOGICAL
MiTriageSystem (
    IN PLOADER_PARAMETER_BLOCK LoaderBlock
    )

/*++

Routine Description:

    This routine takes the information from the last bugcheck (if any)
    and triages it.  Various debugging options are then automatically
    enabled.

Arguments:

    LoaderBlock - Supplies a pointer to the system loader block.

Return Value:

    TRUE if triaging succeeded and options were enabled.  FALSE otherwise.

--*/

{
    PVOID TriageDumpBlock;
    ULONG_PTR BugCheckData[5];
    ULONG i;
    ULONG ModuleCount;
    NTSTATUS Status;
    PLIST_ENTRY NextEntry;
    PKLDR_DATA_TABLE_ENTRY DataTableEntry;
    PKLDR_DATA_TABLE_ENTRY DumpTableEntry;
    LOGICAL Matched;
    ULONG OldDrivers;
    ULONG OldDriversNotVerifying;
    PMI_TRIAGE_STORAGE TriageInformation;
    
    if (LoaderBlock->Extension == NULL) {
        return FALSE;
    }

    if (LoaderBlock->Extension->Size < sizeof (LOADER_PARAMETER_EXTENSION)) {
        return FALSE;
    }

    TriageDumpBlock = LoaderBlock->Extension->TriageDumpBlock;

    Status = TriageGetBugcheckData (TriageDumpBlock,
                                    (PULONG)&BugCheckData[0],
                                    (PUINT_PTR) &BugCheckData[1],
                                    (PUINT_PTR) &BugCheckData[2],
                                    (PUINT_PTR) &BugCheckData[3],
                                    (PUINT_PTR) &BugCheckData[4]);

    if (!NT_SUCCESS (Status)) {
        return FALSE;
    }

    //
    // Always display at least the bugcheck data from the previous crash.
    //

    DbgPrint ("MiTriageSystem: Previous bugcheck was %x %p %p %p %p\n",
        BugCheckData[0],
        BugCheckData[1],
        BugCheckData[2],
        BugCheckData[3],
        BugCheckData[4]);

    if (TriageActUpon (TriageDumpBlock) == FALSE) {
        DbgPrint ("MiTriageSystem: Triage disabled in registry by administrator\n");
        return FALSE;
    }

    DbgPrint ("MiTriageSystem: Triage ENABLED in registry by administrator\n");

    //
    // See if the previous bugcheck was one where action can be taken.
    // If not, bail now.  If so, then march on and verify all the loaded
    // module checksums before actually taking action on the bugcheck.
    //

    if (!MI_CAN_TRIAGE_BUGCHECK(BugCheckData[0])) {
        return FALSE;
    }

    TriageInformation = (PMI_TRIAGE_STORAGE) TriageGetMmInformation (TriageDumpBlock);

    if (TriageInformation == NULL) {
        return FALSE;
    }

    Status = TriageGetDriverCount (TriageDumpBlock, &ModuleCount);

    if (!NT_SUCCESS (Status)) {
        return FALSE;
    }

    //
    // Process module information from the triage dump.
    //

#if DBG
    if (MiTriageDebug & 0x1) {
        DbgPrint ("MiTriageSystem: printing active drivers from triage crash...\n");
    }
#endif

    OldDrivers = 0;
    OldDriversNotVerifying = 0;

    for (i = 0; i < ModuleCount; i += 1) {

        DumpTableEntry = TriageGetLoaderEntry (TriageDumpBlock, i);

        if (DumpTableEntry != NULL) {

            if ((DumpTableEntry->Flags & LDRP_ENTRY_NATIVE) == 0) {
                OldDrivers += 1;
                if ((DumpTableEntry->Flags & LDRP_IMAGE_VERIFYING) == 0) {

                    //
                    // An NT3 or NT4 driver is in the system and was not
                    // running under the verifier.
                    //

                    OldDriversNotVerifying += 1;
                }
            }
#if DBG
            if (MiTriageDebug & 0x1) {

                DbgPrint (" %wZ: base = %p, size = %lx, flags = %lx\n",
                          &DumpTableEntry->BaseDllName,
                          DumpTableEntry->DllBase,
                          DumpTableEntry->SizeOfImage,
                          DumpTableEntry->Flags);
            }
#endif
        }
    }

    //
    // Ensure that every driver that is currently loaded is identical to
    // the one in the triage dump before proceeding.
    //

    NextEntry = LoaderBlock->LoadOrderListHead.Flink;

    while (NextEntry != &LoaderBlock->LoadOrderListHead) {

        DataTableEntry = CONTAINING_RECORD(NextEntry,
                                           KLDR_DATA_TABLE_ENTRY,
                                           InLoadOrderLinks);

        Matched = FALSE;

        for (i = 0; i < ModuleCount; i += 1) {
    
            DumpTableEntry = TriageGetLoaderEntry (TriageDumpBlock, i);
    
            if (DumpTableEntry != NULL) {
    
                if (DataTableEntry->CheckSum == DumpTableEntry->CheckSum) {
                    Matched = TRUE;
                    break;
                }
            }
        }
    
        if (Matched == FALSE) {
            DbgPrint ("Matching checksum for module %wZ not found in triage dump\n",
                &DataTableEntry->BaseDllName);

#if DBG
            if (MiTriageRegardless == FALSE)
#endif
            return FALSE;
        }

        NextEntry = NextEntry->Flink;
    }

#if DBG
    if (MiTriageDebug & 0x1) {
        DbgPrint ("MiTriageSystem: OldDrivers = %u, without verification =%u\n",
            OldDrivers,
            OldDriversNotVerifying);
    }
#endif

    //
    // All boot loaded drivers matched, take action on the triage dump now.
    //

    if (MI_HOLD_TRIAGE_BUGCHECK(BugCheckData[0])) {

        //
        // The last bugcheck was presumably triggered by either autotriage or
        // the admin's registry settings - so don't apply any new rules
        // and in addition, keep the old ones unaltered so it can reproduce.
        //

        MmTriageActionTaken = TriageInformation->MiTriageActionTaken;
        MmTriageActionTaken |= MI_KEEPING_PREVIOUS_SETTINGS;
    }
    else {
    
        switch (BugCheckData[0]) {
    
            case DRIVER_CORRUPTED_SYSPTES:
    
                //
                // Turn on PTE tracking to trigger a SYSTEM_PTE_MISUSE bugcheck.
                //
    
                MmTriageActionTaken |= MI_TRACKING_PTES;
                break;
    
            case NO_MORE_SYSTEM_PTES:
    
                //
                // Turn on PTE tracking so the driver can be identified via a
                // DRIVER_USED_EXCESSIVE_PTES bugcheck.
                //
    
                if (BugCheckData[1] == SystemPteSpace) {
                    MmTriageActionTaken |= MI_TRACKING_PTES;
                }
                break;
    
            case BAD_POOL_HEADER:
            case DRIVER_CORRUPTED_EXPOOL:
    
                //
                // Turn on the driver verifier and/or special pool.
                // Start by enabling it for every driver that isn't built for NT5.
                // Override any specified driver verifier options so that only
                // special pool is enabled to minimize the performance hit.
                //
    
                if (OldDrivers != 0) {
                    if (OldDriversNotVerifying != 0) {
                        MmTriageActionTaken |= MI_VERIFYING_PRENT5_DRIVERS;
                    }
                }
    
                break;
    
            case DRIVER_CORRUPTED_MMPOOL:
    
                //
                // Protect freed nonpaged pool if the system had less than 128mb
                // of nonpaged pool anyway.  This is to trigger a
                // DRIVER_CAUGHT_MODIFYING_FREED_POOL bugcheck.
                //
    
#define MB128 ((ULONG_PTR)0x80000000 >> PAGE_SHIFT)
    
                if (TriageInformation->MmMaximumNonPagedPool < MB128) {
                    MmTriageActionTaken |= MI_PROTECT_FREED_NONPAGED_POOL;
                }
                break;
    
            case IRQL_NOT_LESS_OR_EQUAL:
            case DRIVER_IRQL_NOT_LESS_OR_EQUAL:
            default:
                break;
        }
    }

    //
    // For now always show if action was taken from the bugcheck
    // data from the crash.  This print and the space for the print strings
    // will be enabled for checked builds only prior to shipping.
    //

    if (MmTriageActionTaken != 0) {

        if (MmTriageActionTaken & MI_TRACKING_PTES) {
            MmTrackPtes |= 0x1;
        }
    
        if (MmTriageActionTaken & MI_VERIFYING_PRENT5_DRIVERS) {
            MmVerifyDriverLevel &= ~DRIVER_VERIFIER_FORCE_IRQL_CHECKING;
            MmVerifyDriverLevel |= DRIVER_VERIFIER_SPECIAL_POOLING;
        }
    
        if (MmTriageActionTaken & MI_PROTECT_FREED_NONPAGED_POOL) {
            MmProtectFreedNonPagedPool = TRUE;
        }

        DbgPrint ("MiTriageSystem: enabling options below to find who caused the last crash\n");

        for (i = 0; i < 32; i += 1) {
            if (MmTriageActionTaken & (1 << i)) {
                DbgPrint ("  %s\n", MiTriageActionStrings[i]);
            }
        }
    }

    return TRUE;
}


LOGICAL
MiTriageAddDrivers (
    IN PLOADER_PARAMETER_BLOCK LoaderBlock
    )

/*++

Routine Description:

    This routine moves the names of any drivers that autotriage has determined
    need verifying from the LoaderBlock into pool.

Arguments:

    LoaderBlock - Supplies a pointer to the system loader block.

Return Value:

    TRUE if any drivers were added, FALSE if not.

--*/

{
    ULONG i;
    ULONG ModuleCount;
    NTSTATUS Status;
    PKLDR_DATA_TABLE_ENTRY DumpTableEntry;
    PVOID TriageDumpBlock;
    ULONG NameLength;
    LOGICAL Added;
    PMI_VERIFIER_DRIVER_ENTRY VerifierDriverEntry;

    if ((MmTriageActionTaken & MI_VERIFYING_PRENT5_DRIVERS) == 0) {
        return FALSE;
    }

    TriageDumpBlock = LoaderBlock->Extension->TriageDumpBlock;

    Status = TriageGetDriverCount (TriageDumpBlock, &ModuleCount);

    if (!NT_SUCCESS (Status)) {
        return FALSE;
    }

    Added = FALSE;

    for (i = 0; i < ModuleCount; i += 1) {

        DumpTableEntry = TriageGetLoaderEntry (TriageDumpBlock, i);

        if (DumpTableEntry == NULL) {
            continue;
        }

        if (DumpTableEntry->Flags & LDRP_ENTRY_NATIVE) {
            continue;
        }

        DbgPrint ("MiTriageAddDrivers: Marking %wZ for verification when it is loaded\n", &DumpTableEntry->BaseDllName);

        NameLength = DumpTableEntry->BaseDllName.Length;

        VerifierDriverEntry = (PMI_VERIFIER_DRIVER_ENTRY)ExAllocatePoolWithTag (
                                    NonPagedPool,
                                    sizeof (MI_VERIFIER_DRIVER_ENTRY) +
                                                        NameLength,
                                    'dLmM');

        if (VerifierDriverEntry == NULL) {
            continue;
        }

        VerifierDriverEntry->Loads = 0;
        VerifierDriverEntry->Unloads = 0;
        VerifierDriverEntry->BaseName.Buffer = (PWSTR)((PCHAR)VerifierDriverEntry +
                            sizeof (MI_VERIFIER_DRIVER_ENTRY));

        VerifierDriverEntry->BaseName.Length = (USHORT)NameLength;
        VerifierDriverEntry->BaseName.MaximumLength = (USHORT)NameLength;

        RtlCopyMemory (VerifierDriverEntry->BaseName.Buffer,
                       DumpTableEntry->BaseDllName.Buffer,
                       NameLength);

        InsertHeadList (&MiSuspectDriverList, &VerifierDriverEntry->Links);
        Added = TRUE;
    }

    return Added;
}

#define MAX_UNLOADED_NAME_LENGTH    24

typedef struct _DUMP_UNLOADED_DRIVERS {
    UNICODE_STRING Name;
    WCHAR DriverName[MAX_UNLOADED_NAME_LENGTH / sizeof (WCHAR)];
    PVOID StartAddress;
    PVOID EndAddress;
} DUMP_UNLOADED_DRIVERS, *PDUMP_UNLOADED_DRIVERS;


ULONG
MmSizeOfUnloadedDriverInformation (
    VOID
    )

/*++

Routine Description:

    This routine returns the size of the Mm-internal unloaded driver
    information that is stored in the triage dump when (if?) the system crashes.

Arguments:

    None.

Return Value:

    Size of the Mm-internal unloaded driver information.

--*/

{
    if (MmUnloadedDrivers == NULL) {
        return sizeof (ULONG_PTR);
    }

    return sizeof(ULONG_PTR) + MI_UNLOADED_DRIVERS * sizeof(DUMP_UNLOADED_DRIVERS);
}


VOID
MmWriteUnloadedDriverInformation (
    IN PVOID Destination
    )

/*++

Routine Description:

    This routine stores the Mm-internal unloaded driver information into
    the triage dump.

Arguments:

    None.

Return Value:

    None.

--*/

{
    ULONG i;
    ULONG Index;
    PUNLOADED_DRIVERS Unloaded;
    PDUMP_UNLOADED_DRIVERS DumpUnloaded;

    if (MmUnloadedDrivers == NULL) {
        *(PULONG)Destination = 0;
    }
    else {

        DumpUnloaded = (PDUMP_UNLOADED_DRIVERS)((PULONG_PTR)Destination + 1);
        Unloaded = MmUnloadedDrivers;

        //
        // Write the list with the most recently unloaded driver first to the
        // least recently unloaded driver last.
        //

        Index = MmLastUnloadedDriver - 1;

        for (i = 0; i < MI_UNLOADED_DRIVERS; i += 1) {

            if (Index >= MI_UNLOADED_DRIVERS) {
                Index = MI_UNLOADED_DRIVERS - 1;
            }

            Unloaded = &MmUnloadedDrivers[Index];

            DumpUnloaded->Name = Unloaded->Name;

            if (Unloaded->Name.Buffer == NULL) {
                break;
            }

            DumpUnloaded->StartAddress = Unloaded->StartAddress;
            DumpUnloaded->EndAddress = Unloaded->EndAddress;

            if (DumpUnloaded->Name.Length > MAX_UNLOADED_NAME_LENGTH) {
                DumpUnloaded->Name.Length = MAX_UNLOADED_NAME_LENGTH;
            }

            if (DumpUnloaded->Name.MaximumLength > MAX_UNLOADED_NAME_LENGTH) {
                DumpUnloaded->Name.MaximumLength = MAX_UNLOADED_NAME_LENGTH;
            }

            DumpUnloaded->Name.Buffer = DumpUnloaded->DriverName;

            RtlCopyMemory ((PVOID)DumpUnloaded->Name.Buffer,
                           (PVOID)Unloaded->Name.Buffer,
                           DumpUnloaded->Name.MaximumLength);

            DumpUnloaded += 1;
            Index -= 1;
        }

        *(PULONG)Destination = i;
    }
}


ULONG
MmSizeOfTriageInformation (
    VOID
    )

/*++

Routine Description:

    This routine returns the size of the Mm-internal information that is
    stored in the triage dump when (if?) the system crashes.

Arguments:

    None.

Return Value:

    Size of the Mm-internal triage information.

--*/

{
    return sizeof (MI_TRIAGE_STORAGE);
}


VOID
MmWriteTriageInformation (
    IN PVOID Destination
    )

/*++

Routine Description:

    This routine stores the Mm-internal information into the triage dump.

Arguments:

    None.

Return Value:

    None.

--*/

{
    MI_TRIAGE_STORAGE TriageInformation;

    TriageInformation.Version = 1;
    TriageInformation.Size = sizeof (MI_TRIAGE_STORAGE);

    TriageInformation.MmSpecialPoolTag = MmSpecialPoolTag;
    TriageInformation.MiTriageActionTaken = MmTriageActionTaken;

    TriageInformation.MmVerifyDriverLevel = MmVerifierData.Level;
    TriageInformation.KernelVerifier = KernelVerifier;

    TriageInformation.MmMaximumNonPagedPool = MmMaximumNonPagedPoolInBytes >> PAGE_SHIFT;
    TriageInformation.MmAllocatedNonPagedPool = MmAllocatedNonPagedPool;

    TriageInformation.PagedPoolMaximum = MmSizeOfPagedPoolInBytes >> PAGE_SHIFT;
    TriageInformation.PagedPoolAllocated = MmPagedPoolInfo.AllocatedPagedPool;

    TriageInformation.CommittedPages = MmTotalCommittedPages;
    TriageInformation.CommittedPagesPeak = MmPeakCommitment;
    TriageInformation.CommitLimitMaximum = MmTotalCommitLimitMaximum;

    RtlCopyMemory (Destination,
                   (PVOID)&TriageInformation,
                   sizeof (MI_TRIAGE_STORAGE));
}