[43135] | 1 | ; $Id: VMMR0TripleFaultHackA.asm 98103 2023-01-17 14:15:46Z vboxsync $
|
---|
| 2 | ;; @file
|
---|
| 3 | ; VMM - Host Context Ring 0, Assembly Code for The Triple Fault Debugging Hack.
|
---|
| 4 | ;
|
---|
| 5 |
|
---|
| 6 | ;
|
---|
[98103] | 7 | ; Copyright (C) 2011-2023 Oracle and/or its affiliates.
|
---|
[43135] | 8 | ;
|
---|
[96407] | 9 | ; This file is part of VirtualBox base platform packages, as
|
---|
| 10 | ; available from https://www.virtualbox.org.
|
---|
[43135] | 11 | ;
|
---|
[96407] | 12 | ; This program is free software; you can redistribute it and/or
|
---|
| 13 | ; modify it under the terms of the GNU General Public License
|
---|
| 14 | ; as published by the Free Software Foundation, in version 3 of the
|
---|
| 15 | ; License.
|
---|
| 16 | ;
|
---|
| 17 | ; This program is distributed in the hope that it will be useful, but
|
---|
| 18 | ; WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 19 | ; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
| 20 | ; General Public License for more details.
|
---|
| 21 | ;
|
---|
| 22 | ; You should have received a copy of the GNU General Public License
|
---|
| 23 | ; along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
| 24 | ;
|
---|
| 25 | ; SPDX-License-Identifier: GPL-3.0-only
|
---|
| 26 | ;
|
---|
[43135] | 27 |
|
---|
| 28 | ;*******************************************************************************
|
---|
| 29 | ;* Header Files *
|
---|
| 30 | ;*******************************************************************************
|
---|
| 31 | %include "VBox/asmdefs.mac"
|
---|
| 32 |
|
---|
| 33 |
|
---|
| 34 | BEGINCODE
|
---|
| 35 | GLOBALNAME vmmR0TripleFaultHackStart
|
---|
| 36 | %define CALC_ADDR(a_Addr) ( (a_Addr) - NAME(vmmR0TripleFaultHackStart) + 07000h )
|
---|
| 37 |
|
---|
| 38 |
|
---|
| 39 | BITS 16
|
---|
| 40 | BEGINPROC vmmR0TripleFaultHack
|
---|
| 41 | ; Set up stack.
|
---|
| 42 | cli ; paranoia
|
---|
| 43 | mov sp, 0ffffh
|
---|
| 44 | mov ax, cs
|
---|
| 45 | mov ss, ax
|
---|
| 46 | mov ds, ax
|
---|
| 47 | mov es, ax
|
---|
| 48 | cld ; paranoia
|
---|
| 49 |
|
---|
| 50 | COM_INIT
|
---|
| 51 |
|
---|
| 52 | ; Beep and say hello to the post-reset world.
|
---|
| 53 | call NAME(vmmR0TripleFaultHackBeep)
|
---|
| 54 | mov si, CALC_ADDR(.s_szHello)
|
---|
| 55 | call NAME(vmmR0TripleFaultHackPrint)
|
---|
| 56 |
|
---|
| 57 | .forever:
|
---|
| 58 | hlt
|
---|
| 59 | jmp .forever
|
---|
| 60 |
|
---|
| 61 | .s_szHello:
|
---|
| 62 | db 'Hello post-reset world', 0ah, 0dh, 0
|
---|
| 63 | ENDPROC vmmR0TripleFaultHack
|
---|
| 64 |
|
---|
| 65 | ;; ds:si = zero terminated string.
|
---|
| 66 | BEGINPROC vmmR0TripleFaultHackPrint
|
---|
| 67 | push eax
|
---|
| 68 | push esi
|
---|
| 69 |
|
---|
| 70 | .outer_loop:
|
---|
| 71 | lodsb
|
---|
| 72 | cmp al, 0
|
---|
| 73 | je .done
|
---|
| 74 | call NAME(vmmR0TripleFaultHackPrintCh)
|
---|
| 75 | jmp .outer_loop
|
---|
| 76 |
|
---|
| 77 | .done:
|
---|
| 78 | pop esi
|
---|
| 79 | pop eax
|
---|
| 80 | ret
|
---|
| 81 | ENDPROC vmmR0TripleFaultHackPrint
|
---|
| 82 |
|
---|
| 83 |
|
---|
| 84 | ;; al = char to print
|
---|
| 85 | BEGINPROC vmmR0TripleFaultHackPrintCh
|
---|
| 86 | push eax
|
---|
| 87 | push edx
|
---|
| 88 | push ecx
|
---|
| 89 | mov ah, al ; save char.
|
---|
| 90 |
|
---|
| 91 | ; Wait for status.
|
---|
| 92 | mov ecx, _1G
|
---|
| 93 | mov dx, VBOX_UART_BASE + 5
|
---|
| 94 | .pre_status:
|
---|
| 95 | in al, dx
|
---|
| 96 | test al, 20h
|
---|
| 97 | jnz .put_char
|
---|
| 98 | dec ecx
|
---|
| 99 | jnz .pre_status
|
---|
| 100 |
|
---|
| 101 | ; Write the character.
|
---|
| 102 | .put_char:
|
---|
| 103 | mov al, ah
|
---|
| 104 | mov dx, VBOX_UART_BASE
|
---|
| 105 | out dx, al
|
---|
| 106 |
|
---|
| 107 | ; Wait for status.
|
---|
| 108 | mov ecx, _1G
|
---|
| 109 | mov dx, VBOX_UART_BASE + 5
|
---|
| 110 | .post_status:
|
---|
| 111 | in al, dx
|
---|
| 112 | test al, 20h
|
---|
| 113 | jnz .done
|
---|
| 114 | dec ecx
|
---|
| 115 | jnz .post_status
|
---|
| 116 |
|
---|
| 117 | .done:
|
---|
| 118 | pop ecx
|
---|
| 119 | pop edx
|
---|
| 120 | pop eax
|
---|
| 121 | ret
|
---|
| 122 | ENDPROC vmmR0TripleFaultHackPrintCh
|
---|
| 123 |
|
---|
| 124 | ;;
|
---|
| 125 | ; make a 440 BEEP.
|
---|
| 126 | BEGINPROC vmmR0TripleFaultHackBeep
|
---|
| 127 | push eax
|
---|
| 128 | push edx
|
---|
| 129 | push ecx
|
---|
| 130 |
|
---|
| 131 | ; program PIT(1) and stuff.
|
---|
| 132 | mov al, 10110110b
|
---|
| 133 | out 43h, al
|
---|
| 134 | mov ax, 0a79h ; A = 440
|
---|
| 135 | out 42h, al
|
---|
| 136 | shr ax, 8
|
---|
| 137 | out 42h, al
|
---|
| 138 |
|
---|
| 139 | in al, 61h
|
---|
| 140 | or al, 3
|
---|
| 141 | out 61h, al
|
---|
| 142 |
|
---|
| 143 | ; delay
|
---|
| 144 | mov ecx, _1G
|
---|
| 145 | .delay:
|
---|
| 146 | inc ecx
|
---|
| 147 | dec ecx
|
---|
| 148 | dec ecx
|
---|
| 149 | jnz .delay
|
---|
| 150 |
|
---|
| 151 | ; shut up speaker.
|
---|
| 152 | in al, 61h
|
---|
| 153 | and al, 11111100b
|
---|
| 154 | out 61h, al
|
---|
| 155 |
|
---|
| 156 | .done:
|
---|
| 157 | pop ecx
|
---|
| 158 | pop edx
|
---|
| 159 | pop eax
|
---|
| 160 | ret
|
---|
| 161 | ENDPROC vmmR0TripleFaultHackBeep
|
---|
| 162 |
|
---|
| 163 |
|
---|
| 164 | GLOBALNAME vmmR0TripleFaultHackEnd
|
---|
| 165 |
|
---|
| 166 |
|
---|
| 167 |
|
---|
| 168 |
|
---|
| 169 | ;;;
|
---|
| 170 | ;;;
|
---|
| 171 | ;;;
|
---|
| 172 | ;;;
|
---|
| 173 | ;;;
|
---|
| 174 |
|
---|
| 175 |
|
---|
| 176 |
|
---|
| 177 | BITS ARCH_BITS
|
---|
| 178 |
|
---|
| 179 | BEGINPROC vmmR0TripleFaultHackKbdWait
|
---|
| 180 | push xAX
|
---|
| 181 |
|
---|
| 182 | .check_status:
|
---|
| 183 | in al, 64h
|
---|
| 184 | test al, 1 ; KBD_STAT_OBF
|
---|
| 185 | jnz .read_data_and_status
|
---|
| 186 | test al, 2 ; KBD_STAT_IBF
|
---|
| 187 | jnz .check_status
|
---|
| 188 |
|
---|
| 189 | pop xAX
|
---|
| 190 | ret
|
---|
| 191 |
|
---|
| 192 | .read_data_and_status:
|
---|
| 193 | in al, 60h
|
---|
| 194 | jmp .check_status
|
---|
| 195 | ENDPROC vmmR0TripleFaultHackKbdWait
|
---|
| 196 |
|
---|
| 197 |
|
---|
| 198 | BEGINPROC vmmR0TripleFaultHackKbdRead
|
---|
| 199 | out 64h, al ; Write the command.
|
---|
| 200 |
|
---|
| 201 | .check_status:
|
---|
| 202 | in al, 64h
|
---|
| 203 | test al, 1 ; KBD_STAT_OBF
|
---|
| 204 | jz .check_status
|
---|
| 205 |
|
---|
| 206 | in al, 60h ; Read the data.
|
---|
| 207 | ret
|
---|
| 208 | ENDPROC vmmR0TripleFaultHackKbdRead
|
---|
| 209 |
|
---|
| 210 |
|
---|
| 211 | BEGINPROC vmmR0TripleFaultHackKbdWrite
|
---|
| 212 | out 64h, al ; Write the command.
|
---|
| 213 | call NAME(vmmR0TripleFaultHackKbdWait)
|
---|
| 214 |
|
---|
| 215 | xchg al, ah
|
---|
| 216 | out 60h, al ; Write the data.
|
---|
| 217 | call NAME(vmmR0TripleFaultHackKbdWait)
|
---|
| 218 | xchg al, ah
|
---|
| 219 |
|
---|
| 220 | ret
|
---|
| 221 | ENDPROC vmmR0TripleFaultHackKbdWrite
|
---|
| 222 |
|
---|
| 223 |
|
---|
| 224 |
|
---|
| 225 | BEGINPROC vmmR0TripleFaultHackTripleFault
|
---|
| 226 | push xAX
|
---|
| 227 | push xSI
|
---|
| 228 |
|
---|
| 229 | xor eax, eax
|
---|
| 230 | push xAX
|
---|
| 231 | push xAX
|
---|
| 232 | push xAX
|
---|
| 233 | push xAX
|
---|
| 234 |
|
---|
| 235 | COM_CHAR 'B'
|
---|
| 236 | COM_CHAR 'y'
|
---|
| 237 | COM_CHAR 'e'
|
---|
| 238 | COM_CHAR '!'
|
---|
| 239 | COM_CHAR 0ah
|
---|
| 240 | COM_CHAR 0dh
|
---|
| 241 |
|
---|
| 242 |
|
---|
| 243 | ;call NAME(vmmR0TripleFaultHackBeep32)
|
---|
| 244 | %if 1
|
---|
| 245 | lidt [xSP]
|
---|
| 246 | %elif 0
|
---|
| 247 | in al, 92h
|
---|
| 248 | or al, 1
|
---|
| 249 | out 92h, al
|
---|
| 250 | in al, 92h
|
---|
| 251 | cli
|
---|
| 252 | hlt
|
---|
| 253 | %else
|
---|
| 254 | mov al, 0d0h ; KBD_CCMD_READ_OUTPORT
|
---|
| 255 | call NAME(vmmR0TripleFaultHackKbdRead)
|
---|
| 256 | mov ah, 0feh
|
---|
| 257 | and ah, al
|
---|
| 258 | mov al, 0d1h ; KBD_CCMD_WRITE_OUTPORT
|
---|
| 259 | call NAME(vmmR0TripleFaultHackKbdWrite)
|
---|
| 260 | cli
|
---|
| 261 | hlt
|
---|
| 262 | %endif
|
---|
| 263 | int3
|
---|
| 264 |
|
---|
| 265 | pop xAX
|
---|
| 266 | pop xAX
|
---|
| 267 | pop xAX
|
---|
| 268 | pop xAX
|
---|
| 269 |
|
---|
| 270 | pop xSI
|
---|
| 271 | pop xAX
|
---|
| 272 | ret
|
---|
| 273 | ENDPROC vmmR0TripleFaultHackTripleFault
|
---|
| 274 |
|
---|