| 1 | /* $Id: DBGFRZ.cpp 72254 2018-05-18 07:28:30Z vboxsync $ */
|
|---|
| 2 | /** @file
|
|---|
| 3 | * DBGF - Debugger Facility, RZ part.
|
|---|
| 4 | */
|
|---|
| 5 |
|
|---|
| 6 | /*
|
|---|
| 7 | * Copyright (C) 2006-2017 Oracle Corporation
|
|---|
| 8 | *
|
|---|
| 9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
|---|
| 10 | * available from http://www.virtualbox.org. This file is free software;
|
|---|
| 11 | * you can redistribute it and/or modify it under the terms of the GNU
|
|---|
| 12 | * General Public License (GPL) as published by the Free Software
|
|---|
| 13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
|---|
| 14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
|---|
| 15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
|---|
| 16 | */
|
|---|
| 17 |
|
|---|
| 18 |
|
|---|
| 19 | /*********************************************************************************************************************************
|
|---|
| 20 | * Header Files *
|
|---|
| 21 | *********************************************************************************************************************************/
|
|---|
| 22 | #define LOG_GROUP LOG_GROUP_DBGF
|
|---|
| 23 | #include <VBox/vmm/dbgf.h>
|
|---|
| 24 | #include <VBox/vmm/selm.h>
|
|---|
| 25 | #ifdef IN_RC
|
|---|
| 26 | # include <VBox/vmm/trpm.h>
|
|---|
| 27 | #endif
|
|---|
| 28 | #include <VBox/log.h>
|
|---|
| 29 | #include "DBGFInternal.h"
|
|---|
| 30 | #include <VBox/vmm/vm.h>
|
|---|
| 31 | #include <VBox/err.h>
|
|---|
| 32 | #include <iprt/assert.h>
|
|---|
| 33 |
|
|---|
| 34 | #ifdef IN_RC
|
|---|
| 35 | DECLASM(void) TRPMRCHandlerAsmTrap03(void);
|
|---|
| 36 | #endif
|
|---|
| 37 |
|
|---|
| 38 |
|
|---|
| 39 | /**
|
|---|
| 40 | * \#DB (Debug event) handler.
|
|---|
| 41 | *
|
|---|
| 42 | * @returns VBox status code.
|
|---|
| 43 | * VINF_SUCCESS means we completely handled this trap,
|
|---|
| 44 | * other codes are passed execution to host context.
|
|---|
| 45 | *
|
|---|
| 46 | * @param pVM The cross context VM structure.
|
|---|
| 47 | * @param pVCpu The cross context virtual CPU structure.
|
|---|
| 48 | * @param pRegFrame Pointer to the register frame for the trap.
|
|---|
| 49 | * @param uDr6 The DR6 hypervisor register value.
|
|---|
| 50 | * @param fAltStepping Alternative stepping indicator.
|
|---|
| 51 | */
|
|---|
| 52 | VMMRZ_INT_DECL(int) DBGFRZTrap01Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCUINTREG uDr6, bool fAltStepping)
|
|---|
| 53 | {
|
|---|
| 54 | #ifdef IN_RC
|
|---|
| 55 | const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
|
|---|
| 56 | #else
|
|---|
| 57 | NOREF(pRegFrame);
|
|---|
| 58 | const bool fInHyper = false;
|
|---|
| 59 | #endif
|
|---|
| 60 |
|
|---|
| 61 | /** @todo Intel docs say that X86_DR6_BS has the highest priority... */
|
|---|
| 62 | /*
|
|---|
| 63 | * A breakpoint?
|
|---|
| 64 | */
|
|---|
| 65 | AssertCompile(X86_DR6_B0 == 1 && X86_DR6_B1 == 2 && X86_DR6_B2 == 4 && X86_DR6_B3 == 8);
|
|---|
| 66 | if ( (uDr6 & (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3))
|
|---|
| 67 | && pVM->dbgf.s.cEnabledHwBreakpoints > 0)
|
|---|
| 68 | {
|
|---|
| 69 | for (unsigned iBp = 0; iBp < RT_ELEMENTS(pVM->dbgf.s.aHwBreakpoints); iBp++)
|
|---|
| 70 | {
|
|---|
| 71 | if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
|
|---|
| 72 | && pVM->dbgf.s.aHwBreakpoints[iBp].enmType == DBGFBPTYPE_REG)
|
|---|
| 73 | {
|
|---|
| 74 | pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aHwBreakpoints[iBp].iBp;
|
|---|
| 75 | pVCpu->dbgf.s.fSingleSteppingRaw = false;
|
|---|
| 76 | LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %d at %04x:%RGv\n",
|
|---|
| 77 | pVM->dbgf.s.aHwBreakpoints[iBp].iBp, pRegFrame->cs.Sel, pRegFrame->rip));
|
|---|
| 78 |
|
|---|
| 79 | return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
|
|---|
| 80 | }
|
|---|
| 81 | }
|
|---|
| 82 | }
|
|---|
| 83 |
|
|---|
| 84 | /*
|
|---|
| 85 | * Single step?
|
|---|
| 86 | * Are we single stepping or is it the guest?
|
|---|
| 87 | */
|
|---|
| 88 | if ( (uDr6 & X86_DR6_BS)
|
|---|
| 89 | && (fInHyper || pVCpu->dbgf.s.fSingleSteppingRaw || fAltStepping))
|
|---|
| 90 | {
|
|---|
| 91 | pVCpu->dbgf.s.fSingleSteppingRaw = false;
|
|---|
| 92 | LogFlow(("DBGFRZTrap01Handler: single step at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
|
|---|
| 93 | return fInHyper ? VINF_EM_DBG_HYPER_STEPPED : VINF_EM_DBG_STEPPED;
|
|---|
| 94 | }
|
|---|
| 95 |
|
|---|
| 96 | #ifdef IN_RC
|
|---|
| 97 | /*
|
|---|
| 98 | * Either an ICEBP in hypervisor code or a guest related debug exception
|
|---|
| 99 | * of sorts.
|
|---|
| 100 | */
|
|---|
| 101 | if (RT_UNLIKELY(fInHyper))
|
|---|
| 102 | {
|
|---|
| 103 | /*
|
|---|
| 104 | * Is this a guest debug event that was delayed past a ring transition?
|
|---|
| 105 | *
|
|---|
| 106 | * Since we do no allow sysenter/syscall in raw-mode, the only
|
|---|
| 107 | * non-trap/fault type transitions that can occur are thru interrupt gates.
|
|---|
| 108 | * Of those, only INT3 (#BP) has a DPL other than 0 with a CS.RPL of 0.
|
|---|
| 109 | * See bugref:9171 and bs3-cpu-weird-1 for more details.
|
|---|
| 110 | *
|
|---|
| 111 | * We need to reconstruct the guest register state from the hypervisor one
|
|---|
| 112 | * here, so here is the layout of the IRET frame on the stack:
|
|---|
| 113 | * 20:[8] GS (V86 only)
|
|---|
| 114 | * 1C:[7] FS (V86 only)
|
|---|
| 115 | * 18:[6] DS (V86 only)
|
|---|
| 116 | * 14:[5] ES (V86 only)
|
|---|
| 117 | * 10:[4] SS
|
|---|
| 118 | * 0c:[3] ESP
|
|---|
| 119 | * 08:[2] EFLAGS
|
|---|
| 120 | * 04:[1] CS
|
|---|
| 121 | * 00:[0] EIP
|
|---|
| 122 | */
|
|---|
| 123 | if (pRegFrame->rip == (uintptr_t)TRPMRCHandlerAsmTrap03)
|
|---|
| 124 | {
|
|---|
| 125 | uint32_t const *pu32Stack = (uint32_t const *)pRegFrame->esp;
|
|---|
| 126 | if ( (pu32Stack[2] & X86_EFL_VM)
|
|---|
| 127 | || (pu32Stack[1] & X86_SEL_RPL))
|
|---|
| 128 | {
|
|---|
| 129 | LogFlow(("DBGFRZTrap01Handler: Detected guest #DB delayed past ring transition %04x:%RX32 %#x\n",
|
|---|
| 130 | pu32Stack[1] & 0xffff, pu32Stack[0], pu32Stack[2]));
|
|---|
| 131 | PCPUMCTX pGstCtx = CPUMQueryGuestCtxPtr(pVCpu);
|
|---|
| 132 | pGstCtx->rip = pu32Stack[0];
|
|---|
| 133 | pGstCtx->cs.Sel = pu32Stack[1];
|
|---|
| 134 | pGstCtx->eflags.u = pu32Stack[2];
|
|---|
| 135 | pGstCtx->rsp = pu32Stack[3];
|
|---|
| 136 | pGstCtx->ss.Sel = pu32Stack[4];
|
|---|
| 137 | if (pu32Stack[2] & X86_EFL_VM)
|
|---|
| 138 | {
|
|---|
| 139 | pGstCtx->es.Sel = pu32Stack[5];
|
|---|
| 140 | pGstCtx->ds.Sel = pu32Stack[6];
|
|---|
| 141 | pGstCtx->fs.Sel = pu32Stack[7];
|
|---|
| 142 | pGstCtx->gs.Sel = pu32Stack[8];
|
|---|
| 143 | }
|
|---|
| 144 | else
|
|---|
| 145 | {
|
|---|
| 146 | pGstCtx->es.Sel = pRegFrame->es.Sel;
|
|---|
| 147 | pGstCtx->ds.Sel = pRegFrame->ds.Sel;
|
|---|
| 148 | pGstCtx->fs.Sel = pRegFrame->fs.Sel;
|
|---|
| 149 | pGstCtx->gs.Sel = pRegFrame->gs.Sel;
|
|---|
| 150 | }
|
|---|
| 151 | pGstCtx->rax = pRegFrame->rax;
|
|---|
| 152 | pGstCtx->rcx = pRegFrame->rcx;
|
|---|
| 153 | pGstCtx->rdx = pRegFrame->rdx;
|
|---|
| 154 | pGstCtx->rbx = pRegFrame->rbx;
|
|---|
| 155 | pGstCtx->rsi = pRegFrame->rsi;
|
|---|
| 156 | pGstCtx->rdi = pRegFrame->rdi;
|
|---|
| 157 | pGstCtx->rbp = pRegFrame->rbp;
|
|---|
| 158 |
|
|---|
| 159 | /*
|
|---|
| 160 | * We should assert a #BP followed by a #DB here, but TRPM cannot
|
|---|
| 161 | * do that. So, we'll just assert the #BP and ignore the #DB, even
|
|---|
| 162 | * if that isn't strictly correct.
|
|---|
| 163 | */
|
|---|
| 164 | TRPMResetTrap(pVCpu);
|
|---|
| 165 | TRPMAssertTrap(pVCpu, X86_XCPT_BP, TRPM_SOFTWARE_INT);
|
|---|
| 166 | return VINF_EM_RAW_GUEST_TRAP;
|
|---|
| 167 | }
|
|---|
| 168 | }
|
|---|
| 169 |
|
|---|
| 170 | LogFlow(("DBGFRZTrap01Handler: Unknown bp at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
|
|---|
| 171 | return VERR_DBGF_HYPER_DB_XCPT;
|
|---|
| 172 | }
|
|---|
| 173 | #endif
|
|---|
| 174 |
|
|---|
| 175 | LogFlow(("DBGFRZTrap01Handler: guest debug event %#x at %04x:%RGv!\n", (uint32_t)uDr6, pRegFrame->cs.Sel, pRegFrame->rip));
|
|---|
| 176 | return VINF_EM_RAW_GUEST_TRAP;
|
|---|
| 177 | }
|
|---|
| 178 |
|
|---|
| 179 |
|
|---|
| 180 | /**
|
|---|
| 181 | * \#BP (Breakpoint) handler.
|
|---|
| 182 | *
|
|---|
| 183 | * @returns VBox status code.
|
|---|
| 184 | * VINF_SUCCESS means we completely handled this trap,
|
|---|
| 185 | * other codes are passed execution to host context.
|
|---|
| 186 | *
|
|---|
| 187 | * @param pVM The cross context VM structure.
|
|---|
| 188 | * @param pVCpu The cross context virtual CPU structure.
|
|---|
| 189 | * @param pRegFrame Pointer to the register frame for the trap.
|
|---|
| 190 | */
|
|---|
| 191 | VMMRZ_INT_DECL(int) DBGFRZTrap03Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
|
|---|
| 192 | {
|
|---|
| 193 | #ifdef IN_RC
|
|---|
| 194 | const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
|
|---|
| 195 | #else
|
|---|
| 196 | const bool fInHyper = false;
|
|---|
| 197 | #endif
|
|---|
| 198 |
|
|---|
| 199 | /*
|
|---|
| 200 | * Get the trap address and look it up in the breakpoint table.
|
|---|
| 201 | * Don't bother if we don't have any breakpoints.
|
|---|
| 202 | */
|
|---|
| 203 | unsigned cToSearch = pVM->dbgf.s.Int3.cToSearch;
|
|---|
| 204 | if (cToSearch > 0)
|
|---|
| 205 | {
|
|---|
| 206 | RTGCPTR pPc;
|
|---|
| 207 | int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
|
|---|
| 208 | #ifdef IN_RC
|
|---|
| 209 | pRegFrame->eip - 1,
|
|---|
| 210 | #else
|
|---|
| 211 | pRegFrame->rip /* no -1 in R0 */,
|
|---|
| 212 | #endif
|
|---|
| 213 | &pPc);
|
|---|
| 214 | AssertRCReturn(rc, rc);
|
|---|
| 215 |
|
|---|
| 216 | unsigned iBp = pVM->dbgf.s.Int3.iStartSearch;
|
|---|
| 217 | while (cToSearch-- > 0)
|
|---|
| 218 | {
|
|---|
| 219 | if ( pVM->dbgf.s.aBreakpoints[iBp].u.GCPtr == (RTGCUINTPTR)pPc
|
|---|
| 220 | && pVM->dbgf.s.aBreakpoints[iBp].enmType == DBGFBPTYPE_INT3)
|
|---|
| 221 | {
|
|---|
| 222 | pVM->dbgf.s.aBreakpoints[iBp].cHits++;
|
|---|
| 223 | pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aBreakpoints[iBp].iBp;
|
|---|
| 224 |
|
|---|
| 225 | LogFlow(("DBGFRZTrap03Handler: hit breakpoint %d at %RGv (%04x:%RGv) cHits=0x%RX64\n",
|
|---|
| 226 | pVM->dbgf.s.aBreakpoints[iBp].iBp, pPc, pRegFrame->cs.Sel, pRegFrame->rip,
|
|---|
| 227 | pVM->dbgf.s.aBreakpoints[iBp].cHits));
|
|---|
| 228 | return fInHyper
|
|---|
| 229 | ? VINF_EM_DBG_HYPER_BREAKPOINT
|
|---|
| 230 | : VINF_EM_DBG_BREAKPOINT;
|
|---|
| 231 | }
|
|---|
| 232 | iBp++;
|
|---|
| 233 | }
|
|---|
| 234 | }
|
|---|
| 235 |
|
|---|
| 236 | return fInHyper
|
|---|
| 237 | ? VINF_EM_DBG_HYPER_ASSERTION
|
|---|
| 238 | : VINF_EM_RAW_GUEST_TRAP;
|
|---|
| 239 | }
|
|---|
| 240 |
|
|---|
