VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMRZ/DBGFRZ.cpp@ 86701

Last change on this file since 86701 was 86701, checked in by vboxsync, 4 years ago

VMM/DBGF: Start implementing support for int3 breakpoints, bugref:9837
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 13.8 KB
Line 
1/* $Id: DBGFRZ.cpp 86701 2020-10-25 18:20:09Z vboxsync $ */
2/** @file
3 * DBGF - Debugger Facility, RZ part.
4 */
5
6/*
7 * Copyright (C) 2006-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF
23#include <VBox/vmm/dbgf.h>
24#include <VBox/vmm/selm.h>
25#ifdef IN_RC
26# include <VBox/vmm/trpm.h>
27#endif
28#include <VBox/log.h>
29#include "DBGFInternal.h"
30#include <VBox/vmm/vmcc.h>
31#include <VBox/err.h>
32#include <iprt/assert.h>
33
34#ifdef IN_RC
35DECLASM(void) TRPMRCHandlerAsmTrap03(void);
36#endif
37
38
39/**
40 * \#DB (Debug event) handler.
41 *
42 * @returns VBox status code.
43 * VINF_SUCCESS means we completely handled this trap,
44 * other codes are passed execution to host context.
45 *
46 * @param pVM The cross context VM structure.
47 * @param pVCpu The cross context virtual CPU structure.
48 * @param pRegFrame Pointer to the register frame for the trap.
49 * @param uDr6 The DR6 hypervisor register value.
50 * @param fAltStepping Alternative stepping indicator.
51 */
52VMMRZ_INT_DECL(int) DBGFRZTrap01Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCUINTREG uDr6, bool fAltStepping)
53{
54#ifdef IN_RC
55 const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
56#else
57 NOREF(pRegFrame);
58 const bool fInHyper = false;
59#endif
60
61 /** @todo Intel docs say that X86_DR6_BS has the highest priority... */
62 /*
63 * A breakpoint?
64 */
65 AssertCompile(X86_DR6_B0 == 1 && X86_DR6_B1 == 2 && X86_DR6_B2 == 4 && X86_DR6_B3 == 8);
66 if ( (uDr6 & (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3))
67 && pVM->dbgf.s.cEnabledHwBreakpoints > 0)
68 {
69 for (unsigned iBp = 0; iBp < RT_ELEMENTS(pVM->dbgf.s.aHwBreakpoints); iBp++)
70 {
71#ifndef VBOX_WITH_LOTS_OF_DBGF_BPS
72 if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
73 && pVM->dbgf.s.aHwBreakpoints[iBp].enmType == DBGFBPTYPE_REG)
74 {
75 pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aHwBreakpoints[iBp].iBp;
76 pVCpu->dbgf.s.fSingleSteppingRaw = false;
77 LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %d at %04x:%RGv\n",
78 pVM->dbgf.s.aHwBreakpoints[iBp].iBp, pRegFrame->cs.Sel, pRegFrame->rip));
79
80 return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
81 }
82#else
83 if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
84 && pVM->dbgf.s.aHwBreakpoints[iBp].hBp != NIL_DBGFBP)
85 {
86 pVCpu->dbgf.s.hBpActive = pVM->dbgf.s.aHwBreakpoints[iBp].hBp;
87 pVCpu->dbgf.s.fSingleSteppingRaw = false;
88 LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %x at %04x:%RGv\n",
89 pVM->dbgf.s.aHwBreakpoints[iBp].hBp, pRegFrame->cs.Sel, pRegFrame->rip));
90
91 return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
92 }
93#endif
94 }
95 }
96
97 /*
98 * Single step?
99 * Are we single stepping or is it the guest?
100 */
101 if ( (uDr6 & X86_DR6_BS)
102 && (fInHyper || pVCpu->dbgf.s.fSingleSteppingRaw || fAltStepping))
103 {
104 pVCpu->dbgf.s.fSingleSteppingRaw = false;
105 LogFlow(("DBGFRZTrap01Handler: single step at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
106 return fInHyper ? VINF_EM_DBG_HYPER_STEPPED : VINF_EM_DBG_STEPPED;
107 }
108
109#ifdef IN_RC
110 /*
111 * Either an ICEBP in hypervisor code or a guest related debug exception
112 * of sorts.
113 */
114 if (RT_UNLIKELY(fInHyper))
115 {
116 /*
117 * Is this a guest debug event that was delayed past a ring transition?
118 *
119 * Since we do no allow sysenter/syscall in raw-mode, the only
120 * non-trap/fault type transitions that can occur are thru interrupt gates.
121 * Of those, only INT3 (#BP) has a DPL other than 0 with a CS.RPL of 0.
122 * See bugref:9171 and bs3-cpu-weird-1 for more details.
123 *
124 * We need to reconstruct the guest register state from the hypervisor one
125 * here, so here is the layout of the IRET frame on the stack:
126 * 20:[8] GS (V86 only)
127 * 1C:[7] FS (V86 only)
128 * 18:[6] DS (V86 only)
129 * 14:[5] ES (V86 only)
130 * 10:[4] SS
131 * 0c:[3] ESP
132 * 08:[2] EFLAGS
133 * 04:[1] CS
134 * 00:[0] EIP
135 */
136 if (pRegFrame->rip == (uintptr_t)TRPMRCHandlerAsmTrap03)
137 {
138 uint32_t const *pu32Stack = (uint32_t const *)pRegFrame->esp;
139 if ( (pu32Stack[2] & X86_EFL_VM)
140 || (pu32Stack[1] & X86_SEL_RPL))
141 {
142 LogFlow(("DBGFRZTrap01Handler: Detected guest #DB delayed past ring transition %04x:%RX32 %#x\n",
143 pu32Stack[1] & 0xffff, pu32Stack[0], pu32Stack[2]));
144 PCPUMCTX pGstCtx = CPUMQueryGuestCtxPtr(pVCpu);
145 pGstCtx->rip = pu32Stack[0];
146 pGstCtx->cs.Sel = pu32Stack[1];
147 pGstCtx->eflags.u = pu32Stack[2];
148 pGstCtx->rsp = pu32Stack[3];
149 pGstCtx->ss.Sel = pu32Stack[4];
150 if (pu32Stack[2] & X86_EFL_VM)
151 {
152 pGstCtx->es.Sel = pu32Stack[5];
153 pGstCtx->ds.Sel = pu32Stack[6];
154 pGstCtx->fs.Sel = pu32Stack[7];
155 pGstCtx->gs.Sel = pu32Stack[8];
156 }
157 else
158 {
159 pGstCtx->es.Sel = pRegFrame->es.Sel;
160 pGstCtx->ds.Sel = pRegFrame->ds.Sel;
161 pGstCtx->fs.Sel = pRegFrame->fs.Sel;
162 pGstCtx->gs.Sel = pRegFrame->gs.Sel;
163 }
164 pGstCtx->rax = pRegFrame->rax;
165 pGstCtx->rcx = pRegFrame->rcx;
166 pGstCtx->rdx = pRegFrame->rdx;
167 pGstCtx->rbx = pRegFrame->rbx;
168 pGstCtx->rsi = pRegFrame->rsi;
169 pGstCtx->rdi = pRegFrame->rdi;
170 pGstCtx->rbp = pRegFrame->rbp;
171
172 /*
173 * We should assert a #BP followed by a #DB here, but TRPM cannot
174 * do that. So, we'll just assert the #BP and ignore the #DB, even
175 * if that isn't strictly correct.
176 */
177 TRPMResetTrap(pVCpu);
178 TRPMAssertTrap(pVCpu, X86_XCPT_BP, TRPM_SOFTWARE_INT);
179 return VINF_EM_RAW_GUEST_TRAP;
180 }
181 }
182
183 LogFlow(("DBGFRZTrap01Handler: Unknown bp at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
184 return VERR_DBGF_HYPER_DB_XCPT;
185 }
186#endif
187
188 LogFlow(("DBGFRZTrap01Handler: guest debug event %#x at %04x:%RGv!\n", (uint32_t)uDr6, pRegFrame->cs.Sel, pRegFrame->rip));
189 return VINF_EM_RAW_GUEST_TRAP;
190}
191
192#ifdef VBOX_WITH_LOTS_OF_DBGF_BPS
193# ifdef IN_RING0
194/**
195 * Returns the internal breakpoint state for the given handle.
196 *
197 * @returns Pointer to the internal breakpoint state or NULL if the handle is invalid.
198 * @param pVM The ring-0 VM structure pointer.
199 * @param hBp The breakpoint handle to resolve.
200 * @param ppBpR0 Where to store the pointer to the ring-0 only part of the breakpoint
201 * on success, optional.
202 */
203DECLINLINE(PDBGFBPINT) dbgfR0BpGetByHnd(PVMCC pVM, DBGFBP hBp, PDBGFBPINTR0 *ppBpR0)
204{
205 uint32_t idChunk = DBGF_BP_HND_GET_CHUNK_ID(hBp);
206 uint32_t idxEntry = DBGF_BP_HND_GET_ENTRY(hBp);
207
208 AssertReturn(idChunk < DBGF_BP_CHUNK_COUNT, NULL);
209 AssertReturn(idxEntry < DBGF_BP_COUNT_PER_CHUNK, NULL);
210
211 PDBGFBPCHUNKR0 pBpChunk = &pVM->dbgfr0.s.aBpChunks[idChunk];
212 AssertPtrReturn(pBpChunk->paBpBaseSharedR0, NULL);
213
214 if (ppBpR0)
215 *ppBpR0 = &pBpChunk->paBpBaseR0Only[idxEntry];
216 return &pBpChunk->paBpBaseSharedR0[idxEntry];
217}
218# endif
219
220
221/**
222 * Executes the actions associated with the given breakpoint.
223 *
224 * @returns VBox status code.
225 * @param pVM The cross context VM structure.
226 * @param pVCpu The cross context virtual CPU structure.
227 * @param pRegFrame Pointer to the register frame for the trap.
228 * @param hBp The breakpoint handle which hit.
229 * @param pBp The shared breakpoint state.
230 * @param pBpR0 The ring-0 only breakpoint state.
231 * @param fInHyper Flag whether the breakpoint triggered in hypervisor code.
232 */
233DECLINLINE(int) dbgfRZBpHit(PVMCC pVM, PVMCPUCC pVCpu, PCPUMCTXCORE pRegFrame,
234 DBGFBP hBp, PDBGFBPINT pBp, PDBGFBPINTR0 pBpR0, bool fInHyper)
235{
236 uint64_t cHits = ASMAtomicIncU64(&pBp->Pub.cHits);
237 pVCpu->dbgf.s.hBpActive = hBp;
238
239 /** @todo Owner handling. */
240
241 LogFlow(("dbgfRZBpHit: hit breakpoint %u at %04x:%RGv cHits=0x%RX64\n",
242 hBp, pRegFrame->cs.Sel, pRegFrame->rip, cHits));
243 return fInHyper
244 ? VINF_EM_DBG_HYPER_BREAKPOINT
245 : VINF_EM_DBG_BREAKPOINT;
246}
247#endif /* !VBOX_WITH_LOTS_OF_DBGF_BPS */
248
249/**
250 * \#BP (Breakpoint) handler.
251 *
252 * @returns VBox status code.
253 * VINF_SUCCESS means we completely handled this trap,
254 * other codes are passed execution to host context.
255 *
256 * @param pVM The cross context VM structure.
257 * @param pVCpu The cross context virtual CPU structure.
258 * @param pRegFrame Pointer to the register frame for the trap.
259 */
260VMMRZ_INT_DECL(int) DBGFRZTrap03Handler(PVMCC pVM, PVMCPUCC pVCpu, PCPUMCTXCORE pRegFrame)
261{
262#ifdef IN_RC
263 const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
264#else
265 const bool fInHyper = false;
266#endif
267
268#ifndef VBOX_WITH_LOTS_OF_DBGF_BPS
269 /*
270 * Get the trap address and look it up in the breakpoint table.
271 * Don't bother if we don't have any breakpoints.
272 */
273 unsigned cToSearch = pVM->dbgf.s.Int3.cToSearch;
274 if (cToSearch > 0)
275 {
276 RTGCPTR pPc;
277 int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
278# ifdef IN_RC
279 pRegFrame->eip - 1,
280# else
281 pRegFrame->rip /* no -1 in R0 */,
282# endif
283 &pPc);
284 AssertRCReturn(rc, rc);
285
286 unsigned iBp = pVM->dbgf.s.Int3.iStartSearch;
287 while (cToSearch-- > 0)
288 {
289 if ( pVM->dbgf.s.aBreakpoints[iBp].u.GCPtr == (RTGCUINTPTR)pPc
290 && pVM->dbgf.s.aBreakpoints[iBp].enmType == DBGFBPTYPE_INT3)
291 {
292 pVM->dbgf.s.aBreakpoints[iBp].cHits++;
293 pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aBreakpoints[iBp].iBp;
294
295 LogFlow(("DBGFRZTrap03Handler: hit breakpoint %d at %RGv (%04x:%RGv) cHits=0x%RX64\n",
296 pVM->dbgf.s.aBreakpoints[iBp].iBp, pPc, pRegFrame->cs.Sel, pRegFrame->rip,
297 pVM->dbgf.s.aBreakpoints[iBp].cHits));
298 return fInHyper
299 ? VINF_EM_DBG_HYPER_BREAKPOINT
300 : VINF_EM_DBG_BREAKPOINT;
301 }
302 iBp++;
303 }
304 }
305#else
306# ifdef IN_RC
307# error "You lucky person have the pleasure to implement the raw mode part for this!"
308# endif
309
310 if (pVM->dbgfr0.s.CTX_SUFF(paBpLocL1))
311 {
312 RTGCPTR GCPtrBp;
313 int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
314# ifdef IN_RC
315 pRegFrame->eip - 1,
316# else
317 pRegFrame->rip /* no -1 in R0 */,
318# endif
319 &GCPtrBp);
320 AssertRCReturn(rc, rc);
321
322 const uint16_t idxL1 = DBGF_BP_INT3_L1_IDX_EXTRACT_FROM_ADDR(GCPtrBp);
323 const uint32_t u32L1Entry = ASMAtomicReadU32(&pVM->dbgfr0.s.CTX_SUFF(paBpLocL1)[idxL1]);
324
325 LogFlowFunc(("GCPtrBp=%RGv idxL1=%u u32L1Entry=%#x\n", GCPtrBp, idxL1, u32L1Entry));
326 if (u32L1Entry != DBGF_BP_INT3_L1_ENTRY_TYPE_NULL)
327 {
328 uint8_t u8Type = DBGF_BP_INT3_L1_ENTRY_GET_TYPE(u32L1Entry);
329 if (u8Type == DBGF_BP_INT3_L1_ENTRY_TYPE_BP_HND)
330 {
331 DBGFBP hBp = DBGF_BP_INT3_L1_ENTRY_GET_BP_HND(u32L1Entry);
332
333 /* Query the internal breakpoint state from the handle. */
334 PDBGFBPINTR0 pBpR0 = NULL;
335 PDBGFBPINT pBp = dbgfR0BpGetByHnd(pVM, hBp, &pBpR0);
336 if ( pBp
337 && DBGF_BP_PUB_GET_TYPE(pBp->Pub.fFlagsAndType) == DBGFBPTYPE_INT3)
338 {
339 if (pBp->Pub.u.Int3.GCPtr == (RTGCUINTPTR)GCPtrBp)
340 return dbgfRZBpHit(pVM, pVCpu, pRegFrame, hBp, pBp, pBpR0, fInHyper);
341 /* else Genuine guest trap. */
342 }
343 /** @todo else Guru meditation */
344 }
345 else if (u8Type == DBGF_BP_INT3_L1_ENTRY_TYPE_L2_IDX)
346 {
347 /** @todo Walk the L2 tree searching for the correct spot. */
348 }
349 /** @todo else Guru meditation */
350 }
351 }
352#endif /* !VBOX_WITH_LOTS_OF_DBGF_BPS */
353
354 return fInHyper
355 ? VINF_EM_DBG_HYPER_ASSERTION
356 : VINF_EM_RAW_GUEST_TRAP;
357}
358
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette