VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMRZ/DBGFRZ.cpp@ 86708

Last change on this file since 86708 was 86704, checked in by vboxsync, 4 years ago

VMM/DBGF: Updates to the new breakpoint manager, L2 table management groundwork, bugref:9837
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 13.9 KB
Line 
1/* $Id: DBGFRZ.cpp 86704 2020-10-26 12:04:05Z vboxsync $ */
2/** @file
3 * DBGF - Debugger Facility, RZ part.
4 */
5
6/*
7 * Copyright (C) 2006-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF
23#include <VBox/vmm/dbgf.h>
24#include <VBox/vmm/selm.h>
25#ifdef IN_RC
26# include <VBox/vmm/trpm.h>
27#endif
28#include <VBox/log.h>
29#include "DBGFInternal.h"
30#include <VBox/vmm/vmcc.h>
31#include <VBox/err.h>
32#include <iprt/assert.h>
33
34#ifdef IN_RC
35DECLASM(void) TRPMRCHandlerAsmTrap03(void);
36#endif
37
38
39/**
40 * \#DB (Debug event) handler.
41 *
42 * @returns VBox status code.
43 * VINF_SUCCESS means we completely handled this trap,
44 * other codes are passed execution to host context.
45 *
46 * @param pVM The cross context VM structure.
47 * @param pVCpu The cross context virtual CPU structure.
48 * @param pRegFrame Pointer to the register frame for the trap.
49 * @param uDr6 The DR6 hypervisor register value.
50 * @param fAltStepping Alternative stepping indicator.
51 */
52VMMRZ_INT_DECL(int) DBGFRZTrap01Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCUINTREG uDr6, bool fAltStepping)
53{
54#ifdef IN_RC
55 const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
56#else
57 NOREF(pRegFrame);
58 const bool fInHyper = false;
59#endif
60
61 /** @todo Intel docs say that X86_DR6_BS has the highest priority... */
62 /*
63 * A breakpoint?
64 */
65 AssertCompile(X86_DR6_B0 == 1 && X86_DR6_B1 == 2 && X86_DR6_B2 == 4 && X86_DR6_B3 == 8);
66 if ( (uDr6 & (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3))
67 && pVM->dbgf.s.cEnabledHwBreakpoints > 0)
68 {
69 for (unsigned iBp = 0; iBp < RT_ELEMENTS(pVM->dbgf.s.aHwBreakpoints); iBp++)
70 {
71#ifndef VBOX_WITH_LOTS_OF_DBGF_BPS
72 if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
73 && pVM->dbgf.s.aHwBreakpoints[iBp].enmType == DBGFBPTYPE_REG)
74 {
75 pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aHwBreakpoints[iBp].iBp;
76 pVCpu->dbgf.s.fSingleSteppingRaw = false;
77 LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %d at %04x:%RGv\n",
78 pVM->dbgf.s.aHwBreakpoints[iBp].iBp, pRegFrame->cs.Sel, pRegFrame->rip));
79
80 return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
81 }
82#else
83 if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
84 && pVM->dbgf.s.aHwBreakpoints[iBp].hBp != NIL_DBGFBP)
85 {
86 pVCpu->dbgf.s.hBpActive = pVM->dbgf.s.aHwBreakpoints[iBp].hBp;
87 pVCpu->dbgf.s.fSingleSteppingRaw = false;
88 LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %x at %04x:%RGv\n",
89 pVM->dbgf.s.aHwBreakpoints[iBp].hBp, pRegFrame->cs.Sel, pRegFrame->rip));
90
91 return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
92 }
93#endif
94 }
95 }
96
97 /*
98 * Single step?
99 * Are we single stepping or is it the guest?
100 */
101 if ( (uDr6 & X86_DR6_BS)
102 && (fInHyper || pVCpu->dbgf.s.fSingleSteppingRaw || fAltStepping))
103 {
104 pVCpu->dbgf.s.fSingleSteppingRaw = false;
105 LogFlow(("DBGFRZTrap01Handler: single step at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
106 return fInHyper ? VINF_EM_DBG_HYPER_STEPPED : VINF_EM_DBG_STEPPED;
107 }
108
109#ifdef IN_RC
110 /*
111 * Either an ICEBP in hypervisor code or a guest related debug exception
112 * of sorts.
113 */
114 if (RT_UNLIKELY(fInHyper))
115 {
116 /*
117 * Is this a guest debug event that was delayed past a ring transition?
118 *
119 * Since we do no allow sysenter/syscall in raw-mode, the only
120 * non-trap/fault type transitions that can occur are thru interrupt gates.
121 * Of those, only INT3 (#BP) has a DPL other than 0 with a CS.RPL of 0.
122 * See bugref:9171 and bs3-cpu-weird-1 for more details.
123 *
124 * We need to reconstruct the guest register state from the hypervisor one
125 * here, so here is the layout of the IRET frame on the stack:
126 * 20:[8] GS (V86 only)
127 * 1C:[7] FS (V86 only)
128 * 18:[6] DS (V86 only)
129 * 14:[5] ES (V86 only)
130 * 10:[4] SS
131 * 0c:[3] ESP
132 * 08:[2] EFLAGS
133 * 04:[1] CS
134 * 00:[0] EIP
135 */
136 if (pRegFrame->rip == (uintptr_t)TRPMRCHandlerAsmTrap03)
137 {
138 uint32_t const *pu32Stack = (uint32_t const *)pRegFrame->esp;
139 if ( (pu32Stack[2] & X86_EFL_VM)
140 || (pu32Stack[1] & X86_SEL_RPL))
141 {
142 LogFlow(("DBGFRZTrap01Handler: Detected guest #DB delayed past ring transition %04x:%RX32 %#x\n",
143 pu32Stack[1] & 0xffff, pu32Stack[0], pu32Stack[2]));
144 PCPUMCTX pGstCtx = CPUMQueryGuestCtxPtr(pVCpu);
145 pGstCtx->rip = pu32Stack[0];
146 pGstCtx->cs.Sel = pu32Stack[1];
147 pGstCtx->eflags.u = pu32Stack[2];
148 pGstCtx->rsp = pu32Stack[3];
149 pGstCtx->ss.Sel = pu32Stack[4];
150 if (pu32Stack[2] & X86_EFL_VM)
151 {
152 pGstCtx->es.Sel = pu32Stack[5];
153 pGstCtx->ds.Sel = pu32Stack[6];
154 pGstCtx->fs.Sel = pu32Stack[7];
155 pGstCtx->gs.Sel = pu32Stack[8];
156 }
157 else
158 {
159 pGstCtx->es.Sel = pRegFrame->es.Sel;
160 pGstCtx->ds.Sel = pRegFrame->ds.Sel;
161 pGstCtx->fs.Sel = pRegFrame->fs.Sel;
162 pGstCtx->gs.Sel = pRegFrame->gs.Sel;
163 }
164 pGstCtx->rax = pRegFrame->rax;
165 pGstCtx->rcx = pRegFrame->rcx;
166 pGstCtx->rdx = pRegFrame->rdx;
167 pGstCtx->rbx = pRegFrame->rbx;
168 pGstCtx->rsi = pRegFrame->rsi;
169 pGstCtx->rdi = pRegFrame->rdi;
170 pGstCtx->rbp = pRegFrame->rbp;
171
172 /*
173 * We should assert a #BP followed by a #DB here, but TRPM cannot
174 * do that. So, we'll just assert the #BP and ignore the #DB, even
175 * if that isn't strictly correct.
176 */
177 TRPMResetTrap(pVCpu);
178 TRPMAssertTrap(pVCpu, X86_XCPT_BP, TRPM_SOFTWARE_INT);
179 return VINF_EM_RAW_GUEST_TRAP;
180 }
181 }
182
183 LogFlow(("DBGFRZTrap01Handler: Unknown bp at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
184 return VERR_DBGF_HYPER_DB_XCPT;
185 }
186#endif
187
188 LogFlow(("DBGFRZTrap01Handler: guest debug event %#x at %04x:%RGv!\n", (uint32_t)uDr6, pRegFrame->cs.Sel, pRegFrame->rip));
189 return VINF_EM_RAW_GUEST_TRAP;
190}
191
192#ifdef VBOX_WITH_LOTS_OF_DBGF_BPS
193# ifdef IN_RING0
194/**
195 * Returns the internal breakpoint state for the given handle.
196 *
197 * @returns Pointer to the internal breakpoint state or NULL if the handle is invalid.
198 * @param pVM The ring-0 VM structure pointer.
199 * @param hBp The breakpoint handle to resolve.
200 * @param ppBpR0 Where to store the pointer to the ring-0 only part of the breakpoint
201 * on success, optional.
202 */
203DECLINLINE(PDBGFBPINT) dbgfR0BpGetByHnd(PVMCC pVM, DBGFBP hBp, PDBGFBPINTR0 *ppBpR0)
204{
205 uint32_t idChunk = DBGF_BP_HND_GET_CHUNK_ID(hBp);
206 uint32_t idxEntry = DBGF_BP_HND_GET_ENTRY(hBp);
207
208 AssertReturn(idChunk < DBGF_BP_CHUNK_COUNT, NULL);
209 AssertReturn(idxEntry < DBGF_BP_COUNT_PER_CHUNK, NULL);
210
211 PDBGFBPCHUNKR0 pBpChunk = &pVM->dbgfr0.s.aBpChunks[idChunk];
212 AssertPtrReturn(pBpChunk->paBpBaseSharedR0, NULL);
213
214 if (ppBpR0)
215 *ppBpR0 = &pBpChunk->paBpBaseR0Only[idxEntry];
216 return &pBpChunk->paBpBaseSharedR0[idxEntry];
217}
218# endif
219
220
221/**
222 * Executes the actions associated with the given breakpoint.
223 *
224 * @returns VBox status code.
225 * @param pVM The cross context VM structure.
226 * @param pVCpu The cross context virtual CPU structure.
227 * @param pRegFrame Pointer to the register frame for the trap.
228 * @param hBp The breakpoint handle which hit.
229 * @param pBp The shared breakpoint state.
230 * @param pBpR0 The ring-0 only breakpoint state.
231 * @param fInHyper Flag whether the breakpoint triggered in hypervisor code.
232 */
233DECLINLINE(int) dbgfRZBpHit(PVMCC pVM, PVMCPUCC pVCpu, PCPUMCTXCORE pRegFrame,
234 DBGFBP hBp, PDBGFBPINT pBp, PDBGFBPINTR0 pBpR0, bool fInHyper)
235{
236 uint64_t cHits = ASMAtomicIncU64(&pBp->Pub.cHits);
237 pVCpu->dbgf.s.hBpActive = hBp;
238
239 /** @todo Owner handling. */
240 RT_NOREF(pVM, pRegFrame, pBpR0);
241
242 LogFlow(("dbgfRZBpHit: hit breakpoint %u at %04x:%RGv cHits=0x%RX64\n",
243 hBp, pRegFrame->cs.Sel, pRegFrame->rip, cHits));
244 return fInHyper
245 ? VINF_EM_DBG_HYPER_BREAKPOINT
246 : VINF_EM_DBG_BREAKPOINT;
247}
248#endif /* !VBOX_WITH_LOTS_OF_DBGF_BPS */
249
250/**
251 * \#BP (Breakpoint) handler.
252 *
253 * @returns VBox status code.
254 * VINF_SUCCESS means we completely handled this trap,
255 * other codes are passed execution to host context.
256 *
257 * @param pVM The cross context VM structure.
258 * @param pVCpu The cross context virtual CPU structure.
259 * @param pRegFrame Pointer to the register frame for the trap.
260 */
261VMMRZ_INT_DECL(int) DBGFRZTrap03Handler(PVMCC pVM, PVMCPUCC pVCpu, PCPUMCTXCORE pRegFrame)
262{
263#ifdef IN_RC
264 const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
265#else
266 const bool fInHyper = false;
267#endif
268
269#ifndef VBOX_WITH_LOTS_OF_DBGF_BPS
270 /*
271 * Get the trap address and look it up in the breakpoint table.
272 * Don't bother if we don't have any breakpoints.
273 */
274 unsigned cToSearch = pVM->dbgf.s.Int3.cToSearch;
275 if (cToSearch > 0)
276 {
277 RTGCPTR pPc;
278 int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
279# ifdef IN_RC
280 pRegFrame->eip - 1,
281# else
282 pRegFrame->rip /* no -1 in R0 */,
283# endif
284 &pPc);
285 AssertRCReturn(rc, rc);
286
287 unsigned iBp = pVM->dbgf.s.Int3.iStartSearch;
288 while (cToSearch-- > 0)
289 {
290 if ( pVM->dbgf.s.aBreakpoints[iBp].u.GCPtr == (RTGCUINTPTR)pPc
291 && pVM->dbgf.s.aBreakpoints[iBp].enmType == DBGFBPTYPE_INT3)
292 {
293 pVM->dbgf.s.aBreakpoints[iBp].cHits++;
294 pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aBreakpoints[iBp].iBp;
295
296 LogFlow(("DBGFRZTrap03Handler: hit breakpoint %d at %RGv (%04x:%RGv) cHits=0x%RX64\n",
297 pVM->dbgf.s.aBreakpoints[iBp].iBp, pPc, pRegFrame->cs.Sel, pRegFrame->rip,
298 pVM->dbgf.s.aBreakpoints[iBp].cHits));
299 return fInHyper
300 ? VINF_EM_DBG_HYPER_BREAKPOINT
301 : VINF_EM_DBG_BREAKPOINT;
302 }
303 iBp++;
304 }
305 }
306#else
307# ifdef IN_RC
308# error "You lucky person have the pleasure to implement the raw mode part for this!"
309# endif
310
311 if (pVM->dbgfr0.s.CTX_SUFF(paBpLocL1))
312 {
313 RTGCPTR GCPtrBp;
314 int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
315# ifdef IN_RC
316 pRegFrame->eip - 1,
317# else
318 pRegFrame->rip /* no -1 in R0 */,
319# endif
320 &GCPtrBp);
321 AssertRCReturn(rc, rc);
322
323 const uint16_t idxL1 = DBGF_BP_INT3_L1_IDX_EXTRACT_FROM_ADDR(GCPtrBp);
324 const uint32_t u32L1Entry = ASMAtomicReadU32(&pVM->dbgfr0.s.CTX_SUFF(paBpLocL1)[idxL1]);
325
326 LogFlowFunc(("GCPtrBp=%RGv idxL1=%u u32L1Entry=%#x\n", GCPtrBp, idxL1, u32L1Entry));
327 if (u32L1Entry != DBGF_BP_INT3_L1_ENTRY_TYPE_NULL)
328 {
329 uint8_t u8Type = DBGF_BP_INT3_L1_ENTRY_GET_TYPE(u32L1Entry);
330 if (u8Type == DBGF_BP_INT3_L1_ENTRY_TYPE_BP_HND)
331 {
332 DBGFBP hBp = DBGF_BP_INT3_L1_ENTRY_GET_BP_HND(u32L1Entry);
333
334 /* Query the internal breakpoint state from the handle. */
335 PDBGFBPINTR0 pBpR0 = NULL;
336 PDBGFBPINT pBp = dbgfR0BpGetByHnd(pVM, hBp, &pBpR0);
337 if ( pBp
338 && DBGF_BP_PUB_GET_TYPE(pBp->Pub.fFlagsAndType) == DBGFBPTYPE_INT3)
339 {
340 if (pBp->Pub.u.Int3.GCPtr == (RTGCUINTPTR)GCPtrBp)
341 return dbgfRZBpHit(pVM, pVCpu, pRegFrame, hBp, pBp, pBpR0, fInHyper);
342 /* else Genuine guest trap. */
343 }
344 /** @todo else Guru meditation */
345 }
346 else if (u8Type == DBGF_BP_INT3_L1_ENTRY_TYPE_L2_IDX)
347 {
348 /** @todo Walk the L2 tree searching for the correct spot. */
349 }
350 /** @todo else Guru meditation */
351 }
352 }
353#endif /* !VBOX_WITH_LOTS_OF_DBGF_BPS */
354
355 return fInHyper
356 ? VINF_EM_DBG_HYPER_ASSERTION
357 : VINF_EM_RAW_GUEST_TRAP;
358}
359
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette