Esempio n. 1
0
/**
 * Return to host context from a hypervisor trap handler.
 *
 * This function will *never* return.
 * It will also reset any traps that are pending.
 *
 * @param   pVM     Pointer to the VM.
 * @param   rc      The return code for host context.
 */
VMMRCDECL(void) TRPMGCHyperReturnToHost(PVM pVM, int rc)
{
    PVMCPU pVCpu = VMMGetCpu0(pVM);

    LogFlow(("TRPMGCHyperReturnToHost: rc=%Rrc\n", rc));
    TRPMResetTrap(pVCpu);
    VMMGCGuestToHost(pVM, rc);
    AssertReleaseFailed();
}
/**
 * \#DB (Debug event) handler.
 *
 * @returns VBox status code.
 *          VINF_SUCCESS means we completely handled this trap,
 *          other codes are passed execution to host context.
 *
 * @param   pVM             The cross context VM structure.
 * @param   pVCpu           The cross context virtual CPU structure.
 * @param   pRegFrame       Pointer to the register frame for the trap.
 * @param   uDr6            The DR6 hypervisor register value.
 * @param   fAltStepping    Alternative stepping indicator.
 */
VMMRZ_INT_DECL(int) DBGFRZTrap01Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCUINTREG uDr6, bool fAltStepping)
{
#ifdef IN_RC
    const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
#else
    NOREF(pRegFrame);
    const bool fInHyper = false;
#endif

    /** @todo Intel docs say that X86_DR6_BS has the highest priority... */
    /*
     * A breakpoint?
     */
    AssertCompile(X86_DR6_B0 == 1 && X86_DR6_B1 == 2 && X86_DR6_B2 == 4 && X86_DR6_B3 == 8);
    if (   (uDr6 & (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3))
        && pVM->dbgf.s.cEnabledHwBreakpoints > 0)
    {
        for (unsigned iBp = 0; iBp < RT_ELEMENTS(pVM->dbgf.s.aHwBreakpoints); iBp++)
        {
            if (    ((uint32_t)uDr6 & RT_BIT_32(iBp))
                &&  pVM->dbgf.s.aHwBreakpoints[iBp].enmType == DBGFBPTYPE_REG)
            {
                pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aHwBreakpoints[iBp].iBp;
                pVCpu->dbgf.s.fSingleSteppingRaw = false;
                LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %d at %04x:%RGv\n",
                         pVM->dbgf.s.aHwBreakpoints[iBp].iBp, pRegFrame->cs.Sel, pRegFrame->rip));

                return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
            }
        }
    }

    /*
     * Single step?
     * Are we single stepping or is it the guest?
     */
    if (    (uDr6 & X86_DR6_BS)
        &&  (fInHyper || pVCpu->dbgf.s.fSingleSteppingRaw || fAltStepping))
    {
        pVCpu->dbgf.s.fSingleSteppingRaw = false;
        LogFlow(("DBGFRZTrap01Handler: single step at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
        return fInHyper ? VINF_EM_DBG_HYPER_STEPPED : VINF_EM_DBG_STEPPED;
    }

#ifdef IN_RC
    /*
     * Either an ICEBP in hypervisor code or a guest related debug exception
     * of sorts.
     */
    if (RT_UNLIKELY(fInHyper))
    {
        /*
         * Is this a guest debug event that was delayed past a ring transition?
         *
         * Since we do no allow sysenter/syscall in raw-mode, the  only
         * non-trap/fault type transitions that can occur are thru interrupt gates.
         * Of those, only INT3 (#BP) has a DPL other than 0 with a CS.RPL of 0.
         * See bugref:9171 and bs3-cpu-weird-1 for more details.
         *
         * We need to reconstruct the guest register state from the hypervisor one
         * here, so here is the layout of the IRET frame on the stack:
         *    20:[8] GS          (V86 only)
         *    1C:[7] FS          (V86 only)
         *    18:[6] DS          (V86 only)
         *    14:[5] ES          (V86 only)
         *    10:[4] SS
         *    0c:[3] ESP
         *    08:[2] EFLAGS
         *    04:[1] CS
         *    00:[0] EIP
         */
        if (pRegFrame->rip == (uintptr_t)TRPMRCHandlerAsmTrap03)
        {
            uint32_t const *pu32Stack = (uint32_t const *)pRegFrame->esp;
            if (   (pu32Stack[2] & X86_EFL_VM)
                || (pu32Stack[1] & X86_SEL_RPL))
            {
                LogFlow(("DBGFRZTrap01Handler: Detected guest #DB delayed past ring transition %04x:%RX32 %#x\n",
                         pu32Stack[1] & 0xffff, pu32Stack[0], pu32Stack[2]));
                PCPUMCTX pGstCtx = CPUMQueryGuestCtxPtr(pVCpu);
                pGstCtx->rip      = pu32Stack[0];
                pGstCtx->cs.Sel   = pu32Stack[1];
                pGstCtx->eflags.u = pu32Stack[2];
                pGstCtx->rsp      = pu32Stack[3];
                pGstCtx->ss.Sel   = pu32Stack[4];
                if (pu32Stack[2] & X86_EFL_VM)
                {
                    pGstCtx->es.Sel = pu32Stack[5];
                    pGstCtx->ds.Sel = pu32Stack[6];
                    pGstCtx->fs.Sel = pu32Stack[7];
                    pGstCtx->gs.Sel = pu32Stack[8];
                }
                else
                {
                    pGstCtx->es.Sel = pRegFrame->es.Sel;
                    pGstCtx->ds.Sel = pRegFrame->ds.Sel;
                    pGstCtx->fs.Sel = pRegFrame->fs.Sel;
                    pGstCtx->gs.Sel = pRegFrame->gs.Sel;
                }
                pGstCtx->rax      = pRegFrame->rax;
                pGstCtx->rcx      = pRegFrame->rcx;
                pGstCtx->rdx      = pRegFrame->rdx;
                pGstCtx->rbx      = pRegFrame->rbx;
                pGstCtx->rsi      = pRegFrame->rsi;
                pGstCtx->rdi      = pRegFrame->rdi;
                pGstCtx->rbp      = pRegFrame->rbp;

                /*
                 * We should assert a #BP followed by a #DB here, but TRPM cannot
                 * do that.  So, we'll just assert the #BP and ignore the #DB, even
                 * if that isn't strictly correct.
                 */
                TRPMResetTrap(pVCpu);
                TRPMAssertTrap(pVCpu, X86_XCPT_BP, TRPM_SOFTWARE_INT);
                return VINF_EM_RAW_GUEST_TRAP;
            }
        }

        LogFlow(("DBGFRZTrap01Handler: Unknown bp at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
        return VERR_DBGF_HYPER_DB_XCPT;
    }
#endif

    LogFlow(("DBGFRZTrap01Handler: guest debug event %#x at %04x:%RGv!\n", (uint32_t)uDr6, pRegFrame->cs.Sel, pRegFrame->rip));
    return VINF_EM_RAW_GUEST_TRAP;
}