d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Cleanups related to debug exceptions on x86.

Browse Source 
- Add constants for fields in DR6 and the reserved fields in DR7.  Use
  these constants instead of magic numbers in most places that use DR6
  and DR7.
- Refer to T_TRCTRAP as "debug exception" rather than a "trace trap"
  as it is not just for trace exceptions.
- Always read DR6 for debug exceptions and only clear TF in the flags
  register for user exceptions where DR6.BS is set.
- Clear DR6 before returning from a debug exception handler as
  recommended by the SDM dating all the way back to the 386.  This
  allows debuggers to determine the cause of each exception.  For
  kernel traps, clear DR6 in the T_TRCTRAP case and pass DR6 by value
  to other parts of the handler (namely, user_dbreg_trap()).  For user
  traps, wait until after trapsignal to clear DR6 so that userland
  debuggers can read DR6 via PT_GETDBREGS while the thread is stopped
  in trapsignal().

Reviewed by:	kib, rgrimes
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D15189
This commit is contained in:
John Baldwin 2018-05-22 00:45:00 +00:00
parent dc0dbd74c4
commit 9e2154ff1c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=334009
10 changed files with 108 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
sys/amd64/amd64/machdep.c
View File

@ -2486,14 +2486,23 @@ reset_dbregs(void)
* breakpoint was in user space. Return 0, otherwise.
*/
int
user_dbreg_trap(void)
user_dbreg_trap(register_t dr6)
{
u_int64_t dr7, dr6; /* debug registers dr6 and dr7 */
u_int64_t dr7;
u_int64_t bp; /* breakpoint bits extracted from dr6 */
int nbp; /* number of breakpoints that triggered */
caddr_t addr[4]; /* breakpoint addresses */
int i;
bp = dr6 & DBREG_DR6_BMASK;
if (bp == 0) {
/*
* None of the breakpoint bits are set meaning this
* trap was not caused by any of the debug registers
*/
return 0;
}
dr7 = rdr7();
if ((dr7 & 0x000000ff) == 0) {
/*
@ -2505,16 +2514,6 @@ user_dbreg_trap(void)
}
nbp = 0;
dr6 = rdr6();
bp = dr6 & 0x0000000f;
if (!bp) {
/*
* None of the breakpoint bits are set meaning this
* trap was not caused by any of the debug registers
*/
return 0;
}
/*
* at least one of the breakpoints were hit, check to see

55
sys/amd64/amd64/trap.c
View File

@ -126,7 +126,7 @@ static char *trap_msg[] = {
"", /* 7 unused */
"", /* 8 unused */
"general protection fault", /* 9 T_PROTFLT */
"trace trap", /* 10 T_TRCTRAP */
"debug exception", /* 10 T_TRCTRAP */
"", /* 11 unused */
"page fault", /* 12 T_PAGEFLT */
"", /* 13 unused */
@ -173,10 +173,7 @@ trap(struct trapframe *frame)
ksiginfo_t ksi;
struct thread *td;
struct proc *p;
register_t addr;
#ifdef KDB
register_t dr6;
#endif
register_t addr, dr6;
int signo, ucode;
u_int type;
@ -185,6 +182,7 @@ trap(struct trapframe *frame)
signo = 0;
ucode = 0;
addr = 0;
dr6 = 0;
VM_CNT_INC(v_trap);
type = frame->tf_trapno;
@ -272,18 +270,23 @@ trap(struct trapframe *frame)
break;
case T_BPTFLT: /* bpt instruction fault */
case T_TRCTRAP: /* trace trap */
enable_intr();
#ifdef KDTRACE_HOOKS
if (type == T_BPTFLT) {
if (dtrace_pid_probe_ptr != NULL &&
dtrace_pid_probe_ptr(frame) == 0)
return;
}
if (dtrace_pid_probe_ptr != NULL &&
dtrace_pid_probe_ptr(frame) == 0)
return;
#endif
frame->tf_rflags &= ~PSL_T;
signo = SIGTRAP;
ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT);
ucode = TRAP_BRKPT;
break;
case T_TRCTRAP: /* debug exception */
enable_intr();
signo = SIGTRAP;
ucode = TRAP_TRACE;
dr6 = rdr6();
if (dr6 & DBREG_DR6_BS)
frame->tf_rflags &= ~PSL_T;
break;
case T_ARITHTRAP: /* arithmetic trap */
@ -521,9 +524,13 @@ trap(struct trapframe *frame)
}
break;
case T_TRCTRAP: /* trace trap */
case T_TRCTRAP: /* debug exception */
/* Clear any pending debug events. */
dr6 = rdr6();
load_dr6(0);
/*
* Ignore debug register trace traps due to
* Ignore debug register exceptions due to
* accesses in the user's address space, which
* can happen under several conditions such as
* if a user sets a watchpoint on a buffer and
@ -532,14 +539,8 @@ trap(struct trapframe *frame)
* in kernel space because that is useful when
* debugging the kernel.
*/
if (user_dbreg_trap()) {
/*
* Reset breakpoint bits because the
* processor doesn't
*/
load_dr6(rdr6() & ~0xf);
if (user_dbreg_trap(dr6))
return;
}
/*
* Malicious user code can configure a debug
@ -595,9 +596,6 @@ trap(struct trapframe *frame)
* Otherwise, debugger traps "can't happen".
*/
#ifdef KDB
/* XXX %dr6 is not quite reentrant. */
dr6 = rdr6();
load_dr6(dr6 & ~0x4000);
if (kdb_trap(type, dr6, frame))
return;
#endif
@ -640,6 +638,13 @@ trap(struct trapframe *frame)
}
KASSERT((read_rflags() & PSL_I) != 0, ("interrupts disabled"));
trapsignal(td, &ksi);
/*
* Clear any pending debug exceptions after allowing a
* debugger to read DR6 while stopped in trapsignal().
*/
if (type == T_TRCTRAP)
load_dr6(0);
userret:
userret(td, frame);
KASSERT(PCB_USER_FPU(td->td_pcb),

4
sys/amd64/include/db_machdep.h
View File

@ -30,6 +30,7 @@
#define _MACHINE_DB_MACHDEP_H_
#include <machine/frame.h>
#include <machine/reg.h>
#include <machine/trap.h>
typedef vm_offset_t db_addr_t; /* address - unsigned */
@ -64,7 +65,8 @@ do { \
* unknown addresses and doesn't turn them off while it is running.
*/
#define IS_BREAKPOINT_TRAP(type, code) ((type) == T_BPTFLT)
#define IS_SSTEP_TRAP(type, code) ((type) == T_TRCTRAP && (code) & 0x4000)
#define IS_SSTEP_TRAP(type, code) \
((type) == T_TRCTRAP && (code) & DBREG_DR6_BS)
#define IS_WATCHPOINT_TRAP(type, code) 0
#define I_CALL 0xe8

5
sys/amd64/vmm/amd/svm.c
View File

@ -42,6 +42,7 @@ __FBSDID("$FreeBSD$");
#include <machine/cpufunc.h>
#include <machine/psl.h>
#include <machine/md_var.h>
#include <machine/reg.h>
#include <machine/specialreg.h>
#include <machine/smp.h>
#include <machine/vmm.h>
@ -507,8 +508,8 @@ vmcb_init(struct svm_softc *sc, int vcpu, uint64_t iopm_base_pa,
PAT_VALUE(7, PAT_UNCACHEABLE);
/* Set up DR6/7 to power-on state */
state->dr6 = 0xffff0ff0;
state->dr7 = 0x400;
state->dr6 = DBREG_DR6_RESERVED1;
state->dr7 = DBREG_DR7_RESERVED1;
}
/*

5
sys/amd64/vmm/intel/vmx.c
View File

@ -46,6 +46,7 @@ __FBSDID("$FreeBSD$");
#include <machine/psl.h>
#include <machine/cpufunc.h>
#include <machine/md_var.h>
#include <machine/reg.h>
#include <machine/segments.h>
#include <machine/smp.h>
#include <machine/specialreg.h>
@ -994,8 +995,8 @@ vmx_vminit(struct vm *vm, pmap_t pmap)
exc_bitmap = 1 << IDT_MC;
error += vmwrite(VMCS_EXCEPTION_BITMAP, exc_bitmap);
vmx->ctx[i].guest_dr6 = 0xffff0ff0;
error += vmwrite(VMCS_GUEST_DR7, 0x400);
vmx->ctx[i].guest_dr6 = DBREG_DR6_RESERVED1;
error += vmwrite(VMCS_GUEST_DR7, DBREG_DR7_RESERVED1);
if (virtual_interrupt_delivery) {
error += vmwrite(VMCS_APIC_ACCESS, APIC_ACCESS_ADDRESS);

25
sys/i386/i386/machdep.c
View File

@ -3151,14 +3151,23 @@ set_dbregs(struct thread *td, struct dbreg *dbregs)
* breakpoint was in user space. Return 0, otherwise.
*/
int
user_dbreg_trap(void)
user_dbreg_trap(register_t dr6)
{
u_int32_t dr7, dr6; /* debug registers dr6 and dr7 */
u_int32_t dr7;
u_int32_t bp; /* breakpoint bits extracted from dr6 */
int nbp; /* number of breakpoints that triggered */
caddr_t addr[4]; /* breakpoint addresses */
int i;
bp = dr6 & DBREG_DR6_BMASK;
if (bp == 0) {
/*
* None of the breakpoint bits are set meaning this
* trap was not caused by any of the debug registers
*/
return 0;
}
dr7 = rdr7();
if ((dr7 & 0x000000ff) == 0) {
/*
@ -3170,16 +3179,6 @@ user_dbreg_trap(void)
}
nbp = 0;
dr6 = rdr6();
bp = dr6 & 0x0000000f;
if (!bp) {
/*
* None of the breakpoint bits are set meaning this
* trap was not caused by any of the debug registers
*/
return 0;
}
/*
* at least one of the breakpoints were hit, check to see

58
sys/i386/i386/trap.c
View File

@ -132,7 +132,7 @@ static const struct trap_data trap_data[] = {
[T_BPTFLT] = { .ei = false, .msg = "breakpoint instruction fault" },
[T_ARITHTRAP] = { .ei = true, .msg = "arithmetic trap" },
[T_PROTFLT] = { .ei = true, .msg = "general protection fault" },
[T_TRCTRAP] = { .ei = false, .msg = "trace trap" },
[T_TRCTRAP] = { .ei = false, .msg = "debug exception" },
[T_PAGEFLT] = { .ei = true, .msg = "page fault" },
[T_ALIGNFLT] = { .ei = true, .msg = "alignment fault" },
[T_DIVIDE] = { .ei = true, .msg = "integer divide fault" },
@ -199,12 +199,9 @@ trap(struct trapframe *frame)
ksiginfo_t ksi;
struct thread *td;
struct proc *p;
#ifdef KDB
register_t dr6;
#endif
int signo, ucode;
u_int type;
register_t addr;
register_t addr, dr6;
vm_offset_t eva;
#ifdef POWERFAIL_NMI
static int lastalert = 0;
@ -215,6 +212,7 @@ trap(struct trapframe *frame)
signo = 0;
ucode = 0;
addr = 0;
dr6 = 0;
VM_CNT_INC(v_trap);
type = frame->tf_trapno;
@ -323,19 +321,24 @@ trap(struct trapframe *frame)
break;
case T_BPTFLT: /* bpt instruction fault */
case T_TRCTRAP: /* trace trap */
enable_intr();
#ifdef KDTRACE_HOOKS
if (type == T_BPTFLT) {
if (dtrace_pid_probe_ptr != NULL &&
dtrace_pid_probe_ptr(frame) == 0)
return;
}
if (dtrace_pid_probe_ptr != NULL &&
dtrace_pid_probe_ptr(frame) == 0)
return;
#endif
user_trctrap_out:
frame->tf_eflags &= ~PSL_T;
signo = SIGTRAP;
ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT);
ucode = TRAP_BRKPT;
break;
case T_TRCTRAP: /* debug exception */
enable_intr();
user_trctrap_out:
signo = SIGTRAP;
ucode = TRAP_TRACE;
dr6 = rdr6();
if (dr6 & DBREG_DR6_BS)
frame->tf_rflags &= ~PSL_T;
break;
case T_ARITHTRAP: /* arithmetic trap */
@ -643,10 +646,14 @@ trap(struct trapframe *frame)
}
break;
case T_TRCTRAP: /* trace trap */
case T_TRCTRAP: /* debug exception */
kernel_trctrap:
/* Clear any pending debug events. */
dr6 = rdr6();
load_dr6(0);
/*
* Ignore debug register trace traps due to
* Ignore debug register exceptions due to
* accesses in the user's address space, which
* can happen under several conditions such as
* if a user sets a watchpoint on a buffer and
@ -655,15 +662,9 @@ trap(struct trapframe *frame)
* in kernel space because that is useful when
* debugging the kernel.
*/
if (user_dbreg_trap() &&
!(curpcb->pcb_flags & PCB_VM86CALL)) {
/*
* Reset breakpoint bits because the
* processor doesn't
*/
load_dr6(rdr6() & ~0xf);
if (user_dbreg_trap(dr6) &&
!(curpcb->pcb_flags & PCB_VM86CALL))
return;
}
/*
* Malicious user code can configure a debug
@ -703,9 +704,6 @@ trap(struct trapframe *frame)
* Otherwise, debugger traps "can't happen".
*/
#ifdef KDB
/* XXX %dr6 is not quite reentrant. */
dr6 = rdr6();
load_dr6(dr6 & ~0x4000);
if (kdb_trap(type, dr6, frame))
return;
#endif
@ -759,6 +757,12 @@ trap(struct trapframe *frame)
KASSERT((read_eflags() & PSL_I) != 0, ("interrupts disabled"));
trapsignal(td, &ksi);
/*
* Clear any pending debug exceptions after allowing a
* debugger to read DR6 while stopped in trapsignal().
*/
if (type == T_TRCTRAP)
load_dr6(0);
user:
userret(td, frame);
KASSERT(PCB_USER_FPU(td->td_pcb),

4
sys/i386/include/db_machdep.h
View File

@ -30,6 +30,7 @@
#define _MACHINE_DB_MACHDEP_H_
#include <machine/frame.h>
#include <machine/reg.h>
#include <machine/trap.h>
typedef vm_offset_t db_addr_t; /* address - unsigned */
@ -67,7 +68,8 @@ do { \
* unknown addresses and doesn't turn them off while it is running.
*/
#define IS_BREAKPOINT_TRAP(type, code) ((type) == T_BPTFLT)
#define IS_SSTEP_TRAP(type, code) ((type) == T_TRCTRAP && (code) & 0x4000)
#define IS_SSTEP_TRAP(type, code) \
((type) == T_TRCTRAP && (code) & DBREG_DR6_BS)
#define IS_WATCHPOINT_TRAP(type, code) 0
#define I_CALL 0xe8

10
sys/x86/include/reg.h
View File

@ -206,6 +206,14 @@ struct __dbreg64 {
/* Index 8-15: reserved */
};
#define DBREG_DR6_RESERVED1 0xffff0ff0
#define DBREG_DR6_BMASK 0x000f
#define DBREG_DR6_B(i) (1 << (i))
#define DBREG_DR6_BD 0x2000
#define DBREG_DR6_BS 0x4000
#define DBREG_DR6_BT 0x8000
#define DBREG_DR7_RESERVED1 0x0400
#define DBREG_DR7_LOCAL_ENABLE 0x01
#define DBREG_DR7_GLOBAL_ENABLE 0x02
#define DBREG_DR7_LEN_1 0x00 /* 1 byte length */
@ -236,6 +244,8 @@ struct __dbreg64 {
#undef __dbreg64
#ifdef _KERNEL
struct thread;
/*
* XXX these interfaces are MI, so they should be declared in a MI place.
*/

2
sys/x86/include/x86_var.h
View File

@ -145,7 +145,7 @@ void nmi_handle_intr(u_int type, struct trapframe *frame);
void pagecopy(void *from, void *to);
void printcpuinfo(void);
int pti_get_default(void);
int user_dbreg_trap(void);
int user_dbreg_trap(register_t dr6);
int minidumpsys(struct dumperinfo *);
struct pcb *get_pcb_td(struct thread *td);