From 9e2154ff1c388193a9b21b770edd0cedf91f897a Mon Sep 17 00:00:00 2001 From: John Baldwin Date: Tue, 22 May 2018 00:45:00 +0000 Subject: [PATCH] Cleanups related to debug exceptions on x86. - Add constants for fields in DR6 and the reserved fields in DR7. Use these constants instead of magic numbers in most places that use DR6 and DR7. - Refer to T_TRCTRAP as "debug exception" rather than a "trace trap" as it is not just for trace exceptions. - Always read DR6 for debug exceptions and only clear TF in the flags register for user exceptions where DR6.BS is set. - Clear DR6 before returning from a debug exception handler as recommended by the SDM dating all the way back to the 386. This allows debuggers to determine the cause of each exception. For kernel traps, clear DR6 in the T_TRCTRAP case and pass DR6 by value to other parts of the handler (namely, user_dbreg_trap()). For user traps, wait until after trapsignal to clear DR6 so that userland debuggers can read DR6 via PT_GETDBREGS while the thread is stopped in trapsignal(). Reviewed by: kib, rgrimes MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D15189 --- sys/amd64/amd64/machdep.c | 25 +++++++-------- sys/amd64/amd64/trap.c | 55 +++++++++++++++++--------------- sys/amd64/include/db_machdep.h | 4 ++- sys/amd64/vmm/amd/svm.c | 5 +-- sys/amd64/vmm/intel/vmx.c | 5 +-- sys/i386/i386/machdep.c | 25 +++++++-------- sys/i386/i386/trap.c | 58 ++++++++++++++++++---------------- sys/i386/include/db_machdep.h | 4 ++- sys/x86/include/reg.h | 10 ++++++ sys/x86/include/x86_var.h | 2 +- 10 files changed, 108 insertions(+), 85 deletions(-) diff --git a/sys/amd64/amd64/machdep.c b/sys/amd64/amd64/machdep.c index 2c3903652f65..a14026398bd0 100644 --- a/sys/amd64/amd64/machdep.c +++ b/sys/amd64/amd64/machdep.c @@ -2486,14 +2486,23 @@ reset_dbregs(void) * breakpoint was in user space. Return 0, otherwise. */ int -user_dbreg_trap(void) +user_dbreg_trap(register_t dr6) { - u_int64_t dr7, dr6; /* debug registers dr6 and dr7 */ + u_int64_t dr7; u_int64_t bp; /* breakpoint bits extracted from dr6 */ int nbp; /* number of breakpoints that triggered */ caddr_t addr[4]; /* breakpoint addresses */ int i; - + + bp = dr6 & DBREG_DR6_BMASK; + if (bp == 0) { + /* + * None of the breakpoint bits are set meaning this + * trap was not caused by any of the debug registers + */ + return 0; + } + dr7 = rdr7(); if ((dr7 & 0x000000ff) == 0) { /* @@ -2505,16 +2514,6 @@ user_dbreg_trap(void) } nbp = 0; - dr6 = rdr6(); - bp = dr6 & 0x0000000f; - - if (!bp) { - /* - * None of the breakpoint bits are set meaning this - * trap was not caused by any of the debug registers - */ - return 0; - } /* * at least one of the breakpoints were hit, check to see diff --git a/sys/amd64/amd64/trap.c b/sys/amd64/amd64/trap.c index 9c50f7ea8774..8e4d411b3435 100644 --- a/sys/amd64/amd64/trap.c +++ b/sys/amd64/amd64/trap.c @@ -126,7 +126,7 @@ static char *trap_msg[] = { "", /* 7 unused */ "", /* 8 unused */ "general protection fault", /* 9 T_PROTFLT */ - "trace trap", /* 10 T_TRCTRAP */ + "debug exception", /* 10 T_TRCTRAP */ "", /* 11 unused */ "page fault", /* 12 T_PAGEFLT */ "", /* 13 unused */ @@ -173,10 +173,7 @@ trap(struct trapframe *frame) ksiginfo_t ksi; struct thread *td; struct proc *p; - register_t addr; -#ifdef KDB - register_t dr6; -#endif + register_t addr, dr6; int signo, ucode; u_int type; @@ -185,6 +182,7 @@ trap(struct trapframe *frame) signo = 0; ucode = 0; addr = 0; + dr6 = 0; VM_CNT_INC(v_trap); type = frame->tf_trapno; @@ -272,18 +270,23 @@ trap(struct trapframe *frame) break; case T_BPTFLT: /* bpt instruction fault */ - case T_TRCTRAP: /* trace trap */ enable_intr(); #ifdef KDTRACE_HOOKS - if (type == T_BPTFLT) { - if (dtrace_pid_probe_ptr != NULL && - dtrace_pid_probe_ptr(frame) == 0) - return; - } + if (dtrace_pid_probe_ptr != NULL && + dtrace_pid_probe_ptr(frame) == 0) + return; #endif - frame->tf_rflags &= ~PSL_T; signo = SIGTRAP; - ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); + ucode = TRAP_BRKPT; + break; + + case T_TRCTRAP: /* debug exception */ + enable_intr(); + signo = SIGTRAP; + ucode = TRAP_TRACE; + dr6 = rdr6(); + if (dr6 & DBREG_DR6_BS) + frame->tf_rflags &= ~PSL_T; break; case T_ARITHTRAP: /* arithmetic trap */ @@ -521,9 +524,13 @@ trap(struct trapframe *frame) } break; - case T_TRCTRAP: /* trace trap */ + case T_TRCTRAP: /* debug exception */ + /* Clear any pending debug events. */ + dr6 = rdr6(); + load_dr6(0); + /* - * Ignore debug register trace traps due to + * Ignore debug register exceptions due to * accesses in the user's address space, which * can happen under several conditions such as * if a user sets a watchpoint on a buffer and @@ -532,14 +539,8 @@ trap(struct trapframe *frame) * in kernel space because that is useful when * debugging the kernel. */ - if (user_dbreg_trap()) { - /* - * Reset breakpoint bits because the - * processor doesn't - */ - load_dr6(rdr6() & ~0xf); + if (user_dbreg_trap(dr6)) return; - } /* * Malicious user code can configure a debug @@ -595,9 +596,6 @@ trap(struct trapframe *frame) * Otherwise, debugger traps "can't happen". */ #ifdef KDB - /* XXX %dr6 is not quite reentrant. */ - dr6 = rdr6(); - load_dr6(dr6 & ~0x4000); if (kdb_trap(type, dr6, frame)) return; #endif @@ -640,6 +638,13 @@ trap(struct trapframe *frame) } KASSERT((read_rflags() & PSL_I) != 0, ("interrupts disabled")); trapsignal(td, &ksi); + + /* + * Clear any pending debug exceptions after allowing a + * debugger to read DR6 while stopped in trapsignal(). + */ + if (type == T_TRCTRAP) + load_dr6(0); userret: userret(td, frame); KASSERT(PCB_USER_FPU(td->td_pcb), diff --git a/sys/amd64/include/db_machdep.h b/sys/amd64/include/db_machdep.h index ed49c2612992..c88c281ff9a6 100644 --- a/sys/amd64/include/db_machdep.h +++ b/sys/amd64/include/db_machdep.h @@ -30,6 +30,7 @@ #define _MACHINE_DB_MACHDEP_H_ #include +#include #include typedef vm_offset_t db_addr_t; /* address - unsigned */ @@ -64,7 +65,8 @@ do { \ * unknown addresses and doesn't turn them off while it is running. */ #define IS_BREAKPOINT_TRAP(type, code) ((type) == T_BPTFLT) -#define IS_SSTEP_TRAP(type, code) ((type) == T_TRCTRAP && (code) & 0x4000) +#define IS_SSTEP_TRAP(type, code) \ + ((type) == T_TRCTRAP && (code) & DBREG_DR6_BS) #define IS_WATCHPOINT_TRAP(type, code) 0 #define I_CALL 0xe8 diff --git a/sys/amd64/vmm/amd/svm.c b/sys/amd64/vmm/amd/svm.c index 9ce50621511f..eb3fd6530963 100644 --- a/sys/amd64/vmm/amd/svm.c +++ b/sys/amd64/vmm/amd/svm.c @@ -42,6 +42,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include #include @@ -507,8 +508,8 @@ vmcb_init(struct svm_softc *sc, int vcpu, uint64_t iopm_base_pa, PAT_VALUE(7, PAT_UNCACHEABLE); /* Set up DR6/7 to power-on state */ - state->dr6 = 0xffff0ff0; - state->dr7 = 0x400; + state->dr6 = DBREG_DR6_RESERVED1; + state->dr7 = DBREG_DR7_RESERVED1; } /* diff --git a/sys/amd64/vmm/intel/vmx.c b/sys/amd64/vmm/intel/vmx.c index 8db58068acfc..ef0354dc826b 100644 --- a/sys/amd64/vmm/intel/vmx.c +++ b/sys/amd64/vmm/intel/vmx.c @@ -46,6 +46,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include #include @@ -994,8 +995,8 @@ vmx_vminit(struct vm *vm, pmap_t pmap) exc_bitmap = 1 << IDT_MC; error += vmwrite(VMCS_EXCEPTION_BITMAP, exc_bitmap); - vmx->ctx[i].guest_dr6 = 0xffff0ff0; - error += vmwrite(VMCS_GUEST_DR7, 0x400); + vmx->ctx[i].guest_dr6 = DBREG_DR6_RESERVED1; + error += vmwrite(VMCS_GUEST_DR7, DBREG_DR7_RESERVED1); if (virtual_interrupt_delivery) { error += vmwrite(VMCS_APIC_ACCESS, APIC_ACCESS_ADDRESS); diff --git a/sys/i386/i386/machdep.c b/sys/i386/i386/machdep.c index cfa7c0e0c936..c1ba777d26d4 100644 --- a/sys/i386/i386/machdep.c +++ b/sys/i386/i386/machdep.c @@ -3151,14 +3151,23 @@ set_dbregs(struct thread *td, struct dbreg *dbregs) * breakpoint was in user space. Return 0, otherwise. */ int -user_dbreg_trap(void) +user_dbreg_trap(register_t dr6) { - u_int32_t dr7, dr6; /* debug registers dr6 and dr7 */ + u_int32_t dr7; u_int32_t bp; /* breakpoint bits extracted from dr6 */ int nbp; /* number of breakpoints that triggered */ caddr_t addr[4]; /* breakpoint addresses */ int i; - + + bp = dr6 & DBREG_DR6_BMASK; + if (bp == 0) { + /* + * None of the breakpoint bits are set meaning this + * trap was not caused by any of the debug registers + */ + return 0; + } + dr7 = rdr7(); if ((dr7 & 0x000000ff) == 0) { /* @@ -3170,16 +3179,6 @@ user_dbreg_trap(void) } nbp = 0; - dr6 = rdr6(); - bp = dr6 & 0x0000000f; - - if (!bp) { - /* - * None of the breakpoint bits are set meaning this - * trap was not caused by any of the debug registers - */ - return 0; - } /* * at least one of the breakpoints were hit, check to see diff --git a/sys/i386/i386/trap.c b/sys/i386/i386/trap.c index 333b2681f82d..12a1316bd7e1 100644 --- a/sys/i386/i386/trap.c +++ b/sys/i386/i386/trap.c @@ -132,7 +132,7 @@ static const struct trap_data trap_data[] = { [T_BPTFLT] = { .ei = false, .msg = "breakpoint instruction fault" }, [T_ARITHTRAP] = { .ei = true, .msg = "arithmetic trap" }, [T_PROTFLT] = { .ei = true, .msg = "general protection fault" }, - [T_TRCTRAP] = { .ei = false, .msg = "trace trap" }, + [T_TRCTRAP] = { .ei = false, .msg = "debug exception" }, [T_PAGEFLT] = { .ei = true, .msg = "page fault" }, [T_ALIGNFLT] = { .ei = true, .msg = "alignment fault" }, [T_DIVIDE] = { .ei = true, .msg = "integer divide fault" }, @@ -199,12 +199,9 @@ trap(struct trapframe *frame) ksiginfo_t ksi; struct thread *td; struct proc *p; -#ifdef KDB - register_t dr6; -#endif int signo, ucode; u_int type; - register_t addr; + register_t addr, dr6; vm_offset_t eva; #ifdef POWERFAIL_NMI static int lastalert = 0; @@ -215,6 +212,7 @@ trap(struct trapframe *frame) signo = 0; ucode = 0; addr = 0; + dr6 = 0; VM_CNT_INC(v_trap); type = frame->tf_trapno; @@ -323,19 +321,24 @@ trap(struct trapframe *frame) break; case T_BPTFLT: /* bpt instruction fault */ - case T_TRCTRAP: /* trace trap */ enable_intr(); #ifdef KDTRACE_HOOKS - if (type == T_BPTFLT) { - if (dtrace_pid_probe_ptr != NULL && - dtrace_pid_probe_ptr(frame) == 0) - return; - } + if (dtrace_pid_probe_ptr != NULL && + dtrace_pid_probe_ptr(frame) == 0) + return; #endif -user_trctrap_out: - frame->tf_eflags &= ~PSL_T; signo = SIGTRAP; - ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); + ucode = TRAP_BRKPT; + break; + + case T_TRCTRAP: /* debug exception */ + enable_intr(); +user_trctrap_out: + signo = SIGTRAP; + ucode = TRAP_TRACE; + dr6 = rdr6(); + if (dr6 & DBREG_DR6_BS) + frame->tf_rflags &= ~PSL_T; break; case T_ARITHTRAP: /* arithmetic trap */ @@ -643,10 +646,14 @@ trap(struct trapframe *frame) } break; - case T_TRCTRAP: /* trace trap */ + case T_TRCTRAP: /* debug exception */ kernel_trctrap: + /* Clear any pending debug events. */ + dr6 = rdr6(); + load_dr6(0); + /* - * Ignore debug register trace traps due to + * Ignore debug register exceptions due to * accesses in the user's address space, which * can happen under several conditions such as * if a user sets a watchpoint on a buffer and @@ -655,15 +662,9 @@ trap(struct trapframe *frame) * in kernel space because that is useful when * debugging the kernel. */ - if (user_dbreg_trap() && - !(curpcb->pcb_flags & PCB_VM86CALL)) { - /* - * Reset breakpoint bits because the - * processor doesn't - */ - load_dr6(rdr6() & ~0xf); + if (user_dbreg_trap(dr6) && + !(curpcb->pcb_flags & PCB_VM86CALL)) return; - } /* * Malicious user code can configure a debug @@ -703,9 +704,6 @@ trap(struct trapframe *frame) * Otherwise, debugger traps "can't happen". */ #ifdef KDB - /* XXX %dr6 is not quite reentrant. */ - dr6 = rdr6(); - load_dr6(dr6 & ~0x4000); if (kdb_trap(type, dr6, frame)) return; #endif @@ -759,6 +757,12 @@ trap(struct trapframe *frame) KASSERT((read_eflags() & PSL_I) != 0, ("interrupts disabled")); trapsignal(td, &ksi); + /* + * Clear any pending debug exceptions after allowing a + * debugger to read DR6 while stopped in trapsignal(). + */ + if (type == T_TRCTRAP) + load_dr6(0); user: userret(td, frame); KASSERT(PCB_USER_FPU(td->td_pcb), diff --git a/sys/i386/include/db_machdep.h b/sys/i386/include/db_machdep.h index 76c0cdce875f..42f0f19d29a9 100644 --- a/sys/i386/include/db_machdep.h +++ b/sys/i386/include/db_machdep.h @@ -30,6 +30,7 @@ #define _MACHINE_DB_MACHDEP_H_ #include +#include #include typedef vm_offset_t db_addr_t; /* address - unsigned */ @@ -67,7 +68,8 @@ do { \ * unknown addresses and doesn't turn them off while it is running. */ #define IS_BREAKPOINT_TRAP(type, code) ((type) == T_BPTFLT) -#define IS_SSTEP_TRAP(type, code) ((type) == T_TRCTRAP && (code) & 0x4000) +#define IS_SSTEP_TRAP(type, code) \ + ((type) == T_TRCTRAP && (code) & DBREG_DR6_BS) #define IS_WATCHPOINT_TRAP(type, code) 0 #define I_CALL 0xe8 diff --git a/sys/x86/include/reg.h b/sys/x86/include/reg.h index b08422564a5a..f82848192e67 100644 --- a/sys/x86/include/reg.h +++ b/sys/x86/include/reg.h @@ -206,6 +206,14 @@ struct __dbreg64 { /* Index 8-15: reserved */ }; +#define DBREG_DR6_RESERVED1 0xffff0ff0 +#define DBREG_DR6_BMASK 0x000f +#define DBREG_DR6_B(i) (1 << (i)) +#define DBREG_DR6_BD 0x2000 +#define DBREG_DR6_BS 0x4000 +#define DBREG_DR6_BT 0x8000 + +#define DBREG_DR7_RESERVED1 0x0400 #define DBREG_DR7_LOCAL_ENABLE 0x01 #define DBREG_DR7_GLOBAL_ENABLE 0x02 #define DBREG_DR7_LEN_1 0x00 /* 1 byte length */ @@ -236,6 +244,8 @@ struct __dbreg64 { #undef __dbreg64 #ifdef _KERNEL +struct thread; + /* * XXX these interfaces are MI, so they should be declared in a MI place. */ diff --git a/sys/x86/include/x86_var.h b/sys/x86/include/x86_var.h index 338727d14cc9..4e9871f434b6 100644 --- a/sys/x86/include/x86_var.h +++ b/sys/x86/include/x86_var.h @@ -145,7 +145,7 @@ void nmi_handle_intr(u_int type, struct trapframe *frame); void pagecopy(void *from, void *to); void printcpuinfo(void); int pti_get_default(void); -int user_dbreg_trap(void); +int user_dbreg_trap(register_t dr6); int minidumpsys(struct dumperinfo *); struct pcb *get_pcb_td(struct thread *td);