| #/**@file | |
| # Low leve x64 specific debug support functions. | |
| # | |
| # Copyright (c) 2006 - 2008, Intel Corporation | |
| # All rights reserved. This program and the accompanying materials | |
| # are licensed and made available under the terms and conditions of the BSD License | |
| # which accompanies this distribution. The full text of the license may be found at | |
| # http://opensource.org/licenses/bsd-license.php | |
| # | |
| # THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. | |
| # | |
| #**/ | |
| .intel_syntax noprefix | |
| .globl ASM_PFX(OrigVector) | |
| .globl ASM_PFX(InterruptEntryStub) | |
| .globl ASM_PFX(StubSize) | |
| .globl ASM_PFX(CommonIdtEntry) | |
| .globl ASM_PFX(FxStorSupport) | |
| .data | |
| ASM_PFX(StubSize): .long ASM_PFX(InterruptEntryStubEnd) - ASM_PFX(InterruptEntryStub) | |
| ASM_PFX(AppRsp): .long 0x11111111 # ? | |
| .long 0x11111111 # ? | |
| ASM_PFX(DebugRsp): .long 0x22222222 # ? | |
| .long 0x22222222 # ? | |
| ASM_PFX(ExtraPush): .long 0x33333333 # ? | |
| .long 0x33333333 # ? | |
| ASM_PFX(ExceptData): .long 0x44444444 # ? | |
| .long 0x44444444 # ? | |
| ASM_PFX(Rflags): .long 0x55555555 # ? | |
| .long 0x55555555 # ? | |
| ASM_PFX(OrigVector): .long 0x66666666 # ? | |
| .long 0x66666666 # ? | |
| ## The declarations below define the memory region that will be used for the debug stack. | |
| ## The context record will be built by pushing register values onto this stack. | |
| ## It is imparitive that alignment be carefully managed, since the FXSTOR and | |
| ## FXRSTOR instructions will GP fault if their memory operand is not 16 byte aligned. | |
| ## | |
| ## The stub will switch stacks from the application stack to the debuger stack | |
| ## and pushes the exception number. | |
| ## | |
| ## Then we building the context record on the stack. Since the stack grows down, | |
| ## we push the fields of the context record from the back to the front. There | |
| ## are 336 bytes of stack used prior allocating the 512 bytes of stack to be | |
| ## used as the memory buffer for the fxstor instruction. Therefore address of | |
| ## the buffer used for the FXSTOR instruction is &Eax - 336 - 512, which | |
| ## must be 16 byte aligned. | |
| ## | |
| ## We carefully locate the stack to make this happen. | |
| ## | |
| ## For reference, the context structure looks like this: | |
| ## struct { | |
| ## UINT64 ExceptionData; | |
| ## FX_SAVE_STATE_X64 FxSaveState; // 512 bytes, must be 16 byte aligned | |
| ## UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7; | |
| ## UINT64 Cr0, Cr1, Cr2, Cr3, Cr4, Cr8; | |
| ## UINT64 RFlags; | |
| ## UINT64 Ldtr, Tr; | |
| ## UINT64 Gdtr[2], Idtr[2]; | |
| ## UINT64 Rip; | |
| ## UINT64 Gs, Fs, Es, Ds, Cs, Ss; | |
| ## UINT64 Rdi, Rsi, Rbp, Rsp, Rbx, Rdx, Rcx, Rax; | |
| ## UINT64 R8, R9, R10, R11, R12, R13, R14, R15; | |
| ## } SYSTEM_CONTEXT_X64; // 64 bit system context record | |
| .align 16 | |
| DebugStackEnd : .ascii "DbgStkEnd >>>>>>" # 16 byte long string - must be 16 bytes to preserve alignment | |
| .rept 0x1ffc | |
| .long 0x00000000 | |
| .endr | |
| # 32K should be enough stack | |
| # This allocation is coocked to insure | |
| # that the the buffer for the FXSTORE instruction | |
| # will be 16 byte aligned also. | |
| # | |
| ASM_PFX(ExceptionNumber): .long 0x77777777 # first entry will be the vector number pushed by the stub | |
| .long 0x77777777 # ? | |
| DebugStackBegin : .ascii "<<<< DbgStkBegin" # initial debug ESP == DebugStackBegin, set in stub | |
| .text | |
| #------------------------------------------------------------------------------ | |
| # BOOLEAN | |
| # FxStorSupport ( | |
| # void | |
| # ) | |
| # | |
| # Abstract: Returns TRUE if FxStor instructions are supported | |
| # | |
| .globl ASM_PFX(FxStorSupport) | |
| ASM_PFX(FxStorSupport): | |
| # | |
| # cpuid corrupts rbx which must be preserved per the C calling convention | |
| # | |
| push rbx | |
| mov rax, 1 | |
| cpuid | |
| mov eax, edx | |
| and rax, 0x01000000 | |
| shr rax, 24 | |
| pop rbx | |
| ret | |
| #------------------------------------------------------------------------------ | |
| # void | |
| # Vect2Desc ( | |
| # IA32_IDT_GATE_DESCRIPTOR * DestDesc, // rcx | |
| # void (*Vector) (void) // rdx | |
| # ) | |
| # | |
| # Abstract: Encodes an IDT descriptor with the given physical address | |
| # | |
| .globl ASM_PFX(Vect2Desc) | |
| ASM_PFX(Vect2Desc): | |
| mov rax, rdx | |
| mov word ptr [rcx], ax # write bits 15..0 of offset | |
| mov dx, cs | |
| mov word ptr [rcx+2], dx # SYS_CODE_SEL from GDT | |
| mov word ptr [rcx+4], 0x0e00 OR 0x8000 # type = 386 interrupt gate, present | |
| shr rax, 16 | |
| mov word ptr [rcx+6], ax # write bits 31..16 of offset | |
| shr rax, 16 | |
| mov dword ptr [rcx+8], eax # write bits 63..32 of offset | |
| ret | |
| #------------------------------------------------------------------------------ | |
| # InterruptEntryStub | |
| # | |
| # Abstract: This code is not a function, but is a small piece of code that is | |
| # copied and fixed up once for each IDT entry that is hooked. | |
| # | |
| .globl ASM_PFX(InterruptEntryStub) | |
| ASM_PFX(InterruptEntryStub): | |
| push 0 # push vector number - will be modified before installed | |
| jmp ASM_PFX(CommonIdtEntry) | |
| .globl ASM_PFX(InterruptEntryStubEnd) | |
| ASM_PFX(InterruptEntryStubEnd): | |
| #------------------------------------------------------------------------------ | |
| # CommonIdtEntry | |
| # | |
| # Abstract: This code is not a function, but is the common part for all IDT | |
| # vectors. | |
| # | |
| .globl ASM_PFX(CommonIdtEntry) | |
| ## | |
| ## At this point, the stub has saved the current application stack esp into AppRsp | |
| ## and switched stacks to the debug stack, where it pushed the vector number | |
| ## | |
| ## The application stack looks like this: | |
| ## | |
| ## ... | |
| ## (last application stack entry) | |
| ## [16 bytes alignment, do not care it] | |
| ## SS from interrupted task | |
| ## RSP from interrupted task | |
| ## rflags from interrupted task | |
| ## CS from interrupted task | |
| ## RIP from interrupted task | |
| ## Error code <-------------------- Only present for some exeption types | |
| ## | |
| ## Vector Number <----------------- pushed in our IDT Entry | |
| ## | |
| ## The stub switched us to the debug stack and pushed the interrupt number. | |
| ## | |
| ## Next, construct the context record. It will be build on the debug stack by | |
| ## pushing the registers in the correct order so as to create the context structure | |
| ## on the debug stack. The context record must be built from the end back to the | |
| ## beginning because the stack grows down... | |
| # | |
| ## For reference, the context record looks like this: | |
| ## | |
| ## typedef | |
| ## struct { | |
| ## UINT64 ExceptionData; | |
| ## FX_SAVE_STATE_X64 FxSaveState; | |
| ## UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7; | |
| ## UINT64 Cr0, Cr2, Cr3, Cr4, Cr8; | |
| ## UINT64 RFlags; | |
| ## UINT64 Ldtr, Tr; | |
| ## UINT64 Gdtr[2], Idtr[2]; | |
| ## UINT64 Rip; | |
| ## UINT64 Gs, Fs, Es, Ds, Cs, Ss; | |
| ## UINT64 Rdi, Rsi, Rbp, Rsp, Rbx, Rdx, Rcx, Rax; | |
| ## UINT64 R8, R9, R10, R11, R12, R13, R14, R15; | |
| ## } SYSTEM_CONTEXT_X64; // 64 | |
| ASM_PFX(CommonIdtEntry): | |
| ## NOTE: we save rsp here to prevent compiler put rip reference cause error AppRsp | |
| push rax | |
| mov rax, qword ptr [rsp][8] # save vector number | |
| mov ASM_PFX(ExceptionNumber), rax # save vector number | |
| pop rax | |
| add rsp, 8 # pop vector number | |
| mov ASM_PFX(AppRsp), rsp # save stack top | |
| mov rsp, offset DebugStackBegin # switch to debugger stack | |
| sub rsp, 8 # leave space for vector number | |
| ## UINT64 Rdi, Rsi, Rbp, Rsp, Rbx, Rdx, Rcx, Rax; | |
| ## UINT64 R8, R9, R10, R11, R12, R13, R14, R15; | |
| push r15 | |
| push r14 | |
| push r13 | |
| push r12 | |
| push r11 | |
| push r10 | |
| push r9 | |
| push r8 | |
| push rax | |
| push rcx | |
| push rdx | |
| push rbx | |
| push rsp | |
| push rbp | |
| push rsi | |
| push rdi | |
| ## Save interrupt state rflags register... | |
| pushfq | |
| pop rax | |
| mov qword ptr ASM_PFX(Rflags), rax | |
| ## We need to determine if any extra data was pushed by the exception, and if so, save it | |
| ## To do this, we check the exception number pushed by the stub, and cache the | |
| ## result in a variable since we'll need this again. | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 0 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 10 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 11 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 12 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 13 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 14 | |
| jz ExtraPushOne | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 17 | |
| jz ExtraPushOne | |
| mov dword ptr ASM_PFX(ExtraPush), 0 | |
| mov dword ptr ASM_PFX(ExceptData), 0 | |
| jmp ExtraPushDone | |
| ExtraPushOne: | |
| mov dword ptr ASM_PFX(ExtraPush), 1 | |
| ## If there's some extra data, save it also, and modify the saved AppRsp to effectively | |
| ## pop this value off the application's stack. | |
| mov rax, ASM_PFX(AppRsp) | |
| mov rbx, [rax] | |
| mov ASM_PFX(ExceptData), rbx | |
| add rax, 8 | |
| mov ASM_PFX(AppRsp), rax | |
| ExtraPushDone: | |
| ## The "push" above pushed the debug stack rsp. Since what we're actually doing | |
| ## is building the context record on the debug stack, we need to save the pushed | |
| ## debug RSP, and replace it with the application's last stack entry... | |
| mov rax, [rsp + 24] | |
| mov ASM_PFX(DebugRsp), rax | |
| mov rax, ASM_PFX(AppRsp) | |
| add rax, 40 | |
| # application stack has ss, rsp, rflags, cs, & rip, so | |
| # last actual application stack entry is 40 bytes | |
| # into the application stack. | |
| mov [rsp + 24], rax | |
| ## continue building context record | |
| ## UINT64 Gs, Fs, Es, Ds, Cs, Ss; insure high 16 bits of each is zero | |
| mov rax, ss | |
| push rax | |
| # CS from application is one entry back in application stack | |
| mov rax, ASM_PFX(AppRsp) | |
| movzx rax, word ptr [rax + 8] | |
| push rax | |
| mov rax, ds | |
| push rax | |
| mov rax, es | |
| push rax | |
| mov rax, fs | |
| push rax | |
| mov rax, gs | |
| push rax | |
| ## UINT64 Rip; | |
| # Rip from application is on top of application stack | |
| mov rax, ASM_PFX(AppRsp) | |
| push qword ptr [rax] | |
| ## UINT64 Gdtr[2], Idtr[2]; | |
| push 0 | |
| push 0 | |
| sidt [rsp] | |
| push 0 | |
| push 0 | |
| sgdt [rsp] | |
| ## UINT64 Ldtr, Tr; | |
| xor rax, rax | |
| str ax | |
| push rax | |
| sldt ax | |
| push rax | |
| ## UINT64 RFlags; | |
| ## Rflags from application is two entries back in application stack | |
| mov rax, ASM_PFX(AppRsp) | |
| push qword ptr [rax + 16] | |
| ## UINT64 Cr0, Cr1, Cr2, Cr3, Cr4, Cr8; | |
| ## insure FXSAVE/FXRSTOR is enabled in CR4... | |
| ## ... while we're at it, make sure DE is also enabled... | |
| mov rax, cr8 | |
| push rax | |
| mov rax, cr4 | |
| or rax, 0x208 | |
| mov cr4, rax | |
| push rax | |
| mov rax, cr3 | |
| push rax | |
| mov rax, cr2 | |
| push rax | |
| push 0 | |
| mov rax, cr0 | |
| push rax | |
| ## UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7; | |
| mov rax, dr7 | |
| push rax | |
| ## clear Dr7 while executing debugger itself | |
| xor rax, rax | |
| mov dr7, rax | |
| mov rax, dr6 | |
| push rax | |
| ## insure all status bits in dr6 are clear... | |
| xor rax, rax | |
| mov dr6, rax | |
| mov rax, dr3 | |
| push rax | |
| mov rax, dr2 | |
| push rax | |
| mov rax, dr1 | |
| push rax | |
| mov rax, dr0 | |
| push rax | |
| ## FX_SAVE_STATE_X64 FxSaveState; | |
| sub rsp, 512 | |
| mov rdi, rsp | |
| # IMPORTANT!! The debug stack has been carefully constructed to | |
| # insure that rsp and rdi are 16 byte aligned when we get here. | |
| # They MUST be. If they are not, a GP fault will occur. | |
| # FXSTOR_RDI | |
| fxsave [rdi] | |
| ## UINT64 ExceptionData; | |
| mov rax, ASM_PFX(ExceptData) | |
| push rax | |
| # call to C code which will in turn call registered handler | |
| # pass in the vector number | |
| mov rdx, rsp | |
| mov rcx, ASM_PFX(ExceptionNumber) | |
| sub rsp, 40 | |
| call ASM_PFX(InterruptDistrubutionHub) | |
| add rsp, 40 | |
| # restore context... | |
| ## UINT64 ExceptionData; | |
| add rsp, 8 | |
| ## FX_SAVE_STATE_X64 FxSaveState; | |
| mov rsi, rsp | |
| # FXRSTOR_RSI | |
| fxrstor [rsi] | |
| add rsp, 512 | |
| ## UINT64 Dr0, Dr1, Dr2, Dr3, Dr6, Dr7; | |
| pop rax | |
| mov dr0, rax | |
| pop rax | |
| mov dr1, rax | |
| pop rax | |
| mov dr2, rax | |
| pop rax | |
| mov dr3, rax | |
| ## skip restore of dr6. We cleared dr6 during the context save. | |
| add rsp, 8 | |
| pop rax | |
| mov dr7, rax | |
| ## UINT64 Cr0, Cr1, Cr2, Cr3, Cr4, Cr8; | |
| pop rax | |
| mov cr0, rax | |
| add rsp, 8 | |
| pop rax | |
| mov cr2, rax | |
| pop rax | |
| mov cr3, rax | |
| pop rax | |
| mov cr4, rax | |
| pop rax | |
| mov cr8, rax | |
| ## UINT64 RFlags; | |
| mov rax, ASM_PFX(AppRsp) | |
| pop qword ptr [rax + 16] | |
| ## UINT64 Ldtr, Tr; | |
| ## UINT64 Gdtr[2], Idtr[2]; | |
| ## Best not let anyone mess with these particular registers... | |
| add rsp, 48 | |
| ## UINT64 Rip; | |
| pop qword ptr [rax] | |
| ## UINT64 Gs, Fs, Es, Ds, Cs, Ss; | |
| ## NOTE - modified segment registers could hang the debugger... We | |
| ## could attempt to insulate ourselves against this possibility, | |
| ## but that poses risks as well. | |
| ## | |
| pop rax | |
| # mov gs, rax | |
| pop rax | |
| # mov fs, rax | |
| pop rax | |
| mov es, rax | |
| pop rax | |
| mov ds, rax | |
| mov rax, ASM_PFX(AppRsp) | |
| pop qword ptr [rax + 8] | |
| pop rax | |
| mov ss, rax | |
| ## The next stuff to restore is the general purpose registers that were pushed | |
| ## using the "push" instruction. | |
| ## | |
| ## The value of RSP as stored in the context record is the application RSP | |
| ## including the 5 entries on the application stack caused by the exception | |
| ## itself. It may have been modified by the debug agent, so we need to | |
| ## determine if we need to relocate the application stack. | |
| mov rbx, [rsp + 24] # move the potentially modified AppRsp into rbx | |
| mov rax, ASM_PFX(AppRsp) | |
| add rax, 40 | |
| cmp rbx, rax | |
| je NoAppStackMove | |
| mov rax, ASM_PFX(AppRsp) | |
| mov rcx, [rax] # RIP | |
| mov [rbx], rcx | |
| mov rcx, [rax + 8] # CS | |
| mov [rbx + 8], rcx | |
| mov rcx, [rax + 16] # RFLAGS | |
| mov [rbx + 16], rcx | |
| mov rcx, [rax + 24] # RSP | |
| mov [rbx + 24], rcx | |
| mov rcx, [rax + 32] # SS | |
| mov [rbx + 32], rcx | |
| mov rax, rbx # modify the saved AppRsp to the new AppRsp | |
| mov ASM_PFX(AppRsp), rax | |
| NoAppStackMove: | |
| mov rax, ASM_PFX(DebugRsp) # restore the DebugRsp on the debug stack | |
| # so our "pop" will not cause a stack switch | |
| mov [rsp + 24], rax | |
| cmp dword ptr ASM_PFX(ExceptionNumber), 0x068 | |
| jne NoChain | |
| Chain: | |
| ## Restore rflags so when we chain, the flags will be exactly as if we were never here. | |
| ## We gin up the stack to do an iretq so we can get ALL the flags. | |
| mov rax, ASM_PFX(AppRsp) | |
| mov rbx, [rax + 40] | |
| push rbx | |
| mov rax, ss | |
| push rax | |
| mov rax, rsp | |
| add rax, 16 | |
| push rax | |
| mov rax, ASM_PFX(AppRsp) | |
| mov rbx, [rax + 16] | |
| and rbx, NOT 0x300 # special handling for IF and TF | |
| push rbx | |
| mov rax, cs | |
| push rax | |
| mov rax, offset PhonyIretq | |
| push rax | |
| iretq | |
| PhonyIretq: | |
| ## UINT64 Rdi, Rsi, Rbp, Rsp, Rbx, Rdx, Rcx, Rax; | |
| ## UINT64 R8, R9, R10, R11, R12, R13, R14, R15; | |
| pop rdi | |
| pop rsi | |
| pop rbp | |
| pop rsp | |
| pop rbx | |
| pop rdx | |
| pop rcx | |
| pop rax | |
| pop r8 | |
| pop r9 | |
| pop r10 | |
| pop r11 | |
| pop r12 | |
| pop r13 | |
| pop r14 | |
| pop r15 | |
| ## Switch back to application stack | |
| mov rsp, ASM_PFX(AppRsp) | |
| ## Jump to original handler | |
| jmp ASM_PFX(OrigVector) | |
| NoChain: | |
| ## UINT64 Rdi, Rsi, Rbp, Rsp, Rbx, Rdx, Rcx, Rax; | |
| ## UINT64 R8, R9, R10, R11, R12, R13, R14, R15; | |
| pop rdi | |
| pop rsi | |
| pop rbp | |
| pop rsp | |
| pop rbx | |
| pop rdx | |
| pop rcx | |
| pop rax | |
| pop r8 | |
| pop r9 | |
| pop r10 | |
| pop r11 | |
| pop r12 | |
| pop r13 | |
| pop r14 | |
| pop r15 | |
| ## Switch back to application stack | |
| mov rsp, ASM_PFX(AppRsp) | |
| ## We're outa here... | |
| iret |