From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1KERIx-0006W2-BR for qemu-devel@nongnu.org; Thu, 03 Jul 2008 12:05:08 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1KERIn-0006Lv-Ja for qemu-devel@nongnu.org; Thu, 03 Jul 2008 12:05:01 -0400 Received: from [199.232.76.173] (port=33013 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1KERIm-0006LZ-Cv for qemu-devel@nongnu.org; Thu, 03 Jul 2008 12:04:57 -0400 Received: from lizzard.sbs.de ([194.138.37.39]:19223) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1KERIk-0002F4-G9 for qemu-devel@nongnu.org; Thu, 03 Jul 2008 12:04:56 -0400 Received: from mail2.sbs.de (localhost [127.0.0.1]) by lizzard.sbs.de (8.12.11.20060308/8.12.11) with ESMTP id m63G4nw8005369 for ; Thu, 3 Jul 2008 18:04:49 +0200 Received: from [139.25.109.167] (mchn012c.ww002.siemens.net [139.25.109.167] (may be forged)) by mail2.sbs.de (8.12.11.20060308/8.12.11) with ESMTP id m63G4nlA022035 for ; Thu, 3 Jul 2008 18:04:49 +0200 Resent-To: qemu-devel@nongnu.org Resent-Message-Id: <486CF8A1.2050809@siemens.com> Message-ID: <486CF858.50204@siemens.com> Date: Thu, 03 Jul 2008 18:03:36 +0200 From: Jan Kiszka MIME-Version: 1.0 References: <486CF559.5090805@siemens.com> In-Reply-To: <486CF559.5090805@siemens.com> Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH 13/13] x86: Debug register emulation Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Built on top of previously enhanced breakpoint/watchpoint support, this patch adds full debug register emulation for the x86 architecture. Many corner cases were considered, and the result was successfully tested inside a Linux guest with gdb, but I won't be surprised if one or two scenarios still behave differently in reality. Signed-off-by: Jan Kiszka --- linux-user/main.c | 4 - target-i386/cpu.h | 33 +++++++++++++ target-i386/helper.c | 118 ++++++++++++++++++++++++++++++++++++------------ target-i386/op_helper.c | 79 ++++++++++++++++++++++++++++++-- 4 files changed, 198 insertions(+), 36 deletions(-) Index: b/linux-user/main.c =================================================================== --- a/linux-user/main.c +++ b/linux-user/main.c @@ -403,7 +403,7 @@ void cpu_loop(CPUX86State *env) queue_signal(env, info.si_signo, &info); } break; - case EXCP01_SSTP: + case EXCP01_DB: case EXCP03_INT3: #ifndef TARGET_X86_64 if (env->eflags & VM_MASK) { @@ -413,7 +413,7 @@ void cpu_loop(CPUX86State *env) { info.si_signo = SIGTRAP; info.si_errno = 0; - if (trapnr == EXCP01_SSTP) { + if (trapnr == EXCP01_DB) { info.si_code = TARGET_TRAP_BRKPT; info._sifields._sigfault._addr = env->eip; } else { Index: b/target-i386/cpu.h =================================================================== --- a/target-i386/cpu.h +++ b/target-i386/cpu.h @@ -199,6 +199,16 @@ #define CR4_OSFXSR_MASK (1 << 9) #define CR4_OSXMMEXCPT_MASK (1 << 10) +#define DR6_BD (1 << 13) +#define DR6_BS (1 << 14) +#define DR6_BT (1 << 15) +#define DR6_FIXED_1 0xffff0ff0 + +#define DR7_GD (1 << 13) +#define DR7_TYPE_SHIFT 16 +#define DR7_LEN_SHIFT 18 +#define DR7_FIXED_1 0x00000400 + #define PG_PRESENT_BIT 0 #define PG_RW_BIT 1 #define PG_USER_BIT 2 @@ -334,7 +344,7 @@ #define CPUID_EXT3_SKINIT (1 << 12) #define EXCP00_DIVZ 0 -#define EXCP01_SSTP 1 +#define EXCP01_DB 1 #define EXCP02_NMI 2 #define EXCP03_INT3 3 #define EXCP04_INTO 4 @@ -566,6 +576,10 @@ typedef struct CPUX86State { int exception_is_int; target_ulong exception_next_eip; target_ulong dr[8]; /* debug registers */ + union { + CPUBreakpoint *cpu_breakpoint[4]; + CPUWatchpoint *cpu_watchpoint[4]; + }; /* break/watchpoints for dr[0..3] */ uint32_t smbase; int old_exception; /* exception in flight */ @@ -755,6 +769,23 @@ static inline void cpu_clone_regs(CPUSta #define CPU_PC_FROM_TB(env, tb) env->eip = tb->pc - tb->cs_base +static inline int hw_breakpoint_enabled(unsigned long dr7, int index) +{ + return (dr7 >> (index * 2)) & 3; +} + +static inline int hw_breakpoint_type(unsigned long dr7, int index) +{ + return (dr7 >> (DR7_TYPE_SHIFT + (index * 2))) & 3; +} + +static inline int hw_breakpoint_len(unsigned long dr7, int index) +{ + return ((dr7 >> (DR7_LEN_SHIFT + (index * 2))) & 3) + 1; +} + +int check_hw_breakpoints(CPUState *env, int force_dr6_update); + #include "cpu-all.h" #include "svm.h" Index: b/target-i386/helper.c =================================================================== --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -32,8 +32,6 @@ //#define DEBUG_MMU -static int cpu_x86_register (CPUX86State *env, const char *cpu_model); - static void add_flagname_to_bitmaps(char *flagname, uint32_t *features, uint32_t *ext_features, uint32_t *ext2_features, @@ -91,33 +89,6 @@ static void add_flagname_to_bitmaps(char fprintf(stderr, "CPU feature %s not found\n", flagname); } -CPUX86State *cpu_x86_init(const char *cpu_model) -{ - CPUX86State *env; - static int inited; - - env = qemu_mallocz(sizeof(CPUX86State)); - if (!env) - return NULL; - cpu_exec_init(env); - env->cpu_model_str = cpu_model; - - /* init various static tables */ - if (!inited) { - inited = 1; - optimize_flags_init(); - } - if (cpu_x86_register(env, cpu_model) < 0) { - cpu_x86_close(env); - return NULL; - } - cpu_reset(env); -#ifdef USE_KQEMU - kqemu_init(env); -#endif - return env; -} - typedef struct x86_def_t { const char *name; uint32_t level; @@ -429,6 +400,12 @@ void cpu_reset(CPUX86State *env) env->fpuc = 0x37f; env->mxcsr = 0x1f80; + + memset(env->dr, 0, sizeof(env->dr)); + env->dr[6] = DR6_FIXED_1; + env->dr[7] = DR7_FIXED_1; + cpu_breakpoint_remove_all(env, BP_CPU); + cpu_watchpoint_remove_all(env, BP_CPU); } void cpu_x86_close(CPUX86State *env) @@ -1223,4 +1200,87 @@ target_phys_addr_t cpu_get_phys_page_deb paddr = (pte & TARGET_PAGE_MASK) + page_offset; return paddr; } + +int check_hw_breakpoints(CPUState *env, int force_dr6_update) +{ + target_ulong dr6; + int reg, type; + int hit_enabled = 0; + + dr6 = env->dr[6] & ~0xf; + for (reg = 0; reg < 4; reg++) { + type = hw_breakpoint_type(env->dr[7], reg); + if ((type == 0 && env->dr[reg] == env->eip) || + ((type & 1) && env->cpu_watchpoint[reg] && + (env->cpu_watchpoint[reg]->flags & BP_WATCHPOINT_HIT))) { + dr6 |= 1 << reg; + if (hw_breakpoint_enabled(env->dr[7], reg)) + hit_enabled = 1; + } + } + if (hit_enabled || force_dr6_update) + env->dr[6] = dr6; + return hit_enabled; +} + +static CPUDebugExcpHandler *prev_debug_excp_handler; + +void raise_exception(int exception_index); + +static void breakpoint_handler(CPUState *env) +{ + CPUBreakpoint *bp; + + if (env->watchpoint_hit) { + if (env->watchpoint_hit->flags & BP_CPU) { + env->watchpoint_hit = NULL; + if (check_hw_breakpoints(env, 0)) + raise_exception(EXCP01_DB); + else + cpu_resume_from_signal(env, NULL); + } + } else { + for (bp = env->breakpoints; bp != NULL; bp = bp->next) + if (bp->pc == env->eip) { + if (bp->flags & BP_CPU) { + check_hw_breakpoints(env, 1); + raise_exception(EXCP01_DB); + } + break; + } + } + if (prev_debug_excp_handler) + prev_debug_excp_handler(env); +} #endif /* !CONFIG_USER_ONLY */ + +CPUX86State *cpu_x86_init(const char *cpu_model) +{ + CPUX86State *env; + static int inited; + + env = qemu_mallocz(sizeof(CPUX86State)); + if (!env) + return NULL; + cpu_exec_init(env); + env->cpu_model_str = cpu_model; + + /* init various static stuff */ + if (!inited) { + inited = 1; + optimize_flags_init(); +#ifndef CONFIG_USER_ONLY + prev_debug_excp_handler = + cpu_set_debug_excp_handler(breakpoint_handler); +#endif + } + if (cpu_x86_register(env, cpu_model) < 0) { + cpu_x86_close(env); + return NULL; + } + cpu_reset(env); +#ifdef USE_KQEMU + kqemu_init(env); +#endif + return env; +} Index: b/target-i386/op_helper.c =================================================================== --- a/target-i386/op_helper.c +++ b/target-i386/op_helper.c @@ -94,6 +94,53 @@ const CPU86_LDouble f15rk[7] = 3.32192809488736234781L, /*l2t*/ }; +static void hw_breakpoint_insert(int index) +{ + int type, err = 0; + + switch (hw_breakpoint_type(env->dr[7], index)) { + case 0: + if (hw_breakpoint_enabled(env->dr[7], index)) + err = cpu_breakpoint_insert(env, env->dr[index], BP_CPU, + &env->cpu_breakpoint[index]); + break; + case 1: + type = BP_CPU | BP_MEM_WRITE; + goto insert_wp; + case 2: + /* No support for I/O watchpoints yet */ + break; + case 3: + type = BP_CPU | BP_MEM_ACCESS; + insert_wp: + err = cpu_watchpoint_insert(env, env->dr[index], + hw_breakpoint_len(env->dr[7], index), + type, &env->cpu_watchpoint[index]); + break; + } + if (err) + env->cpu_breakpoint[index] = NULL; +} + +static void hw_breakpoint_remove(int index) +{ + if (!env->cpu_breakpoint[index]) + return; + switch (hw_breakpoint_type(env->dr[7], index)) { + case 0: + if (hw_breakpoint_enabled(env->dr[7], index)) + cpu_breakpoint_remove_by_ref(env, env->cpu_breakpoint[index]); + break; + case 1: + case 3: + cpu_watchpoint_remove_by_ref(env, env->cpu_watchpoint[index]); + break; + case 2: + /* No support for I/O watchpoints yet */ + break; + } +} + /* broken thread support */ spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED; @@ -496,6 +543,15 @@ static void switch_tss(int tss_selector, /* XXX: different exception if CALL ? */ raise_exception_err(EXCP0D_GPF, 0); } + + /* reset local breakpoints */ + if (env->dr[7] & 0x55) { + for (i = 0; i < 4; i++) { + if (hw_breakpoint_enabled(env->dr[7], i) == 0x1) + hw_breakpoint_remove(i); + } + env->dr[7] &= ~0x55; + } } /* check if Port I/O is allowed in TSS */ @@ -1875,8 +1931,11 @@ void helper_cmpxchg16b(target_ulong a0) void helper_single_step(void) { - env->dr[6] |= 0x4000; - raise_exception(EXCP01_SSTP); +#ifndef CONFIG_USER_ONLY + check_hw_breakpoints(env, 1); +#endif + env->dr[6] |= DR6_BS; + raise_exception(EXCP01_DB); } void helper_cpuid(void) @@ -2991,10 +3050,22 @@ void helper_clts(void) env->hflags &= ~HF_TS_MASK; } -/* XXX: do more */ void helper_movl_drN_T0(int reg, target_ulong t0) { - env->dr[reg] = t0; + int i; + + if (reg < 4) { + hw_breakpoint_remove(reg); + env->dr[reg] = t0; + hw_breakpoint_insert(reg); + } else if (reg == 7) { + for (i = 0; i < 4; i++) + hw_breakpoint_remove(i); + env->dr[7] = t0; + for (i = 0; i < 4; i++) + hw_breakpoint_insert(i); + } else + env->dr[reg] = t0; } void helper_invlpg(target_ulong addr)