I hope someone can help with the following questions or point me at a document that explains how this works. I hope I am just missing something obvious. I haveread at all the SDMs (Vols 3a and 3b) without getting insight.
If I set the TR flag in the rflags register and also set the BTF flags in the MSR_DEBUGCTL MSR, then the processor will generate a "single step" debug exception the next time it takes a branch, services an interrupt or generates an exception. I am assuming that I have set the processor to only do this at ring level 3.
1: When is the interrupt or exception delivered to the actual interrupt or exception handler? As the debug exception has a higher priority then the other exceptions or interrupt, the processor will vector to the #DB (interrupt 1) IDT entry. When does it vector to the other exception or interrupt IDT entry? On the next iret? Or does the code after handling the debug exception have to jump to the correct handler (see next question).
2: In the #DB handler is there anyway to tell the reason for entering the debug handler. In other words can the handler code tell that it was a branch, exception or interrupt that cause the entry into the #DB handler. Note that it is possible that both a branch and an interrupt or exception can occur at the same time.
Here a couple of places I would look at:
- Microsoft Platform SDK ( any version ). Look at '..\Samples\WinBase\Debug\' folder with examples
related to Debugging on Windows platforms;
- On MSDN "Debugging and Error Handling" topic;
- Win32 API structure 'EXCEPTION_DEBUG_INFO' has 'EXCEPTION_RECORD' member (structure )and
it is filled with information about an exception.
RIP), stack pointer (
RSP), flags register (
RFLAGS). The handler is responsible for saving the remaining state of the interrupted program (GPR, XMM, ). Saving registers allows the CPU to restart the interrupted program after the handler finishes exception handling.
These questions are out of my range of knowledge.
I've sent them off to some other folks but I don't know if they will have theknowledge or timeto respond.
What are trying to accomplish? Perhaps there are others ways of reaching your goals.
Have you looked at how GDB does single-instruction mode?
I assumegdb must do this.