[Qemu-discuss] QEMU with UEFI (OVMF): exception callback

[Omar EL-ACHI CHEBIB]

Dear Qemu community, 

I am currently developping programs for UEFI.
To do so, I use EDK II with the official UEFI specification and QEMU
with OVMF.bin bios to test my programs. 

While developping, I want to
debug my applications by replacing exceptions callbacks. So what I do
is, first, get a EFI_DEBUG_SUPPORT_PROTOCOL to have an access to the
function RegisterExceptionCallback. Then, I call this function giving
EXCEPT_X64_SEG_NOT_PRESENT as the ExceptionType parameter and my own
function as a callback. However, what I get after executing this
function is an INVALID_PARAMETER return code. Therefore, I try with
another exception (easily triggerable): EXCEPT_X64_DIVIDE_ERROR. The
result is different: first, it tells me another callback already exists,
so I "erase" it by giving NULL as callback, then I call again with my
function, the return code is EFI_SUCCESS but when I trigger this
exception, by doing 5/0 for example, the system freezes and my callback
is not executed. 

To have a better understanding of what is happening
under the function RegisterExceptionCallback, I took its address
(0x7EB099B), I did a dump of QEMU's RAM, went to this address, took the
bytes and disassemble it. What this function does is simple:
- It tests
whether the ExceptionType code is between 0 and 10 (0xA), if not, it
returns INVALID_PARAMETER. That's why EXCEPT_X64_SEG_NOT_PRESENT doesn't
work, its code is 11 according to the official UEFI specification.
-
Then it tests whether a callback already exists in the exception
callback table, if yes, it returns EFI_ALREADY_STARTED
- Finally, it
loads our function address in the table, located at 0x7EB6500, at the
offset given by the ExceptionType code. For example: exception
EXCEPT_X64_BREAKPOINT (which code 3) callback is located at
0x7EB6500+8*3 

After calling this function, the table is indeed
modified, however when triggering my exception, my callback isn't
executed. I also tried to manually modify the table, without using the
RegisterExceptionCallback. However, it doesn't seem to work too.
Did I
miss anything in my implementation ? Is it possible to replace an
exception's callback ? 

Thank you for your attention,
Omar