{"action":"created","issue":{"url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/20","repository_url":"https://api.github.com/repos/tandasat/HyperPlatform","labels_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/20/comments","events_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/20/events","html_url":"https://github.com/tandasat/HyperPlatform/issues/20","id":167974105,"number":20,"title":"Hardware breakpoint does not work","user":{"login":"tandasat","id":1620923,"avatar_url":"https://avatars.githubusercontent.com/u/1620923?v=3","gravatar_id":"","url":"https://api.github.com/users/tandasat","html_url":"https://github.com/tandasat","followers_url":"https://api.github.com/users/tandasat/followers","following_url":"https://api.github.com/users/tandasat/following{/other_user}","gists_url":"https://api.github.com/users/tandasat/gists{/gist_id}","starred_url":"https://api.github.com/users/tandasat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tandasat/subscriptions","organizations_url":"https://api.github.com/users/tandasat/orgs","repos_url":"https://api.github.com/users/tandasat/repos","events_url":"https://api.github.com/users/tandasat/events{/privacy}","received_events_url":"https://api.github.com/users/tandasat/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tandasat/HyperPlatform/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-27T22:43:49Z","updated_at":"2016-09-01T14:02:34Z","closed_at":null,"body":"### Summary\r\nHardware breakpoint (HWBP) does not hit after HyperPlatform is installed. After VmInitialization() returned successfully, I set HWBP onto a guest kernel code running on VMware through Windbg from a host. Contents of DR registers seemed fine, but HWBP did not trigger, and also, even if I set HWBP before VmInitialization(), the HWBP did not hit after VmInitialization() was executed.\r\n\r\n###  Workaround \r\nDisable Move-to-DR-exiting by setting false to mov_dr_exiting. This lets HWBP function as it should be.\r\n\r\n###  Related Resources\r\nThere are some bug reports with regard to HWBP support on VirtualBox and KVM. Those may or may not be related.\r\n\r\n- Hardware breakpoints don't work in Virtualbox (software virtualization only)\r\nhttps://www.virtualbox.org/ticket/477\r\nNot much into to see.\r\n\r\n- KVM: x86: fix root cause for missed hardware breakpoints\r\nhttps://patchwork.kernel.org/patch/8436141/\r\n\r\n- KVM: x86: fix missed hardware breakpoints\r\nhttps://patchwork.kernel.org/patch/8359491/\r\n\r\n- KVM: Fix and improve guest debugging and x86 debug registers\r\nhttp://thread.gmane.org/gmane.comp.emulators.kvm.devel/22838\r\n\r\n- kvm-userspace: Fix and improve guest debugging and x86 debug registers\r\nhttp://thread.gmane.org/gmane.comp.emulators.kvm.devel/22818\r\n\r\n### Steps to Reproduce\r\n[Disassembly used for below test](https://github.com/tandasat/HyperPlatform/files/386919/uf_DriverEntiry.txt)\r\n\r\n```\r\n\r\n$$\r\n$$ break at the entry point of the driver\r\n$$\r\nMemoryMon!DriverEntry+0x9b:\r\nfffff801`1f15409b int     3\r\n\r\n$$ \r\n$$ Set software BP (SWBP) and HWBP to verify HWBP works yet\r\n$$\r\nkd> bp fffff801`1f1540a1\r\nkd> ba e 1 fffff801`1f1540a6 \r\nkd> g\r\nBreakpoint 0 hit\r\nMemoryMon!DriverEntry+0xa1:\r\nfffff801`1f1540a1 call    MemoryMon!ExInitializeDriverRuntime (fffff801`1f1315e0)\r\n\r\n$$\r\n$$ The SWBP hit. Check contents of DR registers\r\n$$ => DR0 seems good\r\n$$\r\nkd> rM 20\r\ndr0=fffff8011f1540a6 dr1=0000000000000000 dr2=0000000000000000\r\ndr3=0000000000000000 dr6=00000000ffff0ff0 dr7=0000000000000401 cr4=00000000001506f8\r\nkdr0=fffff8011f1540a6 kdr1=0000000000000000 kdr2=0000000000000000\r\nkdr3=0000000000000000 kdr6=00000000ffff0ff0 kdr7=0000000000000401\r\nMemoryMon!DriverEntry+0xa1:\r\nfffff801`1f1540a1 call    MemoryMon!ExInitializeDriverRuntime (fffff801`1f1315e0)\r\n\r\n$$\r\n$$ The HWBP works yet\r\n$$\r\nkd> g\r\nBreakpoint 1 hit\r\nMemoryMon!DriverEntry+0xa6:\r\nfffff801`1f1540a6 mov     byte ptr [rsp+20h],0\r\n\r\n$$\r\n$$ Clear old BPs. Set SWBP and HWBP on code after VmInitialization()\r\n$$\r\nkd> bc *\r\nkd> bp fffff801`1f154206\r\nkd> ba e 1 fffff801`1f15420b \r\n\r\n$$\r\n$$ Hit the SWBP. \r\n$$\r\nkd> g\r\nBreakpoint 0 hit\r\nMemoryMon!DriverEntry+0x206:\r\nfffff801`1f154206 cmp     dword ptr [rsp+24h],0\r\n\r\n$$\r\n$$ Contents of DR registers seem good\r\n$$\r\nkd> rM 20\r\ndr0=fffff8011f15420b dr1=0000000000000000 dr2=0000000000000000\r\ndr3=0000000000000000 dr6=00000000ffff0ff0 dr7=0000000000000401 cr4=00000000001526f8\r\nkdr0=fffff8011f15420b kdr1=0000000000000000 kdr2=0000000000000000\r\nkdr3=0000000000000000 kdr6=00000000ffff0ff0 kdr7=0000000000000401\r\nMemoryMon!DriverEntry+0x206:\r\nfffff801`1f154206 cmp     dword ptr [rsp+24h],0 ss:0018:ffffd001`321f7924=00000000\r\n\r\n$$\r\n$$ HWBP at fffff8011f15420b did not fire for some reasons, while DR registers still seem fine\r\n$$\r\nkd> g\r\nMemoryMon!TestRwe+0x37:\r\nfffff801`1f13bb07 int     3\r\nkd> rM 20\r\ndr0=fffff8011f15420b dr1=0000000000000000 dr2=0000000000000000\r\ndr3=0000000000000000 dr6=00000000ffff0ff0 dr7=0000000000000401 cr4=00000000001526f8\r\nkdr0=fffff8011f15420b kdr1=0000000000000000 kdr2=0000000000000000\r\nkdr3=0000000000000000 kdr6=00000000ffff0ff0 kdr7=0000000000000401\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/comments/244088366","html_url":"https://github.com/tandasat/HyperPlatform/issues/20#issuecomment-244088366","issue_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/20","id":244088366,"user":{"login":"tandasat","id":1620923,"avatar_url":"https://avatars.githubusercontent.com/u/1620923?v=3","gravatar_id":"","url":"https://api.github.com/users/tandasat","html_url":"https://github.com/tandasat","followers_url":"https://api.github.com/users/tandasat/followers","following_url":"https://api.github.com/users/tandasat/following{/other_user}","gists_url":"https://api.github.com/users/tandasat/gists{/gist_id}","starred_url":"https://api.github.com/users/tandasat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tandasat/subscriptions","organizations_url":"https://api.github.com/users/tandasat/orgs","repos_url":"https://api.github.com/users/tandasat/repos","events_url":"https://api.github.com/users/tandasat/events{/privacy}","received_events_url":"https://api.github.com/users/tandasat/received_events","type":"User","site_admin":false},"created_at":"2016-09-01T14:02:34Z","updated_at":"2016-09-01T14:02:34Z","body":"Thank you for analyzing the issue! Those are interesting findings. Looks like DR0 does not retain its value for some reasons. \r\n\r\nIt seems the attached code basically limits a number of VM-exit via DR access to DRX_MAGICNUM per one process execution context, is that right? I do not see why it works but definitely a good start point for further analysis. \r\n\r\nCan you possibly share code of testHWBP? I do not have any test code setting HWBP now, so I am thinking that it is going to be faster."}}
{"actor":{"display_login":"tandasat"}}