Hv.c File Reference

This file describes the routines in Hypervisor. More...

#include "pch.h"

Functions
UINT32	HvAdjustControls (UINT32 Ctl, UINT32 Msr)
	Adjust controls for VMCS based on processor capability.
BOOLEAN	HvSetGuestSelector (PVOID GdtBase, UINT32 SegmentRegister, UINT16 Selector)
	Set guest's selector registers.
VOID	HvHandleCpuid (VIRTUAL_MACHINE_STATE *VCpu)
	Handle Cpuid Vmexits.
VOID	HvHandleControlRegisterAccess (VIRTUAL_MACHINE_STATE *VCpu, VMX_EXIT_QUALIFICATION_MOV_CR *CrExitQualification)
	Handles Guest Access to control registers.
VOID	HvFillGuestSelectorData (PVOID GdtBase, UINT32 SegmentRegister, UINT16 Selector)
	Fill the guest's selector data.
VOID	HvResumeToNextInstruction ()
	Add the current instruction length to guest rip to resume to next instruction.
VOID	HvSuppressRipIncrement (VIRTUAL_MACHINE_STATE *VCpu)
	Suppress the incrementation of RIP.
VOID	HvPerformRipIncrement (VIRTUAL_MACHINE_STATE *VCpu)
	Perform the incrementation of RIP.
VOID	HvSetMonitorTrapFlag (BOOLEAN Set)
	Set the monitor trap flag.
VOID	HvSetRflagTrapFlag (BOOLEAN Set)
	Set the rflag's trap flag.
VOID	HvSetLoadDebugControls (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set LOAD DEBUG CONTROLS on Vm-entry controls.
VOID	HvSetLoadGuestIa32LbrCtl (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set LOAD GUEST IA32_LBR_CTL on Vm-entry controls.
VOID	HvSetSaveDebugControls (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set SAVE DEBUG CONTROLS on Vm-exit controls.
VOID	HvSetClearGuestIa32LbrCtl (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set SAVE GUEST IA32_LBR_CTL on Vm-exit controls.
VOID	HvRestoreRegisters ()
	Reset GDTR/IDTR and other old when you do vmxoff as the patchguard will detect them left modified.
VOID	HvSetPmcVmexit (BOOLEAN Set)
	Set vm-exit for rdpmc instructions.
VOID	HvSetMovControlRegsExiting (BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister)
	Set vm-exit for mov-to-cr0/4.
VOID	HvSetMovToCr3Vmexit (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set vm-exit for mov-to-cr3.
VOID	HvWriteExceptionBitmap (UINT32 BitmapMask)
	Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.
UINT32	HvReadExceptionBitmap ()
	Read exception bitmap in VMCS.
VOID	HvSetInterruptWindowExiting (BOOLEAN Set)
	Set Interrupt-window exiting.
VOID	HvSetPmlEnableFlag (BOOLEAN Set)
	Set Page Modification Logging Enable bit.
VOID	HvSetModeBasedExecutionEnableFlag (BOOLEAN Set)
	Set Mode-based Execution Control (MBEC) Enable bit.
VOID	HvSetNmiWindowExiting (BOOLEAN Set)
	Set NMI-window exiting.
VOID	HvHandleMovDebugRegister (VIRTUAL_MACHINE_STATE *VCpu)
	Handle Mov to Debug Registers Exitings.
VOID	HvSetNmiExiting (BOOLEAN Set)
	Set the NMI Exiting.
VOID	HvSetVmxPreemptionTimerExiting (BOOLEAN Set)
	Set the VMX preemption timer.
VOID	HvSetExceptionBitmap (VIRTUAL_MACHINE_STATE *VCpu, UINT32 IdtIndex)
	Set exception bitmap in VMCS.
VOID	HvUnsetExceptionBitmap (VIRTUAL_MACHINE_STATE *VCpu, UINT32 IdtIndex)
	Unset exception bitmap in VMCS.
VOID	HvSetExternalInterruptExiting (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set the External Interrupt Exiting.
VOID	HvEnableAndCheckForPreviousExternalInterrupts (VIRTUAL_MACHINE_STATE *VCpu)
	Checks to enable and reinject previous interrupts.
VOID	HvSetRdtscExiting (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set the RDTSC/P Exiting.
VOID	HvSetMovDebugRegsExiting (VIRTUAL_MACHINE_STATE *VCpu, BOOLEAN Set)
	Set or unset the Mov to Debug Registers Exiting.
UINT16	HvGetCsSelector ()
	Read CS selector.
UINT64	HvGetRflags ()
	Read guest's RFLAGS.
VOID	HvSetRflags (UINT64 Rflags)
	Set guest's RFLAGS.
UINT64	HvGetRip ()
	Read guest's RIP.
VOID	HvSetRip (UINT64 Rip)
	Set guest's RIP.
UINT64	HvGetInterruptibilityState ()
	Read guest's interruptibility state.
UINT64	HvClearSteppingBits (UINT64 Interruptibility)
	Clear STI and MOV SS bits.
VOID	HvSetInterruptibilityState (UINT64 InterruptibilityState)
	Set guest's interruptibility state.
VOID	HvInjectPendingExternalInterrupts (VIRTUAL_MACHINE_STATE *VCpu)
	Inject pending external interrupts.
VOID	HvCheckAndEnableExternalInterrupts (VIRTUAL_MACHINE_STATE *VCpu)
	Check and enable external interrupts.
VOID	HvDisableExternalInterruptsAndInterruptWindow (VIRTUAL_MACHINE_STATE *VCpu)
	Disable external-interrupts and interrupt window.
BOOLEAN	HvInitVmm (VMM_CALLBACKS *VmmCallbacks)
	Initializes the hypervisor.
VOID	HvEnableMtfAndChangeExternalInterruptState (VIRTUAL_MACHINE_STATE *VCpu)
	Enables MTF and adjust external interrupt state.
VOID	HvPreventExternalInterrupts (VIRTUAL_MACHINE_STATE *VCpu)
	Adjust external interrupt state.
UINT64	HvGetPendingDebugExceptions ()
	Get the guest state of pending debug exceptions.
VOID	HvSetPendingDebugExceptions (UINT64 Value)
	Set the guest state of pending debug exceptions.
UINT64	HvGetDebugctl ()
	Get the guest state of IA32_DEBUGCTL.
UINT64	HvGetGuestIa32LbrCtl ()
	Get the guest state of IA32_LBR_CTL.
VOID	HvGetAndStoreDebugctl (UINT64 *StoreDebugctl)
	Get and store the guest state of IA32_DEBUGCTL.
VOID	HvGetAndStoreGuestIa32LbrCtl (UINT64 *StoreGuestIa32Lbr)
	Get and store the guest state of IA32_LBR_CTL.
VOID	HvSetDebugctl (UINT64 Value)
	Set the guest state of IA32_DEBUGCTL.
VOID	HvSetGuestIa32LbrCtl (UINT64 Value)
	Set the guest state of IA32_LBR_CTL.
VOID	HvSetLbrSelect (UINT64 FilterOptions)
	Set LBR selector.
BOOLEAN	HvCheckCpuSupportForSaveAndLoadDebugControls ()
	Check if CPU support save and load debug controls on exit and load entries.
BOOLEAN	HvCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls ()
	Check if CPU support load and clear guest IA32_LBR_CTL controls on entry and exit.
VOID	HvSetDebugReg7 (UINT64 Value)
	Set the guest state of DR7.
VOID	HvHandleTrapFlag ()
	Handle the case when the trap flag is set, and we need to inject the single-step exception right after vm-entry.

Detailed Description

This file describes the routines in Hypervisor.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

vmx related routines

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

HvAdjustControls()

UINT32 HvAdjustControls	(	UINT32	Ctl,
		UINT32	Msr )

Adjust controls for VMCS based on processor capability.

Returns the Cpu Based and Secondary Processor Based Controls and other controls based on hardware support.

Parameters

Ctl
Msr

Returns

UINT32 Returns the Cpu Based and Secondary Processor Based Controls and other controls based on hardware support

Adjust controls for VMCS based on processor capability.

Parameters

Ctl
Msr

Returns

UINT32

{
    MSR MsrValue = {0};
 
    MsrValue.Flags = CpuReadMsr(Msr);
    Ctl &= MsrValue.Fields.High; /* bit == 0 in high word ==> must be zero */
    Ctl |= MsrValue.Fields.Low;  /* bit == 1 in low word  ==> must be one  */
    return Ctl;
}

HvCheckAndEnableExternalInterrupts()

VOID HvCheckAndEnableExternalInterrupts

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Check and enable external interrupts.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Check if we should enable interrupts in this core or not
    //
    if (VCpu->EnableExternalInterruptsOnContinue)
    {
        //
        // Enable normal interrupts
        //
        HvSetExternalInterruptExiting(VCpu, FALSE);
 
        //
        // Check if there is at least an interrupt that needs to be delivered
        //
        HvInjectPendingExternalInterrupts(VCpu);
 
        VCpu->EnableExternalInterruptsOnContinue = FALSE;
    }
}

HvCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls()

BOOLEAN HvCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls

(

)

Check if CPU support load and clear guest IA32_LBR_CTL controls on entry and exit.

Check if CPU support load and clear guest IA32_LBR_CTL controls on VM-entry and VM-exit.

Returns

BOOLEAN

Check if CPU support load and clear guest IA32_LBR_CTL controls on entry and exit.

Returns

BOOLEAN

{
    IA32_VMX_BASIC_REGISTER VmxBasicMsr = {0};
 
    //
    // Reading IA32_VMX_BASIC_MSR
    //
    VmxBasicMsr.AsUInt = CpuReadMsr(IA32_VMX_BASIC);
 
    //
    // Read 1-settings of save debug controls (exit controls)
    //
    UINT32 ExitCtls = HvAdjustControls(
        IA32_VMX_EXIT_CTLS_CLEAR_IA32_LBR_CTL_FLAG,
        VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_EXIT_CTLS : IA32_VMX_EXIT_CTLS);
 
    //
    // Read 1-settings of load debug controls (entry controls)
    //
    UINT32 EntryCtls = HvAdjustControls(
        IA32_VMX_ENTRY_CTLS_LOAD_IA32_LBR_CTL_FLAG,
        VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_ENTRY_CTLS : IA32_VMX_ENTRY_CTLS);
 
    //
    // Check if entry and exit controls are supported on this system
    //
    if (ExitCtls != NULL_ZERO && EntryCtls != NULL_ZERO)
    {
        //
        // Supported
        //
        return TRUE;
    }
    else
    {
        //
        // Not supported
        //
        return FALSE;
    }
}

HvCheckCpuSupportForSaveAndLoadDebugControls()

BOOLEAN HvCheckCpuSupportForSaveAndLoadDebugControls

(

)

Check if CPU support save and load debug controls on exit and load entries.

Returns

BOOLEAN

{
    IA32_VMX_BASIC_REGISTER VmxBasicMsr = {0};
 
    //
    // Reading IA32_VMX_BASIC_MSR
    //
    VmxBasicMsr.AsUInt = CpuReadMsr(IA32_VMX_BASIC);
 
    //
    // Read 1-settings of save debug controls (exit controls)
    //
    UINT32 ExitCtls = HvAdjustControls(
        IA32_VMX_EXIT_CTLS_SAVE_DEBUG_CONTROLS_FLAG,
        VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_EXIT_CTLS : IA32_VMX_EXIT_CTLS);
 
    //
    // Read 1-settings of load debug controls (entry controls)
    //
    UINT32 EntryCtls = HvAdjustControls(
        IA32_VMX_ENTRY_CTLS_LOAD_DEBUG_CONTROLS_FLAG,
        VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_ENTRY_CTLS : IA32_VMX_ENTRY_CTLS);
 
    //
    // Check if entry and exit controls are supported on this system
    //
    if (ExitCtls != NULL_ZERO && EntryCtls != NULL_ZERO)
    {
        //
        // Supported
        //
        return TRUE;
    }
    else
    {
        //
        // Not supported
        //
        return FALSE;
    }
}

HvClearSteppingBits()

UINT64 HvClearSteppingBits

(

UINT64

Interruptibility

)

Clear STI and MOV SS bits.

Returns

UINT64

{
    UINT64 InterruptibilityState = Interruptibility;
 
    InterruptibilityState &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS);
 
    return InterruptibilityState;
}

HvDisableExternalInterruptsAndInterruptWindow()

VOID HvDisableExternalInterruptsAndInterruptWindow

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Disable external-interrupts and interrupt window.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Change guest interrupt-state
    //
    HvSetExternalInterruptExiting(VCpu, TRUE);
 
    //
    // Do not vm-exit on interrupt windows
    //
    HvSetInterruptWindowExiting(FALSE);
 
    VCpu->EnableExternalInterruptsOnContinue = TRUE;
}

HvEnableAndCheckForPreviousExternalInterrupts()

VOID HvEnableAndCheckForPreviousExternalInterrupts

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Checks to enable and reinject previous interrupts.

Parameters

VCpu	The virtual processor's state

Returns

VOID

Parameters

VCpu	The virtual processor's state
Set	Set or unset the External Interrupt Exiting

Returns

VOID

{
    //
    // Check if we should enable interrupts in this core or not,
    // we have another same check in SWITCHING CORES too
    //
    if (VCpu->EnableExternalInterruptsOnContinueMtf)
    {
        //
        // Enable normal interrupts
        //
        HvSetExternalInterruptExiting(VCpu, FALSE);
 
        //
        // Check if there is at least an interrupt that needs to be delivered
        //
        if (VCpu->PendingExternalInterrupts[0] != NULL_ZERO)
        {
            //
            // Enable Interrupt-window exiting.
            //
            HvSetInterruptWindowExiting(TRUE);
        }
 
        VCpu->EnableExternalInterruptsOnContinueMtf = FALSE;
    }
}

HvEnableMtfAndChangeExternalInterruptState()

VOID HvEnableMtfAndChangeExternalInterruptState

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Enables MTF and adjust external interrupt state.

Parameters

VCpu	The virtual processor's state

Returns

VOID

VOID

{
    //
    // We have to set Monitor trap flag and give it the HookedEntry to work with
    //
    HvSetMonitorTrapFlag(TRUE);
 
    //
    // The following codes are added because we realized if the execution takes long then
    // the execution might be switched to another routines, thus, MTF might conclude on
    // another routine and we might (and will) trigger the same instruction soon
    //
 
    //
    // Change guest interrupt-state
    //
    HvSetExternalInterruptExiting(VCpu, TRUE);
 
    //
    // Do not vm-exit on interrupt windows
    //
    HvSetInterruptWindowExiting(FALSE);
 
    //
    // Indicate that we should enable external interrupts and configure external interrupt
    // window exiting somewhere at MTF
    //
    VCpu->EnableExternalInterruptsOnContinueMtf = TRUE;
}

HvFillGuestSelectorData()

VOID HvFillGuestSelectorData	(	PVOID	GdtBase,
		UINT32	SegmentRegister,
		UINT16	Selector )

Fill the guest's selector data.

Fill guest selector data.

Parameters

GdtBase
SegmentRegister
Selector

Returns

VOID

Fill the guest's selector data.

Parameters

GdtBase
SegmentRegister
Selector

Returns

VOID

{
    VMX_SEGMENT_SELECTOR SegmentSelector = {0};
 
    SegmentGetDescriptor(GdtBase, Selector, &SegmentSelector);
 
    if (Selector == 0x0)
    {
        SegmentSelector.Attributes.Unusable = TRUE;
    }
 
    SegmentSelector.Attributes.Reserved1 = 0;
    SegmentSelector.Attributes.Reserved2 = 0;
 
    VmxVmwrite64(VMCS_GUEST_ES_SELECTOR + SegmentRegister * 2, Selector);
    VmxVmwrite64(VMCS_GUEST_ES_LIMIT + SegmentRegister * 2, SegmentSelector.Limit);
    VmxVmwrite64(VMCS_GUEST_ES_ACCESS_RIGHTS + SegmentRegister * 2, SegmentSelector.Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_ES_BASE + SegmentRegister * 2, SegmentSelector.Base);
}

HvGetAndStoreDebugctl()

VOID HvGetAndStoreDebugctl

(

UINT64 *

StoreDebugctl

)

Get and store the guest state of IA32_DEBUGCTL.

mainly used from the VMCALL handler

Parameters

StoreDebugctl

Returns

VOID

{
    UINT64 DebugctlValue;
 
    //
    // Read DEBUGCTL from VMCS
    //
    DebugctlValue = HvGetDebugctl();
 
    //
    // Store the DEBUGCTL
    //
    *StoreDebugctl = DebugctlValue;
}

HvGetAndStoreGuestIa32LbrCtl()

VOID HvGetAndStoreGuestIa32LbrCtl

(

UINT64 *

StoreGuestIa32Lbr

)

Get and store the guest state of IA32_LBR_CTL.

mainly used from the VMCALL handler

Parameters

StoreGuestIa32Lbr

Returns

VOID

{
    UINT64 GuestIa32LbrCtl;
 
    //
    // Read IA32_LBR_CTL from VMCS
    //
    GuestIa32LbrCtl = HvGetGuestIa32LbrCtl();
 
    //
    // Store the IA32_LBR_CTL
    //
    *StoreGuestIa32Lbr = GuestIa32LbrCtl;
}

HvGetCsSelector()

UINT16 HvGetCsSelector

(

)

Read CS selector.

Returns

UINT16

{
    //
    // Only 16 bit is needed however, vmwrite might write on other bits
    // and corrupt other variables, that's why we get 64bit
    //
    UINT64 CsSel = NULL64_ZERO;
 
    VmxVmread64P(VMCS_GUEST_CS_SELECTOR, &CsSel);
 
    return CsSel & 0xffff;
}

HvGetDebugctl()

UINT64 HvGetDebugctl

(

)

Get the guest state of IA32_DEBUGCTL.

Returns

UINT64

{
    UINT32 LowPart;
    UINT32 HighPart;
 
    VmxVmread32P(VMCS_GUEST_DEBUGCTL, &LowPart);
    VmxVmread32P(VMCS_GUEST_DEBUGCTL_HIGH, &HighPart);
 
    return (UINT64)HighPart << 32 | LowPart;
}

HvGetGuestIa32LbrCtl()

UINT64 HvGetGuestIa32LbrCtl

(

)

Get the guest state of IA32_LBR_CTL.

Returns

UINT64

{
    UINT64 GuestIa32LbrCtl;
 
    VmxVmread64P(VMCS_GUEST_LBR_CTL, &GuestIa32LbrCtl);
 
    return GuestIa32LbrCtl;
}

HvGetInterruptibilityState()

UINT64 HvGetInterruptibilityState

(

)

Read guest's interruptibility state.

Returns

UINT64

{
    UINT64 InterruptibilityState = NULL64_ZERO;
 
    VmxVmread64P(VMCS_GUEST_INTERRUPTIBILITY_STATE, &InterruptibilityState);
 
    return InterruptibilityState;
}

HvGetPendingDebugExceptions()

UINT64 HvGetPendingDebugExceptions

(

)

Get the guest state of pending debug exceptions.

Returns

UINT64

{
    UINT64 Value;
    VmxVmread64P(VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, &Value);
 
    return Value;
}

HvGetRflags()

UINT64 HvGetRflags

(

)

Read guest's RFLAGS.

Returns

UINT64

{
    UINT64 Rflags = NULL64_ZERO;
 
    VmxVmread64P(VMCS_GUEST_RFLAGS, &Rflags);
 
    return Rflags;
}

HvGetRip()

UINT64 HvGetRip

(

)

Read guest's RIP.

Returns

UINT64

{
    UINT64 Rip = NULL64_ZERO;
 
    VmxVmread64P(VMCS_GUEST_RIP, &Rip);
 
    return Rip;
}

HvHandleControlRegisterAccess()

VOID HvHandleControlRegisterAccess	(	VIRTUAL_MACHINE_STATE *	VCpu,
		VMX_EXIT_QUALIFICATION_MOV_CR *	CrExitQualification )

Handles Guest Access to control registers.

Handle Guest's Control Registers Access.

Parameters

VCpu	The virtual processor's state

Returns

VOID

Handles Guest Access to control registers.

Parameters

VCpu

Returns

VOID

{
    UINT64 * RegPtr;
    UINT64   NewCr3;
    CR3_TYPE NewCr3Reg;
 
    RegPtr = (UINT64 *)&VCpu->Regs->rax + CrExitQualification->GeneralPurposeRegister;
 
    //
    // Because its RSP and as we didn't save RSP correctly (because of pushes)
    // so we have make it points to the GUEST_RSP
    //
 
    //
    // We handled it in vm-exit handler, commented
    //
 
    /*
    if (CrExitQualification->Fields.Register == 4)
    {
        VmxVmread64P(VMCS_GUEST_RSP, &GuestRsp);
        *RegPtr = GuestRsp;
    }
    */
 
    switch (CrExitQualification->AccessType)
    {
    case VMX_EXIT_QUALIFICATION_ACCESS_MOV_TO_CR:
    {
        switch (CrExitQualification->ControlRegister)
        {
        case VMX_EXIT_QUALIFICATION_REGISTER_CR0:
 
            VmxVmwrite64(VMCS_GUEST_CR0, *RegPtr);
            VmxVmwrite64(VMCS_CTRL_CR0_READ_SHADOW, *RegPtr);
 
            break;
 
        case VMX_EXIT_QUALIFICATION_REGISTER_CR3:
 
            NewCr3          = (*RegPtr & ~(1ULL << 63));
            NewCr3Reg.Flags = NewCr3;
 
            //
            // Apply the new cr3
            //
            VmxVmwrite64(VMCS_GUEST_CR3, NewCr3Reg.Flags);
 
            //
            // Invalidate as we used VPID tags so the vm-exit won't
            // normally (automatically) flush the TLB, we have to do
            // it manually
            //
            VpidInvvpidSingleContext(VPID_TAG);
 
            //
            // Call kernel debugger handler for mov to cr3 in kernel debugger
            //
            InterceptionCallbackTriggerCr3ProcessChange(VCpu->CoreId);
 
            //
            // Call handler of the reversing machine
            //
            if (g_ExecTrapInitialized)
            {
                ExecTrapHandleCr3Vmexit(VCpu);
            }
 
            break;
 
        case VMX_EXIT_QUALIFICATION_REGISTER_CR4:
 
            VmxVmwrite64(VMCS_GUEST_CR4, *RegPtr);
            VmxVmwrite64(VMCS_CTRL_CR4_READ_SHADOW, *RegPtr);
 
            break;
 
        default:
            LogWarning("Unsupported register 0x%x in handling control registers access",
                       CrExitQualification->ControlRegister);
            break;
        }
    }
    break;
 
    case VMX_EXIT_QUALIFICATION_ACCESS_MOV_FROM_CR:
    {
        switch (CrExitQualification->ControlRegister)
        {
        case VMX_EXIT_QUALIFICATION_REGISTER_CR0:
 
            VmxVmread64P(VMCS_GUEST_CR0, RegPtr);
 
            break;
 
        case VMX_EXIT_QUALIFICATION_REGISTER_CR3:
 
            VmxVmread64P(VMCS_GUEST_CR3, RegPtr);
 
            break;
 
        case VMX_EXIT_QUALIFICATION_REGISTER_CR4:
 
            VmxVmread64P(VMCS_GUEST_CR4, RegPtr);
 
            break;
 
        default:
            LogWarning("Unsupported register 0x%x in handling control registers access",
                       CrExitQualification->ControlRegister);
            break;
        }
    }
    break;
 
    default:
        LogWarning("Unsupported operation 0x%x in handling control registers access",
                   CrExitQualification->AccessType);
        break;
    }
}

HvHandleCpuid()

VOID HvHandleCpuid

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handle Cpuid Vmexits.

Handle Cpuid.

Parameters

VCpu	The virtual processor's state

Returns

VOID

Handle Cpuid Vmexits.

Parameters

VCpu

Returns

VOID

{
    INT32       CpuInfo[4];
    PGUEST_REGS Regs = VCpu->Regs;
 
    //
    // Otherwise, issue the CPUID to the logical processor based on the indexes
    // on the VP's GPRs.
    //
    CpuCpuIdEx(CpuInfo, (INT32)Regs->rax, (INT32)Regs->rcx);
 
    //
    // check whether we are in transparent mode or not
    // if we are in transparent mode then ignore the
    // cpuid modifications e.g. hyperviosr name or bit
    //
    if (!g_CheckForFootprints)
    {
        //
        // Check if this was CPUID 1h, which is the features request
        //
        if (Regs->rax == CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS)
        {
            //
            // Set the Hypervisor Present-bit in RCX, which Intel and AMD have both
            // reserved for this indication
            //
            CpuInfo[2] |= HYPERV_HYPERVISOR_PRESENT_BIT;
        }
        else if (Regs->rax == CPUID_HV_VENDOR_AND_MAX_FUNCTIONS)
        {
            //
            // Return a maximum supported hypervisor CPUID leaf range and a vendor
            // ID signature as required by the spec
            //
 
            CpuInfo[0] = HYPERV_CPUID_INTERFACE;
            CpuInfo[1] = 'epyH'; // [HyperDbg]
            CpuInfo[2] = 'gbDr';
            CpuInfo[3] = 0;
        }
        else if (Regs->rax == HYPERV_CPUID_INTERFACE)
        {
            //
            // Return non Hv#1 value. This indicate that our hypervisor does NOT
            // conform to the Microsoft hypervisor interface.
            //
 
            CpuInfo[0] = '0#vH'; // Hv#0
            CpuInfo[1] = CpuInfo[2] = CpuInfo[3] = 0;
        }
    }
    else
    {
        TransparentCheckAndModifyCpuid(Regs, CpuInfo);
    }
 
    //
    // Copy the values from the logical processor registers into the VP GPRs
    //
    Regs->rax = CpuInfo[0];
    Regs->rbx = CpuInfo[1];
    Regs->rcx = CpuInfo[2];
    Regs->rdx = CpuInfo[3];
}

HvHandleMovDebugRegister()

VOID HvHandleMovDebugRegister

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handle Mov to Debug Registers Exitings.

Parameters

VCpu	The virtual processor's state

Returns

VOID

Parameters

VCpu

Returns

VOID

{
    VMX_EXIT_QUALIFICATION_MOV_DR ExitQualification;
    CR4                           Cr4;
    DR7                           Dr7;
    VMX_SEGMENT_SELECTOR          Cs;
    UINT64 *                      GpRegs = (UINT64 *)VCpu->Regs;
 
    //
    // The implementation is derived from Hvpp
    //
    VmxVmread64P(VMCS_EXIT_QUALIFICATION, &ExitQualification.AsUInt);
 
    UINT64 GpRegister = GpRegs[ExitQualification.GeneralPurposeRegister];
 
    //
    // The MOV DR instruction causes a VM exit if the "MOV-DR exiting"
    // VM-execution control is 1.  Such VM exits represent an exception
    // to the principles identified in Section 25.1.1 (Relative Priority
    // of Faults and VM Exits) in that they take priority over the
    // following: general-protection exceptions based on privilege level;
    // and invalid-opcode exceptions that occur because CR4.DE = 1 and the
    // instruction specified access to DR4 or DR5.
    // (ref: Vol3C[25.1.3(Instructions That Cause VM Exits Conditionally)])
    //
    // TL;DR:
    //   CPU usually prioritizes exceptions.  For example RDMSR executed
    //   at CPL = 3 won't cause VM-exit - it causes #GP instead.  MOV DR
    //   is exception to this rule, as it ALWAYS cause VM-exit.
    //
    //   Normally, CPU allows you to write to DR registers only at CPL=0,
    //   otherwise it causes #GP.  Therefore we'll simulate the exact same
    //   behavior here.
    //
 
    Cs = GetGuestCs();
 
    if (Cs.Attributes.DescriptorPrivilegeLevel != 0)
    {
        EventInjectGeneralProtection();
 
        //
        // Redo the instruction
        //
        HvSuppressRipIncrement(VCpu);
        return;
    }
 
    //
    // Debug registers DR4 and DR5 are reserved when debug extensions
    // are enabled (when the DE flag in control register CR4 is set)
    // and attempts to reference the DR4 and DR5 registers cause
    // invalid-opcode exceptions (#UD).
    // When debug extensions are not enabled (when the DE flag is clear),
    // these registers are aliased to debug registers DR6 and DR7.
    // (ref: Vol3B[17.2.2(Debug Registers DR4 and DR5)])
    //
 
    //
    // Read guest cr4
    //
    VmxVmread64P(VMCS_GUEST_CR4, &Cr4.AsUInt);
 
    if (ExitQualification.DebugRegister == 4 || ExitQualification.DebugRegister == 5)
    {
        if (Cr4.DebuggingExtensions)
        {
            //
            // re-inject #UD
            //
            EventInjectUndefinedOpcode(VCpu);
            return;
        }
        else
        {
            ExitQualification.DebugRegister += 2;
        }
    }
 
    //
    // Enables (when set) debug-register protection, which causes a
    // debug exception to be generated prior to any MOV instruction
    // that accesses a debug register.  When such a condition is
    // detected, the BD flag in debug status register DR6 is set prior
    // to generating the exception.  This condition is provided to
    // support in-circuit emulators.
    // When the emulator needs to access the debug registers, emulator
    // software can set the GD flag to prevent interference from the
    // program currently executing on the processor.
    // The processor clears the GD flag upon entering to the debug
    // exception handler, to allow the handler access to the debug
    // registers.
    // (ref: Vol3B[17.2.4(Debug Control Register (DR7)])
    //
 
    //
    // Read the DR7
    //
    VmxVmread64P(VMCS_GUEST_DR7, &Dr7.AsUInt);
 
    if (Dr7.GeneralDetect)
    {
        DR6 Dr6 = {
            .AsUInt                      = CpuReadDr(6),
            .BreakpointCondition         = 0,
            .DebugRegisterAccessDetected = TRUE};
 
        CpuWriteDr(6, Dr6.AsUInt);
 
        Dr7.GeneralDetect = FALSE;
 
        VmxVmwrite64(VMCS_GUEST_DR7, Dr7.AsUInt);
 
        EventInjectDebugBreakpoint();
 
        //
        // Redo the instruction
        //
        HvSuppressRipIncrement(VCpu);
 
        return;
    }
 
    //
    // In 64-bit mode, the upper 32 bits of DR6 and DR7 are reserved
    // and must be written with zeros.  Writing 1 to any of the upper
    // 32 bits results in a #GP(0) exception.
    // (ref: Vol3B[17.2.6(Debug Registers and Intel 64 Processors)])
    //
    if (ExitQualification.DirectionOfAccess == VMX_EXIT_QUALIFICATION_DIRECTION_MOV_TO_DR &&
        (ExitQualification.DebugRegister == VMX_EXIT_QUALIFICATION_REGISTER_DR6 ||
         ExitQualification.DebugRegister == VMX_EXIT_QUALIFICATION_REGISTER_DR7) &&
        (GpRegister >> 32) != 0)
    {
        EventInjectGeneralProtection();
 
        //
        // Redo the instruction
        //
        HvSuppressRipIncrement(VCpu);
        return;
    }
 
    switch (ExitQualification.DirectionOfAccess)
    {
    case VMX_EXIT_QUALIFICATION_DIRECTION_MOV_TO_DR:
        switch (ExitQualification.DebugRegister)
        {
        case VMX_EXIT_QUALIFICATION_REGISTER_DR0:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR0, GpRegister);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR1:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR1, GpRegister);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR2:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR2, GpRegister);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR3:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR3, GpRegister);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR6:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR6, GpRegister);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR7:
            CpuWriteDr(VMX_EXIT_QUALIFICATION_REGISTER_DR7, GpRegister);
            break;
        default:
            break;
        }
        break;
 
    case VMX_EXIT_QUALIFICATION_DIRECTION_MOV_FROM_DR:
        switch (ExitQualification.DebugRegister)
        {
        case VMX_EXIT_QUALIFICATION_REGISTER_DR0:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR0);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR1:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR1);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR2:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR2);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR3:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR3);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR6:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR6);
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_DR7:
            GpRegister = CpuReadDr(VMX_EXIT_QUALIFICATION_REGISTER_DR7);
            break;
        default:
            break;
        }
 
    default:
        break;
    }
}

HvHandleTrapFlag()

VOID HvHandleTrapFlag

(

)

Handle the case when the trap flag is set, and we need to inject the single-step exception right after vm-entry.

Returns

VOID

{
    IA32_DEBUGCTL_REGISTER       Debugctl    = {.AsUInt = HvGetDebugctl()};
    RFLAGS                       GuestRFlags = {.AsUInt = GetGuestRFlags()};
    VMX_PENDING_DEBUG_EXCEPTIONS PendingDebugExceptions;
    VMX_INTERRUPTIBILITY_STATE   InterruptibilityState;
 
    //
    // The btf flag means that the trap flag generates the single-step exception
    // only for branch instructions
    //
    if (GuestRFlags.TrapFlag && !Debugctl.Btf)
    {
        PendingDebugExceptions.AsUInt = HvGetPendingDebugExceptions();
        PendingDebugExceptions.Bs     = 1;
        HvSetPendingDebugExceptions(PendingDebugExceptions.AsUInt);
 
        InterruptibilityState.AsUInt = (UINT32)HvGetInterruptibilityState();
 
        //
        // We also must clear this flag in case of instruction emulation to achieve
        // correctness of the single-step exception
        //
        if (InterruptibilityState.BlockingByMovSs)
        {
            InterruptibilityState.BlockingByMovSs = 0;
            HvSetInterruptibilityState(InterruptibilityState.AsUInt);
        }
    }
}

HvInitVmm()

BOOLEAN HvInitVmm

(

VMM_CALLBACKS *

VmmCallbacks

)

Initializes the hypervisor.

Parameters

VmmCallbacks

Returns

BOOLEAN

{
    ULONG   ProcessorsCount;
    BOOLEAN Result = FALSE;
 
    //
    // Save the callbacks
    //
    RtlCopyMemory(&g_Callbacks, VmmCallbacks, sizeof(VMM_CALLBACKS));
 
    //
    // Check and define compatibility checks and processor constraints
    //
    CompatibilityCheckPerformChecks();
 
    //
    // we allocate virtual machine here because
    // we want to use its state (vmx-root or vmx non-root) in logs
    //
    Result = GlobalGuestStateAllocateZeroedMemory();
 
    if (!Result)
    {
        return FALSE;
    }
 
    //
    // We have a zeroed guest state
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // Set the core's id and initialize memory mapper
    //
    for (UINT32 i = 0; i < ProcessorsCount; i++)
    {
        g_GuestState[i].CoreId = i;
    }
 
    //
    // Initialize memory mapper
    //
    MemoryMapperInitialize();
 
    //
    // Make sure that transparent-mode is disabled
    //
    if (g_CheckForFootprints)
    {
        TransparentUnhideDebuggerWrapper(NULL);
    }
 
    //
    // Not waiting for the interrupt-window to inject page-faults
    //
    g_WaitingForInterruptWindowToInjectPageFault = FALSE;
 
    //
    // Initializes VMX
    //
    return VmxInitialize();
}

HvInjectPendingExternalInterrupts()

VOID HvInjectPendingExternalInterrupts

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Inject pending external interrupts.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Check if there is at least an interrupt that needs to be delivered
    //
    if (VCpu->PendingExternalInterrupts[0] != NULL_ZERO)
    {
        //
        // Enable Interrupt-window exiting.
        //
        HvSetInterruptWindowExiting(TRUE);
    }
}

HvPerformRipIncrement()

VOID HvPerformRipIncrement ( VIRTUAL_MACHINE_STATE * VCpu )

inline

Perform the incrementation of RIP.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    VCpu->IncrementRip = TRUE;
}

HvPreventExternalInterrupts()

VOID HvPreventExternalInterrupts

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Adjust external interrupt state.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Change guest interrupt-state
    //
    HvSetExternalInterruptExiting(VCpu, TRUE);
 
    //
    // Do not vm-exit on interrupt windows
    //
    HvSetInterruptWindowExiting(FALSE);
 
    //
    // Indicate that we should enable external interrupts and configure external interrupt
    // window exiting somewhere at MTF
    //
    VCpu->EnableExternalInterruptsOnContinueMtf = TRUE;
}

HvReadExceptionBitmap()

UINT32 HvReadExceptionBitmap

(

)

Read exception bitmap in VMCS.

Read the exception bitmap.

Should be called in vmx-root

Returns

UINT32

Read exception bitmap in VMCS.

Returns

UINT32

{
    UINT32 ExceptionBitmap = 0;
 
    //
    // Read the current bitmap
    //
    VmxVmread32P(VMCS_CTRL_EXCEPTION_BITMAP, &ExceptionBitmap);
 
    return ExceptionBitmap;
}

HvRestoreRegisters()

VOID HvRestoreRegisters

(

)

Reset GDTR/IDTR and other old when you do vmxoff as the patchguard will detect them left modified.

Returns

VOID

{
    UINT64 FsBase;
    UINT64 GsBase;
    UINT64 GdtrBase;
    UINT64 GdtrLimit;
    UINT64 IdtrBase;
    UINT64 IdtrLimit;
    UINT16 DsSelector;
    UINT16 EsSelector;
    UINT16 SsSelector;
    UINT16 FsSelector;
 
    //
    // Restore FS Base
    //
    VmxVmread64P(VMCS_GUEST_FS_BASE, &FsBase);
    CpuWriteMsr(IA32_FS_BASE, FsBase);
 
    //
    // Restore Gs Base
    //
    VmxVmread64P(VMCS_GUEST_GS_BASE, &GsBase);
    CpuWriteMsr(IA32_GS_BASE, GsBase);
 
    //
    // Restore GDTR
    //
    VmxVmread64P(VMCS_GUEST_GDTR_BASE, &GdtrBase);
    VmxVmread64P(VMCS_GUEST_GDTR_LIMIT, &GdtrLimit);
 
    AsmReloadGdtr((PVOID)GdtrBase, (ULONG)GdtrLimit);
 
    //
    // Restore Segment Selector
    //
    VmxVmread16P(VMCS_GUEST_DS_SELECTOR, &DsSelector);
    AsmSetDs(DsSelector);
    VmxVmread16P(VMCS_GUEST_ES_SELECTOR, &EsSelector);
    AsmSetEs(EsSelector);
    VmxVmread16P(VMCS_GUEST_SS_SELECTOR, &SsSelector);
    AsmSetSs(SsSelector);
    VmxVmread16P(VMCS_GUEST_FS_SELECTOR, &FsSelector);
    AsmSetFs(FsSelector);
 
    //
    // Restore IDTR
    //
    VmxVmread64P(VMCS_GUEST_IDTR_BASE, &IdtrBase);
    VmxVmread64P(VMCS_GUEST_IDTR_LIMIT, &IdtrLimit);
 
    AsmReloadIdtr((PVOID)IdtrBase, (ULONG)IdtrLimit);
}

HvResumeToNextInstruction()

VOID HvResumeToNextInstruction

(

)

Add the current instruction length to guest rip to resume to next instruction.

Resume GUEST_RIP to next instruction.

Returns

VOID

Add the current instruction length to guest rip to resume to next instruction.

Returns

VOID

{
    UINT64 ResumeRIP             = NULL64_ZERO;
    UINT64 CurrentRIP            = NULL64_ZERO;
    SIZE_T ExitInstructionLength = 0;
 
    VmxVmread64P(VMCS_GUEST_RIP, &CurrentRIP);
    VmxVmread64P(VMCS_VMEXIT_INSTRUCTION_LENGTH, &ExitInstructionLength);
 
    ResumeRIP = CurrentRIP + ExitInstructionLength;
 
    VmxVmwrite64(VMCS_GUEST_RIP, ResumeRIP);
}

HvSetClearGuestIa32LbrCtl()

VOID HvSetClearGuestIa32LbrCtl	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set SAVE GUEST IA32_LBR_CTL on Vm-exit controls.

Parameters

VCpu
Set	Set or unset

Returns

VOID

{
    UNREFERENCED_PARAMETER(VCpu);
 
    UINT32 VmexitControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PRIMARY_VMEXIT_CONTROLS, &VmexitControls);
 
    if (Set)
    {
        VmexitControls |= IA32_VMX_EXIT_CTLS_CLEAR_IA32_LBR_CTL_FLAG;
    }
    else
    {
        VmexitControls &= ~IA32_VMX_EXIT_CTLS_CLEAR_IA32_LBR_CTL_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite32(VMCS_CTRL_PRIMARY_VMEXIT_CONTROLS, VmexitControls);
}

HvSetDebugctl()

VOID HvSetDebugctl

(

UINT64

Value

)

Set the guest state of IA32_DEBUGCTL.

Parameters

Value

The new state

Returns

VOID

{
    VmxVmwrite32(VMCS_GUEST_DEBUGCTL, Value & 0xFFFFFFFF);
    VmxVmwrite32(VMCS_GUEST_DEBUGCTL_HIGH, Value >> 32);
}

HvSetDebugReg7()

VOID HvSetDebugReg7

(

UINT64

Value

)

Set the guest state of DR7.

Parameters

Value

The new value for DR7

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_DR7, Value);
}

HvSetExceptionBitmap()

VOID HvSetExceptionBitmap	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	IdtIndex )

Set exception bitmap in VMCS.

Should be called in vmx-root

Parameters

VCpu	The virtual processor's state
IdtIndex	Interrupt Descriptor Table index of exception

Returns

VOID

Should be called in vmx-root

Parameters

IdtIndex

Returns

VOID

{
    //
    // This is a wrapper to perform extra checks
    //
    ProtectedHvSetExceptionBitmap(VCpu, IdtIndex);
}

HvSetExternalInterruptExiting()

VOID HvSetExternalInterruptExiting	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set the External Interrupt Exiting.

Parameters

VCpu	The virtual processor's state
Set	Set or unset the External Interrupt Exiting

Returns

VOID

Parameters

Set

Returns

VOID

{
    //
    // This is a wrapper to perform extra checks
    //
    ProtectedHvSetExternalInterruptExiting(VCpu, Set);
}

HvSetGuestIa32LbrCtl()

VOID HvSetGuestIa32LbrCtl

(

UINT64

Value

)

Set the guest state of IA32_LBR_CTL.

Parameters

Value

The new state

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_LBR_CTL, Value);
}

HvSetGuestSelector()

BOOLEAN HvSetGuestSelector	(	PVOID	GdtBase,
		UINT32	SegmentRegister,
		UINT16	Selector )

Set guest's selector registers.

Set Guest Selector Registers.

Parameters

GdtBase
SegmentRegister
Selector

Returns

BOOLEAN

Set guest's selector registers.

Parameters

GdtBase
SegmentRegister
Selector

Returns

BOOLEAN

{
    VMX_SEGMENT_SELECTOR SegmentSelector = {0};
    SegmentGetDescriptor(GdtBase, Selector, &SegmentSelector);
 
    if (Selector == 0x0)
    {
        SegmentSelector.Attributes.Unusable = TRUE;
    }
 
    VmxVmwrite64(VMCS_GUEST_ES_SELECTOR + SegmentRegister * 2, Selector);
    VmxVmwrite64(VMCS_GUEST_ES_LIMIT + SegmentRegister * 2, SegmentSelector.Limit);
    VmxVmwrite64(VMCS_GUEST_ES_ACCESS_RIGHTS + SegmentRegister * 2, SegmentSelector.Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_ES_BASE + SegmentRegister * 2, SegmentSelector.Base);
 
    return TRUE;
}

HvSetInterruptibilityState()

VOID HvSetInterruptibilityState

(

UINT64

InterruptibilityState

)

Set guest's interruptibility state.

Parameters

InterruptibilityState

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_INTERRUPTIBILITY_STATE, InterruptibilityState);
}

HvSetInterruptWindowExiting()

VOID HvSetInterruptWindowExiting

(

BOOLEAN

Set

)

Set Interrupt-window exiting.

Parameters

Set	Set or unset the Interrupt-window exiting

Returns

VOID

Parameters

Set

Returns

VOID

{
    UINT32 CpuBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &CpuBasedVmExecControls);
 
    //
    // interrupt-window exiting
    //
    if (Set)
    {
        CpuBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS_INTERRUPT_WINDOW_EXITING_FLAG;
    }
    else
    {
        CpuBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS_INTERRUPT_WINDOW_EXITING_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, CpuBasedVmExecControls);
}

HvSetLbrSelect()

VOID HvSetLbrSelect

(

UINT64

FilterOptions

)

Set LBR selector.

If VMM is active, this should be done in vmx-root, otherwise, it doesn't work

Parameters

FilterOptions

The value to write on MSR_LEGACY_LBR_SELECT

Returns

VOID

{
    CpuWriteMsr(MSR_LEGACY_LBR_SELECT, FilterOptions);
}

HvSetLoadDebugControls()

VOID HvSetLoadDebugControls	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set LOAD DEBUG CONTROLS on Vm-entry controls.

Parameters

VCpu
Set	Set or unset

Returns

VOID

{
    ProtectedHvSetLoadDebugControls(VCpu, Set);
}

HvSetLoadGuestIa32LbrCtl()

VOID HvSetLoadGuestIa32LbrCtl	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set LOAD GUEST IA32_LBR_CTL on Vm-entry controls.

Parameters

VCpu
Set	Set or unset

Returns

VOID

{
    UNREFERENCED_PARAMETER(VCpu);
 
    UINT32 VmentryControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_VMENTRY_CONTROLS, &VmentryControls);
 
    if (Set)
    {
        VmentryControls |= IA32_VMX_ENTRY_CTLS_LOAD_IA32_LBR_CTL_FLAG;
    }
    else
    {
        VmentryControls &= ~IA32_VMX_ENTRY_CTLS_LOAD_IA32_LBR_CTL_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite32(VMCS_CTRL_VMENTRY_CONTROLS, VmentryControls);
}

HvSetModeBasedExecutionEnableFlag()

VOID HvSetModeBasedExecutionEnableFlag

(

BOOLEAN

Set

)

Set Mode-based Execution Control (MBEC) Enable bit.

Parameters

Set	Set or unset the MBEC

Returns

VOID

{
    UINT32 AdjSecCtrl;
    UINT32 SecondaryProcBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_SECONDARY_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &SecondaryProcBasedVmExecControls);
 
    //
    // PML enable flag
    //
    if (Set)
    {
        SecondaryProcBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS2_MODE_BASED_EXECUTE_CONTROL_FOR_EPT_FLAG;
    }
    else
    {
        SecondaryProcBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS2_MODE_BASED_EXECUTE_CONTROL_FOR_EPT_FLAG;
    }
 
    AdjSecCtrl = HvAdjustControls(SecondaryProcBasedVmExecControls, IA32_VMX_PROCBASED_CTLS2);
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_SECONDARY_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, AdjSecCtrl);
}

HvSetMonitorTrapFlag()

VOID HvSetMonitorTrapFlag

(

BOOLEAN

Set

)

Set the monitor trap flag.

Set or unset the monitor trap flags.

Parameters

Set	Set or unset the MTFs

Returns

VOID

Set the monitor trap flag.

Parameters

Set

Returns

VOID

{
    UINT32 CpuBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &CpuBasedVmExecControls);
 
    if (Set)
    {
        CpuBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS_MONITOR_TRAP_FLAG_FLAG;
    }
    else
    {
        CpuBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS_MONITOR_TRAP_FLAG_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, CpuBasedVmExecControls);
}

HvSetMovControlRegsExiting()

VOID HvSetMovControlRegsExiting	(	BOOLEAN	Set,
		UINT64	ControlRegister,
		UINT64	MaskRegister )

Set vm-exit for mov-to-cr0/4.

Should be called in vmx-root

Parameters

Set	or unset the vm-exits
Control	Register
Mask	Register

Returns

VOID

Parameters

Set
ControlRegister
MaskRegister

Returns

VOID

{
    ProtectedHvSetMov2CrExiting(Set, ControlRegister, MaskRegister);
}

HvSetMovDebugRegsExiting()

VOID HvSetMovDebugRegsExiting	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set or unset the Mov to Debug Registers Exiting.

Set the Mov to Debug Registers Exiting.

Parameters

VCpu	The virtual processor's state
Set	Set or unset the Mov to Debug Registers Exiting

Returns

VOID

Set or unset the Mov to Debug Registers Exiting.

Parameters

Set

Returns

VOID

{
    ProtectedHvSetMovDebugRegsExiting(VCpu, Set);
}

HvSetMovToCr3Vmexit()

VOID HvSetMovToCr3Vmexit	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set vm-exit for mov-to-cr3.

Should be called in vmx-root

Parameters

VCpu	The virtual processor's state
Set	Set or unset the vm-exits

Returns

VOID

Parameters

Set

Returns

VOID

{
    ProtectedHvSetMov2Cr3Exiting(VCpu, Set);
}

HvSetNmiExiting()

VOID HvSetNmiExiting

(

BOOLEAN

Set

)

Set the NMI Exiting.

Parameters

Set	Set or unset the NMI Exiting

Returns

VOID

Parameters

Set

Returns

VOID

{
    UINT32 PinBasedControls = 0;
    UINT32 VmExitControls   = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PIN_BASED_VM_EXECUTION_CONTROLS, &PinBasedControls);
    VmxVmread32P(VMCS_CTRL_PRIMARY_VMEXIT_CONTROLS, &VmExitControls);
 
    if (Set)
    {
        PinBasedControls |= IA32_VMX_PINBASED_CTLS_NMI_EXITING_FLAG;
        VmExitControls |= IA32_VMX_EXIT_CTLS_ACKNOWLEDGE_INTERRUPT_ON_EXIT_FLAG;
    }
    else
    {
        PinBasedControls &= ~IA32_VMX_PINBASED_CTLS_NMI_EXITING_FLAG;
        VmExitControls &= ~IA32_VMX_EXIT_CTLS_ACKNOWLEDGE_INTERRUPT_ON_EXIT_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PIN_BASED_VM_EXECUTION_CONTROLS, PinBasedControls);
    VmxVmwrite64(VMCS_CTRL_PRIMARY_VMEXIT_CONTROLS, VmExitControls);
}

HvSetNmiWindowExiting()

VOID HvSetNmiWindowExiting

(

BOOLEAN

Set

)

Set NMI-window exiting.

Parameters

Set	Set or unset the NMI-window exiting

Returns

VOID

Parameters

Set

Returns

VOID

{
    UINT32 CpuBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &CpuBasedVmExecControls);
 
    //
    // interrupt-window exiting
    //
    if (Set)
    {
        CpuBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS_NMI_WINDOW_EXITING_FLAG;
    }
    else
    {
        CpuBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS_NMI_WINDOW_EXITING_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, CpuBasedVmExecControls);
}

HvSetPendingDebugExceptions()

VOID HvSetPendingDebugExceptions

(

UINT64

Value

)

Set the guest state of pending debug exceptions.

Parameters

Value

The new state

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, Value);
}

HvSetPmcVmexit()

VOID HvSetPmcVmexit

(

BOOLEAN

Set

)

Set vm-exit for rdpmc instructions.

Should be called in vmx-root

Parameters

Set	Set or unset the vm-exits

Returns

VOID

Parameters

Set

Returns

VOID

{
    UINT32 CpuBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &CpuBasedVmExecControls);
 
    if (Set)
    {
        CpuBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS_RDPMC_EXITING_FLAG;
    }
    else
    {
        CpuBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS_RDPMC_EXITING_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, CpuBasedVmExecControls);
}

HvSetPmlEnableFlag()

VOID HvSetPmlEnableFlag

(

BOOLEAN

Set

)

Set Page Modification Logging Enable bit.

Parameters

Set	Set or unset the PML

Returns

VOID

{
    UINT32 AdjSecCtrl;
    UINT32 SecondaryProcBasedVmExecControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_SECONDARY_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, &SecondaryProcBasedVmExecControls);
 
    //
    // PML enable flag
    //
    if (Set)
    {
        SecondaryProcBasedVmExecControls |= IA32_VMX_PROCBASED_CTLS2_ENABLE_PML_FLAG;
    }
    else
    {
        SecondaryProcBasedVmExecControls &= ~IA32_VMX_PROCBASED_CTLS2_ENABLE_PML_FLAG;
    }
 
    AdjSecCtrl = HvAdjustControls(SecondaryProcBasedVmExecControls, IA32_VMX_PROCBASED_CTLS2);
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_SECONDARY_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, AdjSecCtrl);
}

HvSetRdtscExiting()

VOID HvSetRdtscExiting	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set the RDTSC/P Exiting.

Parameters

VCpu	The virtual processor's state
Set	Set or unset the RDTSC/P Exiting

Returns

VOID

Parameters

Set

Returns

VOID

{
    ProtectedHvSetRdtscExiting(VCpu, Set);
}

HvSetRflags()

VOID HvSetRflags

(

UINT64

Rflags

)

Set guest's RFLAGS.

Parameters

Rflags

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_RFLAGS, Rflags);
}

HvSetRflagTrapFlag()

VOID HvSetRflagTrapFlag

(

BOOLEAN

Set

)

Set the rflag's trap flag.

Parameters

Set	Set or unset the TF

Returns

VOID

{
    RFLAGS Rflags = {0};
 
    //
    // Unset the trap-flag, as we set it before we have to mask it now
    //
    Rflags.AsUInt = HvGetRflags();
 
    Rflags.TrapFlag = Set;
 
    HvSetRflags(Rflags.AsUInt);
}

HvSetRip()

VOID HvSetRip

(

UINT64

Rip

)

Set guest's RIP.

Parameters

Rip

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_RIP, Rip);
}

HvSetSaveDebugControls()

VOID HvSetSaveDebugControls	(	VIRTUAL_MACHINE_STATE *	VCpu,
		BOOLEAN	Set )

Set SAVE DEBUG CONTROLS on Vm-exit controls.

Parameters

VCpu
Set	Set or unset

Returns

VOID

{
    ProtectedHvSetSaveDebugControls(VCpu, Set);
}

HvSetVmxPreemptionTimerExiting()

VOID HvSetVmxPreemptionTimerExiting

(

BOOLEAN

Set

)

Set the VMX preemption timer.

Set the VMX Preemptiom Timer.

Parameters

Set	Set or unset the VMX preemption timer

Returns

VOID

Set the VMX preemption timer.

Parameters

Set

Returns

VOID

{
    UINT32 PinBasedControls = 0;
 
    //
    // Read the previous flags
    //
    VmxVmread32P(VMCS_CTRL_PIN_BASED_VM_EXECUTION_CONTROLS, &PinBasedControls);
 
    if (Set)
    {
        PinBasedControls |= IA32_VMX_PINBASED_CTLS_ACTIVATE_VMX_PREEMPTION_TIMER_FLAG;
    }
    else
    {
        PinBasedControls &= ~IA32_VMX_PINBASED_CTLS_ACTIVATE_VMX_PREEMPTION_TIMER_FLAG;
    }
 
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_PIN_BASED_VM_EXECUTION_CONTROLS, PinBasedControls);
}

HvSuppressRipIncrement()

VOID HvSuppressRipIncrement ( VIRTUAL_MACHINE_STATE * VCpu )

inline

Suppress the incrementation of RIP.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    VCpu->IncrementRip = FALSE;
}

HvUnsetExceptionBitmap()

VOID HvUnsetExceptionBitmap	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	IdtIndex )

Unset exception bitmap in VMCS.

Should be called in vmx-root

Parameters

VCpu	The virtual processor's state
IdtIndex	Interrupt Descriptor Table index of exception

Returns

VOID

Should be called in vmx-root

Parameters

IdtIndex

Returns

VOID

{
    //
    // This is a wrapper to perform extra checks
    //
    ProtectedHvUnsetExceptionBitmap(VCpu, IdtIndex);
}

HvWriteExceptionBitmap()

VOID HvWriteExceptionBitmap

(

UINT32

BitmapMask

)

Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.

Write to the exception bitmap.

Should be called in vmx-root

Parameters

BitmapMask

The content to write on exception bitmap

Returns

VOID

Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.

Parameters

BitmapMask

Returns

VOID

{
    //
    // Set the new value
    //
    VmxVmwrite64(VMCS_CTRL_EXCEPTION_BITMAP, BitmapMask);
}