IoHandler.h File Reference

The I/O Handler for vm-exit headers. More...

Go to the source code of this file.

Typedefs
typedef enum _IO_ACCESS_INSTR	IO_ACCESS_INSTR
	IN Instruction or OUT Instruction.
typedef enum _IO_OP_ENCODING	IO_OP_ENCODING
	Immediate value or in DX.

Enumerations
enum	_IO_ACCESS_INSTR { AccessOut = 0 , AccessIn = 1 }
	IN Instruction or OUT Instruction. More...
enum	_IO_OP_ENCODING { OpEncodingDx = 0 , OpEncodingImm = 1 }
	Immediate value or in DX. More...

Functions
UINT8	IoInByte (UINT16 port)
UINT16	IoInWord (UINT16 port)
UINT32	IoInDword (UINT16 port)
VOID	IoInByteString (UINT16 port, UINT8 *data, UINT32 size)
VOID	IoInWordString (UINT16 port, UINT16 *data, UINT32 size)
VOID	IoInDwordString (UINT16 port, UINT32 *data, UINT32 size)
VOID	IoOutByte (UINT16 port, UINT8 value)
VOID	IoOutWord (UINT16 port, UINT16 value)
VOID	IoOutDword (UINT16 port, UINT32 value)
VOID	IoOutByteString (UINT16 port, UINT8 *data, UINT32 count)
VOID	IoOutWordString (UINT16 port, UINT16 *data, UINT32 count)
VOID	IoOutDwordString (UINT16 port, UINT32 *data, UINT32 count)
VOID	IoHandleIoVmExits (VIRTUAL_MACHINE_STATE *VCpu, VMX_EXIT_QUALIFICATION_IO_INSTRUCTION IoQualification, RFLAGS Flags)
	VM-Exit handler for I/O Instructions (in/out).
VOID	IoHandlePerformIoBitmapChange (VIRTUAL_MACHINE_STATE *VCpu, UINT32 Port)
	Change I/O Bitmap.
VOID	IoHandlePerformIoBitmapReset (VIRTUAL_MACHINE_STATE *VCpu)
	Reset I/O Bitmap.

Detailed Description

The I/O Handler for vm-exit headers.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-06-06

Copyright

This project is released under the GNU Public License v3.

Typedef Documentation

IO_ACCESS_INSTR

typedef enum _IO_ACCESS_INSTR IO_ACCESS_INSTR

IN Instruction or OUT Instruction.

IO_OP_ENCODING

typedef enum _IO_OP_ENCODING IO_OP_ENCODING

Immediate value or in DX.

Enumeration Type Documentation

_IO_ACCESS_INSTR

enum _IO_ACCESS_INSTR

IN Instruction or OUT Instruction.

Enumerator
AccessOut
AccessIn

{
    AccessOut = 0,
    AccessIn  = 1,
} IO_ACCESS_INSTR;

_IO_OP_ENCODING

enum _IO_OP_ENCODING

Immediate value or in DX.

Enumerator
OpEncodingDx
OpEncodingImm

{
    OpEncodingDx  = 0,
    OpEncodingImm = 1,
} IO_OP_ENCODING;

Function Documentation

IoHandleIoVmExits()

VOID IoHandleIoVmExits	(	VIRTUAL_MACHINE_STATE *	VCpu,
		VMX_EXIT_QUALIFICATION_IO_INSTRUCTION	IoQualification,
		RFLAGS	Flags )

VM-Exit handler for I/O Instructions (in/out).

Parameters

VCpu	The virtual processor's state
IoQualification	The I/O Qualification that indicates the instruction
Flags	Guest's RFLAGs

Returns

VOID

{
    UINT16      Port      = 0;
    UINT32      Count     = 0;
    UINT32      Size      = 0;
    PGUEST_REGS GuestRegs = VCpu->Regs;
 
    //
    // VMWare tools uses port  (port 0x5658/0x5659) as I/O backdoor
    // This function will not handle these cases so if you put bitmap
    // to cause vm-exit on port 0x5658/0x5659 then VMWare tools will
    // crash
    //
 
    union
    {
        UCHAR *  AsBytePtr;
        USHORT * AsWordPtr;
        ULONG *  AsDwordPtr;
 
        PVOID  AsPtr;
        UINT64 AsUInt64;
 
    } PortValue;
 
    //
    // The I/O Implementation is derived from Petr Benes's hvpp
    // Take a look at :
    // https://github.com/wbenny/hvpp/blob/f1eece7d0def506f329b5770befd892497be2047/src/hvpp/hvpp/vmexit/vmexit_passthrough.cpp
    //
 
    //
    // We don't check if CPL == 0 here, because the CPU would
    // raise #GP instead of VM-exit.
    //
    // See Vol3C[25.1.1(Relative Priority of Faults and VM Exits)]
    //
 
    //
    // Resolve address of the source or destination.
    //
    if (IoQualification.StringInstruction)
    {
        //
        // String operations always operate either on RDI (in) or
        // RSI (out) registers.
        //
        PortValue.AsPtr = (PVOID)(IoQualification.DirectionOfAccess == AccessIn ? GuestRegs->rdi : GuestRegs->rsi);
    }
    else
    {
        //
        // Save pointer to the RAX register.
        //
        PortValue.AsPtr = &GuestRegs->rax;
    }
 
    //
    // Resolve port as a nice 16-bit number.
    //
    Port = (UINT16)IoQualification.PortNumber;
 
    //
    // Resolve number of bytes to send/receive.
    // REP prefixed instructions always take their count
    // from *CX register.
    //
    Count = IoQualification.RepPrefixed ? (GuestRegs->rcx & 0xffffffff) : 1;
 
    Size = (UINT32)(IoQualification.SizeOfAccess + 1);
 
    switch (IoQualification.DirectionOfAccess)
    {
    case AccessIn:
        if (IoQualification.StringInstruction)
        {
            switch (Size)
            {
            case 1:
                IoInByteString(Port, (UINT8 *)PortValue.AsBytePtr, Count);
                break;
            case 2:
                IoInWordString(Port, (UINT16 *)PortValue.AsWordPtr, Count);
                break;
            case 4:
                IoInDwordString(Port, (UINT32 *)PortValue.AsDwordPtr, Count);
                break;
            }
        }
        else
        {
            //
            // Note that port_value holds pointer to the
            // vp.context().rax member, therefore we're
            // directly overwriting the RAX value.
            //
            switch (Size)
            {
            case 1:
                *PortValue.AsBytePtr = IoInByte(Port);
                break;
            case 2:
                *PortValue.AsWordPtr = IoInWord(Port);
                break;
            case 4:
                *PortValue.AsDwordPtr = IoInDword(Port);
                break;
            }
        }
        break;
 
    case AccessOut:
        if (IoQualification.StringInstruction)
        {
            switch (Size)
            {
            case 1:
                IoOutByteString(Port, (UINT8 *)PortValue.AsBytePtr, Count);
                break;
            case 2:
                IoOutWordString(Port, (UINT16 *)PortValue.AsWordPtr, Count);
                break;
            case 4:
                IoOutDwordString(Port, (UINT32 *)PortValue.AsDwordPtr, Count);
                break;
            }
        }
        else
        {
            //
            // Note that port_value holds pointer to the
            // vp.context().rax member, therefore we're
            // directly reading from the RAX value.
            //
            switch (Size)
            {
            case 1:
                IoOutByte(Port, *PortValue.AsBytePtr);
                break;
            case 2:
                IoOutWord(Port, *PortValue.AsWordPtr);
                break;
            case 4:
                IoOutDword(Port, *PortValue.AsDwordPtr);
                break;
            }
        }
        break;
    }
 
    if (IoQualification.StringInstruction)
    {
        //
        // Update register:
        // If the DF (direction flag) is set, decrement,
        // otherwise increment.
        //
        // For in the register is RDI, for out it's RSI.
        //
        UINT64 GpReg = IoQualification.DirectionOfAccess == AccessIn ? GuestRegs->rdi : GuestRegs->rsi;
 
        if (Flags.DirectionFlag)
        {
            GpReg -= Count * Size;
        }
        else
        {
            GpReg += Count * Size;
        }
 
        //
        // We've sent/received everything, reset counter register
        // to 0.
        //
        if (IoQualification.RepPrefixed)
        {
            GuestRegs->rcx = 0;
        }
    }
}

IoHandlePerformIoBitmapChange()

VOID IoHandlePerformIoBitmapChange	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	Port )

Change I/O Bitmap.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state
IoPort	Port

Returns

VOID

{
    if (Port == DEBUGGER_EVENT_ALL_IO_PORTS)
    {
        //
        // Means all the bitmaps should be put to 1
        //
        memset((PVOID)VCpu->IoBitmapVirtualAddressA, 0xFF, PAGE_SIZE);
        memset((PVOID)VCpu->IoBitmapVirtualAddressB, 0xFF, PAGE_SIZE);
    }
    else
    {
        //
        // Means only one i/o bitmap is target
        //
        IoHandleSetIoBitmap(VCpu, Port);
    }
}

IoHandlePerformIoBitmapReset()

VOID IoHandlePerformIoBitmapReset

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Reset I/O Bitmap.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Means all the bitmaps should be put to 0
    //
    memset((PVOID)VCpu->IoBitmapVirtualAddressA, 0x0, PAGE_SIZE);
    memset((PVOID)VCpu->IoBitmapVirtualAddressB, 0x0, PAGE_SIZE);
}

IoInByte()

UINT8 IoInByte ( UINT16 port )

inline

{
    return CpuIoInByte(port);
}

IoInByteString()

VOID IoInByteString ( UINT16 port, UINT8 * data, UINT32 size )

inline

{
    CpuIoInByteString(port, data, size);
}

IoInDword()

UINT32 IoInDword ( UINT16 port )

inline

{
    return CpuIoInDword(port);
}

IoInDwordString()

VOID IoInDwordString ( UINT16 port, UINT32 * data, UINT32 size )

inline

{
    CpuIoInDwordString(port, data, size);
}

IoInWord()

UINT16 IoInWord ( UINT16 port )

inline

{
    return CpuIoInWord(port);
}

IoInWordString()

VOID IoInWordString ( UINT16 port, UINT16 * data, UINT32 size )

inline

{
    CpuIoInWordString(port, data, size);
}

IoOutByte()

VOID IoOutByte ( UINT16 port, UINT8 value )

inline

{
    CpuIoOutByte(port, value);
}

IoOutByteString()

VOID IoOutByteString ( UINT16 port, UINT8 * data, UINT32 count )

inline

{
    CpuIoOutByteString(port, data, count);
}

IoOutDword()

VOID IoOutDword ( UINT16 port, UINT32 value )

inline

{
    CpuIoOutDword(port, value);
}

IoOutDwordString()

VOID IoOutDwordString ( UINT16 port, UINT32 * data, UINT32 count )

inline

{
    CpuIoOutDwordString(port, data, count);
}

IoOutWord()

VOID IoOutWord ( UINT16 port, UINT16 value )

inline

{
    CpuIoOutWord(port, value);
}

IoOutWordString()

VOID IoOutWordString ( UINT16 port, UINT16 * data, UINT32 count )

inline

{
    CpuIoOutWordString(port, data, count);
}