IoHandler.h File Reference

The I/O Handler for vm-exit headers. More...

Go to the source code of this file.

Typedefs
typedef enum _IO_ACCESS_INSTR	IO_ACCESS_INSTR
	IN Instruction or OUT Instruction.
typedef enum _IO_OP_ENCODING	IO_OP_ENCODING
	Immediate value or in DX.

Enumerations
enum	_IO_ACCESS_INSTR { AccessOut = 0 , AccessIn = 1 }
	IN Instruction or OUT Instruction. More...
enum	_IO_OP_ENCODING { OpEncodingDx = 0 , OpEncodingImm = 1 }
	Immediate value or in DX. More...

Functions
unsigned char	__inbyte (unsigned short)
UINT8	IoInByte (UINT16 port)
unsigned short	__inword (unsigned short)
UINT16	IoInWord (UINT16 port)
unsigned long	__indword (unsigned short)
UINT32	IoInDword (UINT16 port)
void	__inbytestring (unsigned short, unsigned char *, unsigned long)
void	IoInByteString (UINT16 port, UINT8 *data, UINT32 size)
void	__inwordstring (unsigned short, unsigned short *, unsigned long)
void	IoInWordString (UINT16 port, UINT16 *data, UINT32 size)
void	__indwordstring (unsigned short, unsigned long *, unsigned long)
void	IoInDwordString (UINT16 port, UINT32 *data, UINT32 size)
void	__outbyte (unsigned short, unsigned char)
void	IoOutByte (UINT16 port, UINT8 value)
void	__outword (unsigned short, unsigned short)
void	IoOutWord (UINT16 port, UINT16 value)
void	__outdword (unsigned short, unsigned long)
void	IoOutDword (UINT16 port, UINT32 value)
void	__outbytestring (unsigned short, unsigned char *, unsigned long)
void	IoOutByteString (UINT16 port, UINT8 *data, UINT32 count)
void	__outwordstring (unsigned short, unsigned short *, unsigned long)
void	IoOutWordString (UINT16 port, UINT16 *data, UINT32 count)
void	__outdwordstring (unsigned short, unsigned long *, unsigned long)
void	IoOutDwordString (UINT16 port, UINT32 *data, UINT32 count)
VOID	IoHandleIoVmExits (VIRTUAL_MACHINE_STATE *VCpu, VMX_EXIT_QUALIFICATION_IO_INSTRUCTION IoQualification, RFLAGS Flags)
	VM-Exit handler for I/O Instructions (in/out)
VOID	IoHandlePerformIoBitmapChange (VIRTUAL_MACHINE_STATE *VCpu, UINT32 Port)
	Change I/O Bitmap.
VOID	IoHandlePerformIoBitmapReset (VIRTUAL_MACHINE_STATE *VCpu)
	Reset I/O Bitmap.

Detailed Description

The I/O Handler for vm-exit headers.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-06-06

Copyright

This project is released under the GNU Public License v3.

Typedef Documentation

IO_ACCESS_INSTR

typedef enum _IO_ACCESS_INSTR IO_ACCESS_INSTR

IN Instruction or OUT Instruction.

IO_OP_ENCODING

typedef enum _IO_OP_ENCODING IO_OP_ENCODING

Immediate value or in DX.

Enumeration Type Documentation

_IO_ACCESS_INSTR

enum _IO_ACCESS_INSTR

IN Instruction or OUT Instruction.

Enumerator
AccessOut
AccessIn

{
    AccessOut = 0,
    AccessIn  = 1,
} IO_ACCESS_INSTR;

_IO_OP_ENCODING

enum _IO_OP_ENCODING

Immediate value or in DX.

Enumerator
OpEncodingDx
OpEncodingImm

{
    OpEncodingDx  = 0,
    OpEncodingImm = 1,
} IO_OP_ENCODING;

Function Documentation

__inbyte()

unsigned char __inbyte

(

unsigned short

)

__inbytestring()

void __inbytestring	(	unsigned short	,
		unsigned char *	,
		unsigned long	)

__indword()

unsigned long __indword

(

unsigned short

)

__indwordstring()

void __indwordstring	(	unsigned short	,
		unsigned long *	,
		unsigned long	)

__inword()

unsigned short __inword

(

unsigned short

)

__inwordstring()

void __inwordstring	(	unsigned short	,
		unsigned short *	,
		unsigned long	)

__outbyte()

void __outbyte	(	unsigned short	,
		unsigned char	)

__outbytestring()

void __outbytestring	(	unsigned short	,
		unsigned char *	,
		unsigned long	)

__outdword()

void __outdword	(	unsigned short	,
		unsigned long	)

__outdwordstring()

void __outdwordstring	(	unsigned short	,
		unsigned long *	,
		unsigned long	)

__outword()

void __outword	(	unsigned short	,
		unsigned short	)

__outwordstring()

void __outwordstring	(	unsigned short	,
		unsigned short *	,
		unsigned long	)

IoHandleIoVmExits()

VOID IoHandleIoVmExits	(	VIRTUAL_MACHINE_STATE *	VCpu,
		VMX_EXIT_QUALIFICATION_IO_INSTRUCTION	IoQualification,
		RFLAGS	Flags )

VM-Exit handler for I/O Instructions (in/out)

Parameters

VCpu	The virtual processor's state
IoQualification	The I/O Qualification that indicates the instruction
Flags	Guest's RFLAGs

Returns

VOID

{
    UINT16      Port      = 0;
    UINT32      Count     = 0;
    UINT32      Size      = 0;
    PGUEST_REGS GuestRegs = VCpu->Regs;
 
    //
    // VMWare tools uses port  (port 0x5658/0x5659) as I/O backdoor
    // This function will not handle these cases so if you put bitmap
    // to cause vm-exit on port 0x5658/0x5659 then VMWare tools will
    // crash
    //
 
    union
    {
        unsigned char *  AsBytePtr;
        unsigned short * AsWordPtr;
        unsigned long *  AsDwordPtr;
 
        void * AsPtr;
        UINT64 AsUint64;
 
    } PortValue;
 
    //
    // The I/O Implementation is derived from Petr Benes's hvpp
    // Take a look at :
    // https://github.com/wbenny/hvpp/blob/f1eece7d0def506f329b5770befd892497be2047/src/hvpp/hvpp/vmexit/vmexit_passthrough.cpp
    //
 
    //
    // We don't check if CPL == 0 here, because the CPU would
    // raise #GP instead of VM-exit.
    //
    // See Vol3C[25.1.1(Relative Priority of Faults and VM Exits)]
    //
 
    //
    // Resolve address of the source or destination.
    //
    if (IoQualification.StringInstruction)
    {
        //
        // String operations always operate either on RDI (in) or
        // RSI (out) registers.
        //
        PortValue.AsPtr = (PVOID)(IoQualification.DirectionOfAccess == AccessIn ? GuestRegs->rdi : GuestRegs->rsi);
    }
    else
    {
        //
        // Save pointer to the RAX register.
        //
        PortValue.AsPtr = &GuestRegs->rax;
    }
 
    //
    // Resolve port as a nice 16-bit number.
    //
    Port = (UINT16)IoQualification.PortNumber;
 
    //
    // Resolve number of bytes to send/receive.
    // REP prefixed instructions always take their count
    // from *CX register.
    //
    Count = IoQualification.RepPrefixed ? (GuestRegs->rcx & 0xffffffff) : 1;
 
    Size = (UINT32)(IoQualification.SizeOfAccess + 1);
 
    switch (IoQualification.DirectionOfAccess)
    {
    case AccessIn:
        if (IoQualification.StringInstruction)
        {
            switch (Size)
            {
            case 1:
                IoInByteString(Port, (UINT8 *)PortValue.AsBytePtr, Count);
                break;
            case 2:
                IoInWordString(Port, (UINT16 *)PortValue.AsWordPtr, Count);
                break;
            case 4:
                IoInDwordString(Port, (UINT32 *)PortValue.AsDwordPtr, Count);
                break;
            }
        }
        else
        {
            //
            // Note that port_value holds pointer to the
            // vp.context().rax member, therefore we're
            // directly overwriting the RAX value.
            //
            switch (Size)
            {
            case 1:
                *PortValue.AsBytePtr = IoInByte(Port);
                break;
            case 2:
                *PortValue.AsWordPtr = IoInWord(Port);
                break;
            case 4:
                *PortValue.AsDwordPtr = IoInDword(Port);
                break;
            }
        }
        break;
 
    case AccessOut:
        if (IoQualification.StringInstruction)
        {
            switch (Size)
            {
            case 1:
                IoOutByteString(Port, (UINT8 *)PortValue.AsBytePtr, Count);
                break;
            case 2:
                IoOutWordString(Port, (UINT16 *)PortValue.AsWordPtr, Count);
                break;
            case 4:
                IoOutDwordString(Port, (UINT32 *)PortValue.AsDwordPtr, Count);
                break;
            }
        }
        else
        {
            //
            // Note that port_value holds pointer to the
            // vp.context().rax member, therefore we're
            // directly reading from the RAX value.
            //
            switch (Size)
            {
            case 1:
                IoOutByte(Port, *PortValue.AsBytePtr);
                break;
            case 2:
                IoOutWord(Port, *PortValue.AsWordPtr);
                break;
            case 4:
                IoOutDword(Port, *PortValue.AsDwordPtr);
                break;
            }
        }
        break;
    }
 
    if (IoQualification.StringInstruction)
    {
        //
        // Update register:
        // If the DF (direction flag) is set, decrement,
        // otherwise increment.
        //
        // For in the register is RDI, for out it's RSI.
        //
        UINT64 GpReg = IoQualification.DirectionOfAccess == AccessIn ? GuestRegs->rdi : GuestRegs->rsi;
 
        if (Flags.DirectionFlag)
        {
            GpReg -= Count * Size;
        }
        else
        {
            GpReg += Count * Size;
        }
 
        //
        // We've sent/received everything, reset counter register
        // to 0.
        //
        if (IoQualification.RepPrefixed)
        {
            GuestRegs->rcx = 0;
        }
    }
}

IoHandlePerformIoBitmapChange()

VOID IoHandlePerformIoBitmapChange	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	Port )

Change I/O Bitmap.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state
IoPort	Port

Returns

VOID

{
    if (Port == DEBUGGER_EVENT_ALL_IO_PORTS)
    {
        //
        // Means all the bitmaps should be put to 1
        //
        memset((void *)VCpu->IoBitmapVirtualAddressA, 0xFF, PAGE_SIZE);
        memset((void *)VCpu->IoBitmapVirtualAddressB, 0xFF, PAGE_SIZE);
    }
    else
    {
        //
        // Means only one i/o bitmap is target
        //
        IoHandleSetIoBitmap(VCpu, Port);
    }
}

IoHandlePerformIoBitmapReset()

VOID IoHandlePerformIoBitmapReset

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Reset I/O Bitmap.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Means all the bitmaps should be put to 0
    //
    memset((void *)VCpu->IoBitmapVirtualAddressA, 0x0, PAGE_SIZE);
    memset((void *)VCpu->IoBitmapVirtualAddressB, 0x0, PAGE_SIZE);
}

IoInByte()

UINT8 IoInByte ( UINT16 port )

inline

{
    return __inbyte(port);
}

IoInByteString()

void IoInByteString ( UINT16 port, UINT8 * data, UINT32 size )

inline

{
    __inbytestring(port, data, size);
}

IoInDword()

UINT32 IoInDword ( UINT16 port )

inline

{
    return __indword(port);
}

IoInDwordString()

void IoInDwordString ( UINT16 port, UINT32 * data, UINT32 size )

inline

{
    __indwordstring(port, (unsigned long *)data, size);
}

IoInWord()

UINT16 IoInWord ( UINT16 port )

inline

{
    return __inword(port);
}

IoInWordString()

void IoInWordString ( UINT16 port, UINT16 * data, UINT32 size )

inline

{
    __inwordstring(port, data, size);
}

IoOutByte()

void IoOutByte ( UINT16 port, UINT8 value )

inline

{
    __outbyte(port, value);
}

IoOutByteString()

void IoOutByteString ( UINT16 port, UINT8 * data, UINT32 count )

inline

{
    __outbytestring(port, data, count);
}

IoOutDword()

void IoOutDword ( UINT16 port, UINT32 value )

inline

{
    __outdword(port, value);
}

IoOutDwordString()

void IoOutDwordString ( UINT16 port, UINT32 * data, UINT32 count )

inline

{
    __outdwordstring(port, (unsigned long *)data, count);
}

IoOutWord()

void IoOutWord ( UINT16 port, UINT16 value )

inline

{
    __outword(port, value);
}

IoOutWordString()

void IoOutWordString ( UINT16 port, UINT16 * data, UINT32 count )

inline

{
    __outwordstring(port, data, count);
}