MsrHandlers.c File Reference

Handle for MSR-related tasks in VMX-root. More...

#include "pch.h"

Functions
BOOLEAN	MsrHandleIsHypervSyntheticMsr (_In_ UINT32 TargetMsr)
	Checks whether an MSR belongs to the Hyper-V synthetic MSR set.
VOID	MsrHandleRdmsrVmexit (VIRTUAL_MACHINE_STATE *VCpu)
	Handles in the cases when RDMSR causes a vm-exit.
VOID	MsrHandleWrmsrVmexit (VIRTUAL_MACHINE_STATE *VCpu)
	Handles in the cases when RDMSR causes a vm-exit.
BOOLEAN	MsrHandleSetMsrBitmap (VIRTUAL_MACHINE_STATE *VCpu, UINT32 Msr, BOOLEAN ReadDetection, BOOLEAN WriteDetection)
	Set bits in Msr Bitmap.
BOOLEAN	MsrHandleUnSetMsrBitmap (VIRTUAL_MACHINE_STATE *VCpu, UINT32 Msr, BOOLEAN ReadDetection, BOOLEAN WriteDetection)
	UnSet bits in Msr Bitmap.
VOID	MsrHandleFilterMsrReadBitmap (VIRTUAL_MACHINE_STATE *VCpu)
	Filter to avoid msr set for MSRs that are not valid or should be ignored (RDMSR).
VOID	MsrHandleFilterMsrWriteBitmap (VIRTUAL_MACHINE_STATE *VCpu)
	Filter to avoid msr set for MSRs that are not valid or should be ignored (wrmsr).
VOID	MsrHandlePerformMsrBitmapReadChange (VIRTUAL_MACHINE_STATE *VCpu, UINT32 MsrMask)
	Change MSR Bitmap for read.
VOID	MsrHandlePerformMsrBitmapReadReset (VIRTUAL_MACHINE_STATE *VCpu)
	Reset MSR Bitmap for read.
VOID	MsrHandlePerformMsrBitmapWriteChange (VIRTUAL_MACHINE_STATE *VCpu, UINT32 MsrMask)
	Change MSR Bitmap for write.
VOID	MsrHandlePerformMsrBitmapWriteReset (VIRTUAL_MACHINE_STATE *VCpu)
	Reset MSR Bitmap for write.

Detailed Description

Handle for MSR-related tasks in VMX-root.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-12-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

MsrHandleFilterMsrReadBitmap()

VOID MsrHandleFilterMsrReadBitmap

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Filter to avoid msr set for MSRs that are not valid or should be ignored (RDMSR).

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Ignore IA32_KERNEL_GSBASE (0xC0000102)
    //
    ClearBit(0x102, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 1024));
 
    //
    // Ignore IA32_MPERF (0x000000e7), and IA32_APERF (0x000000e8)
    //
    ClearBit(0xe7, (ULONG *)VCpu->MsrBitmapVirtualAddress);
    ClearBit(0xe8, (ULONG *)VCpu->MsrBitmapVirtualAddress);
}

MsrHandleFilterMsrWriteBitmap()

VOID MsrHandleFilterMsrWriteBitmap

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Filter to avoid msr set for MSRs that are not valid or should be ignored (wrmsr).

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Ignore IA32_KERNEL_GSBASE (0xC0000102)
    //
    ClearBit(0x102, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 3072));
 
    //
    // Ignore IA32_MPERF (0x000000e7), and IA32_APERF (0x000000e8)
    //
    ClearBit(0xe7, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 2048));
    ClearBit(0xe8, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 2048));
 
    //
    // Ignore IA32_SPEC_CTRL (0x00000048), and IA32_PRED_CMD (0x00000049)
    //
    ClearBit(0x48, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 2048));
    ClearBit(0x49, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 2048));
}

MsrHandleIsHypervSyntheticMsr()

BOOLEAN MsrHandleIsHypervSyntheticMsr

(

_In_ UINT32

TargetMsr

)

Checks whether an MSR belongs to the Hyper-V synthetic MSR set.

The ranges and individual registers are defined by Hyper-V TLFS synthetic MSRs and mirrored in HypervTlfs.h.

Parameters

TargetMsr

The target MSR

Returns

BOOLEAN Returns TRUE if the MSR should be forwarded to the top-level Hyper-V compatible hypervisor

{
    switch (TargetMsr)
    {
    case HV_X64_MSR_GUEST_OS_ID:
    case HV_X64_MSR_HYPERCALL:
    case HV_X64_MSR_VP_INDEX:
    case HV_X64_MSR_RESET:
    case HV_X64_MSR_VP_RUNTIME:
    case HV_X64_MSR_TIME_REF_COUNT:
    case HV_X64_MSR_REFERENCE_TSC:
    case HV_X64_MSR_TSC_FREQUENCY:
    case HV_X64_MSR_APIC_FREQUENCY:
    case HV_X64_MSR_NPIEP_CONFIG:
    case HV_X64_MSR_GUEST_IDLE:
    case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
    case HV_X64_MSR_TSC_EMULATION_CONTROL:
    case HV_X64_MSR_TSC_EMULATION_STATUS:
    case HV_X64_MSR_STIME_UNHALTED_TIMER_CONFIG:
    case HV_X64_MSR_STIME_UNHALTED_TIMER_COUNT:
    case HV_X64_MSR_NESTED_VP_INDEX:
        return TRUE;
    default:
        return (TargetMsr >= HV_X64_MSR_EOI && TargetMsr <= HV_X64_MSR_TPR) ||
               (TargetMsr >= HV_X64_MSR_SCONTROL && TargetMsr <= HV_X64_MSR_EOM) ||
               (TargetMsr >= HV_X64_MSR_SINT0 && TargetMsr <= HV_X64_MSR_SINT15) ||
               (TargetMsr >= HV_X64_MSR_STIMER0_CONFIG && TargetMsr <= HV_X64_MSR_STIMER3_COUNT) ||
               (TargetMsr >= HV_X64_MSR_CRASH_P0 && TargetMsr <= HV_X64_MSR_CRASH_CTL) ||
               (TargetMsr >= HV_X64_MSR_NESTED_SCONTROL && TargetMsr <= HV_X64_MSR_NESTED_EOM) ||
               (TargetMsr >= HV_X64_MSR_NESTED_SINT0 && TargetMsr <= HV_X64_MSR_NESTED_SINT15);
    }
}

MsrHandlePerformMsrBitmapReadChange()

VOID MsrHandlePerformMsrBitmapReadChange	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	MsrMask )

Change MSR Bitmap for read.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state
MsrMask

Returns

VOID

{
    if (MsrMask == DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS)
    {
        //
        // Means all the bitmaps should be put to 1
        //
        memset((PVOID)VCpu->MsrBitmapVirtualAddress, 0xff, 2048);
 
        //
        // Filter MSR Bitmap for special MSRs
        //
        MsrHandleFilterMsrReadBitmap(VCpu);
    }
    else
    {
        //
        // Means only one msr bitmap is target
        //
        MsrHandleSetMsrBitmap(VCpu, MsrMask, TRUE, FALSE);
    }
}

MsrHandlePerformMsrBitmapReadReset()

VOID MsrHandlePerformMsrBitmapReadReset

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Reset MSR Bitmap for read.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Means all the bitmaps should be put to 0
    //
    memset((PVOID)VCpu->MsrBitmapVirtualAddress, 0x0, 2048);
}

MsrHandlePerformMsrBitmapWriteChange()

VOID MsrHandlePerformMsrBitmapWriteChange	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	MsrMask )

Change MSR Bitmap for write.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state
MsrMask	MSR

Returns

VOID

{
    if (MsrMask == DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS)
    {
        //
        // Means all the bitmaps should be put to 1
        //
        memset((PVOID)((UINT64)VCpu->MsrBitmapVirtualAddress + 2048), 0xff, 2048);
 
        //
        // Filter MSR Bitmap for special MSRs
        //
        MsrHandleFilterMsrWriteBitmap(VCpu);
    }
    else
    {
        //
        // Means only one msr bitmap is target
        //
        MsrHandleSetMsrBitmap(VCpu, MsrMask, FALSE, TRUE);
    }
}

MsrHandlePerformMsrBitmapWriteReset()

VOID MsrHandlePerformMsrBitmapWriteReset

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Reset MSR Bitmap for write.

should be called in vmx-root mode

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    //
    // Means all the bitmaps should be put to 0
    //
    memset((PVOID)((UINT64)VCpu->MsrBitmapVirtualAddress + 2048), 0x0, 2048);
}

MsrHandleRdmsrVmexit()

VOID MsrHandleRdmsrVmexit

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handles in the cases when RDMSR causes a vm-exit.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    UINT32      TargetMsr;
    MSR         Msr       = {0};
    PGUEST_REGS GuestRegs = VCpu->Regs;
 
    //
    // RDMSR. The RDMSR instruction causes a VM exit if any of the following are true:
    //
    // The "use MSR bitmaps" VM-execution control is 0.
    // The value of ECX is not in the ranges 00000000H - 00001FFFH and C0000000H - C0001FFFH
    // The value of ECX is in the range 00000000H - 00001FFFH and bit n in read bitmap for low MSRs is 1,
    //   where n is the value of ECX.
    // The value of ECX is in the range C0000000H - C0001FFFH and bit n in read bitmap for high MSRs is 1,
    //   where n is the value of ECX & 00001FFFH.
    //
    TargetMsr = GuestRegs->rcx & 0xffffffff;
 
    //
    // Execute WRMSR or RDMSR on behalf of the guest. Important that this
    // can cause bug check when the guest tries to access unimplemented MSR
    // even within the SEH block* because the below WRMSR or RDMSR raises
    // #GP and are not protected by the SEH block (or cannot be protected
    // either as this code run outside the thread stack region Windows
    // requires to proceed SEH). Hypervisors typically handle this by noop-ing
    // WRMSR and returning zero for RDMSR with non-architecturally defined
    // MSRs. Alternatively, one can probe which MSRs should cause #GP prior
    // to installation of a hypervisor and the hypervisor can emulate the
    // results.
    //
 
    // LogInfo("MSR read (RDMSR) VM-exit, MSR: %x, from: %llx",
    //         TargetMsr,
    //         VCpu->LastVmexitRip);
 
    //
    // Checking whether it is a synthetic MSR for Hyper-V
    //
    if (g_IsTopLevelHypervisorHyperV && MsrHandleIsHypervSyntheticMsr(TargetMsr))
    {
        Msr.Flags = CpuReadMsr(TargetMsr);
 
        GuestRegs->rax = Msr.Fields.Low;
        GuestRegs->rdx = Msr.Fields.High;
 
        return;
    }
 
    //
    // Check for sanity of MSR if they're valid or they're for reserved range for WRMSR and RDMSR
    //
    if ((TargetMsr <= 0x00001FFF) || ((0xC0000000 <= TargetMsr) && (TargetMsr <= 0xC0001FFF)) ||
        (TargetMsr >= RESERVED_MSR_RANGE_LOW && (TargetMsr <= RESERVED_MSR_RANGE_HI)))
    {
        //
        // Apply the RDMS
        //
        switch (TargetMsr)
        {
        case IA32_SYSENTER_CS:
            VmxVmread64P(VMCS_GUEST_SYSENTER_CS, &Msr.Flags);
            break;
 
        case IA32_SYSENTER_ESP:
            VmxVmread64P(VMCS_GUEST_SYSENTER_ESP, &Msr.Flags);
            break;
 
        case IA32_SYSENTER_EIP:
            VmxVmread64P(VMCS_GUEST_SYSENTER_EIP, &Msr.Flags);
            break;
 
        case IA32_GS_BASE:
            VmxVmread64P(VMCS_GUEST_GS_BASE, &Msr.Flags);
            break;
 
        case IA32_FS_BASE:
            VmxVmread64P(VMCS_GUEST_FS_BASE, &Msr.Flags);
            break;
 
        case HV_X64_MSR_GUEST_IDLE:
 
            //
            // VMware workstation and Hyper-V use this MSR halt the system
            // Read more:
            // https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vp-properties#virtual-processor-idle-sleep-state
            // As a top-level hypervisor, we get this MSRs VM-exit (even
            // without setting MSR bitmap because this MSR is not a valid
            // range MSR).
            //
            // This behavior is problematic for the debugger when we throw an NMI
            // to halt all of the cores, if the core already executed RDMSR on this MSR,
            // we'll end up notifying the core in VMX root-root (this is the expected
            // behavior); however, after continuing the guest, we still won't get a
            // chance to continue execution. Thus, all of the cores remain unlocked (in
            // debuggee) and halted. So, we cannot send commands to them, and later when
            // we continue the guest, and the guest tries to perform the steps necessary for
            // locking, which is not expected and eventually causes a BSOD.
            //
            // As a quick and dirty patch (which is not a good idea for power-saving
            // and performance reasons), we ignored these MSRs.
            //
            break;
 
        default:
 
            //
            // Check whether the MSR should cause #GP or not
            //
            if (TargetMsr <= 0xfff && TestBit(TargetMsr, (ULONG *)g_MsrBitmapInvalidMsrs) != NULL64_ZERO)
            {
                //
                // Invalid MSR between 0x0 to 0xfff
                //
                EventInjectGeneralProtection();
                return;
            }
 
            //
            // Check for the footprints of the RDMSR in the transparent mode
            //
            if (g_CheckForFootprints && TransparentCheckAndModifyMsrRead(VCpu->Regs, TargetMsr))
            {
                return;
            }
 
            //
            // Msr is valid
            //
            Msr.Flags = CpuReadMsr(TargetMsr);
 
            //
            // Check if it's EFER MSR then we show a false SCE state
            //
            if (GuestRegs->rcx == IA32_EFER)
            {
                IA32_EFER_REGISTER MsrEFER;
                MsrEFER.AsUInt        = Msr.Flags;
                MsrEFER.SyscallEnable = TRUE;
                Msr.Flags             = MsrEFER.AsUInt;
            }
 
            break;
        }
 
        GuestRegs->rax = NULL64_ZERO;
        GuestRegs->rdx = NULL64_ZERO;
 
        GuestRegs->rax = Msr.Fields.Low;
        GuestRegs->rdx = Msr.Fields.High;
    }
    else
    {
        //
        // MSR is invalid, inject #GP
        //
        EventInjectGeneralProtection();
        return;
    }
}

MsrHandleSetMsrBitmap()

BOOLEAN MsrHandleSetMsrBitmap	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	Msr,
		BOOLEAN	ReadDetection,
		BOOLEAN	WriteDetection )

Set bits in Msr Bitmap.

Parameters

VCpu	The virtual processor's state
Msr	MSR Address
ReadDetection	set read bit
WriteDetection	set write bit

Returns

BOOLEAN Returns true if the MSR Bitmap is successfully applied or false if not applied

{
    if (!ReadDetection && !WriteDetection)
    {
        //
        // Invalid Command
        //
        return FALSE;
    }
 
    if (Msr <= 0x00001FFF)
    {
        if (ReadDetection)
        {
            SetBit(Msr, (ULONG *)VCpu->MsrBitmapVirtualAddress);
        }
        if (WriteDetection)
        {
            SetBit(Msr, (ULONG *)VCpu->MsrBitmapVirtualAddress + 2048);
        }
    }
    else if ((0xC0000000 <= Msr) && (Msr <= 0xC0001FFF))
    {
        if (ReadDetection)
        {
            SetBit(Msr - 0xC0000000, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 1024));
        }
        if (WriteDetection)
        {
            SetBit(Msr - 0xC0000000, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 3072));
        }
    }
    else
    {
        return FALSE;
    }
    return TRUE;
}

MsrHandleUnSetMsrBitmap()

BOOLEAN MsrHandleUnSetMsrBitmap	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	Msr,
		BOOLEAN	ReadDetection,
		BOOLEAN	WriteDetection )

UnSet bits in Msr Bitmap.

Parameters

VCpu	The virtual processor's state
Msr	MSR Address
ReadDetection	Unset read bit
WriteDetection	Unset write bit

Returns

BOOLEAN Returns true if the MSR Bitmap is successfully applied or false if not applied

{
    if (!ReadDetection && !WriteDetection)
    {
        //
        // Invalid Command
        //
        return FALSE;
    }
 
    if (Msr <= 0x00001FFF)
    {
        if (ReadDetection)
        {
            ClearBit(Msr, (ULONG *)VCpu->MsrBitmapVirtualAddress);
        }
        if (WriteDetection)
        {
            ClearBit(Msr, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 2048));
        }
    }
    else if ((0xC0000000 <= Msr) && (Msr <= 0xC0001FFF))
    {
        if (ReadDetection)
        {
            ClearBit(Msr - 0xC0000000, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 1024));
        }
        if (WriteDetection)
        {
            ClearBit(Msr - 0xC0000000, (ULONG *)(VCpu->MsrBitmapVirtualAddress + 3072));
        }
    }
    else
    {
        return FALSE;
    }
    return TRUE;
}

MsrHandleWrmsrVmexit()

VOID MsrHandleWrmsrVmexit

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handles in the cases when RDMSR causes a vm-exit.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    UINT32      TargetMsr;
    BOOLEAN     UnusedIsKernel;
    MSR         Msr       = {0};
    PGUEST_REGS GuestRegs = VCpu->Regs;
 
    //
    // Execute WRMSR or RDMSR on behalf of the guest. Important that this
    // can cause bug check when the guest tries to access unimplemented MSR
    // even within the SEH block* because the below WRMSR or RDMSR raises
    // #GP and are not protected by the SEH block (or cannot be protected
    // either as this code run outside the thread stack region Windows
    // requires to proceed SEH). Hypervisors typically handle this by noop-ing
    // WRMSR and returning zero for RDMSR with non-architecturally defined
    // MSRs. Alternatively, one can probe which MSRs should cause #GP prior
    // to installation of a hypervisor and the hypervisor can emulate the
    // results.
    //
    TargetMsr = GuestRegs->rcx & 0xffffffff;
 
    Msr.Fields.Low  = (ULONG)GuestRegs->rax;
    Msr.Fields.High = (ULONG)GuestRegs->rdx;
 
    // LogInfo("MSR write (WRMSR) VM-exit, MSR: %x, rax: %llx, rdx: %llx, from: %llx",
    //         TargetMsr,
    //         GuestRegs->rax,
    //         GuestRegs->rdx,
    //         VCpu->LastVmexitRip);
 
    //
    // Checking whether it is a synthetic MSR for Hyper-V
    //
    if (g_IsTopLevelHypervisorHyperV && MsrHandleIsHypervSyntheticMsr(TargetMsr))
    {
        CpuWriteMsr(TargetMsr, Msr.Flags);
        return;
    }
 
    //
    // Check for sanity of MSR if they're valid or they're for reserved range for WRMSR and RDMSR
    //
    if ((TargetMsr <= 0x00001FFF) || ((0xC0000000 <= TargetMsr) && (TargetMsr <= 0xC0001FFF)) ||
        (TargetMsr >= RESERVED_MSR_RANGE_LOW && (TargetMsr <= RESERVED_MSR_RANGE_HI)))
    {
        //
        // If the source register contains a non-canonical address and ECX specifies
        // one of the following MSRs:
        //
        // IA32_DS_AREA, IA32_FS_BASE, IA32_GS_BASE, IA32_KERNEL_GSBASE, IA32_LSTAR,
        // IA32_SYSENTER_EIP, IA32_SYSENTER_ESP
        //
        switch (TargetMsr)
        {
        case IA32_DS_AREA:
        case IA32_FS_BASE:
        case IA32_GS_BASE:
        case IA32_KERNEL_GS_BASE:
        case IA32_LSTAR:
        case IA32_SYSENTER_EIP:
        case IA32_SYSENTER_ESP:
 
            if (!CheckAddressCanonicality(Msr.Flags, &UnusedIsKernel))
            {
                //
                // Address is not canonical, inject #GP
                //
                EventInjectGeneralProtection();
 
                return;
            }
 
            break;
        }
 
        //
        // Perform MSR change
        //
        switch (TargetMsr)
        {
        case IA32_SYSENTER_CS:
            VmxVmwrite64(VMCS_GUEST_SYSENTER_CS, Msr.Flags);
            break;
 
        case IA32_SYSENTER_ESP:
            VmxVmwrite64(VMCS_GUEST_SYSENTER_ESP, Msr.Flags);
            break;
 
        case IA32_SYSENTER_EIP:
            VmxVmwrite64(VMCS_GUEST_SYSENTER_EIP, Msr.Flags);
            break;
 
        case IA32_GS_BASE:
            VmxVmwrite64(VMCS_GUEST_GS_BASE, Msr.Flags);
            break;
 
        case IA32_FS_BASE:
            VmxVmwrite64(VMCS_GUEST_FS_BASE, Msr.Flags);
            break;
 
        default:
 
            //
            // Check for the footprints of the WRMSR in the transparent mode
            //
            if (g_CheckForFootprints && TransparentCheckAndModifyMsrWrite(VCpu->Regs, TargetMsr))
            {
                return;
            }
 
            //
            // Perform the WRMSR
            //
            CpuWriteMsr((ULONG)GuestRegs->rcx, Msr.Flags);
 
            break;
        }
    }
    else
    {
        //
        // Msr is invalid, inject #GP
        //
        EventInjectGeneralProtection();
        return;
    }
}