Vmcall.c File Reference

The main VMCALL and Hypercall handler. More...

#include "pch.h"

Functions
_Use_decl_annotations_ NTSTATUS	VmxHypervVmcallHandler (VIRTUAL_MACHINE_STATE *VCpu, PGUEST_REGS GuestRegs)
	Handle vm-exits of VMCALLs.
_Use_decl_annotations_ NTSTATUS	VmxHandleVmcallVmExit (VIRTUAL_MACHINE_STATE *VCpu)
	Handle vm-exits of VMCALLs.
NTSTATUS	VmxVmcallDirectVmcallHandler (VIRTUAL_MACHINE_STATE *VCpu, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	Direct Vmcall Handler.
_Use_decl_annotations_ NTSTATUS	VmxVmcallHandler (VIRTUAL_MACHINE_STATE *VCpu, UINT64 VmcallNumber, UINT64 OptionalParam1, UINT64 OptionalParam2, UINT64 OptionalParam3)
	Main Vmcall Handler.
NTSTATUS	VmcallTest (_In_ UINT64 Param1, _In_ UINT64 Param2, _In_ UINT64 Param3)
	Test Vmcall (VMCALL_TEST).

Detailed Description

The main VMCALL and Hypercall handler.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

VmcallTest()

NTSTATUS VmcallTest	(	_In_ UINT64	Param1,
		_In_ UINT64	Param2,
		_In_ UINT64	Param3 )

Test Vmcall (VMCALL_TEST).

Test function which shows a message to test a successful VMCALL.

Parameters

Param1
Param2
Param3

Returns

NTSTATUS

Test Vmcall (VMCALL_TEST).

Parameters

Param1
Param2
Param3

Returns

NTSTATUS

{
    LogDebugInfo("VmcallTest called with @Param1 = 0x%llx , @Param2 = 0x%llx , @Param3 = 0x%llx",
                 Param1,
                 Param2,
                 Param3);
 
    //
    // Send one byte buffer to show that Hypervisor
    // is successfully loaded
    //
    LogCallbackSendBuffer(OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED,
                          "$",
                          sizeof(CHAR),
                          TRUE);
 
    return STATUS_SUCCESS;
}

VmxHandleVmcallVmExit()

_Use_decl_annotations_ NTSTATUS VmxHandleVmcallVmExit

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handle vm-exits of VMCALLs.

Parameters

VCpu	The virtual processor's state

Returns

NTSTATUS

{
    BOOLEAN      IsHyperDbgVmcall = FALSE;
    GUEST_REGS * GuestRegs        = VCpu->Regs;
 
    IsHyperDbgVmcall = (GuestRegs->r10 == 0x48564653 && GuestRegs->r11 == 0x564d43414c4c && GuestRegs->r12 == 0x4e4f485950455256);
    //
    // Check if it's our routines that request the VMCALL, or it relates to the Hyper-V
    //
    if (IsHyperDbgVmcall)
    {
        GuestRegs->rax = VmxVmcallHandler(VCpu,
                                          GuestRegs->rcx,
                                          GuestRegs->rdx,
                                          GuestRegs->r8,
                                          GuestRegs->r9);
    }
    else
    {
        return VmxHypervVmcallHandler(VCpu, GuestRegs);
    }
 
    return STATUS_SUCCESS;
}

VmxHypervVmcallHandler()

_Use_decl_annotations_ NTSTATUS VmxHypervVmcallHandler	(	VIRTUAL_MACHINE_STATE *	VCpu,
		PGUEST_REGS	GuestRegs )

Handle vm-exits of VMCALLs.

Parameters

VCpu	The virtual processor's state
GuestRegs

Returns

NTSTATUS

{
    UINT64                GuestRsp   = NULL64_ZERO;
    HYPERCALL_INPUT_VALUE InputValue = {.Flags = GuestRegs->rcx};
 
    switch (InputValue.Fields.CallCode)
    {
    case HvSwitchVirtualAddressSpace:
    case HvFlushVirtualAddressSpace:
    case HvFlushVirtualAddressList:
    case HvCallFlushVirtualAddressSpaceEx:
    case HvCallFlushVirtualAddressListEx:
 
        VpidInvvpidAllContext();
        break;
 
    case HvCallFlushGuestPhysicalAddressSpace:
    case HvCallFlushGuestPhysicalAddressList:
 
        EptInveptSingleContext(VCpu->EptPointer.AsUInt);
        break;
    }
 
    //
    // Save the guest rsp as it will be modified during the Hyper-V's
    // VMCALL process
    //
    GuestRsp = GuestRegs->rsp;
 
    //
    // Let the top-level hypervisor to manage it
    //
    AsmHypervVmcall((UINT64)GuestRegs);
 
    //
    // Restore the guest's RSP
    //
    GuestRegs->rsp = GuestRsp;
 
    return STATUS_SUCCESS;
}

VmxVmcallDirectVmcallHandler()

NTSTATUS VmxVmcallDirectVmcallHandler	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT64	VmcallNumber,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

Direct Vmcall Handler.

Parameters

VCpu	The virtual processor's state
VmcallNumber	The number of the VMCALL
DirectVmcallOptions

Returns

NTSTATUS

{
    return VmxVmcallHandler(VCpu,
                            VmcallNumber,
                            DirectVmcallOptions->OptionalParam1,
                            DirectVmcallOptions->OptionalParam2,
                            DirectVmcallOptions->OptionalParam3);
}

VmxVmcallHandler()

_Use_decl_annotations_ NTSTATUS VmxVmcallHandler	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT64	VmcallNumber,
		UINT64	OptionalParam1,
		UINT64	OptionalParam2,
		UINT64	OptionalParam3 )

Main Vmcall Handler.

Parameters

VCpu	The virtual processor's state
VmcallNumber
OptionalParam1
OptionalParam2
OptionalParam3

Returns

NTSTATUS

{
    NTSTATUS VmcallStatus = STATUS_UNSUCCESSFUL;
 
    //
    // Check for top-level driver's VMCALLs
    //
    if (VmcallNumber > TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER && VmcallNumber <= TOP_LEVEL_DRIVERS_VMCALL_ENDING_NUMBER)
    {
        if (VmmCallbackVmcallHandler(VCpu->CoreId, VmcallNumber, OptionalParam1, OptionalParam2, OptionalParam3))
        {
            return STATUS_SUCCESS;
        }
        else
        {
            return STATUS_UNSUCCESSFUL;
        }
    }
 
    //
    // Only 32bit of Vmcall is valid, this way we can use the upper 32 bit of the Vmcall
    //
    switch (VmcallNumber)
    {
    case VMCALL_TEST:
    {
        VmcallStatus = VmcallTest(OptionalParam1, OptionalParam2, OptionalParam3);
        break;
    }
    case VMCALL_VMXOFF:
    {
        VmxPerformVmxoff(VCpu);
        VmcallStatus = STATUS_SUCCESS;
 
        break;
    }
    case VMCALL_CHANGE_PAGE_ATTRIB:
    {
        BOOLEAN  HookResult = FALSE;
        CR3_TYPE ProcCr3    = {.Flags = OptionalParam3};
 
        HookResult = EptHookPerformPageHookMonitorAndInlineHook(VCpu,
                                                                (PVOID)OptionalParam1 /* hook details */,
                                                                ProcCr3 /* Process cr3 */,
                                                                (UINT32)OptionalParam2 /* PageHookMask */);
 
        VmcallStatus = (HookResult == TRUE) ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
 
        break;
    }
    case VMCALL_INVEPT_SINGLE_CONTEXT:
    {
        EptInveptSingleContext(OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_INVEPT_ALL_CONTEXTS:
    {
        EptInveptAllContexts();
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNHOOK_ALL_PAGES:
    {
        EptHookRestoreAllHooksToOriginalEntry(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNHOOK_SINGLE_PAGE:
    {
        if (EptHookRestoreSingleHookToOriginalEntry(VCpu, OptionalParam1, OptionalParam2))
            VmcallStatus = STATUS_SUCCESS;
        else
            VmcallStatus = STATUS_UNSUCCESSFUL;
 
        break;
    }
    case VMCALL_ENABLE_SYSCALL_HOOK_EFER:
    {
        SyscallHookConfigureEFER(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_SYSCALL_HOOK_EFER:
    {
        SyscallHookConfigureEFER(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_CHANGE_MSR_BITMAP_READ:
    {
        MsrHandlePerformMsrBitmapReadChange(VCpu, (UINT32)OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_CHANGE_MSR_BITMAP_WRITE:
    {
        MsrHandlePerformMsrBitmapWriteChange(VCpu, (UINT32)OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_RDTSC_EXITING:
    {
        HvSetRdtscExiting(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_RDPMC_EXITING:
    {
        HvSetPmcVmexit(TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_EXCEPTION_BITMAP:
    {
        HvSetExceptionBitmap(VCpu, (UINT32)OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING:
    {
        HvSetMovDebugRegsExiting(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING:
    {
        HvSetExternalInterruptExiting(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_CHANGE_IO_BITMAP:
    {
        IoHandlePerformIoBitmapChange(VCpu, (UINT32)OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_HIDDEN_CC_BREAKPOINT:
    {
        BOOLEAN  HookResult = FALSE;
        CR3_TYPE ProcCr3    = {.Flags = OptionalParam2};
 
        HookResult = EptHookPerformPageHook(VCpu,
                                            (PVOID)OptionalParam1, /* TargetAddress */
                                            ProcCr3);              /* process cr3 */
 
        VmcallStatus = (HookResult == TRUE) ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL;
 
        break;
    }
    case VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS:
    {
        ProtectedHvExternalInterruptExitingForDisablingInterruptCommands(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_RDTSC_EXITING:
    {
        HvSetRdtscExiting(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
 
        break;
    }
    case VMCALL_UNSET_RDPMC_EXITING:
    {
        HvSetPmcVmexit(FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING:
    {
        HvSetMovDebugRegsExiting(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_RESET_MSR_BITMAP_READ:
    {
        MsrHandlePerformMsrBitmapReadReset(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_RESET_MSR_BITMAP_WRITE:
    {
        MsrHandlePerformMsrBitmapWriteReset(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS:
    {
        ProtectedHvResetExceptionBitmapToClearEvents(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_RESET_IO_BITMAP:
    {
        IoHandlePerformIoBitmapReset(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING:
    {
        HvSetMovControlRegsExiting(TRUE, OptionalParam1, OptionalParam2);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING:
    {
        HvSetMovControlRegsExiting(FALSE, OptionalParam1, OptionalParam2);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_ENABLE_MOV_TO_CR3_EXITING:
    {
        HvSetMovToCr3Vmexit(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_MOV_TO_CR3_EXITING:
    {
        HvSetMovToCr3Vmexit(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_EXCEPTION_BITMAP:
    {
        HvUnsetExceptionBitmap(VCpu, (UINT32)OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_VM_ENTRY_LOAD_DEBUG_CONTROLS:
    {
        HvSetLoadDebugControls(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_VM_ENTRY_LOAD_DEBUG_CONTROLS:
    {
        HvSetLoadDebugControls(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_VM_EXIT_SAVE_DEBUG_CONTROLS:
    {
        HvSetSaveDebugControls(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_VM_EXIT_SAVE_DEBUG_CONTROLS:
    {
        HvSetSaveDebugControls(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_VM_EXIT_ON_NMIS:
    {
        HvSetNmiExiting(TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_VM_EXIT_ON_NMIS:
    {
        HvSetNmiExiting(FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS:
    {
        ProtectedHvDisableRdtscExitingForDisablingTscCommands(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS:
    {
        ProtectedHvDisableMovDebugRegsExitingForDisablingDrCommands(VCpu);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS:
    {
        ProtectedHvDisableMovControlRegsExitingForDisablingCrCommands(VCpu, OptionalParam1, OptionalParam2);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM:
    {
        if (DirtyLoggingEnable(VCpu))
        {
            VmcallStatus = STATUS_SUCCESS;
        }
        else
        {
            VmcallStatus = STATUS_UNSUCCESSFUL;
        }
 
        break;
    }
    case VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM:
    {
        DirtyLoggingDisable(VCpu);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP:
    {
        ExecTrapChangeToUserDisabledMbecEptp(VCpu);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_RESTORE_TO_NORMAL_EPTP:
    {
        ExecTrapRestoreToNormalEptp(VCpu);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_DISABLE_OR_ENABLE_MBEC:
    {
        ModeBasedExecHookEnableOrDisable(VCpu, (UINT32)OptionalParam1);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_READ_PHYSICAL_MEM_BYPASS_CACHING_POLICIES:
    {
        if (ReadPhysicalMemoryUsingMapIoSpace((PVOID)OptionalParam1, (PVOID)OptionalParam2, (SIZE_T)OptionalParam3))
        {
            VmcallStatus = STATUS_SUCCESS;
        }
        else
        {
            VmcallStatus = STATUS_UNSUCCESSFUL;
        }
 
        break;
    }
    case VMCALL_WRITE_PHYSICAL_MEM_BYPASS_CACHING_POLICIES:
    {
        if (WritePhysicalMemoryUsingMapIoSpace((PVOID)OptionalParam1, (PVOID)OptionalParam2, (SIZE_T)OptionalParam3))
        {
            VmcallStatus = STATUS_SUCCESS;
        }
        else
        {
            VmcallStatus = STATUS_UNSUCCESSFUL;
        }
 
        break;
    }
    case VMCALL_READ_PHYSICAL_MEMORY:
    {
        //
        // Check whether the physical memory is valid or not
        //
        if (!CheckAddressPhysical(OptionalParam1))
        {
            VmcallStatus = STATUS_SUCCESS;
            break;
        }
 
        //
        // Perform the read operation
        //
        if (MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)OptionalParam1, (UINT64)OptionalParam2, (SIZE_T)OptionalParam3))
        {
            VmcallStatus = STATUS_SUCCESS;
        }
        else
        {
            VmcallStatus = STATUS_UNSUCCESSFUL;
        }
 
        break;
    }
    case VMCALL_WRITE_PHYSICAL_MEMORY:
    {
        //
        // Check whether the physical memory is valid or not
        //
        if (!CheckAddressPhysical(OptionalParam1))
        {
            VmcallStatus = STATUS_SUCCESS;
            break;
        }
 
        //
        // Perform the write operation
        //
        if (MemoryMapperWriteMemorySafeByPhysicalAddress((UINT64)OptionalParam1, (UINT64)OptionalParam2, (SIZE_T)OptionalParam3))
        {
            VmcallStatus = STATUS_SUCCESS;
        }
        else
        {
            VmcallStatus = STATUS_UNSUCCESSFUL;
        }
 
        break;
    }
    case VMCALL_GET_VMCS_DEBUGCTL:
    {
        //
        // Perform getting DEBUGCTL from VMCS
        //
        HvGetAndStoreDebugctl((UINT64 *)OptionalParam1);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_VMCS_DEBUGCTL:
    {
        //
        // Perform setting DEBUGCTL from VMCS
        //
        HvSetDebugctl(OptionalParam1);
 
        VmcallStatus = STATUS_SUCCESS;
 
        break;
    }
    case VMCALL_SET_MSR_LBR_SELECT:
    {
        //
        // Perform setting MSR_LEGACY_LBR_SELECT
        //
        HvSetLbrSelect(OptionalParam1);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_GET_GUEST_IA32_LBR_CTL:
    {
        //
        // Perform getting guest IA32_LBR_CTL from VMCS
        //
        HvGetAndStoreGuestIa32LbrCtl((UINT64 *)OptionalParam1);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_GUEST_IA32_LBR_CTL:
    {
        //
        // Perform setting guest IA32_LBR_CTL on VMCS
        //
        HvSetGuestIa32LbrCtl(OptionalParam1);
 
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_VM_ENTRY_LOAD_GUEST_IA32_LBR_CTL:
    {
        HvSetLoadGuestIa32LbrCtl(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_VM_ENTRY_LOAD_GUEST_IA32_LBR_CTL:
    {
        HvSetLoadGuestIa32LbrCtl(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_SET_CLEAR_GUEST_IA32_LBR_CTL:
    {
        HvSetClearGuestIa32LbrCtl(VCpu, TRUE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    case VMCALL_UNSET_CLEAR_GUEST_IA32_LBR_CTL:
    {
        HvSetClearGuestIa32LbrCtl(VCpu, FALSE);
        VmcallStatus = STATUS_SUCCESS;
        break;
    }
    default:
    {
        LogError("Err, unsupported VMCALL (%llx)", VmcallNumber);
        VmcallStatus = STATUS_UNSUCCESSFUL;
        break;
    }
    }
 
    return VmcallStatus;
}