Vmcall.h File Reference

VMCALL Headers. More...

Go to the source code of this file.

Macros
#define	VMCALL_TEST   0x00000001
	VMCALL to test hypervisor.
#define	VMCALL_VMXOFF   0x00000002
	VMCALL to Call VMXOFF to turn off the hypervisor.
#define	VMCALL_CHANGE_PAGE_ATTRIB   0x00000003
	VMCALL to Hook Change the attribute bits of the EPT Table.
#define	VMCALL_INVEPT_ALL_CONTEXTS   0x00000004
	VMCALL to invalidate EPT (All Contexts)
#define	VMCALL_INVEPT_SINGLE_CONTEXT   0x00000005
	VMCALL to invalidate EPT (A Single Context)
#define	VMCALL_UNHOOK_ALL_PAGES   0x00000006
	VMCALL to remove a all physical addresses from hook list.
#define	VMCALL_UNHOOK_SINGLE_PAGE   0x00000007
	VMCALL to restore a single EPT entry and invalidate EPT cache.
#define	VMCALL_ENABLE_SYSCALL_HOOK_EFER   0x00000008
	VMCALL to enable syscall hook using EFER SCE bit.
#define	VMCALL_DISABLE_SYSCALL_HOOK_EFER   0x00000009
	VMCALL to disable syscall hook using EFER SCE bit.
#define	VMCALL_CHANGE_MSR_BITMAP_READ   0x0000000A
	VMCALL to change MSR Bitmap Read.
#define	VMCALL_CHANGE_MSR_BITMAP_WRITE   0x0000000B
	VMCALL to change MSR Bitmap Write.
#define	VMCALL_SET_RDTSC_EXITING   0x0000000C
	VMCALL to enable rdtsc/rdtscp exiting in primary cpu-based controls.
#define	VMCALL_SET_RDPMC_EXITING   0x0000000D
	VMCALL to enable rdpmc exiting in primary cpu-based controls.
#define	VMCALL_SET_EXCEPTION_BITMAP   0x0000000E
	VMCALL to set exception bitmap on VMCS.
#define	VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING   0x0000000F
	VMCALL to enable mov to debug registers exiting.
#define	VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING   0x00000010
	VMCALL to enable external interrupt exiting.
#define	VMCALL_CHANGE_IO_BITMAP   0x00000011
	VMCALL to change I/O Bitmaps (A & B)
#define	VMCALL_SET_HIDDEN_CC_BREAKPOINT   0x00000012
	VMCALL to put hidden breakpoints (using EPT)
#define	VMCALL_UNSET_RDTSC_EXITING   0x00000013
	VMCALL to disable rdtsc/rdtscp exiting in primary cpu-based controls.
#define	VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS   0x00000014
	VMCALL to disable external interrupt exiting only to clear !interrupt commands.
#define	VMCALL_UNSET_RDPMC_EXITING   0x00000015
	VMCALL to disable rdpmc exiting in primary cpu-based controls.
#define	VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING   0x00000016
	VMCALL to disable mov to debug registers exiting.
#define	VMCALL_RESET_MSR_BITMAP_READ   0x00000017
	VMCALL to reset MSR Bitmap Read.
#define	VMCALL_RESET_MSR_BITMAP_WRITE   0x00000018
	VMCALL to reset MSR Bitmap Write.
#define	VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS   0x00000019
	VMCALL to reset exception bitmap on VMCS.
#define	VMCALL_RESET_IO_BITMAP   0x0000001A
	VMCALL to reset I/O Bitmaps (A & B)
#define	VMCALL_ENABLE_MOV_TO_CR3_EXITING   0x0000001B
	VMCALL to enable cr3 exiting.
#define	VMCALL_DISABLE_MOV_TO_CR3_EXITING   0x0000001C
	VMCALL to disable cr3 exiting.
#define	VMCALL_UNSET_EXCEPTION_BITMAP   0x0000001D
	VMCALL to unset exception bitmap on VMCS.
#define	VMCALL_SET_VM_ENTRY_LOAD_DEBUG_CONTROLS   0x0000001E
	VMCALL to set VM-entry LOAD DEBUG CONTROLS.
#define	VMCALL_UNSET_VM_ENTRY_LOAD_DEBUG_CONTROLS   0x0000001F
	VMCALL to unset VM-entry LOAD DEBUG CONTROLS.
#define	VMCALL_SET_VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000020
	VMCALL to set VM-exit SAVE DEBUG CONTROLS.
#define	VMCALL_UNSET_VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000021
	VMCALL to unset VM-exit SAVE DEBUG CONTROLS.
#define	VMCALL_SET_VM_EXIT_ON_NMIS   0x00000022
	VMCALL to cause vm-exit on NMIs.
#define	VMCALL_UNSET_VM_EXIT_ON_NMIS   0x00000023
	VMCALL to not cause vm-exit on NMIs.
#define	VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS   0x00000024
	VMCALL to clear rdtsc exiting bit ONLY in the case of disabling the events for !tsc command.
#define	VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS   0x00000025
	VMCALL to clear mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command.
#define	VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING   0x00000026
	VMCALL to enable mov to CR exiting.
#define	VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING   0x00000027
	VMCALL to disable mov to CR exiting.
#define	VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS   0x00000028
	VMCALL to clear mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command.
#define	VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM   0x00000029
	VMCALL to enable dirty logging (PML) mechanism.
#define	VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM   0x0000002a
	VMCALL to disable dirty logging (PML) mechanism.
#define	VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP   0x0000002b
	VMCALL to change EPTP to an MBEC-supported EPTP.
#define	VMCALL_RESTORE_TO_NORMAL_EPTP   0x0000002c
	VMCALL to restore EPTP to normal EPTP.
#define	VMCALL_DISABLE_OR_ENABLE_MBEC   0x0000002d
	VMCALL to enable/disable MBEC.

Functions
NTSTATUS	VmxHandleVmcallVmExit (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Handle vm-exits of VMCALLs.
NTSTATUS	VmxVmcallDirectVmcallHandler (VIRTUAL_MACHINE_STATE *VCpu, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	Direct Vmcall Handler.
NTSTATUS	VmxVmcallHandler (_Inout_ VIRTUAL_MACHINE_STATE *VCpu, _In_ UINT64 VmcallNumber, _In_ UINT64 OptionalParam1, _In_ UINT64 OptionalParam2, _In_ UINT64 OptionalParam3)
	Main handler for VMCALLs.
NTSTATUS	VmcallTest (_In_ UINT64 Param1, _In_ UINT64 Param2, _In_ UINT64 Param3)
	Test function which shows a message to test a successful VMCALL.

Detailed Description

VMCALL Headers.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

VMCALL_CHANGE_IO_BITMAP

#define VMCALL_CHANGE_IO_BITMAP   0x00000011

VMCALL to change I/O Bitmaps (A & B)

VMCALL_CHANGE_MSR_BITMAP_READ

#define VMCALL_CHANGE_MSR_BITMAP_READ   0x0000000A

VMCALL to change MSR Bitmap Read.

VMCALL_CHANGE_MSR_BITMAP_WRITE

#define VMCALL_CHANGE_MSR_BITMAP_WRITE   0x0000000B

VMCALL to change MSR Bitmap Write.

VMCALL_CHANGE_PAGE_ATTRIB

#define VMCALL_CHANGE_PAGE_ATTRIB   0x00000003

VMCALL to Hook Change the attribute bits of the EPT Table.

VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP

#define VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP   0x0000002b

VMCALL to change EPTP to an MBEC-supported EPTP.

VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM

#define VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM   0x0000002a

VMCALL to disable dirty logging (PML) mechanism.

VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS

#define VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS   0x00000014

VMCALL to disable external interrupt exiting only to clear !interrupt commands.

VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING

#define VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING   0x00000027

VMCALL to disable mov to CR exiting.

VMCALL_DISABLE_MOV_TO_CR3_EXITING

#define VMCALL_DISABLE_MOV_TO_CR3_EXITING   0x0000001C

VMCALL to disable cr3 exiting.

VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS

#define VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS   0x00000028

VMCALL to clear mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command.

VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING

#define VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING   0x00000016

VMCALL to disable mov to debug registers exiting.

VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS

#define VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS   0x00000025

VMCALL to clear mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command.

VMCALL_DISABLE_OR_ENABLE_MBEC

#define VMCALL_DISABLE_OR_ENABLE_MBEC   0x0000002d

VMCALL to enable/disable MBEC.

VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS

#define VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS   0x00000024

VMCALL to clear rdtsc exiting bit ONLY in the case of disabling the events for !tsc command.

VMCALL_DISABLE_SYSCALL_HOOK_EFER

#define VMCALL_DISABLE_SYSCALL_HOOK_EFER   0x00000009

VMCALL to disable syscall hook using EFER SCE bit.

VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM

#define VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM   0x00000029

VMCALL to enable dirty logging (PML) mechanism.

VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING

#define VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING   0x00000010

VMCALL to enable external interrupt exiting.

VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING

#define VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING   0x00000026

VMCALL to enable mov to CR exiting.

VMCALL_ENABLE_MOV_TO_CR3_EXITING

#define VMCALL_ENABLE_MOV_TO_CR3_EXITING   0x0000001B

VMCALL to enable cr3 exiting.

VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING

#define VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING   0x0000000F

VMCALL to enable mov to debug registers exiting.

VMCALL_ENABLE_SYSCALL_HOOK_EFER

#define VMCALL_ENABLE_SYSCALL_HOOK_EFER   0x00000008

VMCALL to enable syscall hook using EFER SCE bit.

VMCALL_INVEPT_ALL_CONTEXTS

#define VMCALL_INVEPT_ALL_CONTEXTS   0x00000004

VMCALL to invalidate EPT (All Contexts)

VMCALL_INVEPT_SINGLE_CONTEXT

#define VMCALL_INVEPT_SINGLE_CONTEXT   0x00000005

VMCALL to invalidate EPT (A Single Context)

VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS

#define VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS   0x00000019

VMCALL to reset exception bitmap on VMCS.

THIS VMCALL SHOULD BE USED ONLY IN RESETTING (CLEARING) EXCEPTION EVENTS

VMCALL_RESET_IO_BITMAP

#define VMCALL_RESET_IO_BITMAP   0x0000001A

VMCALL to reset I/O Bitmaps (A & B)

VMCALL_RESET_MSR_BITMAP_READ

#define VMCALL_RESET_MSR_BITMAP_READ   0x00000017

VMCALL to reset MSR Bitmap Read.

VMCALL_RESET_MSR_BITMAP_WRITE

#define VMCALL_RESET_MSR_BITMAP_WRITE   0x00000018

VMCALL to reset MSR Bitmap Write.

VMCALL_RESTORE_TO_NORMAL_EPTP

#define VMCALL_RESTORE_TO_NORMAL_EPTP   0x0000002c

VMCALL to restore EPTP to normal EPTP.

VMCALL_SET_EXCEPTION_BITMAP

#define VMCALL_SET_EXCEPTION_BITMAP   0x0000000E

VMCALL to set exception bitmap on VMCS.

VMCALL_SET_HIDDEN_CC_BREAKPOINT

#define VMCALL_SET_HIDDEN_CC_BREAKPOINT   0x00000012

VMCALL to put hidden breakpoints (using EPT)

VMCALL_SET_RDPMC_EXITING

#define VMCALL_SET_RDPMC_EXITING   0x0000000D

VMCALL to enable rdpmc exiting in primary cpu-based controls.

VMCALL_SET_RDTSC_EXITING

#define VMCALL_SET_RDTSC_EXITING   0x0000000C

VMCALL to enable rdtsc/rdtscp exiting in primary cpu-based controls.

VMCALL_SET_VM_ENTRY_LOAD_DEBUG_CONTROLS

#define VMCALL_SET_VM_ENTRY_LOAD_DEBUG_CONTROLS   0x0000001E

VMCALL to set VM-entry LOAD DEBUG CONTROLS.

This control determines whether DR7 and the IA32_DEBUGCTL MSR are loaded on VM entry.

VMCALL_SET_VM_EXIT_ON_NMIS

#define VMCALL_SET_VM_EXIT_ON_NMIS   0x00000022

VMCALL to cause vm-exit on NMIs.

VMCALL_SET_VM_EXIT_SAVE_DEBUG_CONTROLS

#define VMCALL_SET_VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000020

VMCALL to set VM-exit SAVE DEBUG CONTROLS.

This control determines whether DR7 and the IA32_DEBUGCTL MSR are saved on VM exit.

VMCALL_TEST

#define VMCALL_TEST   0x00000001

VMCALL to test hypervisor.

VMCALL_UNHOOK_ALL_PAGES

#define VMCALL_UNHOOK_ALL_PAGES   0x00000006

VMCALL to remove a all physical addresses from hook list.

VMCALL_UNHOOK_SINGLE_PAGE

#define VMCALL_UNHOOK_SINGLE_PAGE   0x00000007

VMCALL to restore a single EPT entry and invalidate EPT cache.

VMCALL_UNSET_EXCEPTION_BITMAP

#define VMCALL_UNSET_EXCEPTION_BITMAP   0x0000001D

VMCALL to unset exception bitmap on VMCS.

VMCALL_UNSET_RDPMC_EXITING

#define VMCALL_UNSET_RDPMC_EXITING   0x00000015

VMCALL to disable rdpmc exiting in primary cpu-based controls.

VMCALL_UNSET_RDTSC_EXITING

#define VMCALL_UNSET_RDTSC_EXITING   0x00000013

VMCALL to disable rdtsc/rdtscp exiting in primary cpu-based controls.

VMCALL_UNSET_VM_ENTRY_LOAD_DEBUG_CONTROLS

#define VMCALL_UNSET_VM_ENTRY_LOAD_DEBUG_CONTROLS   0x0000001F

VMCALL to unset VM-entry LOAD DEBUG CONTROLS.

This control determines whether DR7 and the IA32_DEBUGCTL MSR are loaded on VM entry.

VMCALL_UNSET_VM_EXIT_ON_NMIS

#define VMCALL_UNSET_VM_EXIT_ON_NMIS   0x00000023

VMCALL to not cause vm-exit on NMIs.

VMCALL_UNSET_VM_EXIT_SAVE_DEBUG_CONTROLS

#define VMCALL_UNSET_VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000021

VMCALL to unset VM-exit SAVE DEBUG CONTROLS.

This control determines whether DR7 and the IA32_DEBUGCTL MSR are saved on VM exit.

VMCALL_VMXOFF

#define VMCALL_VMXOFF   0x00000002

VMCALL to Call VMXOFF to turn off the hypervisor.

Function Documentation

VmcallTest()

NTSTATUS VmcallTest	(	_In_ UINT64	Param1,
		_In_ UINT64	Param2,
		_In_ UINT64	Param3 )

Test function which shows a message to test a successful VMCALL.

Parameters

Param1
Param2
Param3

Returns

NTSTATUS

Test function which shows a message to test a successful VMCALL.

Parameters

Param1
Param2
Param3

Returns

NTSTATUS

{
    LogDebugInfo("VmcallTest called with @Param1 = 0x%llx , @Param2 = 0x%llx , @Param3 = 0x%llx",
                 Param1,
                 Param2,
                 Param3);
 
    //
    // Send one byte buffer to show that Hypervisor
    // is successfully loaded
    //
    LogCallbackSendBuffer(OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED,
                          "$",
                          sizeof(CHAR),
                          TRUE);
 
    return STATUS_SUCCESS;
}

VmxHandleVmcallVmExit()

NTSTATUS VmxHandleVmcallVmExit

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Handle vm-exits of VMCALLs.

Parameters

VCpu

Returns

NTSTATUS

VmxVmcallDirectVmcallHandler()

NTSTATUS VmxVmcallDirectVmcallHandler	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT64	VmcallNumber,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

Direct Vmcall Handler.

Parameters

VCpu	The virtual processor's state
VmcallNumber	The number of the VMCALL
DirectVmcallOptions

Returns

NTSTATUS

{
    return VmxVmcallHandler(VCpu,
                            VmcallNumber,
                            DirectVmcallOptions->OptionalParam1,
                            DirectVmcallOptions->OptionalParam2,
                            DirectVmcallOptions->OptionalParam3);
}

VmxVmcallHandler()

NTSTATUS VmxVmcallHandler	(	_Inout_ VIRTUAL_MACHINE_STATE *	VCpu,
		_In_ UINT64	VmcallNumber,
		_In_ UINT64	OptionalParam1,
		_In_ UINT64	OptionalParam2,
		_In_ UINT64	OptionalParam3 )

Main handler for VMCALLs.

Parameters

VCpu
VmcallNumber
OptionalParam1
OptionalParam2
OptionalParam3

Returns

NTSTATUS