Gbps / gbhv

Simple x86-64 VT-x Hypervisor with EPT Hooking
Creative Commons Attribution 4.0 International
847 stars 144 forks source link

Unhandled exits on MSR read/write (Windows 10 1903) #9

Closed s405 closed 3 years ago

s405 commented 5 years ago

Hey, I'm having some trouble getting the hypervisor to run correctly on both virtualized and non-virtualized environments.

Both of the test environments are running Windows 10 Pro, build 1903. I wanted to test other builds to see if the issue persists, however, the source doesn't seem to mess with undocumented OS internals and there's already been another issue opened (but closed later on) describing the same issue I'm experiencing.

Now, the HvExitHandleUnknownExit function is invoked multiple times by the VM exit handler and it receives exit codes 0x1F and 0x20, which are, as far as I'm aware, exits for MSR read/write.

What makes this interesting to me is that the MSR bitmap is both cleared and set before the CPU is subverted (https://github.com/Gbps/gbhv/blob/master/gbhv/vmcs.c#L515-L527), so I'm not sure what could be causing the exits...

I'm not too experienced with VT-x, I've never implemented a type 1 hypervisor by myself, but I've covered most of the basics/theory in SDM volume 3, so pardon if my lack of experience is the cause of the issue :)

EDIT: I haven't modified anything, I'm running it on clean Windows 10 installs and the hypervisor is compiled straight from the repo, no modifications...

Gbps commented 5 years ago

Hey there, thanks for testing out the project and for the well-organized report.

There is indeed a range of MSR values defined in the manual that will exit no matter the state of the bitmap. I think it would be a very helpful opportunity for you to register two new exit handlers for MSR read and write, find which ones are causing the exit, and make a pull request with the fixes to resume stable execution. For some extra investigatuon, you could figure out what part of the OS is causing the exits as well :)

Best,

-- Gbps

On Fri, Oct 25, 2019, 7:51 PM s405 notifications@github.com wrote:

Hey, I'm having some trouble getting the hypervisor to run correctly on both virtualized and non-virtualized environments.

Both of the test environments are running Windows 10 Pro, build 1903. I wanted to test other builds to see if the issue persists, however, the source doesn't seem to mess with undocumented OS internals and there's already been another issue opened (but closed later on) describing the same issue I'm experiencing.

Now, the HvExitHandleUnknownExit function is invoked multiple times by the VM exit handler and it receives exit codes 0x1F and 0x20, which are, as far as I'm aware, exits for MSR read/write.

What makes this interesting to me is that the MSR bitmap is both cleared and set before the CPU is subverted ( https://github.com/Gbps/gbhv/blob/master/gbhv/vmcs.c#L515-L527), so I'm not sure what could be causing the exits...

I'm not too experienced with VT-x, I've never implemented a type 1 hypervisor by myself, but I've covered most of the basics/theory in SDM volume 3, so pardon if my lack of experience is the cause of the issue :)

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/Gbps/gbhv/issues/9?email_source=notifications&email_token=ABKZAKDMNPINIE4Y432HEKLQQOWCVA5CNFSM4JFLP6JKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HUQNPZQ, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABKZAKGDQJRNQM2RFIF4FRDQQOWCVANCNFSM4JFLP6JA .

s405 commented 5 years ago

There is indeed a range of MSR values defined in the manual that will exit no matter the state of the bitmap. -- Gbps

Oh sorry, I wasn't aware of this!

I'm going to implement exit handlers for both of these and I'll report back on the issue (logging the RIP as well to see where they come from ;) )

Cheers for the fast response! :)