search

tandasat / MiniVisorPkg

The research UEFI hypervisor that supports booting an operating system.
https://standa-note.blogspot.com/2020/03/introduction-and-design-considerations.html
MIT License
534 stars 87 forks source link

HV fails to subvert in UEFI mode on Intel i9 13900k #11

Open ghost opened 1 year ago

ghost commented 1 year ago

Hi, this is a new github account, although I have worked closely with you before a few years ago over email regarding. I built an introspection engine for detecting bootkits with MiniVisorPkg back when it was first released.

I just upgraded to an i9 13900k from an i7 10900k and it doesn't seem to work. I'll investigate, but I'm leaving this here so if anyone else has this issue in the future, we can provide a solution.

Fails out at in HandleHostException seemingly during the execution of EnableHypervisor on all cores. InterruptNumber 0x6C (undocumented, reserved as far as I can tell) and error code 0x0. Note that at this stage, cr2 is 0. I believe that should be expected though at this phase of subverting the cores.

ghost commented 1 year ago

I cannot test serial, as this is a new build and i don't have a serial card yet. Will get one in for testing soon. VMWare same version of Win10 works fine, as does testing the same version on my i9 build. The only difference in this build is CPU change.

ghost commented 1 year ago

I updated ia32. @tandasat you might want to start the transition to new ia32 (I think MV is back in 2018 in terms of that). I'd be happy to contribute my update to ia32 Dec 2022.

That + disabling e-cores (only subvert p-cores) solves the problem. In the future I'd like to not have to hurt my CPU by 50% performance to subvert, so I'll come up w a solution eventually for dealing with e-cores.

tandasat commented 1 year ago

@spectra-analytics are you referring to ia32-doc headers? If so, I am happy to update the headers. Please consider making a PR against https://github.com/ia32-doc.

HandleHostException getting 0x6c is interesting. IIRC, I have seen 0x6c before and guessed it might be a UEFI thing, though did not take a deeper look. Are you sure that it is received in HandleHostException over, say UEFI's exception handler? The host should run with interrupt disabled, so I do not see why HandleHostException would receive an interrupt. Where does rip point to?