wbenny / hvpp

hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system
MIT License
1.12k stars 221 forks source link

Possible bug in vcpu_t::entry_host() #29

Closed RangeMachine closed 5 years ago

RangeMachine commented 5 years ago

You capturing rip rsp and rflags before vmexit handler: ` auto captured_rsp = exitcontext.rsp; auto captured_rflags = exitcontext.rflags;

{
  exit_context_.rsp    = guest_rsp();
  exit_context_.rip    = guest_rip();
  exit_context_.rflags = guest_rflags();

  //
  // WinDbg will show full callstack (hypervisor + interrupted application)
  // after these two lines are executed.
  // See vcpu.asm for more details.
  //
  // Note that machine_frame.rip is supposed to hold return address.
  // exit_instruction_length() is added to the guest_rip() to create
  // this value.
  //
  stack_.machine_frame.rip = exit_context_.rip + exit_instruction_length();
  stack_.machine_frame.rsp = exit_context_.rsp;

  {
    handler_->handle(*this);`

As result any modifications to rip, rsp and rflags in vmexits have not any effect. So possible solution is: ` memory_manager::allocatorguard ;

auto captured_rsp    = exit_context_.rsp;
auto captured_rflags = exit_context_.rflags;

{
  handler_->handle(*this);

  exit_context_.rsp    = guest_rsp();
  exit_context_.rip    = guest_rip();
  exit_context_.rflags = guest_rflags();`
wbenny commented 5 years ago

I'm not sure what do you mean. The code is there : https://github.com/wbenny/hvpp/blob/ec4115e5af113d5b7fa57735cfc7ea85f6dad47c/src/hvpp/hvpp/vcpu.cpp#L673

RangeMachine commented 5 years ago

Look. We are capturingexit_context_.rip = guest_rip(); before handler_->handle(*this);. If you do something like vmwrite(guest_ip, newip) in vmexit handler, it will not have any effect because after vm exit we are restoring captured rip guest_rsp(exit_context_.rip);.

wbenny commented 5 years ago

That's true. The idea here is that you can change the registers via vp.exit_context(). Including rip, rsp & rflags

RangeMachine commented 5 years ago

Thanks for hint.