Unhandled exits on MSR read/write (Windows 10 1903)

[s405]

Hey, I'm having some trouble getting the hypervisor to run correctly on both virtualized and non-virtualized environments.

Both of the test environments are running Windows 10 Pro, build 1903.
I wanted to test other builds to see if the issue persists, however, the source doesn't seem to mess with undocumented OS internals and there's already been another issue opened (but closed later on) describing the same issue I'm experiencing.

Now, the HvExitHandleUnknownExit function is invoked multiple times by the VM exit handler and it receives exit codes 0x1F and 0x20, which are, as far as I'm aware, exits for MSR read/write.

What makes this interesting to me is that the MSR bitmap is both cleared and set before the CPU is subverted (https://github.com/Gbps/gbhv/blob/master/gbhv/vmcs.c#L515-L527), so I'm not sure what could be causing the exits...

I'm not too experienced with VT-x, I've never implemented a type 1 hypervisor by myself, but I've covered most of the basics/theory in SDM volume 3, so pardon if my lack of experience is the cause of the issue :)

EDIT: I haven't modified anything, I'm running it on clean Windows 10 installs and the hypervisor is compiled straight from the repo, no modifications...

[Gbps]

Hey there, thanks for testing out the project and for the well-organized report. There is indeed a range of MSR values defined in the manual that will exit no matter the state of the bitmap. I think it would be a very helpful opportunity for you to register two new exit handlers for MSR read and write, find which ones are causing the exit, and make a pull request with the fixes to resume stable execution. For some extra investigatuon, you could figure out what part of the OS is causing the exits as well :) Best,

…

-- Gbps

On Fri, Oct 25, 2019, 7:51 PM s405 ***@***.***> wrote: Hey, I'm having some trouble getting the hypervisor to run correctly on both virtualized and non-virtualized environments. Both of the test environments are running Windows 10 Pro, build 1903. I wanted to test other builds to see if the issue persists, however, the source doesn't seem to mess with undocumented OS internals and there's already been another issue opened (but closed later on) describing the same issue I'm experiencing. Now, the HvExitHandleUnknownExit function is invoked multiple times by the VM exit handler and it receives exit codes 0x1F and 0x20, which are, as far as I'm aware, exits for MSR read/write. What makes this interesting to me is that the MSR bitmap is both cleared and set before the CPU is subverted ( https://github.com/Gbps/gbhv/blob/master/gbhv/vmcs.c#L515-L527), so I'm not sure what could be causing the exits... I'm not too experienced with VT-x, I've never implemented a type 1 hypervisor by myself, but I've covered most of the basics/theory in SDM volume 3, so pardon if my lack of experience is the cause of the issue :) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#9?email_source=notifications&email_token=ABKZAKDMNPINIE4Y432HEKLQQOWCVA5CNFSM4JFLP6JKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HUQNPZQ>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKZAKGDQJRNQM2RFIF4FRDQQOWCVANCNFSM4JFLP6JA> .

[s405]

There is indeed a range of MSR values defined in the manual that will exit no matter the state of the bitmap.
…
-- Gbps

Oh sorry, I wasn't aware of this!

I'm going to implement exit handlers for both of these and I'll report back on the issue (logging the RIP as well to see where they come from ;) )

Cheers for the fast response! :)