Bitdefender Hypervisor Memory Introspection
hook_msr.h File Reference
#include "introtypes.h"

Go to the source code of this file.

Data Structures

struct  _MSR_HOOK_STATE
 
struct  _HOOK_MSR
 

Typedefs

typedef INTSTATUS(* PFUNC_MsrReadWriteHookCallback) (DWORD Msr, DWORD Flags, INTRO_ACTION *Action, void *Context, QWORD OriginalValue, QWORD *NewValue)
 Model specific register access callback. More...
 
typedef struct _MSR_HOOK_STATE MSR_HOOK_STATE
 
typedef struct _MSR_HOOK_STATEPMSR_HOOK_STATE
 
typedef struct _HOOK_MSR HOOK_MSR
 
typedef struct _HOOK_MSRPHOOK_MSR
 

Functions

INTSTATUS IntHookMsrSetHook (DWORD Msr, DWORD Flags, PFUNC_MsrReadWriteHookCallback Callback, void *Context, void **Hook)
 Set a model-specific register write hook. More...
 
INTSTATUS IntHookMsrRemoveHook (HOOK_MSR *Hook)
 Remove a model specific register hook. More...
 
INTSTATUS IntHookMsrCommit (void)
 Commit the model specific register hooks. More...
 
INTSTATUS IntHookMsrInit (void)
 Initialize the model specific registers hook state. More...
 
INTSTATUS IntHookMsrUninit (void)
 Uninit the model specific register hooks state. More...
 

Typedef Documentation

◆ HOOK_MSR

typedef struct _HOOK_MSR HOOK_MSR

Describes a MSR hook.

◆ MSR_HOOK_STATE

Global MSR hooks state.

◆ PFUNC_MsrReadWriteHookCallback

typedef INTSTATUS(* PFUNC_MsrReadWriteHookCallback) (DWORD Msr, DWORD Flags, INTRO_ACTION *Action, void *Context, QWORD OriginalValue, QWORD *NewValue)

Model specific register access callback.

Parameters
[in]MsrThe accessed MSR.
[in]FlagsIndicates read or write access. See IG_MSR_HOOK_TYPE.
[out]ActionDesired action.
[in]ContextOptional context, as passed to the hook set function.
[in]OriginalValueOriginal MSR value.
[in,out]NewValueNew MSR value. Can be overridden, but whether this is handled by the HV or not is implementation specific. It is advisable to not modify this value.

Definition at line 23 of file hook_msr.h.

◆ PHOOK_MSR

typedef struct _HOOK_MSR * PHOOK_MSR

◆ PMSR_HOOK_STATE

typedef struct _MSR_HOOK_STATE * PMSR_HOOK_STATE

Function Documentation

◆ IntHookMsrCommit()

INTSTATUS IntHookMsrCommit ( void  )

Commit the model specific register hooks.

This function will iterate the list of MSR hooks, and it will delete all the hooks that were flagged for removal.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZEDIf the MSR hooks state is not initialized.

Definition at line 224 of file hook_msr.c.

Referenced by IntGuestPreReturnCallback().

◆ IntHookMsrInit()

INTSTATUS IntHookMsrInit ( void  )

Initialize the model specific registers hook state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc fails.

Definition at line 262 of file hook_msr.c.

Referenced by IntGuestInit().

◆ IntHookMsrRemoveHook()

INTSTATUS IntHookMsrRemoveHook ( HOOK_MSR Hook)

Remove a model specific register hook.

Removes a MSR write hook. First of all, this function will mark the hook as being disabled (the callback will never be called again). If we are currently in the context of a MSR violation, we will wait for the commit phase to permanently delete the hook. Otherwise, the hook will be deleted immediately. NOTE: If this is the last hook set on this particular MSR, VM exits will be disabled on it.

Parameters
[in]HookThe hook to be removed.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.

Definition at line 138 of file hook_msr.c.

Referenced by IntHandleMsrViolation(), IntHookMsrRemoveAllHooks(), and IntMsrSyscallUnprotect().

◆ IntHookMsrSetHook()

INTSTATUS IntHookMsrSetHook ( DWORD  Msr,
DWORD  Flags,
PFUNC_MsrReadWriteHookCallback  Callback,
void *  Context,
void **  Hook 
)

Set a model-specific register write hook.

Establishes a hook on the given MSR (Model Specific Register). Flags may indicate whether it is a read, write or both hook. When the first hook is set on a MSR, VM exits are enabled for it. When the first MSR hook is set, the MSR access callback is registered to the HV.

Parameters
[in]MsrThe MSR to be intercepted.
[in]FlagsIG_MSR_HOOK_WRITE for write access, IG_MSR_HOOK_READ for read access.
[in]CallbackThe callback to be called when Msr is accessed.
[in]ContextOptional context, will be passed to the callback on calls.
[in]HookHandle to the newly placed MSR hook.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc fails.

Definition at line 11 of file hook_msr.c.

Referenced by IntMsrSyscallProtect().

◆ IntHookMsrUninit()

INTSTATUS IntHookMsrUninit ( void  )

Uninit the model specific register hooks state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZED_HINTIf the MSR hooks state is not initialized.

Definition at line 285 of file hook_msr.c.

Referenced by IntGuestUninit().