bebc <mystery>:
mov 3423441(%rip),%r11
xor (%rsp),%r11
mov %rdx,%r8
mov %rcx,%r9
test %r8,%r8
jne bee3
mov $0x6c16,%rdi
mov $0xc0f4,%rax
vmwrite %rax,%rdi
pushf
For the above instruction, which instruction can possibly cause an exit and which type of exit? Also what's the reason for exit? (Assume the page contains mystery function).The mystery function is running in CPL0.
This answer is based on the Intel VMX extensions, AMD probably differ.
Furthermore, VM extensions had become quite vast and complex (as Oct 2020), so the answer may not suprise you:
They all can and cannot, depending on the VM configuration, cause a VM-exit (henceforward, an exit).
Depending on the context, probably only vmwrite will cause an exit but, again, VMCS shadowing (read: nested virtualization) has been supported for a while by all the mainstream VMMs, AFAICT, and so maybe neither that instruction will cause an exit.
The code seems the prolog a function conforming to the Windows ABI, that sets a stack cookie and eventually overwrite the host rip in the host state area.
bebc: 4c 8b 1d e5 57 30 00 mov 3168229(%rip),%r11
Can cause an exit if it faults (see section 25.2 of the Intel's manual):
Exceptions. Exceptions (faults, traps, and aborts) cause VM exits based on the exception bitmap (see Section 24.6.3). If an exception occurs, its vector (in the range 0–31) is used to select a bit in the exception bitmap. If the bit is 1, a VM exit occurs; if the bit is 0, the exception is delivered normally through the guest IDT.
If exiting windows are configured and the relative interrupt is not masked, before executing this instruction the CPU will generate an exit, though this may not count as an exit generated by the instruction itself.
If the “interrupt-window exiting” VM-execution control is 1, a VM exit occurs before execution of any instruction if RFLAGS.IF = 1 and there is no blocking of events by STI or by MOV SS (see Table 24-3).
If the “NMI-window exiting” VM-execution control is 1, a VM exit occurs before execution of any instruction if there is no virtual-NMI blocking and there is no blocking of events by MOV SS and no blocking of events by STI (see Table 24-3).
If the EPTs are used and they are misconfigured or an EPT-violation (i.e. to emulate a MMIO region) is detected, then an exit is induced.
Accesses using guest-physical addresses may cause VM exits due to EPT misconfigurations, EPT violations, and page-modification log-full events. An EPT misconfiguration occurs when, in the course of translating a guest- physical address, the logical processor encounters an EPT paging-structure entry that contains an unsupported value (see Section 28.2.3.1). An EPT violation occurs when there is no EPT misconfiguration but the EPT paging- structure entries disallow an access using the guest-physical address (see Section 28.2.3.2). A page-modifica- tion log-full event occurs when the logical processor determines a need to create a page-modification log entry and the current log is full (see Section 28.2.6).
bec3: 4c 33 1c 24 xor (%rsp),%r11
Ditto.
bec7: 49 89 d0 mov %rdx,%r8
This instruction cannot fault but otherwise the same exits apply.
beca: 49 89 c9 mov %rcx,%r9
becd: 4d 85 c0 test %r8,%r8
bed0: 75 11 jne bee3
bed2: 48 c7 c7 16 6c 00 00 mov $0x6c16,%rdi
bed9: 48 c7 c0 f4 c0 34 82 mov $0xc0f4,%rax
Ditto for these.
bee0: 0f 79 f8 vmwrite %rax,%rdi
Besides the pedantic exits applying to all instructions, this one can cause an exit if:
VMWRITE. The VMWRITE instruction causes a VM exit if any of the following are true:
— The “VMCS shadowing” VM-execution control is 0.
— Bits 63:15 (bits 31:15 outside 64-bit mode) of the register source operand are not all 0.
— Bit n in VMWRITE bitmap is 1, where n is the value of bits 14:0 of the register source operand. See Section 24.6.15 for details regarding how the VMWRITE bitmap is identified.
bee3: 9c pushf
Some consideration for any other instruction accessing memory.
These are the instructions that always cause an exit:
These instruction could case an exit:
And finally, these are also other sources of exits:
