/*!
    @file HostMain.c

    @brief Functions for VM-exit handling.

    @author Satoshi Tanda

    @copyright Copyright (c) 2020 -, Satoshi Tanda. All rights reserved.
 */
#include "HostMain.h"
#include "HostUtils.h"
#include "Public.h"
#include "Logger.h"
#include "ExtendedPageTables.h"
#include "HostVmcall.h"
#include "HostNesting.h"

//
// The trap frame structure for x64 systems. This is structure is used to help
// Windbg to construct call stack while VM-exit handlers are being executed.
// Since this is for Windbg, this is a Windows specific structure, and its
// layout can be found as nt!_KTRAP_FRAME. In our case, only the Rip and Rsp
// members are used since those are only fields needed to be set for Windbg to
// show proper call stack.
//
typedef struct _WINDOWS_KTRAP_FRAME
{
    UINT64 Reserved1[45];
    UINT64 Rip;
    UINT64 Reserved2[2];
    UINT64 Rsp;
    UINT64 Reserved3;
} WINDOWS_KTRAP_FRAME;
C_ASSERT(sizeof(WINDOWS_KTRAP_FRAME) == 0x190);

//
// The layout of hypervisor stack when the C-handler (HandleVmExit) is executed.
// GuestRegisters and TrapFrame are pushed in assembler part.
//
typedef struct _INITIAL_HYPERVISOR_STACK
{
    GUEST_REGISTERS GuestRegisters;
    WINDOWS_KTRAP_FRAME TrapFrame;
    HYPERVISOR_CONTEXT HypervisorContext;
} INITIAL_HYPERVISOR_STACK;

/*!
    @brief Handles VM-exit due to execution of the RDMSR and WRMSR instruction.

    @param[in,out] GuestContext - A pointer to the guest context.

    @param[in] OperationType - The type of the operation.
 */
static
VOID
HandleMsrAccess (
    _Inout_ GUEST_CONTEXT* GuestContext,
    _In_ OPERATION_TYPE OperationType
    )
{
    IA32_MSR_ADDRESS msr;
    UINT64 value;

    msr = (IA32_MSR_ADDRESS)GuestContext->StackBasedRegisters->Rcx;
    if (OperationType == OperationRead)
    {
        //
        // Performs the same read on behalf of the guest.
        //
        value = __readmsr(msr);
        GuestContext->StackBasedRegisters->Rax = value & MAXUINT32;
        GuestContext->StackBasedRegisters->Rdx = (value >> 32) & MAXUINT32;
    }
    else
    {
        //
        // Performs the same write on behalf of the guest.
        //
        value = (GuestContext->StackBasedRegisters->Rax & MAXUINT32) |
                ((GuestContext->StackBasedRegisters->Rdx & MAXUINT32) << 32);
        __writemsr(msr, value);
    }

    AdvanceGuestInstructionPointer(GuestContext);
}

/*!
    @brief Handles VM-exit due to execution of the RDMSR instruction.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleMsrRead (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    HandleMsrAccess(GuestContext, OperationRead);
}

/*!
    @brief Handles VM-exit due to execution of the WRMSR instruction.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleMsrWrite (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    HandleMsrAccess(GuestContext, OperationWrite);
}

/*!
    @brief Handles VM-exit due to execution of the CPUID instruction.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleCpuid (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    int registers[4];
    int leaf, subLeaf;

    //
    // Execute the same instruction on behalf of the guest.
    //
    leaf = (int)GuestContext->StackBasedRegisters->Rax;
    subLeaf = (int)GuestContext->StackBasedRegisters->Rcx;
    __cpuidex(registers, leaf, subLeaf);

    //
    // Then, modify results when necessary.
    //
    switch (leaf)
    {
        case CPUID_VERSION_INFORMATION:
            //
            // Do not indicate the VMX feature is available on this processor to
            // prevent other hypervisor tries to use it, as MiniVisor does not
            // support nesting the hypervisor.
            //
            ClearFlag(registers[2], CPUID_FEATURE_INFORMATION_ECX_VIRTUAL_MACHINE_EXTENSIONS_FLAG);
            break;

        case CPUID_HV_VENDOR_AND_MAX_FUNCTIONS:
            //
            // Return a maximum supported hypervisor CPUID leaf range and a vendor
            // ID signature as required by the spec.
            //
            registers[0] = CPUID_HV_MAX;
            registers[1] = 'iniM';  // "MiniVisor   "
            registers[2] = 'osiV';
            registers[3] = '   r';
            break;

        case CPUID_HV_INTERFACE:
            //
            // Return non Hv#1 value. This indicate that the MiniVisor does NOT
            // conform to the Microsoft hypervisor interface.
            //
            registers[0] = '0#vH';  // Hv#0
            registers[1] = registers[2] = registers[3] = 0;
            break;

        default:
            break;
    }

    //
    // Update guest's GPRs with results.
    //
    GuestContext->StackBasedRegisters->Rax = (UINT64)registers[0];
    GuestContext->StackBasedRegisters->Rbx = (UINT64)registers[1];
    GuestContext->StackBasedRegisters->Rcx = (UINT64)registers[2];
    GuestContext->StackBasedRegisters->Rdx = (UINT64)registers[3];

    AdvanceGuestInstructionPointer(GuestContext);
}

/*!
    @brief Handles VM-exit due to execution of the VMCALL instruction.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleVmCall (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    UINT64 hypercallNumber;

    //
    // Our hypercall takes the hypercall number in RCX.
    //
    hypercallNumber = GuestContext->StackBasedRegisters->Rcx;
    if (hypercallNumber >= VmcallInvalid)
    {
        //
        // Undefined hypercall number. Inject #UD.
        //
        InjectInterruption(HardwareException, InvalidOpcode, FALSE, 0);
        goto Exit;
    }

    //
    // Executes the corresponding hypercall handler.
    //
    k_VmcallHandlers[hypercallNumber](GuestContext);

    AdvanceGuestInstructionPointer(GuestContext);

Exit:
    return;
}

/*!
    @brief Handles VM-exit due to execution of the XSETBV instruction.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleXsetbv (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    UINT64 value;
    CR4 hostCr4;

    //
    // Execution of the XSETBV instruction requires the OSXSAVE bit to be set,
    // and the host CR4 may not have it. Set the bit and execute the instruction.
    //
    hostCr4.Flags = __readcr4();
    hostCr4.OsXsave = TRUE;
    __writecr4(hostCr4.Flags);

    value = (GuestContext->StackBasedRegisters->Rax & MAXUINT32) |
            ((GuestContext->StackBasedRegisters->Rdx & MAXUINT32) << 32);
    _xsetbv((UINT32)GuestContext->StackBasedRegisters->Rcx, value);

    AdvanceGuestInstructionPointer(GuestContext);
}

/*!
    @brief Returns the address of where the guest general purpose register that
        corresponds to the given index is stored.

    @param[in,out] GuestContext - A pointer to the guest context.

    @param[in] RegisterIndex - The index provided by VMCS up on VM-exit.

    @return The address of where the guest general purpose register that
        corresponds to the given index is stored.
 */
static
UINT64*
SelectEffectiveRegister (
    _Inout_ GUEST_CONTEXT* GuestContext,
    _In_ UINT64 RegisterIndex
    )
{
    UINT64* effectiveRegister;

    switch (RegisterIndex)
    {
        case 0: effectiveRegister = &GuestContext->StackBasedRegisters->Rax; break;
        case 1: effectiveRegister = &GuestContext->StackBasedRegisters->Rcx; break;
        case 2: effectiveRegister = &GuestContext->StackBasedRegisters->Rdx; break;
        case 3: effectiveRegister = &GuestContext->StackBasedRegisters->Rbx; break;
        case 4: effectiveRegister = &GuestContext->VmcsBasedRegisters.Rsp; break;
        case 5: effectiveRegister = &GuestContext->StackBasedRegisters->Rbp; break;
        case 6: effectiveRegister = &GuestContext->StackBasedRegisters->Rsi; break;
        case 7: effectiveRegister = &GuestContext->StackBasedRegisters->Rdi; break;
        case 8: effectiveRegister = &GuestContext->StackBasedRegisters->R8; break;
        case 9: effectiveRegister = &GuestContext->StackBasedRegisters->R9; break;
        case 10: effectiveRegister = &GuestContext->StackBasedRegisters->R10; break;
        case 11: effectiveRegister = &GuestContext->StackBasedRegisters->R11; break;
        case 12: effectiveRegister = &GuestContext->StackBasedRegisters->R12; break;
        case 13: effectiveRegister = &GuestContext->StackBasedRegisters->R13; break;
        case 14: effectiveRegister = &GuestContext->StackBasedRegisters->R14; break;
        case 15: effectiveRegister = &GuestContext->StackBasedRegisters->R15; break;
        default: MV_PANIC(); break;
    }

    return effectiveRegister;
}

/*!
    @brief Handles VM-exit due to execution of access to the control register.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleCrAccess (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    VMX_EXIT_QUALIFICATION_MOV_CR qualification;
    UINT64 newValue;
    CR0 newCr0, currentCr0;
    CR4 newCr4;

    qualification.Flags = VmxRead(VMCS_EXIT_QUALIFICATION);
    newValue = *SelectEffectiveRegister(GuestContext,
                                        qualification.GeneralPurposeRegister);

    switch (qualification.AccessType)
    {
    case VMX_EXIT_QUALIFICATION_ACCESS_MOV_TO_CR:
        //
        // Update what the guest sees (ie, VMCS_CTRL_CRn_READ_SHADOW) exactly
        // as the guest requested, then update the actual state (VMCS_GUEST_CRn)
        // after applying the FIXED0 and FIXED1 MSRs. This ensures VMX continues
        // to function, for example, by keeping the VMXE bit set.
        //
        switch (qualification.ControlRegister)
        {
        case VMX_EXIT_QUALIFICATION_REGISTER_CR0:
            newCr0.Flags = newValue;
            currentCr0.Flags = VmxRead(VMCS_GUEST_CR0);
            VmxWrite(VMCS_CTRL_CR0_READ_SHADOW, newCr0.Flags);
            VmxWrite(VMCS_GUEST_CR0, AdjustGuestCr0(newCr0).Flags);
            if (currentCr0.PagingEnable != newCr0.PagingEnable)
            {
                SwitchGuestPagingMode(newCr0);

                //
                // For demonstration with VMware. On bare-metal, delay because of
                // this logging may lead to failure of AP start up.
                //
                //LOG_INFO("Processor #%d switching to the long mode",
                //         GuestContext->Contexts->ProcessorNumber);
            }
            break;
        case VMX_EXIT_QUALIFICATION_REGISTER_CR4:
            newCr4.Flags = newValue;
            VmxWrite(VMCS_CTRL_CR4_READ_SHADOW, newCr4.Flags);
            VmxWrite(VMCS_GUEST_CR4, AdjustGuestCr4(newCr4).Flags);
            break;
        default:
            MV_PANIC();
        }
        break;
    default:
        MV_PANIC();
    }

    AdvanceGuestInstructionPointer(GuestContext);
}

/*!
    @brief Handles VM-exit due to EPT violation.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleEptViolation (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    UINT64 faultPhysicalAddress;

    //
    // As of now, this should never happen and can panic here. We inject #GP(0)
    // instead, because this is what you may want to do once some EPT related logic
    // such as protecting pages is written.
    //
    faultPhysicalAddress = VmxRead(VMCS_GUEST_PHYSICAL_ADDRESS);
    LOG_WARNING("IP:%016llx PA:%016llx",
                GuestContext->VmcsBasedRegisters.Rip,
                faultPhysicalAddress);

    InjectInterruption(HardwareException, GeneralProtection, TRUE, 0);
}

/*!
    @brief Handles VM-exit due to EPT misconfiguration.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleEptMisconfig (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    UINT64 faultPhysicalAddress;
    ADDRESS_TRANSLATION_HELPER helper;

    //
    // This is a programming error that should never happen. The most helpful
    // thing can be done is to dump information for diagnostics.
    //
    DumpGuestState();
    faultPhysicalAddress = VmxRead(VMCS_GUEST_PHYSICAL_ADDRESS);
    LOG_ERROR("IP:%016llx PA:%016llx",
              GuestContext->VmcsBasedRegisters.Rip,
              faultPhysicalAddress);
    LOG_ERROR("EPT_PML4:%016llx EPTP:%016llx",
              GuestContext->Contexts->EptContext->EptPml4->Flags,
              GuestContext->Contexts->EptContext->EptPointer.Flags);
    helper.AsUInt64 = faultPhysicalAddress;
    LOG_ERROR("Indexes: %llu %llu %llu %llu",
              helper.AsIndex.Pml4,
              helper.AsIndex.Pdpt,
              helper.AsIndex.Pd,
              helper.AsIndex.Pt);

    MV_PANIC();
}

/*!
    @brief Handles VM-exit due to interrupt or exception.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleExceptionOrNmi (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    static BOOLEAN isKeInitAmd64SpecificStateCalled;
    VMEXIT_INTERRUPT_INFORMATION interruptInfo;

    //
    // This handler is specialized for skipping main initialization of PatchGuard.
    // When #DE occurs with the guest state that seems to be during initialization
    // of PatchGuard, suppress it. Otherwise, just inject the exception (pass-through).
    //
    interruptInfo.Flags = (UINT32)VmxRead(VMCS_VMEXIT_INTERRUPTION_INFORMATION);
    MV_ASSERT(interruptInfo.InterruptionType == HardwareException);
    MV_ASSERT(interruptInfo.Vector == DivideError);

    //
    // The below check detects division that will trigger initialization of
    // PatchGuard. The very instruction is this on all versions of Windows.
    //  idiv r8d
    // The IDIV instruction in this form performs (int64)edx:eax / (int32)r8d,
    // and cases #DE, in particular when a positive result is greater than
    // 0x7fffffff. If the kernel debugger is not attached and disabled, the NT
    // kernel executes this instruction with the following values, resulting in
    // the #DE.
    //  ((int64)0xffffffff80000000 / -1) => 0x80000000
    // When this condition is detected for the first time, we do not inject #DE
    // to the guest to avoid initialization of main PatchGuard logic.
    //
    if ((isKeInitAmd64SpecificStateCalled == FALSE) &&
        ((UINT32)GuestContext->StackBasedRegisters->Rax == (UINT32)0x80000000) &&
        ((UINT32)GuestContext->StackBasedRegisters->Rdx == (UINT32)0xffffffff) &&
        ((UINT32)GuestContext->StackBasedRegisters->R8 ==  (UINT32)-1))
    {
        UINT64 ntoskrnlBase;

        //
        // Just as an example of how to access the guest virtual address, search
        // the base address of the NT kernel and print it out.
        //
        ntoskrnlBase = FindImageBase(GuestContext, GuestContext->VmcsBasedRegisters.Rip);
        if (ntoskrnlBase != 0)
        {
            LOG_INFO("Found ntoskrnl.exe at %016llx", ntoskrnlBase);
        }

        LOG_INFO("KeInitAmd64SpecificState triggered #DE");
        LOG_INFO("Skipping main PatchGuard initialization.");
        isKeInitAmd64SpecificStateCalled = TRUE;
        AdvanceGuestInstructionPointer(GuestContext);
        goto Exit;
    }

    //
    // Otherwise, just forward the exception.
    //
    InjectInterruption(interruptInfo.InterruptionType, interruptInfo.Vector, FALSE, 0);

Exit:
    return;
}

/*!
    @brief Handles VM-exit due to the INIT signal.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleInitSignal (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    UNREFERENCED_PARAMETER(GuestContext);

    //
    // For demonstration with VMware. On bare-metal, delay because of this logging
    // may lead to failure of AP start up.
    //
    //LOG_INFO("Starting up processor #%d", GuestContext->Contexts->ProcessorNumber);

    //
    // Simply put the processor into the "wait-for-SIPI" state.
    //
    // "All the processors on the system bus (...) execute the multiple processor
    //  (MP) initialization protocol. ... The application (non-BSP) processors
    //  (APs) go into a Wait For Startup IPI (SIPI) state while the BSP is executing
    //  initialization code."
    //
    // See: 9.1 INITIALIZATION OVERVIEW
    //
    // "Upon receiving an INIT ..., the processor responds by beginning the
    //  initialization process of the processor core and the local APIC. The state
    //  of the local APIC following an INIT reset is the same as it is after a
    //  power-up or hardware reset ... . This state is also referred to at the
    //  "wait-for-SIPI" state."
    //
    // See: 10.4.7.3 Local APIC State After an INIT Reset (“Wait-for-SIPI” State)
    //
    VmxWrite(VMCS_GUEST_ACTIVITY_STATE, VmxWaitForSipi);
}

/*!
    @brief Handles VM-exit due to the Startup-IPI (SIPI) signal.

    @param[in,out] GuestContext - A pointer to the guest context.
 */
static
VOID
HandleStartupIpi (
    _Inout_ GUEST_CONTEXT* GuestContext
    )
{
    int regs[4];
    CPUID_EAX_01 cpuVersionInfo;
    UINT64 extendedModel;
    UINT64 vector;
    VMX_SEGMENT_ACCESS_RIGHTS accessRights;
    IA32_VMX_ENTRY_CTLS_REGISTER vmEntryControls;
    CR0 newCr0;
    CR4 newCr4;

    //
    // Intel SDM suggest to issue SIPI twice. This does not appear to be
    // implemented by many of kernels such as FreeBSD, Linux and Windows, but
    // ignore it if this occurs, as we already initialized the processor with
    // the first SIPI.
    //
    if (VmxRead(VMCS_GUEST_ACTIVITY_STATE) == VmxActive)
    {
        goto Exit;
    }

    //
    // Initializes the processor to the state after INIT as described in the
    // Intel SDM.
    //
    // See: Table 9-1. IA-32 and Intel 64 Processor States Following Power-up,
    //      Reset, or INIT
    //
    VmxWrite(VMCS_GUEST_RFLAGS, RFLAGS_READ_AS_1_FLAG);
    VmxWrite(VMCS_GUEST_RIP, 0xfff0);
    VmxWrite(VMCS_CTRL_CR0_READ_SHADOW, CR0_EXTENSION_TYPE_FLAG);
    __writecr2(0);
    VmxWrite(VMCS_GUEST_CR3, 0);
    VmxWrite(VMCS_CTRL_CR4_READ_SHADOW, 0);

    //
    // Actual guest CR0 and CR4 must fulfill requirements for VMX. Apply those.
    //
    newCr0.Flags = CR0_EXTENSION_TYPE_FLAG;
    newCr4.Flags = 0;
    VmxWrite(VMCS_GUEST_CR0, AdjustGuestCr0(newCr0).Flags);
    VmxWrite(VMCS_GUEST_CR4, AdjustGuestCr4(newCr4).Flags);

    accessRights.Flags = 0;

    accessRights.Type = SEGMENT_DESCRIPTOR_TYPE_CODE_EXECUTE_READ_ACCESSED;
    accessRights.DescriptorType = TRUE;
    accessRights.Present = TRUE;
    VmxWrite(VMCS_GUEST_CS_SELECTOR, 0xf000);
    VmxWrite(VMCS_GUEST_CS_BASE, 0xffff0000);
    VmxWrite(VMCS_GUEST_CS_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_CS_ACCESS_RIGHTS, accessRights.Flags);

    accessRights.Type = SEGMENT_DESCRIPTOR_TYPE_DATA_READ_WRITE_ACCESSED;
    VmxWrite(VMCS_GUEST_SS_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_SS_BASE, 0);
    VmxWrite(VMCS_GUEST_SS_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_SS_ACCESS_RIGHTS, accessRights.Flags);
    VmxWrite(VMCS_GUEST_DS_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_DS_BASE, 0);
    VmxWrite(VMCS_GUEST_DS_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_DS_ACCESS_RIGHTS, accessRights.Flags);
    VmxWrite(VMCS_GUEST_ES_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_ES_BASE, 0);
    VmxWrite(VMCS_GUEST_ES_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_ES_ACCESS_RIGHTS, accessRights.Flags);
    VmxWrite(VMCS_GUEST_FS_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_FS_BASE, 0);
    VmxWrite(VMCS_GUEST_FS_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_FS_ACCESS_RIGHTS, accessRights.Flags);
    VmxWrite(VMCS_GUEST_GS_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_GS_BASE, 0);
    VmxWrite(VMCS_GUEST_GS_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_GS_ACCESS_RIGHTS, accessRights.Flags);

    __cpuid(regs, CPUID_VERSION_INFORMATION);
    cpuVersionInfo.CpuidVersionInformation.Flags = regs[0];
    extendedModel = cpuVersionInfo.CpuidVersionInformation.ExtendedModelId;
    GuestContext->StackBasedRegisters->Rdx = 0x600 | (extendedModel << 16);
    GuestContext->StackBasedRegisters->Rbx = 0;
    GuestContext->StackBasedRegisters->Rcx = 0;
    GuestContext->StackBasedRegisters->Rsi = 0;
    GuestContext->StackBasedRegisters->Rdi = 0;
    GuestContext->StackBasedRegisters->Rbp = 0;
    VmxWrite(VMCS_GUEST_RSP, 0);

    VmxWrite(VMCS_GUEST_GDTR_BASE, 0);
    VmxWrite(VMCS_GUEST_GDTR_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_IDTR_BASE, 0);
    VmxWrite(VMCS_GUEST_IDTR_LIMIT, 0xffff);

    accessRights.Type = SEGMENT_DESCRIPTOR_TYPE_LDT;
    accessRights.DescriptorType = FALSE;
    VmxWrite(VMCS_GUEST_LDTR_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_LDTR_BASE, 0);
    VmxWrite(VMCS_GUEST_LDTR_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_LDTR_ACCESS_RIGHTS, accessRights.Flags);

    accessRights.Type = SEGMENT_DESCRIPTOR_TYPE_TSS_BUSY;
    VmxWrite(VMCS_GUEST_TR_SELECTOR, 0);
    VmxWrite(VMCS_GUEST_TR_BASE, 0);
    VmxWrite(VMCS_GUEST_TR_LIMIT, 0xffff);
    VmxWrite(VMCS_GUEST_TR_ACCESS_RIGHTS, accessRights.Flags);

    __writedr(0, 0);
    __writedr(1, 0);
    __writedr(2, 0);
    __writedr(3, 0);
    __writedr(6, 0xffff0ff0);
    VmxWrite(VMCS_GUEST_DR7, 0x400);

    GuestContext->StackBasedRegisters->R8 = 0;
    GuestContext->StackBasedRegisters->R9 = 0;
    GuestContext->StackBasedRegisters->R10 = 0;
    GuestContext->StackBasedRegisters->R11 = 0;
    GuestContext->StackBasedRegisters->R12 = 0;
    GuestContext->StackBasedRegisters->R13 = 0;
    GuestContext->StackBasedRegisters->R14 = 0;
    GuestContext->StackBasedRegisters->R15 = 0;

    //
    // Those registers are supposed to be cleared but that is not implemented here.
    //  - IA32_XSS
    //  - BNDCFGU
    //  - BND0-BND3
    //  - IA32_BNDCFGS
    //

    VmxWrite(VMCS_GUEST_EFER, 0);
    VmxWrite(VMCS_GUEST_FS_BASE, 0);
    VmxWrite(VMCS_GUEST_GS_BASE, 0);

    vmEntryControls.Flags = VmxRead(VMCS_CTRL_VMENTRY_CONTROLS);
    vmEntryControls.Ia32EModeGuest = FALSE;
    VmxWrite(VMCS_CTRL_VMENTRY_CONTROLS, vmEntryControls.Flags);

    //
    // Then, emulate effects of SIPI by making further changes.
    //
    // "For a start-up IPI (SIPI), the exit qualification contains the SIPI
    //  vector information in bits 7:0. Bits 63:8 of the exit qualification are
    //  cleared to 0."
    // See: 27.2.1 Basic VM-Exit Information
    //
    vector = VmxRead(VMCS_EXIT_QUALIFICATION);

    //
    // "At the end of the boot-strap procedure, the BSP sets ... broadcasts a
    //  SIPI message to all the APs in the system. Here, the SIPI message contains
    //  a vector to the BIOS AP initialization code (at 000VV000H, where VV is the
    //  vector contained in the SIPI message)."
    //
    // See: 8.4.3 MP Initialization Protocol Algorithm for MP Systems
    //
    VmxWrite(VMCS_GUEST_CS_SELECTOR, ((UINT64)vector) << 8);
    VmxWrite(VMCS_GUEST_CS_BASE, ((UINT64)vector) << 12);
    VmxWrite(VMCS_GUEST_RIP, 0);

    //
    // Changing CR0.PG from 1 to 0 *using the MOV instruction* invalidates TLBs.
    // The case with INIT-SIPI does not seem to be documented but we do so just
    // in case. Emulate this invalidating combined caches (GVA to HPA translation
    // caches).
    //
    InvalidateVpidDerivedCache((UINT16)VmxRead(VMCS_CTRL_VIRTUAL_PROCESSOR_IDENTIFIER));

    //
    // Done
    //
    VmxWrite(VMCS_GUEST_ACTIVITY_STATE, VmxActive);

Exit:
    return;
}

/*!
    @brief Handles VM-exit. This is the C-level entry point of the hypervisor.

    @details This function is called the actual entry point of hypervisor, the
        AsmHypervisorEntryPoint function, after it preserved guest registers to
        stack as necessary. Such register values can be referenced and updated
        through the point to the stack location as provided by the Stack
        parameter. Those values are restored in the AsmHypervisorEntryPoint
        function after this function is executed and reflected to the guest.

        Any hypervisor code including this and the AsmHypervisorEntryPoint
        functions are executed while interrupt is disabled via RFLAGS.IF being
        0 (See: 27.5.3 Loading Host RIP, RSP, and RFLAGS). This means IPI, if
        requested, is never delivered and causes deadlock. This condition is
        essentially equal to IRQL being HIGH_LEVEL (i.e., at a higher IRQL than
        IPI_LEVEL), and so, it is unsafe to call any Windows provided API that
        is not stated as callable at HIGH_LEVEL.

    @param[in,out] Stack - A pointer to the hypervisor stack containing the
        guest register values.

    @return TRUE when virtualization should continue and the VMRESUME instruction
        should be executed. FALSE when it should end and the VMXOFF instruction
        should be executed.
 */
_Must_inspect_result_
BOOLEAN
HandleVmExit (
    _Inout_ INITIAL_HYPERVISOR_STACK* Stack
    )
{
    VMX_VMEXIT_REASON vmExitReason;
    GUEST_CONTEXT guestContext;

    //
    // "Determine the exit reason through a VMREAD of the exit-reason field in
    //  the working-VMCS."
    // See: 31.7 HANDLING OF VM EXITS
    //
    vmExitReason.Flags = (UINT32)VmxRead(VMCS_EXIT_REASON);

    //
    // Copy some pointers to a single structure for ease of use.
    //
    guestContext.ContinueVm = TRUE;
    guestContext.Contexts = &Stack->HypervisorContext;
    guestContext.StackBasedRegisters = &Stack->GuestRegisters;

    //
    // Read some of commonly used guest registers that are stored in the VMCS
    // (instead of stack). Reading them are useful for debugging, as we cannot
    // tell which instruction caused the VM-exit if VMCS_GUEST_RIP is not read,
    // for example. Note that those values are not automatically written back to
    // the VMCS. When any of those values should be updated and reflected to the
    // guest, the VMWRITE instruction (the VmxWrite function) should be used.
    //
    guestContext.VmcsBasedRegisters.Rflags.Flags = VmxRead(VMCS_GUEST_RFLAGS);
    guestContext.VmcsBasedRegisters.Rsp = VmxRead(VMCS_GUEST_RSP);
    guestContext.VmcsBasedRegisters.Rip = VmxRead(VMCS_GUEST_RIP);

    //
    // Update the _KTRAP_FRAME structure values in hypervisor stack, so that
    // Windbg can reconstruct call stack of the guest during debug session.
    // This is optional but very useful thing to do for debugging.
    //
    Stack->TrapFrame.Rsp = guestContext.VmcsBasedRegisters.Rsp;
    Stack->TrapFrame.Rip = guestContext.VmcsBasedRegisters.Rip +
        VmxRead(VMCS_VMEXIT_INSTRUCTION_LENGTH);

    //
    // Comment in this for debugging the handlers below.
    //
    //MV_DEBUG_BREAK();

    switch (vmExitReason.BasicExitReason)
    {
        case VMX_EXIT_REASON_EXCEPTION_OR_NMI:
            HandleExceptionOrNmi(&guestContext);
            break;

        case VMX_EXIT_REASON_INIT_SIGNAL:
            HandleInitSignal(&guestContext);
            break;

        case VMX_EXIT_REASON_STARTUP_IPI:
            HandleStartupIpi(&guestContext);
            break;

        case VMX_EXIT_REASON_EXECUTE_CPUID:
            HandleCpuid(&guestContext);
            break;

        case VMX_EXIT_REASON_EXECUTE_VMCALL:
            HandleVmCall(&guestContext);
            break;

        case VMX_EXIT_REASON_MOV_CR:
            HandleCrAccess(&guestContext);
            break;

        case VMX_EXIT_REASON_EXECUTE_RDMSR:
            HandleMsrRead(&guestContext);
            break;

        case VMX_EXIT_REASON_EXECUTE_WRMSR:
            HandleMsrWrite(&guestContext);
            break;

        case VMX_EXIT_REASON_EPT_VIOLATION:
            HandleEptViolation(&guestContext);
            break;

        case VMX_EXIT_REASON_EPT_MISCONFIGURATION:
            HandleEptMisconfig(&guestContext);
            break;

        case VMX_EXIT_REASON_EXECUTE_XSETBV:
            HandleXsetbv(&guestContext);
            break;

        default:
            DumpGuestState();
            DumpHostState();
            DumpControl();
            LOG_DEBUG("VM-exit reason (Full) = %x", vmExitReason.Flags);
            MV_PANIC();
    }

    if (guestContext.ContinueVm  == FALSE)
    {
        //
        // End of virtualization is requested. prevent undesired retention of
        // cache.
        //
        // "Software can use the INVVPID instruction with the "all-context" INVVPID
        //  type (...) immediately prior to execution of the VMXOFF instruction."
        // "Software can use the INVEPT instruction with the "all-context" INVEPT
        //  type (...) immediately prior to execution of the VMXOFF instruction."
        // See: 28.3.3.3 Guidelines for Use of the INVVPID Instruction
        // See: 28.3.3.4 Guidelines for Use of the INVEPT Instruction
        //
        InvalidateEptDerivedCache(0);
        InvalidateVpidDerivedCache(0);
    }

    return guestContext.ContinueVm;
}

typedef struct _EXCEPTION_STACK
{
    UINT64 R15;
    UINT64 R14;
    UINT64 R13;
    UINT64 R12;
    UINT64 R11;
    UINT64 R10;
    UINT64 R9;
    UINT64 R8;
    UINT64 Rdi;
    UINT64 Rsi;
    UINT64 Rbp;
    UINT64 Rbx;
    UINT64 Rdx;
    UINT64 Rcx;
    UINT64 Rax;
    UINT64 InterruptNumber;
    UINT64 ErrorCode;
    UINT64 Rip;
    UINT64 Cs;
    UINT64 Rflags;
} EXCEPTION_STACK;

/*!
    @brief Handles the interrupt and exception occurred during execution of the
        host.

    @details On Windows, this function is unused because the host uses the same
        IDT as that of the guest. All interrupts and exceptions are handled by
        the NT kernel.

    @param[in] Stack - The pointer to the hypervisor stack containing the
        guest register values.
 */
VOID
HandleHostException (
    _In_ CONST EXCEPTION_STACK* Stack
    )
{
    DumpGuestState();
    DumpHostState();
    DumpControl();
    LOG_ERROR("Exception or interrupt 0x%llx(0x%llx)", Stack->InterruptNumber, Stack->ErrorCode);
    LOG_ERROR("RIP  - %016llx, CS  - %016llx, RFLAGS - %016llx", Stack->Rip, Stack->Cs, Stack->Rflags);
    LOG_ERROR("RAX  - %016llx, RCX - %016llx, RDX - %016llx", Stack->Rax, Stack->Rcx, Stack->Rdx);
    LOG_ERROR("RBX  - %016llx, RSP - %016llx, RBP - %016llx", Stack->Rbx, 0ull, Stack->Rbp);
    LOG_ERROR("RSI  - %016llx, RDI - %016llx", Stack->Rsi, Stack->Rdi);
    LOG_ERROR("R8   - %016llx, R9  - %016llx, R10 - %016llx", Stack->R8, Stack->R9, Stack->R10);
    LOG_ERROR("R11  - %016llx, R12 - %016llx, R13 - %016llx", Stack->R11, Stack->R12, Stack->R13);
    LOG_ERROR("R14  - %016llx, R15 - %016llx", Stack->R14, Stack->R15);
    MV_PANIC();
}

/*!
    @brief Handles error occurred on attempt to exit to the guest.

    @param[in] Stack - The pointer to the hypervisor stack containing the
        guest register values.
 */
VOID
HandleVmExitFailure (
    _In_ CONST INITIAL_HYPERVISOR_STACK* Stack
    )
{
    VMX_ERROR_NUMBER vmxErrorNumber;
    VMX_VMEXIT_REASON vmExitReason;

    UNREFERENCED_PARAMETER(Stack);

    vmxErrorNumber = (VMX_ERROR_NUMBER)VmxRead(VMCS_VM_INSTRUCTION_ERROR);
    vmExitReason.Flags = (UINT32)VmxRead(VMCS_EXIT_REASON);

    DumpGuestState();
    DumpHostState();
    DumpControl();
    LOG_ERROR("VM-exit reason (full) = %x, Error = %ul", vmExitReason.Flags, vmxErrorNumber);
    MV_PANIC();
}
