Changeset 107026 in vbox for trunk/src/VBox/VMM/VMMR3

Timestamp:

Nov 18, 2024 2:21:58 PM (2 months ago)

Author:

vboxsync

Message:

VMM/NEM/ARM: Loading a 32-bit value into a register clears the upper half on real hardware, workaround for ldp instruction accessing the TPM MMIO area caused by tpm.sys in a Windows 11/ARM guest, bugref:10777

Location:

trunk/src/VBox/VMM/VMMR3

Files:

• NEMR3Native-darwin-armv8.cpp (modified) (2 diffs)
• NEMR3Native-linux-armv8.cpp (modified) (1 diff)
• NEMR3Native-win-armv8.cpp (modified) (2 diffs)

trunk/src/VBox/VMM/VMMR3/NEMR3Native-darwin-armv8.cpp

@@ -1566 +1566 @@
         pVCpu->cpum.GstCtx.aGRegs[uReg].x = fSignExtend ? (int64_t)u64Val : u64Val;
     else
-        pVCpu->cpum.GstCtx.aGRegs[uReg].w = fSignExtend ? (int32_t)u64Val : u64Val; /** @todo Does this clear the upper half on real hardware? */
+        pVCpu->cpum.GstCtx.aGRegs[uReg].x = (uint64_t)(fSignExtend ? (int32_t)u64Val : (uint32_t)u64Val);
 
     /* Mark the register as not extern anymore. */
@@ -1746 +1746 @@
                         /* Update the indexed register. */
                         pVCpu->cpum.GstCtx.aGRegs[Dis.aParams[1].armv8.Op.Reg.idReg].x += Dis.aParams[1].armv8.u.offBase;
+                    }
+                }
+                /*
+                 * Seeing the following with the Windows 11/ARM TPM driver:
+                 *     %fffff800e5342888 48 25 45 29             ldp w8, w9, [x10, #+0x0028]
+                 */
+                else if (   Dis.pCurInstr->uOpcode == OP_ARMV8_A64_LDP
+                         && Dis.aParams[0].armv8.enmType == kDisArmv8OpParmReg
+                         && Dis.aParams[0].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_32Bit
+                         && Dis.aParams[1].armv8.enmType == kDisArmv8OpParmReg
+                         && Dis.aParams[1].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_32Bit
+                         && Dis.aParams[2].armv8.enmType == kDisArmv8OpParmAddrInGpr
+                         && Dis.aParams[2].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_64Bit)
+                {
+                    /** @todo This is tricky to handle if the first register read returns something else than VINF_SUCCESS... */
+                    /* The fault address is already the final address. */
+                    uint32_t u32Val1 = 0;
+                    uint32_t u32Val2 = 0;
+                    rcStrict = PGMPhysRead(pVM, GCPhysDataAbrt, &u32Val1, sizeof(u32Val1), PGMACCESSORIGIN_HM);
+                    if (rcStrict == VINF_SUCCESS)
+                        rcStrict = PGMPhysRead(pVM, GCPhysDataAbrt + sizeof(uint32_t), &u32Val2, sizeof(u32Val2), PGMACCESSORIGIN_HM);
+                    Log4(("MmioExit/%u: %08RX64: READ %#RGp LB %u -> %.*Rhxs %.*Rhxs rcStrict=%Rrc\n",
+                          pVCpu->idCpu, pVCpu->cpum.GstCtx.Pc.u64, GCPhysDataAbrt, 2 * sizeof(uint32_t), sizeof(u32Val1),
+                          &u32Val1, sizeof(u32Val2), &u32Val2, VBOXSTRICTRC_VAL(rcStrict) ));
+                    if (rcStrict == VINF_SUCCESS)
+                    {
+                        nemR3DarwinSetGReg(pVCpu, Dis.aParams[0].armv8.Op.Reg.idReg, false /*f64BitReg*/, false /*fSignExtend*/, u32Val1);
+                        nemR3DarwinSetGReg(pVCpu, Dis.aParams[1].armv8.Op.Reg.idReg, false /*f64BitReg*/, false /*fSignExtend*/, u32Val2);
                     }
                 }

trunk/src/VBox/VMM/VMMR3/NEMR3Native-linux-armv8.cpp

@@ -555 +555 @@
         pVCpu->cpum.GstCtx.aGRegs[uReg].x = fSignExtend ? (int64_t)u64Val : u64Val;
     else
-        pVCpu->cpum.GstCtx.aGRegs[uReg].w = fSignExtend ? (int32_t)u64Val : u64Val; /** @todo Does this clear the upper half on real hardware? */
+        pVCpu->cpum.GstCtx.aGRegs[uReg].x = (uint64_t)(fSignExtend ? (int32_t)u64Val : (uint32_t)u64Val);
 
     /* Mark the register as not extern anymore. */

trunk/src/VBox/VMM/VMMR3/NEMR3Native-win-armv8.cpp

@@ -2051 +2051 @@
         pVCpu->cpum.GstCtx.aGRegs[uReg].x = fSignExtend ? (int64_t)u64Val : u64Val;
     else
-        pVCpu->cpum.GstCtx.aGRegs[uReg].w = fSignExtend ? (int32_t)u64Val : u64Val; /** @todo Does this clear the upper half on real hardware? */
+        pVCpu->cpum.GstCtx.aGRegs[uReg].x = (uint64_t)(fSignExtend ? (int32_t)u64Val : (uint32_t)u64Val);
 
     /* Mark the register as not extern anymore. */
@@ -2257 +2257 @@
                         /* Update the indexed register. */
                         pVCpu->cpum.GstCtx.aGRegs[Dis.aParams[1].armv8.Op.Reg.idReg].x += Dis.aParams[1].armv8.u.offBase;
+                    }
+                }
+                /*
+                 * Seeing the following with the Windows 11/ARM TPM driver:
+                 *     %fffff800e5342888 48 25 45 29             ldp w8, w9, [x10, #+0x0028]
+                 */
+                else if (   Dis.pCurInstr->uOpcode == OP_ARMV8_A64_LDP
+                         && Dis.aParams[0].armv8.enmType == kDisArmv8OpParmReg
+                         && Dis.aParams[0].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_32Bit
+                         && Dis.aParams[1].armv8.enmType == kDisArmv8OpParmReg
+                         && Dis.aParams[1].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_32Bit
+                         && Dis.aParams[2].armv8.enmType == kDisArmv8OpParmAddrInGpr
+                         && Dis.aParams[2].armv8.Op.Reg.enmRegType == kDisOpParamArmV8RegType_Gpr_64Bit)
+                {
+                    /** @todo This is tricky to handle if the first register read returns something else than VINF_SUCCESS... */
+                    /* The fault address is already the final address. */
+                    uint32_t u32Val1 = 0;
+                    uint32_t u32Val2 = 0;
+                    rcStrict = PGMPhysRead(pVM, GCPhysDataAbrt, &u32Val1, sizeof(u32Val1), PGMACCESSORIGIN_HM);
+                    if (rcStrict == VINF_SUCCESS)
+                        rcStrict = PGMPhysRead(pVM, GCPhysDataAbrt + sizeof(uint32_t), &u32Val2, sizeof(u32Val2), PGMACCESSORIGIN_HM);
+                    Log4(("MmioExit/%u: %08RX64: READ %#RGp LB %u -> %.*Rhxs %.*Rhxs rcStrict=%Rrc\n",
+                          pVCpu->idCpu, pVCpu->cpum.GstCtx.Pc.u64, GCPhysDataAbrt, 2 * sizeof(uint32_t), sizeof(u32Val1),
+                          &u32Val1, sizeof(u32Val2), &u32Val2, VBOXSTRICTRC_VAL(rcStrict) ));
+                    if (rcStrict == VINF_SUCCESS)
+                    {
+                        nemR3WinSetGReg(pVCpu, Dis.aParams[0].armv8.Op.Reg.idReg, false /*f64BitReg*/, false /*fSignExtend*/, u32Val1);
+                        nemR3WinSetGReg(pVCpu, Dis.aParams[1].armv8.Op.Reg.idReg, false /*f64BitReg*/, false /*fSignExtend*/, u32Val2);
                     }
                 }