Changeset 74421 in vbox for trunk/src/VBox/VMM

Timestamp:

Sep 22, 2018 2:38:39 PM (6 years ago)

Author:

vboxsync

Message:

VMM/CPUM, IEM: Nested VMX: bugref:9180 VM-exit bits.

Location:

trunk/src/VBox/VMM

Files:

• VMMAll/HMVMXAll.cpp (modified) (1 diff)
• VMMAll/IEMAllCImplVmxInstr.cpp.h (modified) (9 diffs)
• include/CPUMInternal.mac (modified) (2 diffs)
• testcase/tstVMStruct.h (modified) (2 diffs)

trunk/src/VBox/VMM/VMMAll/HMVMXAll.cpp

@@ -337 +337 @@
     VMXV_DIAG_DESC(kVmxVDiag_Vmentry_VmxRoot                  , "VmxRoot"                   ),
     VMXV_DIAG_DESC(kVmxVDiag_Vmentry_Vpid                     , "Vpid"                      ),
+    VMXV_DIAG_DESC(kVmxVDiag_Vmexit_HostPdpteCr3ReadPhys      , "HostPdpteCr3ReadPhys"      ),
+    VMXV_DIAG_DESC(kVmxVDiag_Vmexit_HostPdpte0Rsvd            , "HostPdpte0Rsvd"            ),
+    VMXV_DIAG_DESC(kVmxVDiag_Vmexit_HostPdpte1Rsvd            , "HostPdpte1Rsvd"            ),
+    VMXV_DIAG_DESC(kVmxVDiag_Vmexit_HostPdpte2Rsvd            , "HostPdpte2Rsvd"            ),
+    VMXV_DIAG_DESC(kVmxVDiag_Vmexit_HostPdpte3Rsvd            , "HostPdpte3Rsvd"            ),
     VMXV_DIAG_DESC(kVmxVDiag_Vmexit_MsrStore                  , "MsrStore"                  ),
     VMXV_DIAG_DESC(kVmxVDiag_Vmexit_MsrStoreCount             , "MsrStoreCount"             ),

trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h

@@ -2346 +2346 @@
 
 /**
- * Gets the instruction diagnostic for CR3 referenced PDPTE reserved bits failure
- * during VM-entry of a nested-guest.
+ * Gets the instruction diagnostic for guest CR3 referenced PDPTE reserved bits
+ * failure during VM-entry of a nested-guest.
  *
  * @param   iSegReg     The PDPTE entry index.
@@ -2361 +2361 @@
         case 3: return kVmxVDiag_Vmentry_GuestPdpte3Rsvd;
         IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_11);
+    }
+}
+
+
+/**
+ * Gets the instruction diagnostic for host CR3 referenced PDPTE reserved bits
+ * failure during VM-exit of a nested-guest.
+ *
+ * @param   iSegReg     The PDPTE entry index.
+ */
+IEM_STATIC VMXVDIAG iemVmxGetDiagVmexitPdpteRsvd(unsigned iPdpte)
+{
+    Assert(iPdpte < X86_PG_PAE_PDPE_ENTRIES);
+    switch (iPdpte)
+    {
+        case 0: return kVmxVDiag_Vmexit_HostPdpte0Rsvd;
+        case 1: return kVmxVDiag_Vmexit_HostPdpte1Rsvd;
+        case 2: return kVmxVDiag_Vmexit_HostPdpte2Rsvd;
+        case 3: return kVmxVDiag_Vmexit_HostPdpte3Rsvd;
+        IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_12);
     }
 }
@@ -4244 +4264 @@
      * nested-guest (or the guest).
      *
-     *   - VMCPU_FF_INHIBIT_INTERRUPTS and RIP needs be preserved as there is no
-     *     implicit Global Interrupt Flag (GIF) handling as with AMD-V's VMRUN
-     *     instruction and the interrupt inhibition is in effect until the
-     *     completion of this VMLAUNCH/VMRESUME instruction.
+     *   - VMCPU_FF_INHIBIT_INTERRUPTS need not be preserved as VM-exit explicitly
+     *     clears interrupt-inhibition and on VM-entry the guest-interruptibility
+     *     state provides the inhibition if any.
      *
-     *   - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
-     *     execution of a subsequent IRET instruction in the guest.
+     *   - VMCPU_FF_BLOCK_NMIS needs not be preserved as VM-entry does not discard
+     *     any NMI blocking. VM-exits caused directly by NMIs (intercepted by the
+     *     exception bitmap) do block subsequent NMIs.
      *
-     *   - MTF needs to be preserved as it's for a single instruction boundary
-     *     which follows the return from VMLAUNCH/VMRESUME instruction.
+     *   - MTF needs to be preserved as it's for a single instruction boundary which
+     *     follows the return from VMLAUNCH/VMRESUME instruction.
      *
      * The remaining FFs (e.g. timers) can stay in place so that we will be able to
      * generate interrupts that should cause #VMEXITs for the nested-guest.
      */
-    if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-        pVCpu->cpum.GstCtx.hwvirt.uInhibitRip = EMGetInhibitInterruptsPC(pVCpu);
-
-    uint32_t const fGuestFFMask = VMCPU_FF_INHIBIT_INTERRUPTS | VMCPU_FF_BLOCK_NMIS | VMCPU_FF_MTF;
-    pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & fGuestFFMask;
-    VMCPU_FF_CLEAR(pVCpu, fGuestFFMask);
-}
-
-
-#if 0
+    uint32_t const fNstGstDiscardMask = VMCPU_FF_MTF;
+    pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & fNstGstDiscardMask;
+    VMCPU_FF_CLEAR(pVCpu, fNstGstDiscardMask);
+}
+
+
 /**
  * Restores the guest force-flags in prepartion of exiting the nested-guest.
@@ -4281 +4297 @@
     }
 }
-#endif
 
 
@@ -4963 +4978 @@
         uint64_t const uHostCr0    = pVmcs->u64HostCr0.u;
         uint64_t const uGuestCr0   = pVCpu->cpum.GstCtx.cr0;
-        pVCpu->cpum.GstCtx.cr0     = (uHostCr0 & ~fCr0IgnMask) | (uGuestCr0 & fCr0IgnMask);
+        uint64_t const uValidCr0   = (uHostCr0 & ~fCr0IgnMask) | (uGuestCr0 & fCr0IgnMask);
+        CPUMSetGuestCR0(pVCpu, uValidCr0);
     }
 
@@ -4972 +4988 @@
         uint64_t const uHostCr4    = pVmcs->u64HostCr4.u;
         uint64_t const uGuestCr4   = pVCpu->cpum.GstCtx.cr4;
-        pVCpu->cpum.GstCtx.cr4     = (uHostCr4 & ~fCr4IgnMask) | (uGuestCr4 & fCr4IgnMask);
-
+        uint64_t       uValidCr4   = (uHostCr4 & ~fCr4IgnMask) | (uGuestCr4 & fCr4IgnMask);
         if (fHostInLongMode)
-            pVCpu->cpum.GstCtx.cr4 |= X86_CR4_PAE;
+            uValidCr4 |= X86_CR4_PAE;
         else
-            pVCpu->cpum.GstCtx.cr4 &= ~X86_CR4_PCIDE;
+            uValidCr4 &= ~X86_CR4_PCIDE;
+        CPUMSetGuestCR4(pVCpu, uValidCr4);
     }
 
@@ -5146 +5162 @@
 
 /**
+ * Checks host PDPTes as part of VM-exit.
+ *
+ * @param   pVCpu           The cross context virtual CPU structure.
+ * @param   uExitReason     The VM-exit reason (for logging purposes).
+ */
+IEM_STATIC int iemVmxVmexitCheckHostPdptes(PVMCPU pVCpu, uint32_t uExitReason)
+{
+    /*
+     * Check host PDPTEs.
+     * See Intel spec. 27.5.4 "Checking and Loading Host Page-Directory-Pointer-Table Entries".
+     */
+    PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
+    const char *const pszFailure = "VMX-abort";
+    bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
+
+    if (   (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
+        && !fHostInLongMode)
+    {
+        uint64_t const uHostCr3 = pVCpu->cpum.GstCtx.cr3 & X86_CR3_PAE_PAGE_MASK;
+        X86PDPE aPdptes[X86_PG_PAE_PDPE_ENTRIES];
+        int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)&aPdptes[0], uHostCr3, sizeof(aPdptes));
+        if (RT_SUCCESS(rc))
+        {
+            for (unsigned iPdpte = 0; iPdpte < RT_ELEMENTS(aPdptes); iPdpte++)
+            {
+                if (   !(aPdptes[iPdpte].u & X86_PDPE_P)
+                    || !(aPdptes[iPdpte].u & X86_PDPE_PAE_MBZ_MASK))
+                { /* likely */ }
+                else
+                {
+                    VMXVDIAG const enmDiag = iemVmxGetDiagVmexitPdpteRsvd(iPdpte);
+                    IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
+                }
+            }
+        }
+        else
+            IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_HostPdpteCr3ReadPhys);
+    }
+
+    NOREF(pszFailure);
+    NOREF(uExitReason);
+    return VINF_SUCCESS;
+}
+
+
+/**
  * Loads the host state as part of VM-exit.
  *
- * @param   pVCpu   The cross context virtual CPU structure.
- */
-IEM_STATIC int iemVmxVmexitLoadHostState(PVMCPU pVCpu)
+ * @param   pVCpu           The cross context virtual CPU structure.
+ * @param   uExitReason     The VM-exit reason (for logging purposes).
+ */
+IEM_STATIC int iemVmxVmexitLoadHostState(PVMCPU pVCpu, uint32_t uExitReason)
 {
     /*
@@ -5181 +5244 @@
     pVCpu->cpum.GstCtx.rflags.u = X86_EFL_1;
 
-    /** @todo NSTVMX: rest of host state loading.  */
+    /* Update non-register state. */
+    iemVmxVmexitRestoreForceFlags(pVCpu);
+
+    /* Clear address range monitoring. */
+    EMMonitorWaitClear(pVCpu);
+
+    /* Perform the VMX transition (PGM updates). */
+    VBOXSTRICTRC rcStrict = iemVmxWorldSwitch(pVCpu);
+    if (rcStrict == VINF_SUCCESS)
+    {
+        /* Check host PDPTEs. */
+        /** @todo r=ramshankar: I don't know if PGM does this for us already or not... */
+        int rc = iemVmxVmexitCheckHostPdptes(pVCpu, uExitReason);
+        if (RT_FAILURE(rc))
+        {
+            Log(("VM-exit failed while restoring host PDPTEs -> VMX-Abort\n"));
+            return iemVmxAbort(pVCpu, VMXBOART_HOST_PDPTE);
+        }
+    }
+    else if (RT_SUCCESS(rcStrict))
+    {
+        Log3(("VM-exit: iemVmxWorldSwitch returns %Rrc (uExitReason=%u) -> Setting passup status\n", VBOXSTRICTRC_VAL(rcStrict),
+              uExitReason));
+        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
+    }
+    else
+    {
+        Log3(("VM-exit: iemVmxWorldSwitch failed! rc=%Rrc (uExitReason=%u)\n", VBOXSTRICTRC_VAL(rcStrict), uExitReason));
+        return rcStrict;
+    }
+
+    /** @todo NSTVMX: rest of host state loading (loading MSRs). */
 
     return VINF_SUCCESS;
@@ -5222 +5316 @@
     }
 
-    int rc = iemVmxVmexitLoadHostState(pVCpu);
+    int rc = iemVmxVmexitLoadHostState(pVCpu, uExitReason);
     if (RT_FAILURE(rc))
         return rc;

trunk/src/VBox/VMM/include/CPUMInternal.mac

@@ -253 +253 @@
     alignb 8
     .Guest.hwvirt.svm.HCPhysVmcb             RTHCPHYS_RES 1
-    .Guest.hwvirt.uInhibitRip                resq         1
     .Guest.hwvirt.fLocalForcedActions        resd         1
     .Guest.hwvirt.fGif                       resb         1
@@ -541 +540 @@
     alignb 8
     .Hyper.hwvirt.svm.HCPhysVmcb             RTHCPHYS_RES 1
-    .Hyper.hwvirt.uInhibitRip                resq         1
     .Hyper.hwvirt.fLocalForcedActions        resd         1
     .Hyper.hwvirt.fGif                       resb         1

trunk/src/VBox/VMM/testcase/tstVMStruct.h

@@ -149 +149 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.GCPhysVmcs);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.enmDiag);
+    GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.enmAbort);
+    GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.uAbortAux);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.fInVmxRootMode);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.fInVmxNonRootMode);
@@ -164 +166 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pAutoMsrAreaR0);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pAutoMsrAreaR3);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.uInhibitRip);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.fLocalForcedActions);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.fGif);