Changeset 77295 in vbox for trunk/src/VBox/VMM/VMMAll

Timestamp:

Feb 13, 2019 10:55:28 AM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

128813

Message:

VMM/IEM: Nested VMX: bugref:9180 Fix CR3 VM-exits to work when CR3-target count is 0. Fix assertion during VM-entry with interrupt inhibition flag being already set.

File:

• trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h (modified) (18 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h

@@ -915 +915 @@
  * @param   puValue         Where to store the CR3-target value.
  */
-DECLINLINE(uint64_t) iemVmxVmcsGetCr3TargetValue(PCVMXVVMCS pVmcs, uint8_t idxCr3Target)
+IEM_STATIC uint64_t iemVmxVmcsGetCr3TargetValue(PCVMXVVMCS pVmcs, uint8_t idxCr3Target)
 {
     Assert(idxCr3Target < VMX_V_CR3_TARGET_COUNT);
@@ -927 +927 @@
     uint8_t  const *pbField        = pbVmcs + offField;
     uint64_t const uCr3TargetValue = *(uint64_t *)pbField;
-
     return uCr3TargetValue;
 }
@@ -2817 +2816 @@
     /* Update the VM-exit reason, the other relevant data fields are expected to be updated by the caller already. */
     pVmcs->u32RoExitReason = uExitReason;
-    Log3(("vmexit: uExitReason=%#RX32 uExitQual=%#RX64\n", uExitReason, pVmcs->u64RoExitQual));
+    Log3(("vmexit: uExitReason=%#RX32 uExitQual=%#RX64 cs:rip=%04x:%#RX64\n", uExitReason, pVmcs->u64RoExitQual,
+          IEM_GET_CTX(pVCpu)->cs.Sel,  IEM_GET_CTX(pVCpu)->rip));
 
     /*
@@ -3250 +3250 @@
             ExitInfo.uReason = VMX_EXIT_MOV_CRX;
             ExitInfo.cbInstr = cbInstr;
-
             ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
                              | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_CLTS);
@@ -3286 +3285 @@
     Assert(puNewCrX);
     Assert(iCrReg == 0 || iCrReg == 4);
+    Assert(iGReg < X86_GREG_COUNT);
 
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
@@ -3324 +3324 @@
         ExitInfo.uReason = VMX_EXIT_MOV_CRX;
         ExitInfo.cbInstr = cbInstr;
-
         ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, iCrReg)
                          | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
@@ -3355 +3354 @@
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
     Assert(pVmcs);
+    Assert(iGReg < X86_GREG_COUNT);
     IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
 
@@ -3369 +3369 @@
         ExitInfo.uReason = VMX_EXIT_MOV_CRX;
         ExitInfo.cbInstr = cbInstr;
-
         ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
                          | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_READ)
@@ -3394 +3393 @@
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
     Assert(pVmcs);
+    Assert(iGReg < X86_GREG_COUNT);
 
     /*
@@ -3403 +3403 @@
     if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_CR3_LOAD_EXIT)
     {
-        uint32_t uCr3TargetCount = pVmcs->u32Cr3TargetCount;
+        uint32_t const uCr3TargetCount = pVmcs->u32Cr3TargetCount;
         Assert(uCr3TargetCount <= VMX_V_CR3_TARGET_COUNT);
 
-        for (uint32_t idxCr3Target = 0; idxCr3Target < uCr3TargetCount; idxCr3Target++)
-        {
-            uint64_t const uCr3TargetValue = iemVmxVmcsGetCr3TargetValue(pVmcs, idxCr3Target);
-            if (uNewCr3 != uCr3TargetValue)
+        /* If the CR3-target count is 0, we must always cause a VM-exit. */
+        bool fIntercept = RT_BOOL(uCr3TargetCount == 0);
+        if (!fIntercept)
+        {
+            for (uint32_t idxCr3Target = 0; idxCr3Target < uCr3TargetCount; idxCr3Target++)
             {
-                Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
-
-                VMXVEXITINFO ExitInfo;
-                RT_ZERO(ExitInfo);
-                ExitInfo.uReason = VMX_EXIT_MOV_CRX;
-                ExitInfo.cbInstr = cbInstr;
-
-                ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
-                                 | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
-                                 | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG,   iGReg);
-                return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
+                uint64_t const uCr3TargetValue = iemVmxVmcsGetCr3TargetValue(pVmcs, idxCr3Target);
+                if (uNewCr3 != uCr3TargetValue)
+                {
+                    fIntercept = true;
+                    break;
+                }
             }
+        }
+
+        if (fIntercept)
+        {
+            Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
+
+            VMXVEXITINFO ExitInfo;
+            RT_ZERO(ExitInfo);
+            ExitInfo.uReason = VMX_EXIT_MOV_CRX;
+            ExitInfo.cbInstr = cbInstr;
+            ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
+                             | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
+                             | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG,   iGReg);
+            return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
         }
     }
@@ -3442 +3452 @@
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
     Assert(pVmcs);
+    Assert(iGReg < X86_GREG_COUNT);
 
     /*
@@ -3455 +3466 @@
         ExitInfo.uReason = VMX_EXIT_MOV_CRX;
         ExitInfo.cbInstr = cbInstr;
-
         ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
                          | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_READ)
@@ -3479 +3489 @@
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
     Assert(pVmcs);
+    Assert(iGReg < X86_GREG_COUNT);
 
     /*
@@ -3492 +3503 @@
         ExitInfo.uReason = VMX_EXIT_MOV_CRX;
         ExitInfo.cbInstr = cbInstr;
-
         ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
                          | RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,   VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
@@ -3521 +3531 @@
     Assert(iDrReg <= 7);
     Assert(uInstrId == VMXINSTRID_MOV_TO_DRX || uInstrId == VMXINSTRID_MOV_FROM_DRX);
+    Assert(iGReg < X86_GREG_COUNT);
 
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
@@ -6935 +6946 @@
      */
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
+
+    /*
+     * If VM-entry is not vectoring, block-by-STI and block-by-MovSS state must be loaded.
+     * If VM-entry is vectoring, there is no block-by-STI or block-by-MovSS.
+     *
+     * See Intel spec. 26.6.1 "Interruptibility State".
+     */
     bool const fEntryVectoring = HMVmxIsVmentryVectoring(pVmcs->u32EntryIntInfo, NULL /* puEntryIntInfoType */);
-    if (!fEntryVectoring)
-    {
-        if (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI | VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
-            EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
-        else
-            Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
-
-        /* SMI blocking is irrelevant. We don't support SMIs yet. */
-    }
-    else
-    {
-        /* When the VM-entry is not vectoring, there is no blocking by STI or Mov-SS. */
-        if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-            VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
-    }
+    if (   !fEntryVectoring
+        && (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI | VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)))
+        EMSetInhibitInterruptsPC(pVCpu, pVmcs->u64GuestRip.u);
+    else if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
+        VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
 
     /* NMI blocking. */
@@ -6956 +6964 @@
         && !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS))
         VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
+
+    /* SMI blocking is irrelevant. We don't support SMIs yet. */
 
     /* Loading PDPTEs will be taken care when we switch modes. We don't support EPT yet. */
@@ -7341 +7351 @@
     }
 
-    /** @todo Distinguish block-by-MOV-SS from block-by-STI. Currently we
+    /** @todo Distinguish block-by-MovSS from block-by-STI. Currently we
      *        use block-by-STI here which is not quite correct. */
     if (   VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)