Changeset 99164 in vbox for trunk/src/VBox/VMM/VMMAll

Timestamp:

Mar 24, 2023 6:20:40 AM (21 months ago)

Author:

vboxsync

Message:

VMM/IEM: Nested VMX: bugref:10318 Fixed vmlaunch/vmresume emulation to save/restore non-zero secondary processor-based execution VM-controls when the 'activate secondary controls' bit is not set.

File:

• trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp (modified) (4 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp

@@ -2637 +2637 @@
         Log(("vmexit: Loading host-state failed. uExitReason=%u rc=%Rrc\n", uExitReason, VBOXSTRICTRC_VAL(rcStrict)));
 
+    /*
+     * Restore non-zero Secondary-processor based VM-execution controls
+     * when the "activate secondary controls" bit was not set.
+     */
+    if (pVmcs->u32RestoreProcCtls2)
+    {
+        Assert(!(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS));
+        pVmcs->u32ProcCtls2        = pVmcs->u32RestoreProcCtls2;
+        pVmcs->u32RestoreProcCtls2 = 0;
+    }
+
     if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
     {
@@ -6394 +6405 @@
                 IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Allowed1);
         }
-        else
+        else if (pVmcs->u32ProcCtls2)
         {
             /*
              * If the "activate secondary controls" is clear, then the secondary processor-based VM-execution controls
-             * is treated as 0. We must not fail/assert here. Microsoft Hyper-V relies on this behavior.
+             * is treated as 0.
              *
              * See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
+             *
+             * Since this is a rather rare occurrence (only observed for a few VM-entries with Microsoft Hyper-V
+             * enabled Windows Server 2008 R2 guest), it's not worth changing every place that reads this control to
+             * also check the "activate secondary controls" bit. Instead, we temporarily save the guest programmed
+             * control here, zero out the value the rest of our code uses and restore the guest programmed value
+             * on VM-exit.
              */
-            pVmcs->u32ProcCtls2 = 0;
+            pVmcs->u32RestoreProcCtls2 = pVmcs->u32ProcCtls2;
+            pVmcs->u32ProcCtls2        = 0;
         }
 
@@ -7812 +7830 @@
      * See Intel spec. 24.11.4 "Software Access to Related Structures".
      */
-    PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
-    Assert(pVmcs);
     Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
 
@@ -7836 +7852 @@
              */
             iemVmxVmentrySaveNmiBlockingFF(pVCpu);
+
+            PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
+            Assert(pVmcs);
 
             rc = iemVmxVmentryCheckGuestState(pVCpu, pszInstr);