Changeset 91580 in vbox for trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h

Timestamp:

Oct 6, 2021 7:22:04 AM (4 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

147289

Message:

VMM: Nested VMX: bugref:10092 Made changes to PGM++ to handle invalid PAE PDPEs being loaded.

File:

• trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h (modified) (5 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h

@@ -82 +82 @@
  *
  * @returns Strict VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- */
-DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu)
+ * @param   pVCpu           The cross context virtual CPU structure.
+ * @param   fPdpesMapped    Whether the PAE PDPEs (and PDPT) have been mapped.
+ */
+DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, bool fPdpesMapped)
 {
     /*
@@ -106 +107 @@
     if (rc == VINF_SUCCESS)
     {
-        rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
+        rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* fGlobal */, fPdpesMapped);
         AssertRCReturn(rc, rc);
     }
@@ -307 +308 @@
 
             /*
-             * Reload the guest's "host state".
+             * If we are switching to PAE mode host, validate the PDPEs first.
+             * Any invalid PDPEs here causes a VCPU shutdown.
              */
-            CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
-
-            /*
-             * Update PGM, IEM and others of a world-switch.
-             */
-            rcStrict = iemSvmWorldSwitch(pVCpu);
-            if (rcStrict == VINF_SUCCESS)
-                rcStrict = VINF_SVM_VMEXIT;
-            else if (RT_SUCCESS(rcStrict))
+            PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
+            bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
+            if (fHostInPaeMode)
+                rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
+            if (RT_LIKELY(rcStrict == VINF_SUCCESS))
             {
-                LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
-                iemSetPassUpStatus(pVCpu, rcStrict);
-                rcStrict = VINF_SVM_VMEXIT;
+                /*
+                 * Reload the host state.
+                 */
+                CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
+
+                /*
+                 * Update PGM, IEM and others of a world-switch.
+                 */
+                rcStrict = iemSvmWorldSwitch(pVCpu, fHostInPaeMode);
+                if (rcStrict == VINF_SUCCESS)
+                    rcStrict = VINF_SVM_VMEXIT;
+                else if (RT_SUCCESS(rcStrict))
+                {
+                    LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+                    iemSetPassUpStatus(pVCpu, rcStrict);
+                    rcStrict = VINF_SVM_VMEXIT;
+                }
+                else
+                    LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
             }
             else
-                LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+            {
+                Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+                rcStrict = VINF_EM_TRIPLE_FAULT;
+            }
         }
         else
         {
             AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
-            rcStrict = VERR_SVM_VMEXIT_FAILED;
+            rcStrict = VINF_EM_TRIPLE_FAULT;
         }
     }
@@ -705 +722 @@
 
         /*
+         * Validate and map PAE PDPEs if the guest will be using PAE paging.
+         * Invalid PAE PDPEs here causes a #VMEXIT.
+         */
+        bool fPdpesMapped;
+        if (   !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
+            && CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
+        {
+            rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
+            if (RT_SUCCESS(rc))
+                fPdpesMapped = true;
+            else
+            {
+                Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
+                return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
+            }
+        }
+        else
+            fPdpesMapped = false;
+
+        /*
          * Copy the remaining guest state from the VMCB to the guest-CPU context.
          */
@@ -742 +779 @@
          * Update PGM, IEM and others of a world-switch.
          */
-        VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
+        VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, fPdpesMapped);
         if (rcStrict == VINF_SUCCESS)
         { /* likely */ }