[Bug]: VMM IEM: Nested SVM is missing a variety of consistency checks on the VMCB12. #964

Version

trunk/main

Host OS Type

all

Host OS name + version

Debian Trixie

Host Architecture

x86

Guest OS Type

all

Guest Architecture

x86

Guest OS name + version

No response

Component

VMM

What happened?

The nested SVM component of VMM IEM intends to perform all consistency checks specified in the AMD manual (See AMD spec. 15.5.1 "Basic Operation") on a nested VMRUN.
While the majority are implemented, some are entirely missing or implemented incorrectly.

For example, the function iemSvmVmrun is responsible for validating the architectural correctness of the VMCB12 provided by a nested L1 hypervisor for an invocation of VMRUN. However, it lacks any consistency checks for the GUEST CR3/GUEST CR4 fields.
As a result, the nested L1 hypervisor can provide an architecturally invalid VMCB12 and force VirtualBox to perform its own hardware VM entry on a now similarly architecturally invalid VMCB02. Then the hardware will reject a VM entry for such an invalid VMCB.

In release builds, this may cause unexpected behavior in the nested L1 hypervisor.
In debug/strict builds, this will trigger a debug assert and shut down the L1 guest. In particular:

static VBOXSTRICTRC hmR0SvmRunGuestCodeNested(PVMCPUCC pVCpu, uint32_t *pcLoops)
{
    /* ... */
    for (;;)
    {
        /* ... */
        rc = hmR0SvmRunGuest(pVCpu, HCPhysVmcb);
        /* ... */
        /* Invalid nested-guest state. Cause a #VMEXIT but assert on strict builds. */
        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
        AssertMsgFailed(("Invalid nested-guest state..."));
        rc = IEMExecSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0, 0);  // (B)
        break;
    /* ... */

How can we reproduce this?

To reproduce this, simply let an L1 hypervisor set up an architecturally invalid VMCB12 (e.g., with one of the upper 32 bits in GUEST_CR4 set to 1) and perform a VMRUN. Ideally, use a debug build such that the GURU meditation pops up.

Did you upload all of your necessary log files, screenshots, etc.?

• Yes, I've uploaded all pertinent files to this issue.