From nobody Thu Oct 22 17:31:53 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9j4p7Mz6xP8Z for ; Thu, 22 Oct 2026 17:31:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9Y9j2CXxz3GhB for ; Thu, 22 Oct 2026 17:31:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=78WV96ob6SV90mCupzDifiaoS7kAqrr7J/DVNHfwUMs=; b=YzoWE+9lxV1CTx3QzrHEPRlFsMRMlDHfyQb8JGweBuPPMBg+sapC7gEbwBPKWJRANZVm5e 2leHMqM2Gndt86dxkQT/Fqcvl0Wfe86EqojbnDxjErM3hgoM5s+j54J9O2NgkwoKvroS6W mwVimUu1V/WC8CQefCYZIW4UAFbc4pJ0KDW8SCyPtaDWWWC4iDteG4f8VvQPCWGH1Zoyua EkJMhwyewFEzrhzMzZqaIZ25/kBr2AuxX0e+7nsSC4LE9fcyZpjXETCsOm+0r0k4+ui7A6 PhbIFFyXaQZobj1FXCtZRyuGmBbLgJSVxXZo02IqL0YjUL4hUMPqtqGMv/SadA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690313; b=uyk6mpBVM9lZdtBWuhP6mUe3yUKORBjrUe5FxE5NsBkKkx4jIvzrWoNR9+VnEecKUzVeGa 1H63klh6EbhkENNBpZYj2sLQfCftfC9s06moMf6gNSTyR4ieLecLkzx1CFJCohRjT2Xz++ x0gZ7tQBSF+wfme5LvgOQthWTJ77NQ5Cxn4aphoayjEcJligZxkozd2F+PNFy11YBqLlmA lUBzA860x2BKBkICGSfFqqw5ZzwVvKr7fj07yyCfuBmFm3IYlaQ+9HmHqwjZFCJ+qBiZeo vNSTWx5xdfn92BvybXbS9TDTtxJoyY5mc+oznV/+jAgT7W4Oq43zFgbikXGNRA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690313; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=78WV96ob6SV90mCupzDifiaoS7kAqrr7J/DVNHfwUMs=; b=R5db/uaVGLmjRt/UvHGWJ+fc9JM/u4h3sRfJBJ4Am+qnMr9AJX3uLuVLRTa/8CtOCUVXmS kK1ER4a/aIAIqb2t2Rd5Al5whSvTZhfb5/Mx6aYcyI38LDV7efnd1NSV9nAruv29AqxvQZ gwi+tp7nHV18zEbMGQZy2uCS4kN7AN4yW5715wgR41BomO3LBAm/SO31xkrUhc8jdLe5FB HOfL8Sdi/1E1qe+ucqz6SGEiJLRg7bYq4chCudmasn2Dyk6LLTmTMRA3RqPa3DBrpRoXkD UTWmTM1ArdevX35A8iKG/SPm4k+IdHBh6KSP9KxYfuer7BvXNS3Fhz45D0JW9w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9j1v7tzsSG for ; Thu, 22 Oct 2026 17:31:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ef00 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:31:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Hayzam Sherif From: Mark Johnston Subject: git: 20d3d425900d - stable/15 - vmm: Synchronize long-mode state when emulating CR0 writes List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 20d3d425900d6fe6de92158158346dfc3bd0e581 Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:31:53 +0000 Message-Id: <6ada4889.3ef00.7dc5ba97@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=20d3d425900d6fe6de92158158346dfc3bd0e581 commit 20d3d425900d6fe6de92158158346dfc3bd0e581 Author: Hayzam Sherif AuthorDate: 2026-09-21 16:33:55 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:40 +0000 vmm: Synchronize long-mode state when emulating CR0 writes vmx_emulate_cr0_access() sets EFER.LMA and the IA-32e guest VM-entry control when enabling paging with EFER.LME set, but does not clear them when disabling paging. This can leave an inconsistent guest state that fails VM entry. Update both fields in either direction based on EFER.LME and the CR0 value written to the VMCS. Use the mask-adjusted CR0 value so the resulting state remains consistent with the VMX fixed-bit requirements. Reviewed by: markj MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59756 (cherry picked from commit d400b1ca31fd9b12655c83f9a7b3e8cdb68646dd) --- sys/amd64/vmm/intel/vmx.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/sys/amd64/vmm/intel/vmx.c b/sys/amd64/vmm/intel/vmx.c index 65a6d9603caf..29aadb5881f3 100644 --- a/sys/amd64/vmm/intel/vmx.c +++ b/sys/amd64/vmm/intel/vmx.c @@ -1879,7 +1879,7 @@ vmx_set_guest_reg(struct vmx_vcpu *vcpu, int ident, uint64_t regval) static int vmx_emulate_cr0_access(struct vmx_vcpu *vcpu, uint64_t exitqual) { - uint64_t crval, regval; + uint64_t crval, efer, entry_ctls, regval; /* We only handle mov to %cr0 at this time */ if ((exitqual & 0xf0) != 0x00) @@ -1893,23 +1893,21 @@ vmx_emulate_cr0_access(struct vmx_vcpu *vcpu, uint64_t exitqual) crval &= ~cr0_zeros_mask; vmcs_write(VMCS_GUEST_CR0, crval); - if (regval & CR0_PG) { - uint64_t efer, entry_ctls; - - /* - * If CR0.PG is 1 and EFER.LME is 1 then EFER.LMA and - * the "IA-32e mode guest" bit in VM-entry control must be - * equal. - */ - efer = vmcs_read(VMCS_GUEST_IA32_EFER); - if (efer & EFER_LME) { - efer |= EFER_LMA; - vmcs_write(VMCS_GUEST_IA32_EFER, efer); - entry_ctls = vmcs_read(VMCS_ENTRY_CTLS); - entry_ctls |= VM_ENTRY_GUEST_LMA; - vmcs_write(VMCS_ENTRY_CTLS, entry_ctls); - } + /* + * Keep EFER.LMA and the IA-32e guest VM-entry control in sync + * with CR0.PG, using the value written to the VMCS (crval). + */ + efer = vmcs_read(VMCS_GUEST_IA32_EFER); + entry_ctls = vmcs_read(VMCS_ENTRY_CTLS); + if ((crval & CR0_PG) != 0 && (efer & EFER_LME) != 0) { + efer |= EFER_LMA; + entry_ctls |= VM_ENTRY_GUEST_LMA; + } else { + efer &= ~EFER_LMA; + entry_ctls &= ~VM_ENTRY_GUEST_LMA; } + vmcs_write(VMCS_GUEST_IA32_EFER, efer); + vmcs_write(VMCS_ENTRY_CTLS, entry_ctls); return (HANDLED); }