[DragonFlyBSD - Bug #3452] (New) nvmm: trap CR0.PE changes so guest mode switches reconfigure the VMCS

[sigttou]

Issue #3452 has been reported by sigttou.

----------------------------------------
Bug #3452: nvmm: trap CR0.PE changes so guest mode switches reconfigure the VMCS
http://bugs.dragonflybsd.org/issues/3452

* Author: sigttou
* Status: New
* Priority: Normal
* Category: nvmm
* Target version: 6.6
* Start date: 2026-10-16
----------------------------------------
GNU Mach starts secondary CPUs by having the AP enter protected mode: the AP writes
CR0 with PE set (and the cache-disable bits) from real mode. The CR0 guest/host mask only covers
CR0_ET/CR0_NW/CR0_CD, so when the guest writes the same cache-disable values it already reads
back, no VM exit occurs and the hardware applies CR0.PE directly. NVMM then leaves the VMCS guest
state un-reconfigured, and the AP faults back into the firmware after the write instead of
entering the kernel (observed as "Waiting for AP 1"; the AP ends up in the SeaBIOS wait loop).

Add CR0_PE to the trapped bits so a PE change always exits to
vmx_inkernel_handle_cr0() and the guest state is committed before re-entry. CR0_PG is deliberately
not included: trapping it would break 32-bit PAE guests, whose PDPTEs this handler does not load.

NetBSD NVMM has the same issue: https://gnats.netbsd.org/60887

---Files--------------------------------
0001-nvmm-trap-CR0.PE-changes-so-guest-mode-switches-reco.patch (3.44 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account