On Wed, Sep 30, 2026 at 10:23:13AM -0400, Josh Grosse wrote:
> On Tue, Sep 29, 2026 at 09:26:02PM -0700, Mike Larkin wrote:
> > On Tue, Sep 29, 2026 at 09:00:00PM -0400, Josh Grosse wrote:
> > > On Tue, Sep 29, 2026 at 05:19:56PM -0700, Mike Larkin wrote:
> > > > On Sat, Sep 26, 2026 at 09:49:32AM -0400, Josh Grosse wrote:
> > > > > On Sat, Sep 26, 2026 at 09:32:04AM -0400, Josh Grosse wrote:
> > > > > > This began at some point after the vcpu enhancement.
> > > > >
> > > > > Adding the vm.conf. Guest is 7.9-release.
> > > > >
> > > > > ---
> > > > >
> > > > > files= /home/josh/vm/
> > > > >
> > > > > vm lab {
> > > > > disable
> > > > > owner josh
> > > > > memory 8g
> > > > > disk $files lab/disk.drive
> > > > > disk $files lab/releases/usr.ports.drive
> > > > > local interface tap0 rdomain 1 switch perm
> > > > > }
> > > > >
> > > > > switch perm {
> > > > > interface veb0 rdomain 1
> > > > > }
> > > > >
> > > > > ---
> > > > >
> > > > > > # vmd -dvvvvv output, and dmesg follow.
> > > > > >
> > > > > > ---
> > > > > >
> > > >
> > > > can't reproduce this locally with i386 7.9 original release nor the
> > > > latest
> > > > syspatch kernel. tried mp and up.
> > > >
> > > > can you run strings on the guest kernel inside the vm disk and tell me
> > > > what
> > > > build it is?
> > > >
> > > > -ml
> > >
> > > OpenBSD
> > > GENERIC#329
> > > @(#)OpenBSD 7.9 (GENERIC) #329: Wed May 6 14:56:46 MDT 2026
> > > OpenBSD 7.9 (GENERIC) #329: Wed May 6 14:56:46 MDT 2026
> > > [email protected]:/usr/src/sys/arch/i386/compile/GENERIC
> > >
> >
> > still can't repro this and I even dug out an ancient haswell machine like
> > yours from the garage and ran the exact same kernel (although KARL likely
> > means we have different .o layouts, the bug below shouldn't be due to that).
> >
> > when exactly does this happen? right at boot? some other time?
> >
> > if its reproducible, see if you can find a way to share the kernel that
> > is failing. I have a vmd here with extra debug that might point to the
> > source.
> >
> > -ml
>
> I can no longer replicate. Now running snap #65; now I get a hung i386 guest
> even
> with a null vm.conf, no network configured, and booted -s. It hangs at
> different
> points: running fsck, during mount -a, or during halt. There's no
> reapeatability.
> I thought it might be the guest's network configuration, so I've tried it
> without
> veb/vports defined, and vmd without a vm.conf. All hang, at some point, while
> still in single-user mode.
>
> A copy of the guest's kernel, for what it might be worth, is in
>
> https://jggimi.net/guest.bsd.booted
>
I also saw the hang while trying to reproduce your original issue; here is a fix
you can try (apply to host and rebuild host kernel).
-ml
Index: arch/amd64/amd64/vmm_machdep.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/vmm_machdep.c,v
diff -u -p -a -u -r1.89 vmm_machdep.c
--- arch/amd64/amd64/vmm_machdep.c 22 Sep 2026 08:21:39 -0000 1.89
+++ arch/amd64/amd64/vmm_machdep.c 30 Sep 2026 04:44:02 -0000
@@ -3653,7 +3653,7 @@ int
vcpu_run_vmx(struct vcpu *vcpu, struct vm_run_params *vrp)
{
enum vmm_action action;
- int error, exitinfo, ret = 0, vmx_ret = 0;
+ int error, exitinfo, inject_blocked = 0, ret = 0, vmx_ret = 0;
struct region_descriptor gdt;
struct cpu_info *ci = NULL;
uint64_t exit_reason, cr3, msr, insn_error;
@@ -3735,7 +3735,7 @@ vcpu_run_vmx(struct vcpu *vcpu, struct v
return (EINVAL);
}
- /* Interruptibility state 0x3 covers NMIs and STI */
+ /* Bits 0 and 1 block interrupts after STI and MOV SS. */
if (!(int_st & 0x3) && vcpu->vc_irqready) {
eii = (uint64_t)vcpu->vc_inject.vie_vector;
eii |= (1ULL << 31); /* Valid */
@@ -3746,22 +3746,38 @@ vcpu_run_vmx(struct vcpu *vcpu, struct v
}
vcpu->vc_inject.vie_type = VCPU_INJECT_NONE;
+ } else
+ inject_blocked = 1;
+ }
+
+ /*
+ * handle case where we need to inject but are blocked due to the
+ * guest being in an interrupt shadow due to mov ss or sti
+ */
+ if (inject_blocked || vcpu->vc_intr ||
+ READ_ONCE(vcpu->vc_intr_latch)) {
+ if (vmread(VMCS_PROCBASED_CTLS, &procbased)) {
+ printf("%s: can't read procbased controls for interrupt
"
+ "window\n", __func__);
+ return (EINVAL);
}
- } else if (!(vcpu->vc_intr || READ_ONCE(vcpu->vc_intr_latch))) {
- /*
- * Disable window exiting
- */
+ procbased |= IA32_VMX_INTERRUPT_WINDOW_EXITING;
+ if (vmwrite(VMCS_PROCBASED_CTLS, procbased)) {
+ printf("%s: can't enable interrupt-window exiting\n",
+ __func__);
+ return (EINVAL);
+ }
+ } else {
if (vmread(VMCS_PROCBASED_CTLS, &procbased)) {
- printf("%s: can't read procbased ctls on exit\n",
+ printf("%s: can't read procbased controls for interrupt
"
+ "window\n", __func__);
+ return (EINVAL);
+ }
+ procbased &= ~IA32_VMX_INTERRUPT_WINDOW_EXITING;
+ if (vmwrite(VMCS_PROCBASED_CTLS, procbased)) {
+ printf("%s: can't disable interrupt-window exiting\n",
__func__);
return (EINVAL);
- } else {
- procbased &= ~IA32_VMX_INTERRUPT_WINDOW_EXITING;
- if (vmwrite(VMCS_PROCBASED_CTLS, procbased)) {
- printf("%s: can't write procbased ctls "
- "on exit\n", __func__);
- return (EINVAL);
- }
}
}
@@ -4046,10 +4062,15 @@ vcpu_run_vmx(struct vcpu *vcpu, struct v
/* Handle the exit and determine what to do next. */
action = vmx_handle_exit(vcpu);
- if (vcpu->vc_gueststate.vg_rflags & PSL_I)
- vcpu->vc_irqready = 1;
- else
- vcpu->vc_irqready = 0;
+ if (vmread(VMCS_GUEST_INTERRUPTIBILITY_ST, &int_st)) {
+ printf("%s: can't read interruptibility
state\n",
+ __func__);
+ ret = EINVAL;
+ goto out;
+ }
+ vcpu->vc_irqready =
+ (vcpu->vc_gueststate.vg_rflags & PSL_I) != 0 &&
+ (int_st & 0x3) == 0;
/*
* If not ready for interrupts, but interrupts pending,
