On Thu, Dec 21, 2017 at 3:56 AM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > rsm_load_state_64() and rsm_enter_protected_mode() load CR3, then > CR4 & ~PCIDE, then CR0, then CR4. > > However, setting CR4.PCIDE fails if CR3[11:0] != 0. It's probably easier > in the long run to replace rsm_enter_protected_mode() with an emulator > callback that sets all the special registers (like KVM_SET_SREGS would > do). For now, set the PCID field of CR3 only after CR4.PCIDE is 1. Out of curiosity, has anyone ever tested RSM returning to PAE mode? I *think* it's supposed to restore the PDPTR registers directly rather than reloading them from the memory pointed to by CR3, and it doesn't look like the new or old code does it. --Andy