Re: [Xen-devel] Xen 4.6.1 crash with altp2m enabled bydefault

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 05.08.16 at 14:51, <Kevin.Mayer@xxxxxxxx> wrote:
> According to the xen dmesg
> 
> (XEN) RIP:    e008:[<ffff82d0801fd23a>] vmx_vmenter_helper+0x27e/0x30a
> (XEN) RFLAGS: 0000000000010003   CONTEXT: hypervisor
> (XEN) rax: 000000008005003b   rbx: ffff8300e72fc000   rcx: 0000000000000000
> (XEN) rdx: 0000000000006c00   rsi: ffff830617fd7fc0   rdi: ffff8300e6fc0000
> (XEN) rbp: ffff830617fd7c40   rsp: ffff830617fd7c30   r8:  0000000000000000
> (XEN) r9:  ffff830be8dc9310   r10: 0000000000000000   r11: 00003475e9cf85d0
> (XEN) r12: 0000000000000006   r13: ffff830c14ee1000   r14: ffff8300e6fc0000
> (XEN) r15: ffff830617fd0000   cr0: 000000008005003b   cr4: 00000000000026e0
> (XEN) cr3: 00000001bd665000   cr2: 0000000004510000
> (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: 0000   cs: e008
> 
> 0xffff82d0801fa0c3 <vmx_ctxt_switch_from+85>:        mov    $0x6c00,%edx
> 0xffff82d0801fa0c8 <vmx_ctxt_switch_from+90>:        vmwrite %rax,%rdx
> 
> The vmwrite tries to write 0x000000008005003b   to 0x6c00.
> But the active VCPU has a 0-vmcs-pointer.

Which likely means altp2m manages to confuse some of VMX'es
VMCS management - vmx_vmenter_helper() being on the path
back to the guest, it should be impossible for the VMCS pointer to
be zero here. Can you perhaps identify the most recent vmread or
vmwrite which worked fine? There ought to be many on that path,
and the state corruption could then perhaps be narrowed to quite
small a range of code.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel