From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kai Luo Subject: Question about the repeated page fault Date: Sat, 21 Sep 2013 07:52:22 -0700 (PDT) Message-ID: <2079492317.13239468.1379775142008.JavaMail.root@vmware.com> References: <23281310.13239311.1379774911305.JavaMail.root@vmware.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6442663914124488829==" Return-path: In-Reply-To: <23281310.13239311.1379774911305.JavaMail.root@vmware.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --===============6442663914124488829== Content-Type: multipart/alternative; boundary="----=_Part_13239467_1423133508.1379775142007" ------=_Part_13239467_1423133508.1379775142007 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Hello everyone: Recently,I am working on a feature of intercepting the giving function in windows SSDT table,I replace address of function in SSDT whith an invalid address. The question is when I trapped the page fault caused by accessing the invalid address and I recovered it to the correct function address,I can recive the same page fault again.That is to say: 1.I trapped a page fault caused by an invalid address in sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs) 2.I rescover the guest eip to the correct address using the following code(Missing something?): regs->eip = __vmwrite(GUEST_RIP, ); 3.Another page fault caused by the same address occured I dumped the vmcs when the page faults occured,contents in vmcs are almost the same except the 'Virtual processor ID',still confused.Could you help me to analyse the strange phenomenon? Thank you very much! Jone ------=_Part_13239467_1423133508.1379775142007 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Hello everyone:

  = ;  Recently,I am working on a feature of intercepting the giving = function in windows SSDT table,I replace address of function in SSDT w= hith an invalid address.
    The question is when I= trapped the page fault caused by accessing the invalid address and I recov= ered it to the correct function address,I can recive the same page fau= lt again.That is to say:
          1.I trapped = a page fault caused by an invalid address in sh_page_fault(struct vcpu *v,u= nsigned long va,struct cpu_user_regs *regs)
        =   2.I rescover the guest eip to the correct address using the followin= g code(Missing something?):
            &n= bsp;     regs->eip =3D <correct_addr>
    &= nbsp;             __vmwrite(GUEST_RIP, <co= rrect_addr>);
          3.Another page faul= t caused by the same address occured
    I dumped the vmcs whe= n the page faults occured,contents in vmcs are almost the same except the '= Virtual processor ID',still confused.Could you help me to analyse the = strange phenomenon?Thank you very much!

Jone


<= /div> ------=_Part_13239467_1423133508.1379775142007-- --===============6442663914124488829== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============6442663914124488829==--