Hello everyone:

= ; Recently,I am working on a feature of intercepting the giving = function in windows SSDT table,I replace address of function in SSDT w= hith an invalid address.
The question is when I= trapped the page fault caused by accessing the invalid address and I recov= ered it to the correct function address,I can recive the same page fau= lt again.That is to say:
1.I trapped = a page fault caused by an invalid address in sh_page_fault(struct vcpu *v,u= nsigned long va,struct cpu_user_regs *regs)
= 2.I rescover the guest eip to the correct address using the followin= g code(Missing something?):
&n= bsp; regs->eip =3D <correct_addr>
&= nbsp; __vmwrite(GUEST_RIP, <co= rrect_addr>);
3.Another page faul= t caused by the same address occured
I dumped the vmcs whe= n the page faults occured,contents in vmcs are almost the same except the '= Virtual processor ID',still confused.Could you help me to analyse the = strange phenomenon?Thank you very much!

Jone

<= /div> ------=_Part_13239467_1423133508.1379775142007-- --===============6442663914124488829== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============6442663914124488829==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: Question about the repeated page fault Date: Sat, 21 Sep 2013 17:02:56 +0100 Message-ID: <523DC330.4050004@citrix.com> References: <2079492317.13239468.1379775142008.JavaMail.root@vmware.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2679016287398607902==" Return-path: In-Reply-To: <2079492317.13239468.1379775142008.JavaMail.root@vmware.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Kai Luo Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --===============2679016287398607902== Content-Type: multipart/alternative; boundary="------------090009090806050507050702" --------------090009090806050507050702 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit On 21/09/2013 15:52, Kai Luo wrote: > > Hello everyone: > > Recently,I am working on a feature of intercepting the giving > function in windows SSDT table,I replace address of function in SSDT > whith an invalid address. > The question is when I trapped the page fault caused by accessing > the invalid address and I recovered it to the correct function > address,I can recive the same page fault again.That is to say: > 1.I trapped a page fault caused by an invalid address in > sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs) > 2.I rescover the guest eip to the correct address using the > following code(Missing something?): > regs->eip = > __vmwrite(GUEST_RIP, ); > 3.Another page fault caused by the same address occured > I dumped the vmcs when the page faults occured,contents in vmcs > are almost the same except the 'Virtual processor ID',still > confused.Could you help me to analyse the strange phenomenon?Thank you > very much! > > Jone > > Ignoring for now whether this is sensible in the slightest, are you certain that the SSDT function is only being executed once by Windows and still resulting in two pagefaults? (Not directly related, but) sh_page_fault() is only valid for shadow mode, and not valid for EPT/NPT, which HVM domains default on appropriate hardware. The vmentry helper writes regs->rip back to GUEST_RIP so you should not need to do that. If you have followed the instructions at the top of sh_page_fault(), the guest should retry the access with the correct RIP. As for the VPID being different, that is to be expected. ~Andrew --------------090009090806050507050702 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit

On 21/09/2013 15:52, Kai Luo wrote:

Hello everyone:

Recently,I am working on a feature of intercepting the giving function in windows SSDT table,I replace address of function in SSDT whith an invalid address.
The question is when I trapped the page fault caused by accessing the invalid address and I recovered it to the correct function address,I can recive the same page fault again.That is to say:
1.I trapped a page fault caused by an invalid address in sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs)
2.I rescover the guest eip to the correct address using the following code(Missing something?):
regs->eip = <correct_addr>
__vmwrite(GUEST_RIP, <correct_addr>);
3.Another page fault caused by the same address occured
I dumped the vmcs when the page faults occured,contents in vmcs are almost the same except the 'Virtual processor ID',still confused.Could you help me to analyse the strange phenomenon?Thank you very much!

Jone

Ignoring for now whether this is sensible in the slightest, are you certain that the SSDT function is only being executed once by Windows and still resulting in two pagefaults?

(Not directly related, but) sh_page_fault() is only valid for shadow mode, and not valid for EPT/NPT, which HVM domains default on appropriate hardware.

The vmentry helper writes regs->rip back to GUEST_RIP so you should not need to do that. If you have followed the instructions at the top of sh_page_fault(), the guest should retry the access with the correct RIP.

As for the VPID being different, that is to be expected.

~Andrew --------------090009090806050507050702-- --===============2679016287398607902== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============2679016287398607902==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: Question about the repeated page fault Date: Sat, 21 Sep 2013 19:04:06 +0100 Message-ID: <523DDF96.1070201@citrix.com> References: <2079492317.13239468.1379775142008.JavaMail.root@vmware.com> <523DC330.4050004@citrix.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4004832676566350378==" Return-path: In-Reply-To: <523DC330.4050004@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Kai Luo Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --===============4004832676566350378== Content-Type: multipart/alternative; boundary="------------000506080700080102090003" --------------000506080700080102090003 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit On 21/09/2013 17:02, Andrew Cooper wrote: > On 21/09/2013 15:52, Kai Luo wrote: >> >> Hello everyone: >> >> Recently,I am working on a feature of intercepting the giving >> function in windows SSDT table,I replace address of function in SSDT >> whith an invalid address. >> The question is when I trapped the page fault caused by accessing >> the invalid address and I recovered it to the correct function >> address,I can recive the same page fault again.That is to say: >> 1.I trapped a page fault caused by an invalid address in >> sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs) >> 2.I rescover the guest eip to the correct address using the >> following code(Missing something?): >> regs->eip = >> __vmwrite(GUEST_RIP, ); >> 3.Another page fault caused by the same address occured >> I dumped the vmcs when the page faults occured,contents in vmcs >> are almost the same except the 'Virtual processor ID',still >> confused.Could you help me to analyse the strange phenomenon?Thank >> you very much! >> >> Jone >> >> > > Ignoring for now whether this is sensible in the slightest, are you > certain that the SSDT function is only being executed once by Windows > and still resulting in two pagefaults? > > (Not directly related, but) sh_page_fault() is only valid for shadow > mode, and not valid for EPT/NPT, which HVM domains default on > appropriate hardware. > > The vmentry helper writes regs->rip back to GUEST_RIP so you should > not need to do that. If you have followed the instructions at the top > of sh_page_fault(), the guest should retry the access with the correct > RIP. > > As for the VPID being different, that is to be expected. > Thinking about this a little more, it is utterly crazy. The SSDT will be made of AML which will be interpreted. The pagefault will almost certainly have occurred because of a read from the bad address, rather than an instruction fetch. Fixing up rip will result in an unexpected branch as far as the VM is concerned. I am surprised it didn't BSOD. If you still insist on using this method, then you would need to decode the instruction under regs->rip and fix up the appropriate source operand. ~Andrew --------------000506080700080102090003 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit

On 21/09/2013 17:02, Andrew Cooper wrote:

On 21/09/2013 15:52, Kai Luo wrote:

Hello everyone:

Recently,I am working on a feature of intercepting the giving function in windows SSDT table,I replace address of function in SSDT whith an invalid address.
The question is when I trapped the page fault caused by accessing the invalid address and I recovered it to the correct function address,I can recive the same page fault again.That is to say:
1.I trapped a page fault caused by an invalid address in sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs)
2.I rescover the guest eip to the correct address using the following code(Missing something?):
regs->eip = <correct_addr>
__vmwrite(GUEST_RIP, <correct_addr>);
3.Another page fault caused by the same address occured
I dumped the vmcs when the page faults occured,contents in vmcs are almost the same except the 'Virtual processor ID',still confused.Could you help me to analyse the strange phenomenon?Thank you very much!

Jone

Ignoring for now whether this is sensible in the slightest, are you certain that the SSDT function is only being executed once by Windows and still resulting in two pagefaults?

(Not directly related, but) sh_page_fault() is only valid for shadow mode, and not valid for EPT/NPT, which HVM domains default on appropriate hardware.

The vmentry helper writes regs->rip back to GUEST_RIP so you should not need to do that. If you have followed the instructions at the top of sh_page_fault(), the guest should retry the access with the correct RIP.

As for the VPID being different, that is to be expected.

Thinking about this a little more, it is utterly crazy. The SSDT will be made of AML which will be interpreted. The pagefault will almost certainly have occurred because of a read from the bad address, rather than an instruction fetch. Fixing up rip will result in an unexpected branch as far as the VM is concerned. I am surprised it didn't BSOD.

If you still insist on using this method, then you would need to decode the instruction under regs->rip and fix up the appropriate source operand.

~Andrew
--------------000506080700080102090003-- --===============4004832676566350378== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============4004832676566350378==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Zhang, Yang Z" Subject: Re: Question about the repeated page fault Date: Sun, 22 Sep 2013 01:48:52 +0000 Message-ID: References: <2079492317.13239468.1379775142008.JavaMail.root@vmware.com> <523DC330.4050004@citrix.com> <523DDF96.1070201@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <523DDF96.1070201@citrix.com> Content-Language: en-US List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper , Kai Luo Cc: "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org Andrew Cooper wrote on 2013-09-22: > On 21/09/2013 17:02, Andrew Cooper wrote: > > > On 21/09/2013 15:52, Kai Luo wrote: > > > Hello everyone: > > Recently,I am working on a feature of intercepting the giving > function in windows SSDT table,I replace address of function in SSDT > whith an invalid address. > The question is when I trapped the page fault caused by > accessing the invalid address and I recovered it to the correct > function address,I can recive the same page fault again.That is to say: > 1.I trapped a page fault caused by an invalid address in > sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs) > 2.I rescover the guest eip to the correct address using > the following code(Missing something?): > regs->eip = > __vmwrite(GUEST_RIP, ); > 3.Another page fault caused by the same address occured > I dumped the vmcs when the page faults occured,contents in vmcs > are almost the same except the 'Virtual processor ID',still > confused.Could you help me to analyse the strange phenomenon?Thank you very much! > > Jone > > > > Ignoring for now whether this is sensible in the slightest, are you > certain that the SSDT function is only being executed once by Windows > and still resulting in two pagefaults? > > (Not directly related, but) sh_page_fault() is only valid for shadow > mode, and not valid for EPT/NPT, which HVM domains default on > appropriate hardware. > > The vmentry helper writes regs->rip back to GUEST_RIP so you should > not need to do that. If you have followed the instructions at the top > of sh_page_fault(), the guest should retry the access with the correct RIP. Yes, this is the point. You should not write GUEST_RIP directly. Instead, modify regs->rip to the correct_addr. > > As for the VPID being different, that is to be expected. > > > > > Thinking about this a little more, it is utterly crazy. The SSDT will > be made of AML which will be interpreted. The pagefault will almost > certainly have occurred because of a read from the bad address, rather > than an instruction fetch. Fixing up rip will result in an unexpected > branch as far as the VM is concerned. I am surprised it didn't BSOD. > > > If you still insist on using this method, then you would need to > decode the instruction under regs->rip and fix up the appropriate source operand. I guess he knows correct_addr. So there is no decoding involved. > > ~Andrew Best regards, Yang