Re: Question about the repeated page fault

[Andrew Cooper <andrew.cooper3@citrix.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2298 bytes --]

On 21/09/2013 17:02, Andrew Cooper wrote:
> On 21/09/2013 15:52, Kai Luo wrote:
>>
>> Hello everyone:
>>
>>     Recently,I am working on a feature of intercepting the giving
>> function in windows SSDT table,I replace address of function in SSDT
>> whith an invalid address.
>>     The question is when I trapped the page fault caused by accessing
>> the invalid address and I recovered it to the correct function
>> address,I can recive the same page fault again.That is to say:
>>           1.I trapped a page fault caused by an invalid address in
>> sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs)
>>           2.I rescover the guest eip to the correct address using the
>> following code(Missing something?):
>>                   regs->eip = <correct_addr>
>>                   __vmwrite(GUEST_RIP, <correct_addr>);
>>           3.Another page fault caused by the same address occured
>>     I dumped the vmcs when the page faults occured,contents in vmcs
>> are almost the same except the 'Virtual processor ID',still
>> confused.Could you help me to analyse the strange phenomenon?Thank
>> you very much!
>>
>> Jone
>>
>>
>
> Ignoring for now whether this is sensible in the slightest, are you
> certain that the SSDT function is only being executed once by Windows
> and still resulting in two pagefaults?
>
> (Not directly related, but) sh_page_fault() is only valid for shadow
> mode, and not valid for EPT/NPT, which HVM domains default on
> appropriate hardware.
>
> The vmentry helper writes regs->rip back to GUEST_RIP so you should
> not need to do that.  If you have followed the instructions at the top
> of sh_page_fault(), the guest should retry the access with the correct
> RIP.
>
> As for the VPID being different, that is to be expected.
>

Thinking about this a little more, it is utterly crazy.  The SSDT will
be made of AML which will be interpreted.  The pagefault will almost
certainly have occurred because of a read from the bad address, rather
than an instruction fetch.  Fixing up rip will result in an unexpected
branch as far as the VM is concerned.  I am surprised it didn't BSOD.

If you still insist on using this method, then you would need to decode
the instruction under regs->rip and fix up the appropriate source operand.

~Andrew

[-- Attachment #1.2: Type: text/html, Size: 3847 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel