Re: [Xen-devel] Question about the repeated page fault

["Zhang, Yang Z" <yang.z.zhang@xxxxxxxxx>]

Andrew Cooper wrote on 2013-09-22:
> On 21/09/2013 17:02, Andrew Cooper wrote:
> 
> 
>       On 21/09/2013 15:52, Kai Luo wrote:
> 
> 
>               Hello everyone:
> 
>                   Recently,I am working on a feature of intercepting the 
> giving 
> function in windows SSDT table,I replace address of function in SSDT 
> whith an invalid address.
>                   The question is when I trapped the page fault caused by 
> accessing the invalid address and I recovered it to the correct 
> function address,I can recive the same page fault again.That is to say:
>                         1.I trapped a page fault caused by an invalid address 
> in 
> sh_page_fault(struct vcpu *v,unsigned long va,struct cpu_user_regs *regs)
>                         2.I rescover the guest eip to the correct address 
> using 
> the following code(Missing something?):
>                                 regs->eip = <correct_addr>
>                                 __vmwrite(GUEST_RIP, <correct_addr>);
>                         3.Another page fault caused by the same address 
> occured
>                   I dumped the vmcs when the page faults occured,contents in 
> vmcs 
> are almost the same except the 'Virtual processor ID',still 
> confused.Could you help me to analyse the strange phenomenon?Thank you very 
> much!
> 
>               Jone
> 
> 
> 
>       Ignoring for now whether this is sensible in the slightest, are you 
> certain that the SSDT function is only being executed once by Windows 
> and still resulting in two pagefaults?
> 
>       (Not directly related, but) sh_page_fault() is only valid for shadow 
> mode, and not valid for EPT/NPT, which HVM domains default on 
> appropriate hardware.
> 
>       The vmentry helper writes regs->rip back to GUEST_RIP so you should 
> not need to do that.  If you have followed the instructions at the top 
> of sh_page_fault(), the guest should retry the access with the correct RIP.
Yes, this is the point. You should not write GUEST_RIP directly. Instead, 
modify regs->rip to the correct_addr.

> 
>       As for the VPID being different, that is to be expected.
> 
> 
> 
> 
> Thinking about this a little more, it is utterly crazy.  The SSDT will 
> be made of AML which will be interpreted.  The pagefault will almost 
> certainly have occurred because of a read from the bad address, rather 
> than an instruction fetch.  Fixing up rip will result in an unexpected 
> branch as far as the VM is concerned.  I am surprised it didn't BSOD.
>
> 
> If you still insist on using this method, then you would need to 
> decode the instruction under regs->rip and fix up the appropriate source 
> operand.
I guess he knows correct_addr. So there is no decoding involved.

> 
> ~Andrew


Best regards,
Yang



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel