{"action":"created","issue":{"url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/54","repository_url":"https://api.github.com/repos/tandasat/HyperPlatform","labels_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/54/comments","events_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/54/events","html_url":"https://github.com/tandasat/HyperPlatform/issues/54","id":326008234,"node_id":"MDU6SXNzdWUzMjYwMDgyMzQ=","number":54,"title":"DOUBLE_FAULT exception under win7 x86 with KB4088878","user":{"login":"leeqwind","id":10241894,"node_id":"MDQ6VXNlcjEwMjQxODk0","avatar_url":"https://avatars3.githubusercontent.com/u/10241894?v=4","gravatar_id":"","url":"https://api.github.com/users/leeqwind","html_url":"https://github.com/leeqwind","followers_url":"https://api.github.com/users/leeqwind/followers","following_url":"https://api.github.com/users/leeqwind/following{/other_user}","gists_url":"https://api.github.com/users/leeqwind/gists{/gist_id}","starred_url":"https://api.github.com/users/leeqwind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leeqwind/subscriptions","organizations_url":"https://api.github.com/users/leeqwind/orgs","repos_url":"https://api.github.com/users/leeqwind/repos","events_url":"https://api.github.com/users/leeqwind/events{/privacy}","received_events_url":"https://api.github.com/users/leeqwind/received_events","type":"User","site_admin":false},"labels":[{"id":438258991,"node_id":"MDU6TGFiZWw0MzgyNTg5OTE=","url":"https://api.github.com/repos/tandasat/HyperPlatform/labels/prio:high","name":"prio:high","color":"f9d0c4","default":false},{"id":332455005,"node_id":"MDU6TGFiZWwzMzI0NTUwMDU=","url":"https://api.github.com/repos/tandasat/HyperPlatform/labels/type:bug","name":"type:bug","color":"fc2929","default":false}],"state":"open","locked":false,"assignee":{"login":"tandasat","id":1620923,"node_id":"MDQ6VXNlcjE2MjA5MjM=","avatar_url":"https://avatars2.githubusercontent.com/u/1620923?v=4","gravatar_id":"","url":"https://api.github.com/users/tandasat","html_url":"https://github.com/tandasat","followers_url":"https://api.github.com/users/tandasat/followers","following_url":"https://api.github.com/users/tandasat/following{/other_user}","gists_url":"https://api.github.com/users/tandasat/gists{/gist_id}","starred_url":"https://api.github.com/users/tandasat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tandasat/subscriptions","organizations_url":"https://api.github.com/users/tandasat/orgs","repos_url":"https://api.github.com/users/tandasat/repos","events_url":"https://api.github.com/users/tandasat/events{/privacy}","received_events_url":"https://api.github.com/users/tandasat/received_events","type":"User","site_admin":false},"assignees":[{"login":"tandasat","id":1620923,"node_id":"MDQ6VXNlcjE2MjA5MjM=","avatar_url":"https://avatars2.githubusercontent.com/u/1620923?v=4","gravatar_id":"","url":"https://api.github.com/users/tandasat","html_url":"https://github.com/tandasat","followers_url":"https://api.github.com/users/tandasat/followers","following_url":"https://api.github.com/users/tandasat/following{/other_user}","gists_url":"https://api.github.com/users/tandasat/gists{/gist_id}","starred_url":"https://api.github.com/users/tandasat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tandasat/subscriptions","organizations_url":"https://api.github.com/users/tandasat/orgs","repos_url":"https://api.github.com/users/tandasat/repos","events_url":"https://api.github.com/users/tandasat/events{/privacy}","received_events_url":"https://api.github.com/users/tandasat/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2018-05-24T08:07:11Z","updated_at":"2018-06-12T09:59:15Z","closed_at":null,"author_association":"NONE","body":"### Description\r\n\r\nUnder Windows 7 x86 SP1 with KB4088878 \\(the 2018-03 security update: [http://download.windowsupdate.com/c/msdownload/update/software/secu/2018/03/windows6.1-kb4088878-x86_7512ab54d6a6df9d7e3d511d84a387aaeaeef111.msu](http://download.windowsupdate.com/c/msdownload/update/software/secu/2018/03/windows6.1-kb4088878-x86_7512ab54d6a6df9d7e3d511d84a387aaeaeef111.msu)\\), everytime loading and running HyperPlatform driver, a DOUBLE_FAULT exception would be raised during handling cr3 access in vmexit.\r\n\r\n### Expected behavior\r\n\r\nExecuting normally.\r\n\r\n### Actual behavior\r\n\r\nThe DOUBLE_FAULT exception was triggered by instruction `mov cr3,ecx` in function `UtilLoadPdptes`.\r\n\r\n### Steps to reproduce the problem\r\n\r\n1. Install the 2018-03 security update for Windows 7 x86 SP1: [http://download.windowsupdate.com/c/msdownload/update/software/secu/2018/03/windows6.1-kb4088878-x86_7512ab54d6a6df9d7e3d511d84a387aaeaeef111.msu](http://download.windowsupdate.com/c/msdownload/update/software/secu/2018/03/windows6.1-kb4088878-x86_7512ab54d6a6df9d7e3d511d84a387aaeaeef111.msu)\r\n\r\n2. Load and run the latest version of HyperPlatform (without any extra modification) in the Windows 7 environment.\r\n\r\n3. The exception would be triggered immediately.\r\n\r\n### Specifications\r\n- Commit: 97d6ccc (the latest commit so far)\r\n\r\n- OS version: Windows 7 SP1 7601 with KB4088878\r\n\r\n- Architecture: x86\r\n\r\n- Hardware: VMware Workstation (any version)\r\n\r\n- Details:\r\n\r\nThe DOUBLE_FAULT exception was triggered by instruction `mov cr3,ecx` in function `UtilLoadPdptes`:\r\n\r\n```cpp\r\nkd> !analyze -v\r\n*******************************************************************************\r\n*                                                                             *\r\n*                        Bugcheck Analysis                                    *\r\n*                                                                             *\r\n*******************************************************************************\r\n\r\nUNEXPECTED_KERNEL_MODE_TRAP (7f)\r\n\r\nArguments:\r\nArg1: 00000008, EXCEPTION_DOUBLE_FAULT\r\nArg2: 80b93c00\r\nArg3: 00000000\r\nArg4: 00000000\r\n\r\nTSS:  00000028 -- (.tss 0x28)\r\neax=00185000 ebx=7793fce0 ecx=5f2fd4a0 edx=87d5cff0 esi=003993d8 edi=00000000\r\neip=987bc8ad esp=87d5cdd0 ebp=87d5ce08 iopl=0         nv up di ng nz na po nc\r\ncs=0008  ss=0010  ds=0020  es=0020  fs=0030  gs=0000             efl=00010082\r\n\r\nSTACK_TEXT:  \r\n87d5ce08 987bdb3f 5f2fd4a0 86fa1000 987bc580 HyperPlatform!UtilLoadPdptes+0x1d [d:\\github\\hyperplatform\\hyperplatform\\util.cpp @ 835]\r\n87d5cef4 987bf205 87d5cf40 00000000 003993d8 HyperPlatform!VmmpHandleCrAccess+0x14f [d:\\github\\hyperplatform\\hyperplatform\\vmm.cpp @ 966]\r\n87d5cf34 987bd185 87d5cf40 87d5cfd8 00000006 HyperPlatform!VmmpHandleVmExit+0x145 [d:\\github\\hyperplatform\\hyperplatform\\vmm.cpp @ 268]\r\n87d5cf64 987ba27e 87d5cfd8 00000000 00000000 HyperPlatform!VmmVmExitHandler+0xa5 [d:\\github\\hyperplatform\\hyperplatform\\vmm.cpp @ 205]\r\n87d5cf6c 00000000 00000000 00000000 00000000 HyperPlatform!AsmVmmEntryPoint+0x37 [D:\\GitHub\\HyperPlatform\\HyperPlatform\\Arch\\x86\\x86.asm @ 117]\r\n\r\nkd> ub 987bc8ad \r\nHyperPlatform!UtilLoadPdptes+0x6 [d:\\github\\hyperplatform\\hyperplatform\\util.cpp @ 828]:\r\n987bc896 a108207c98      mov     eax,dword ptr [HyperPlatform!__security_cookie (987c2008)]\r\n987bc89b 33c5            xor     eax,ebp\r\n987bc89d 8945fc          mov     dword ptr [ebp-4],eax\r\n987bc8a0 56              push    esi\r\n987bc8a1 0f20d8          mov     eax,cr3\r\n987bc8a4 8945cc          mov     dword ptr [ebp-34h],eax\r\n987bc8a7 8b4d08          mov     ecx,dword ptr [ebp+8]\r\n987bc8aa 0f22d9          mov     cr3,ecx\r\n```\r\n\r\nThe current VMExit is handling a cr3 access from system function `KiKernelSysretExit`:\r\n\r\n```cpp\r\nkd> dc 87d5cf40 \r\n87d5cf40  87d5cfd8 00000006 83f38028 00000000  ........(.......\r\n87d5cf50  00000100 00000000 00000001 00000000  ................\r\n87d5cf60  00000000 0051fdc8 987ba27e 87d5cfd8  ......Q.~.{.....\r\n87d5cf70  00000000 00000000 00000000 00000000  ................\r\nkd> u 83f38028 \r\nnt!KiKernelSysretExit+0x28:\r\n83f38028 0f22d9          mov     cr3,ecx\r\n83f3802b 59              pop     ecx\r\n83f3802c 0fa1            pop     fs\r\n83f3802e fb              sti\r\n83f3802f 0f35            sysexit\r\n83f38031 cc              int     3\r\n```\r\n\r\nDetail files: https://1drv.ms/u/s!ApQpgQkWR0QOi8ZOVXUBX83WEQIE8Q\r\n\r\n- a Debug build version of a compiled SYS file and a PDB file\r\n- a log file\r\n- a system crash dump file\r\n"},"comment":{"url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/comments/396535311","html_url":"https://github.com/tandasat/HyperPlatform/issues/54#issuecomment-396535311","issue_url":"https://api.github.com/repos/tandasat/HyperPlatform/issues/54","id":396535311,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjUzNTMxMQ==","user":{"login":"leeqwind","id":10241894,"node_id":"MDQ6VXNlcjEwMjQxODk0","avatar_url":"https://avatars3.githubusercontent.com/u/10241894?v=4","gravatar_id":"","url":"https://api.github.com/users/leeqwind","html_url":"https://github.com/leeqwind","followers_url":"https://api.github.com/users/leeqwind/followers","following_url":"https://api.github.com/users/leeqwind/following{/other_user}","gists_url":"https://api.github.com/users/leeqwind/gists{/gist_id}","starred_url":"https://api.github.com/users/leeqwind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leeqwind/subscriptions","organizations_url":"https://api.github.com/users/leeqwind/orgs","repos_url":"https://api.github.com/users/leeqwind/repos","events_url":"https://api.github.com/users/leeqwind/events{/privacy}","received_events_url":"https://api.github.com/users/leeqwind/received_events","type":"User","site_admin":false},"created_at":"2018-06-12T09:59:15Z","updated_at":"2018-06-12T09:59:15Z","author_association":"NONE","body":"BTW the target to judge should be the source operand of the `mov cr3, ecx` instruction rather than the value of kGuestCr3 when handling CR3 writting access since the value has not been written into kGuestCr3 yet."}}
{"actor":{"display_login":"leeqwind"}}