Showing results for 
Search instead for 
Did you mean: 

VT-x mtf Monitor Trap Flag windows

I use intel vt-x to monitor windows kernel memory access.I set mtf after every time windows kernel access memory, but In the end the guest always shows running in windbg and the guest shows stuck, do not response. I want to know what happened there.

0 Kudos
4 Replies

Hello frankenstein,

Thank you for posting on the Intel* Community.

To better assist you, please run the following tool in Windows* and attach the report generated. 


Intel® System Support Utility (Intel® SSU) 


  • Intel® SSU Download
  • Open the application and click on "Scan" to see the system and device information. By default, Intel® SSU will take you to the "Summary View". 
  • Click on the menu where it says "Summary" to change to "Detailed View". 
  • To save your scan, click on "Next", then "Save". 

Best regards,

Maria R.

Intel Customer Support Technician


Maybe I do not epress myself clear. I develop a driver based on intel vt-x. I run windows in VMware and connect to it by windbg.And I deployment the driver in the windows ,and the windbg just shows that the "guest is busy" no error report. 

I will show you some of the code.

1. set the kernel corrponsed's ept entry unread and unwrite

  const auto pm_ranges = UtilGetPhysicalMemoryRanges();
  for (auto run_index = 0ul; run_index < pm_ranges->number_of_runs;
       ++run_index) {
    const auto run = &pm_ranges->run[run_index];
    const auto base_addr = run->base_page * PAGE_SIZE;
    for (auto page_index = 0ull; page_index < run->page_count; ++page_index) {
      const auto indexed_addr = base_addr + page_index * PAGE_SIZE;
      const auto ept_pt_entry = EptGetEptPtEntry(ept_data, indexed_addr);
      //    if (!ept_pt_entry)
      // Mark the page as non-executable if it is not a non-pagable section of
      // a system module.
      const auto va = UtilVaFromPa(indexed_addr);
      if (!UtilPcToFileHeader(va) &&UtilIsInSystemRange(va) &&
          !UtilIsNonPageableAddress(va, pfn_database, is_v6_kernel)) {
        ept_pt_entry->fields.read_access = false;
        ept_pt_entry->fields.write_access = false;

2.once wm-exiting happen ,set the ept entry readable and writeable,and set Monitor Trap Flag

ept_pt_entry->fields.read_access = true;
ept_pt_entry->fields.write_access = true;



3.then when a vm-exiting happen because of mtf, reset the ept entry unread/unwrite,and disable mtf.

  disabledEntry->fields.read_access = false;
  disabledEntry->fields.write_access = false;



I can not get error code or something information,so I can not give such things


Hello frankenstein,

Thank you for the information.

The kind of support you're requesting is provided by a different support team. I will move your thread. Please expect a response soon.

Best regards, 

Maria R.  

Intel Customer Support Technician 


Hello frankenstein,

We have been checking this internally to help you to guide your request to the proper support team.

In this case, these are our recommendations:

Please, post your inquiry in the proper Developer Zone forums:


From the following link: you can click on "Forum" and you should be redirected to "Intel Community - Software Products". Then you should see a list of different common topics about "Software products" where you may select to post your question on the appropriate topic.


You may also try the following:

1- Go to

2- Under "Browse Community Forums" click on the disclosure widget (the rotating black triangle) to expand the section "Software Products". You should see a list of topics, and you can also expand the topics to display additional "sub-topics".

3- You can choose one of the topics that best relate to your questions and products. For instance, this an example of OpenCL* topics:

4- The a community peer may help you with your inquiry.

If you are not able to gather the proper information/support the best is a direct engagement with Intel*, you will have to submit the issue through Intel Premier Support (IPS). If you already have a Field Application Engineer (FAE) assigned he may help you with this request or through your closes Intel Authorized Distributor.

If you need any additional information, please submit a new question as this thread will no longer being monitored.

Best regards,

Maria R.

Intel Customer Support Technician