Hello, I''ve seen that, once the hypervisor code decides that it should send a mem_event to userspace in p2m_mem_access_check() (file: xen/arch/x86/mm/p2m.c), it first pauses the VCPU that tried to write to a page that doesn''t allow writes. Then, control is handed over to userspace, and then back to the hypervisor via p2m_mem_access_resume(), which looks like this: void p2m_mem_access_resume(struct domain *d) { mem_event_response_t rsp; /* Pull all responses off the ring */ while( mem_event_get_response(d, &d->mem_event->access, &rsp) ) { if ( rsp.flags & MEM_EVENT_FLAG_DUMMY ) continue; /* Unpause domain */ if ( rsp.flags & MEM_EVENT_FLAG_VCPU_PAUSED ) vcpu_unpause(d->vcpu[rsp.vcpu_id]); } } What I want to do is: based on the response received from userspace (i.e. if ( rsp.flags & MY_FLAG ) ...), allow the write instruction (without unprotecting the page) and move on. This means: I want to be able to receive a page fault mem_event caused by a write only once, _without_ lifting the write restrictions. I''ve tried to achieve this by using hvm_emulate_one(), but in order to be able to use it, I need a valid struct cpu_user_regs *parameter. As I''ve written to xen-devel in a previous thread, I''ve initially tried to obtain that via guest_cpu_user_regs(), which was not the way to go. I''ve recently tried &(d->vcpu[rsp.vcpu_id]->arch.user_regs) instead, with similar success. I''ve even passed a valid struct cpu_user_regs *parameter to p2m_mem_access_check(), from ept_handle_violation() down, and kept that pointer to use later on from p2m_mem_access_resume(). Nothing has worked so far. Is it possible, in theory, to achieve what I''m after? Is there another way I might be able to achieve it, if emulating the write instruction is not possible there? How does p2m_mem_access_resume() fit into the overall code flow, and what can (and can''t) I do from it''s scope, related to the specific vcpu I''m interested in? Thank you in advance for your replies, Razvan Cojocaru