Re: [PATCH 7/8] KVM: MMU: VMX cr3 cache support

[Marcelo Tosatti <marcelo@kvack.org>]

On Thu, Mar 06, 2008 at 04:44:26PM +0200, Avi Kivity wrote:
> Marcelo Tosatti wrote:
> >>
> >>Here CR3_TARGET_VALUEx is written.
> >>My question is:
> >>1 why is vmcs_writel(CR3_TARGET_VALUE0 + idx*2, cr3); called by
> >>vmx_set_cr3(), but not called by mmu_free_roots()?
> >>    
> >
> >By clearing guest_cr3 entry of the shared area we avoid the guest from
> >using it.
> >
> >So its unecessary to also clear the corresponding CR3_TARGET_VALUE0
> >register.
> >
> >  
> >>2 since "cache" is also mapped to guest OS. Is calling
> >>vmcs_writel(CR3_TARGET_VALUE0 + idx*2, cr3); necessary?
> >>    
> >
> >As said above, no, because the guest will check
> >cache->entry[idx].guest_cr3 before attempting to use a cached host_cr3
> >value.
> >  
> 
> 
> Only if you trust the guest.

If a guest manages to catch a stale entry in the CR3_TARGET_VALUE0
register it will hit:

+       /*
+        * Figure out whether vcpu->cr3 needs updating because
+        * the guest made use of the cr3 cache.
+        */
+       kvm_cr3_cache_sync(vcpu);
+       WARN_ON(vmcs_readl(GUEST_CR3) != vcpu->arch.mmu.root_hpa[vcpu->arch.cr3_cache_idx]);

And have the shadow root table pointer unsynced with its cr3. I can't
see how it could cause any damage to the host (the guest is will very
likely die due to that).


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/