Re: [patch] kvm: make cr3 loading more robust

Avi Kivity
2007-01-03T12:01:32Z

Avi Kivity wrote:
> Ingo Molnar wrote:
>> * Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org> wrote:
>>
>>
>>>> rmap_write_protect() has a BUG_ON() if a physical address is not
>>>> found the the memslot. But this is a possible scenario if a buggy
>>>> guest OS loads an invalid or corrupted cr3 value. So exit more
>>>> gracefully.
>>>>
>>> I think a better solution is to detect the invalid cr3 in new_cr3().
>>> That way the entire chain of error returns is avoided.
>>>
>>
>> i'm wondering what the right semantics would be though. Kill the VM
>> context?
>>
>> on a real CPU an invalid cr3 does nothing explicitly (besides being a
>> sure way to get a triple fault) - physical memory is always
>> accessible, non-present physical memory at most generates an #MCE,
>> but is typically just returning 0xff, right? So perhaps keep a
>> non-mapped page filled with 0xff and map non-existent RAM to that?
>> But then this 'RAM' needs to be made non-writable.
>
> That's a good solution. I don't see why it has to be made
> non-writable -- it has undefined content, and any old value will do.
> We have (or maybe had) something like that somewhere.

It probably solves other cases as well, and simplifies error handling
elsewhere.