Re: [patch] kvm: make cr3 loading more robust

Avi Kivity
2007-01-03T12:59:47Z

Ingo Molnar wrote:
> * Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org> wrote:
>
>
>> Note that the corner cases will never be 100% emulatable. For
>> example, you can set cr3 to point at your IDE DMA mmio space or
>> something like that. It's quite all right to kill the guest quietly
>> at that point, as no real-life guest will do that.
>>
>
> yes. Or to map the lapic to the IDT ;-) (as yours truly has tried it
> years ago)
>
> that's why my suggestion is to just kill the guest. Loading such a cr3
> is a serious bug that might be hard to debug in the guest. I had to
> debug at least one such bug in Linux before (years ago, in the lazy TLB
> switching code) and it was a royal PITA to track down. Having a
> hypervisor that points any cr3 load error out /before/ the effects of
> the error propagate further is a bonus, not an incompatibility. The CPU
> does not implement this not because the semantics is important, but i
> suspect mostly because it doesnt really know the boundaries and type of
> RAM.
>
>
>> The kvm goals do not include cycle accurate emulation. [...]
>>
>
> yes. That's why i'm suggesting to kill the VM in such a scenario. A cr3
> value is only valid if it points to real RAM.
>
>

Yes.

The value of the bad ram page is that it avoids a check in many places
where a guest page is referenced, and so reduces the number of hard to
test error paths. It's hard to make the case for cr3 changes alone, but
when you consider demand faulting, it makes more sense.