tandasat / MemoryMon

Detecting execution of kernel memory where is not backed by any image file
MIT License
253 stars 97 forks source link

rwe: add VPID support for better performance and cache invalidation #2

Closed tandasat closed 8 years ago

tandasat commented 8 years ago

Add VPID support to retain cache and gain performance benefit. Only downside of it would be that older processors might not support it and HyperPlatform could drop their support, but seems that the VPID feature is old enough to ignore this impact.

Also, Intel SDM describes that some cache invalidation should|can be done. Review the description and implement them. At this time, HyperPlatform would need those two invalidation.

Guidelines for Use of the INVVPID Instruction

Software can use the INVVPID instruction with the “all-context” INVVPID type immediately after execution of the VMXON instruction or immediately prior to execution of the VMXOFF instruction. Either prevents potentially undesired retention of information cached from paging structures between separate uses of VMX operation.

Guidelines for Use of the INVEPT Instruction

Software can use the INVEPT instruction with the “all-context” INVEPT type immediately after execution of the VMXON instruction or immediately prior to execution of the VMXOFF instruction. Either prevents potentially undesired retention of information cached from EPT paging structures between separate uses of VMX operation.

Do not forget test code with real hardware since VMware is unlikely to implement cache behaviour perfectly.

tandasat commented 8 years ago

https://github.com/tandasat/HyperPlatform/commit/48965cfae4b9d9d7d06af2a417c7606fa7a1c189