Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752930AbdHQPQN (ORCPT ); Thu, 17 Aug 2017 11:16:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52666 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751882AbdHQPQL (ORCPT ); Thu, 17 Aug 2017 11:16:11 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 69391C04B317 Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=mst@redhat.com Date: Thu, 17 Aug 2017 18:15:56 +0300 From: "Michael S. Tsirkin" To: Paolo Bonzini Cc: Radim =?utf-8?B?S3LEjW3DocWZ?= , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] kvm: x86: disable KVM_FAST_MMIO_BUS Message-ID: <20170817180129-mutt-send-email-mst@kernel.org> References: <9de5ebf5-457d-2a34-0314-c6c612ddb2e9@redhat.com> <20170816161301-mutt-send-email-mst@kernel.org> <20170816194342-mutt-send-email-mst@kernel.org> <81dabc78-edfd-32fc-024c-c57330386a51@redhat.com> <20170816190316.GA2566@flask> <20170816224815-mutt-send-email-mst@kernel.org> <20170817011815-mutt-send-email-mst@kernel.org> <2e42e64c-f31d-5ccd-2357-1a859cec5b5b@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2e42e64c-f31d-5ccd-2357-1a859cec5b5b@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 17 Aug 2017 15:16:11 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1098 Lines: 26 On Thu, Aug 17, 2017 at 11:00:01AM +0200, Paolo Bonzini wrote: > >> and also not a page table walk---just in case. > > > > I still don't get it, sorry. Let's assume for the sake of argument > > that it's a PT walk causing the MMIO access. Just why do you think > > that it makes sense to skip the instruction that caused the walk? > > I think it doesn't. I think in that case it's better to skip the fast > write and proceed with full emulation. Right. So my argument is that fast mmio is used for paravirtualization exclusively. Thus someone doing anything that isn't a memory write to trigger it gets to keep both pieces. I get it that even writes don't work in some nested virt setups, and this seems worth fixing, and I get it that we have inadvertently relied on an undocumented behaviour. I would like to understand whether you believe that on bare metal and when accessing MMIO using writes exclusively, and after checking the address matches one of the paravirtualized device, there's still a real chance length is invalid, or is it more a question of missing documentation. -- MST