Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\))
Subject: Re: [PATCH] KVM: X86: Avoid explictly fetch instruction in
 x86_decode_insn()
From:   Nadav Amit <nadav.amit@gmail.com>
In-Reply-To: <ad023c34-9a08-7d61-22de-911c4e8760ba@redhat.com>
Date:   Wed, 4 Mar 2020 12:30:30 -0800
Cc:     Peter Xu <peterx@redhat.com>, linmiaohe <linmiaohe@huawei.com>,
        Sean Christopherson <sean.j.christopherson@intel.com>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "kvm@vger.kernel.org" <kvm@vger.kernel.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <13E8DCB7-D977-49AD-B63F-8BF4B06B096E@gmail.com>
References: <05ca4e7e070844dd92e4f673a1bc15d9@huawei.com>
 <20200304153253.GB7146@xz-x1>
 <ad023c34-9a08-7d61-22de-911c4e8760ba@redhat.com>
To:     Paolo Bonzini <pbonzini@redhat.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> On Mar 4, 2020, at 10:19 AM, Paolo Bonzini <pbonzini@redhat.com> =
wrote:
>=20
> On 04/03/20 16:32, Peter Xu wrote:
>>> Looks good, thanks. But it seems we should also take care of the =
comment in __do_insn_fetch_bytes(), as we do not
>>> load instruction at the beginning of x86_decode_insn() now, which =
may be misleading:
>>> 		/*
>>>         * One instruction can only straddle two pages,
>>>         * and one has been loaded at the beginning of
>>>         * x86_decode_insn.  So, if not enough bytes
>>>         * still, we must have hit the 15-byte boundary.
>>>         */
>>>        if (unlikely(size < op_size))
>>>                return emulate_gp(ctxt, 0);
>> Right, thanks for spotting that (even if the patch to be dropped :).
>>=20
>> I guess not only the comment, but the check might even fail if we
>> apply the patch. Because when the fetch is the 1st attempt and
>> unluckily that acrosses one page boundary (because we'll only fetch
>> until either 15 bytes or the page boundary), so that single fetch
>> could be smaller than op_size provided.
>=20
> Right, priming the decode cache with one byte from the current page
> cannot fail, and then we know that the next call must be at the
> beginning of the next page.

IIRC I encountered (and fixed) a similar KVM bug in the past. It is a =
shame
I never wrote a unit test (and I don=E2=80=99t have time now), but it =
would be nice
to have one.