From nobody Sat Jul 25 20:07:53 2026 Received: from out28-145.mail.aliyun.com (out28-145.mail.aliyun.com [115.124.28.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CE802EEE88; Tue, 14 Jul 2026 05:10:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.145 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005850; cv=none; b=uGRsLpPg1EhNfPiHtxwl7k2StrWENo2p8EnkQMAhLFscgucV5B2PUI8M+DvPrbdxdr8aLc8YMmlUZCFGgZcFfAnh5IgBUqsapoddlVPS6K7aInX2R3XyIM96Ox74WVxhGBQN2NO3mPbQc9WVblzcjGeHvhsZfSoQmkUt//4rA88= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005850; c=relaxed/simple; bh=pQIQs+5gmtpHA1a9k1pi8+2qzdJacoqncWTMdmFXoUw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UHmEjJDt3yO28jrQDWyfqMA9yUqTAoDXj/K43RfuxpVja7IRIsY6lkF59V0nvCn2K2lSPV1c8aBLIH/Q9k5D/I/GddBEXYiks7TY+GobOZ+46w5cxX1671ZmipfSDmDRMoFnp8mvMtfmc+zAQxDN94j/3H2MA1/IxMujS7HpWak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.145 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.07876458|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_alarm|0.130429-0.00019804-0.869373;FP=16580402972953747187|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033045018182;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCX9_1784005835; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCX9_1784005835 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:35 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 1/8] KVM: x86: Add intercept_linear_addr to x86_instruction_info Date: Tue, 14 Jul 2026 13:09:57 +0800 Message-ID: <6a7b096f43b0e97c6690160a407fd52162cfc1e6.1783999988.git.zhang_wei@open-hieco.net> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add intercept_linear_addr to x86_instruction_info so that the emulator can pass linear addresses needed by intercept handlers. Populate the field for INVLPG from its decoded memory operand. INVLPG is decoded with NoAccess, and therefore src_val does not contain the operand address. Calculate the address in the emulator, where the decoded segment and effective address are available. Signed-off-by: Tina Zhang --- arch/x86/kvm/emulate.c | 30 ++++++++++++++++++++++-------- arch/x86/kvm/kvm_emulate.h | 1 + 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 8013dccb3110..03bf95417275 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -410,6 +410,27 @@ static int em_salc(struct x86_emulate_ctxt *ctxt) _fault ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE; \ }) =20 +static unsigned long seg_base(struct x86_emulate_ctxt *ctxt, int seg) +{ + if (ctxt->mode =3D=3D X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS) + return 0; + + return ctxt->ops->get_cached_segment_base(ctxt, seg); +} + +/* Return the linear address for intercepts that report one. */ +static u64 get_intercept_linear_addr(struct x86_emulate_ctxt *ctxt, + enum x86_intercept intercept) +{ + u64 la; + + if (intercept !=3D x86_intercept_invlpg) + return 0; + + la =3D seg_base(ctxt, ctxt->src.addr.mem.seg) + ctxt->src.addr.mem.ea; + return ctxt->mode =3D=3D X86EMUL_MODE_PROT64 ? la : (u32)la; +} + static int emulator_check_intercept(struct x86_emulate_ctxt *ctxt, enum x86_intercept intercept, enum x86_intercept_stage stage) @@ -427,6 +448,7 @@ static int emulator_check_intercept(struct x86_emulate_= ctxt *ctxt, .src_type =3D ctxt->src.type, .dst_type =3D ctxt->dst.type, .ad_bytes =3D ctxt->ad_bytes, + .intercept_linear_addr =3D get_intercept_linear_addr(ctxt, intercept), .rip =3D ctxt->eip, .next_rip =3D ctxt->_eip, }; @@ -520,14 +542,6 @@ static u32 desc_limit_scaled(struct desc_struct *desc) return desc->g ? (limit << 12) | 0xfff : limit; } =20 -static unsigned long seg_base(struct x86_emulate_ctxt *ctxt, int seg) -{ - if (ctxt->mode =3D=3D X86EMUL_MODE_PROT64 && seg < VCPU_SREG_FS) - return 0; - - return ctxt->ops->get_cached_segment_base(ctxt, seg); -} - static int emulate_exception(struct x86_emulate_ctxt *ctxt, int vec, u32 error, bool valid) { diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h index 0abff36d0994..900bd95e9e55 100644 --- a/arch/x86/kvm/kvm_emulate.h +++ b/arch/x86/kvm/kvm_emulate.h @@ -47,6 +47,7 @@ struct x86_instruction_info { u8 src_type; /* type of source operand */ u8 dst_type; /* type of destination operand */ u8 ad_bytes; /* size of src/dst address */ + u64 intercept_linear_addr; /* arch-reported linear address, if any */ u64 rip; /* rip of the instruction */ u64 next_rip; /* rip following the instruction */ }; --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out28-75.mail.aliyun.com (out28-75.mail.aliyun.com [115.124.28.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F16B1AAE28; Tue, 14 Jul 2026 05:16:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.75 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784006165; cv=none; b=ZQQOOyb6SjRZOy8UVVTaezmEzg2QhSIGVNguBLzCcsqC16fZ+Kbb2pehgFc9FAKJAwRfhJesm2f1rCkJYkNClnv6C9jxr4jrdgvNulPnbrqMTk/Pnnsi5AU/CO5NsybdcHWm/AUvZWze/u7HlJUx09PihNK+7gI2OQqAaTh/A4Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784006165; c=relaxed/simple; bh=4dUa7eQJddOaaDTOSb1GKzqKEPvJK6UnUQEmdpQ8Q5k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m3Zo00Me6T0daBtAuagtDrHwj6mfvtMvH1s2zbh4iLJTCk+oBIzgxbBaUtXZdvRE+/bk7aY/tERQpXswyuGmomY0nNOxsQ7AxSi0w4xoER5Gf7P+aLdhs3ObcDA8Fq4KXr8uMHW2yEXEXTuECwyn/SVirhyGWQcI8/pymg4wgzk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.75 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.09963188|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.0956124-8.82729e-05-0.904299;FP=4965285672310604979|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037025160;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCYB_1784005835; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCYB_1784005835 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:36 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 2/8] KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts Date: Tue, 14 Jul 2026 13:09:58 +0800 Message-ID: X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When the x86 emulator encounters an instruction intercepted by L1, svm_check_intercept() synthesizes a nested VM-Exit without fresh hardware DecodeAssist state. Populate the architectural EXITINFO fields when DecodeAssists is exposed to L1. Generate EXITINFO1 with the GPR number for MOV CR/DR, the interrupt vector for INTn, and the linear address for INVLPG. Set EXITINFO1 to zero for CLTS, LMSW, SMSW, and INVLPGA; the INVLPGA address remains in guest rAX. Clear EXITINFO2 for all covered intercepts and leave unrelated intercepts unchanged. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/svm.c | 48 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e02a38da5296..cc35afb59623 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -4754,6 +4754,52 @@ static const struct __x86_intercept { #undef POST_EX #undef POST_MEM =20 +static void svm_prepare_decode_assist_exit_info(struct kvm_vcpu *vcpu, + const struct x86_instruction_info *info) +{ + struct vmcb *vmcb =3D to_svm(vcpu)->vmcb; + u64 exit_info_1; + + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS)) + return; + + switch (info->intercept) { + case x86_intercept_cr_read: + case x86_intercept_cr_write: + /* MOV CRx: bit 63 set, GPR number in bits 3:0. */ + exit_info_1 =3D BIT_ULL(63) | (info->modrm_rm & 0xf); + break; + case x86_intercept_clts: + case x86_intercept_lmsw: + case x86_intercept_smsw: + /* CLTS/LMSW/SMSW: no decode information, bit 63 clear. */ + exit_info_1 =3D 0; + break; + case x86_intercept_dr_read: + case x86_intercept_dr_write: + /* MOV DRx: GPR number in bits 3:0. */ + exit_info_1 =3D info->modrm_rm & 0xf; + break; + case x86_intercept_intn: + /* INTn: software interrupt number in bits 7:0. */ + exit_info_1 =3D info->src_val & 0xff; + break; + case x86_intercept_invlpg: + /* INVLPG: linear address of the target page. */ + exit_info_1 =3D info->intercept_linear_addr; + break; + case x86_intercept_invlpga: + /* INVLPGA: the address remains available in guest rAX. */ + exit_info_1 =3D 0; + break; + default: + return; + } + + vmcb->control.exit_info_1 =3D exit_info_1; + vmcb->control.exit_info_2 =3D 0; +} + static int svm_check_intercept(struct kvm_vcpu *vcpu, struct x86_instruction_info *info, enum x86_intercept_stage stage, @@ -4875,6 +4921,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, break; } =20 + svm_prepare_decode_assist_exit_info(vcpu, info); + /* TODO: Advertise NRIPS to guest hypervisor unconditionally */ if (static_cpu_has(X86_FEATURE_NRIPS)) vmcb->control.next_rip =3D info->next_rip; --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out28-2.mail.aliyun.com (out28-2.mail.aliyun.com [115.124.28.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F37C530C366; Tue, 14 Jul 2026 05:16:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784006168; cv=none; b=SVnaw5OfTZw5U0jEZTNgwiz8zu63480pUQMld9IlL+FEHXKrBBSxZlqVelus9Fuw9wbi6opmRCiXx0PVGOJ9azP8kVhWKI2jIeX1eXj2QQCepa4Jg7zaAnN1a+Qer/CuptFq/MRnAMyLgW8miqAJ9kKh4AdWrebTdjjDdIJ8PmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784006168; c=relaxed/simple; bh=8/aeiul7ytSuPSONOJ3OYEypaAEzsL7B+p5izsk250E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EDZXxfUharnLFVbc67pBTQk4m+kAzBEFOjSofESuLAxpd0K3iZFQSc2Om3ttPubHemBYVMq/CfKchU6OshluoWslAN5HsRB5TwYPsm0tRj7JyFRkhyQzSOtpoUWRD8y6kJgryIYVwcvn+0i66OZL5t8aVFAoMIGvGfwlPF5KoIw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.07436476|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.0066315-0.00233629-0.991032;FP=14769882741064011514|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037021130;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCZM_1784005836; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCZM_1784005836 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:36 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 3/8] KVM: nSVM: Track fresh VMCB02 DecodeAssist bytes Date: Tue, 14 Jul 2026 13:09:59 +0800 Message-ID: X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Only hardware VM-Exits provide fresh DecodeAssist instruction bytes in VMCB02. KVM-synthesized nested VM-Exits must not reuse whatever bytes were left by an earlier hardware exit. Track whether VMCB02 contains DecodeAssist instruction bytes from the hardware VM-Exit currently being reflected to L1, and clear the fields before each nested run so stale bytes cannot be mistaken for fresh hardware state. The flag is consumed by a later change that propagates hardware-provided DecodeAssist bytes to VMCB12. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/nested.c | 20 +++++++++++++++++--- arch/x86/kvm/svm/svm.c | 6 +++--- arch/x86/kvm/svm/svm.h | 9 ++++++++- 3 files changed, 28 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index b340dc9991ad..70e2ee3af78b 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -33,13 +33,21 @@ =20 #define CC KVM_NESTED_VMENTER_CONSISTENCY_CHECK =20 +static void nested_svm_clear_insn_bytes(struct vmcb *vmcb) +{ + vmcb->control.insn_len =3D 0; + memset(vmcb->control.insn_bytes, 0, + sizeof(vmcb->control.insn_bytes)); +} + static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu, struct x86_exception *fault) { struct vcpu_svm *svm =3D to_svm(vcpu); struct vmcb *vmcb =3D svm->vmcb; + bool from_hardware =3D vmcb->control.exit_code =3D=3D SVM_EXIT_NPF; =20 - if (vmcb->control.exit_code !=3D SVM_EXIT_NPF) { + if (!from_hardware) { /* * TODO: track the cause of the nested page fault, and * correctly fill in the high bits of exit_info_1. @@ -52,6 +60,7 @@ static void nested_svm_inject_npf_exit(struct kvm_vcpu *v= cpu, vmcb->control.exit_info_1 &=3D ~0xffffffffULL; vmcb->control.exit_info_1 |=3D fault->error_code; =20 + svm->nested.vmcb02_insn_bytes_fresh =3D from_hardware; nested_svm_vmexit(svm); } =20 @@ -838,7 +847,10 @@ static void nested_vmcb02_prepare_control(struct vcpu_= svm *svm) /* * Filled at exit: exit_code, exit_info_1, exit_info_2, exit_int_info, * exit_int_info_err, next_rip, insn_len, insn_bytes. + * Clear stale DecodeAssist data before L2 runs. */ + nested_svm_clear_insn_bytes(vmcb02); + svm->nested.vmcb02_insn_bytes_fresh =3D false; =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_VGIF) && (vmcb12_ctrl->int_ctl & V_GIF_ENABLE_MASK)) @@ -1587,14 +1599,16 @@ static int nested_svm_intercept(struct vcpu_svm *sv= m) return vmexit; } =20 -int nested_svm_exit_handled(struct vcpu_svm *svm) +int nested_svm_exit_handled(struct vcpu_svm *svm, bool vmcb02_insn_bytes_f= resh) { int vmexit; =20 vmexit =3D nested_svm_intercept(svm); =20 - if (vmexit =3D=3D NESTED_EXIT_DONE) + if (vmexit =3D=3D NESTED_EXIT_DONE) { + svm->nested.vmcb02_insn_bytes_fresh =3D vmcb02_insn_bytes_fresh; nested_svm_vmexit(svm); + } =20 return vmexit; } diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index cc35afb59623..2c04a8d9da29 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2544,7 +2544,7 @@ static bool check_selective_cr0_intercepted(struct kv= m_vcpu *vcpu, =20 if (cr0 ^ val) { svm->vmcb->control.exit_code =3D SVM_EXIT_CR0_SEL_WRITE; - ret =3D (nested_svm_exit_handled(svm) =3D=3D NESTED_EXIT_DONE); + ret =3D (nested_svm_exit_handled(svm, false) =3D=3D NESTED_EXIT_DONE); } =20 return ret; @@ -3671,7 +3671,7 @@ static int svm_handle_exit(struct kvm_vcpu *vcpu, fas= tpath_t exit_fastpath) vmexit =3D nested_svm_exit_special(svm); =20 if (vmexit =3D=3D NESTED_EXIT_CONTINUE) - vmexit =3D nested_svm_exit_handled(svm); + vmexit =3D nested_svm_exit_handled(svm, true); =20 if (vmexit =3D=3D NESTED_EXIT_DONE) return 1; @@ -4927,7 +4927,7 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, if (static_cpu_has(X86_FEATURE_NRIPS)) vmcb->control.next_rip =3D info->next_rip; vmcb->control.exit_code =3D icpt_info.exit_code; - vmexit =3D nested_svm_exit_handled(svm); + vmexit =3D nested_svm_exit_handled(svm, false); =20 ret =3D (vmexit =3D=3D NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED : X86EMUL_CONTINUE; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 5137416be593..fa65f6a1a59b 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -238,6 +238,13 @@ struct svm_nested_state { * on its side. */ bool force_msr_bitmap_recalc; + + /* + * True if VMCB02's DecodeAssist instruction bytes belong to the hardware + * VM-Exit currently being reflected to L1. KVM-synthesized exits leave + * it clear. + */ + bool vmcb02_insn_bytes_fresh; }; =20 struct vcpu_sev_es_state { @@ -864,7 +871,7 @@ static inline void nested_svm_simple_vmexit(struct vcpu= _svm *svm, u32 exit_code) nested_svm_vmexit(svm); } =20 -int nested_svm_exit_handled(struct vcpu_svm *svm); +int nested_svm_exit_handled(struct vcpu_svm *svm, bool vmcb02_insn_bytes_f= resh); int nested_svm_check_permissions(struct kvm_vcpu *vcpu); int nested_svm_check_cached_vmcb12(struct kvm_vcpu *vcpu); int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr, --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out28-146.mail.aliyun.com (out28-146.mail.aliyun.com [115.124.28.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 405F42EEE9E; Tue, 14 Jul 2026 05:10:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.146 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005851; cv=none; b=NiFa5oCnHy9EqpWPZsBPfl5el4gWzNlKe+saA7hOc/E8gaGtcX15bu4Xg/DlzqQUgSpNQCDfdKUtfxLcW/ImF6RAkapgClftN4ZQe42qSDrs95CAYSC1Rlggcs8Qy9E83Tcedo79IgV8+adcDwqg1Mih/uZ6ccTXHH3sqzvxnn8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005851; c=relaxed/simple; bh=bjj33wySkv4V1fyTH1jdRrmoSvUQ3NreRObG2rTkofo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WXnGs2YfJ3TA8bY1tDXSWuY80eeOdanp4NPthbmkKt8Z1bug85f1pEOR60rlFCCgKB/qmxmXb7QBGT8RenYzqqgkX4PeAE7GKbeTcSgtyVFbUXMgTBPflGlcDrnhg6A2+ePI0B0AMi5mTOXVj4HKm4rhSVW/QZ316HVRvvMr2Tw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.146 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.0743687|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_regular_dialog|0.00277275-0.000469179-0.996758;FP=12601192811204381883|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033045213054;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCaE_1784005837; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCaE_1784005837 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:37 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 4/8] KVM: nSVM: Propagate hardware DecodeAssist bytes to VMCB12 Date: Tue, 14 Jul 2026 13:10:00 +0800 Message-ID: X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When DecodeAssists is exposed to L1, copy fresh hardware instruction bytes from VMCB02 to VMCB12 for data #NPF and intercepted #PF VM-Exits. Clear VMCB12's instruction-byte state for instruction-fetch faults, unrelated exits, and exits without fresh VMCB02 state so that stale bytes are not exposed to L1. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/nested.c | 53 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 70e2ee3af78b..9e12eab7eed9 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -40,6 +40,57 @@ static void nested_svm_clear_insn_bytes(struct vmcb *vmc= b) sizeof(vmcb->control.insn_bytes)); } =20 +static void nested_svm_copy_insn_bytes(struct vmcb *to, + const struct vmcb *from) +{ + u8 insn_len =3D from->control.insn_len; + + nested_svm_clear_insn_bytes(to); + + if (WARN_ON_ONCE(insn_len > sizeof(from->control.insn_bytes))) + return; + + to->control.insn_len =3D insn_len; + memcpy(to->control.insn_bytes, from->control.insn_bytes, insn_len); +} + +static bool nested_svm_vmexit_supports_insn_bytes(struct kvm_vcpu *vcpu, + const struct vmcb *vmcb12) +{ + u64 exit_code =3D vmcb12->control.exit_code; + + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS)) + return false; + + if (exit_code !=3D SVM_EXIT_NPF && + exit_code !=3D SVM_EXIT_EXCP_BASE + PF_VECTOR) + return false; + + return !(vmcb12->control.exit_info_1 & PFERR_FETCH_MASK); +} + +/* + * Rebuild VMCB12's DecodeAssist bytes for the nested VM-Exit. Use fresh + * hardware VMCB02 state when available; otherwise report a zero byte coun= t. + */ +static void nested_svm_update_vmcb12_insn_bytes(struct kvm_vcpu *vcpu, + struct vmcb *vmcb12, + struct vmcb *vmcb02) +{ + struct vcpu_svm *svm =3D to_svm(vcpu); + bool vmcb02_insn_bytes_fresh =3D svm->nested.vmcb02_insn_bytes_fresh; + + svm->nested.vmcb02_insn_bytes_fresh =3D false; + + nested_svm_clear_insn_bytes(vmcb12); + + if (!nested_svm_vmexit_supports_insn_bytes(vcpu, vmcb12)) + return; + + if (vmcb02_insn_bytes_fresh) + nested_svm_copy_insn_bytes(vmcb12, vmcb02); +} + static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu, struct x86_exception *fault) { @@ -1263,6 +1314,8 @@ static int nested_svm_vmexit_update_vmcb12(struct kvm= _vcpu *vcpu) if (guest_cpu_cap_has(vcpu, X86_FEATURE_NRIPS)) vmcb12->control.next_rip =3D vmcb02->control.next_rip; =20 + nested_svm_update_vmcb12_insn_bytes(vcpu, vmcb12, vmcb02); + if (nested_vmcb12_has_lbrv(vcpu)) svm_copy_lbrs(&vmcb12->save, &vmcb02->save); =20 --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out198-28.us.a.mail.aliyun.com (out198-28.us.a.mail.aliyun.com [47.90.198.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF68B2F1FDE; Tue, 14 Jul 2026 05:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=47.90.198.28 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005862; cv=none; b=UWlPN2wylvkJab2FF3SNy54d5IVzP8WNPnOwvUTsNwhMyQ/xo6cZIGf/Pt7fyMLVNN+aIcbNQfMxPY3XOp975A/e1pi04j3N9/Ro38MGLQQMjRN5UMjyxn0tqSdnQ5jtzBPsxV+2mgUbLIRDY0Ngl45158yxjNtYinE9DDLeZHY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005862; c=relaxed/simple; bh=31ioZjMW5Mxl9hif23064/Z1GgpF2XRJdIgBJY2lNQ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S5vbMPqOBOMuwMW4aiTpmWGzaySMp0oyf6rkq/NuDu9aGL/FUMme7eSPu1WCtppJDBetylvK/6x31P9VWiakBnks0wzFKVDO1yoxIQRuSavtecHCXWpvIyavn93SwQWf5/b4rW4ta+Qhd7OXaicts9eRU83b31DF5bI9RLgeQQg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=47.90.198.28 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.07436259|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_alarm|0.00280468-0.000381889-0.996813;FP=18330615963761446395|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037006180;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCbB_1784005837; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCbB_1784005837 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:38 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 5/8] KVM: nSVM: Use emulator bytes for synthesized nested #NPF/#PF Date: Tue, 14 Jul 2026 13:10:01 +0800 Message-ID: X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" SVM DecodeAssists records up to 15 instruction bytes from L2 CS:RIP for data-access #NPF and intercepted #PF exits. For nested VM-Exits reflected directly from hardware, KVM can copy the fresh VMCB02 DecodeAssist bytes into VMCB12. KVM-synthesized #NPF/#PF exits, however, do not have fresh hardware DecodeAssist bytes in VMCB02. When KVM synthesizes a nested #NPF/#PF from emulator context and the emulator fetch cache still matches L2 RIP, populate a synthesized instruction-byte buffer from those already-fetched bytes and copy them into VMCB12 when constructing the nested VM-Exit for L1. Consume the synthesized buffer exactly once and clear it before each nested run, so stale emulator bytes cannot leak into unrelated nested VM-Exits. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/nested.c | 56 +++++++++++++++++++++++++++++++++++++-- arch/x86/kvm/svm/svm.h | 15 ++++++++++- 2 files changed, 68 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 9e12eab7eed9..8cee9aeaf4f2 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -69,26 +69,72 @@ static bool nested_svm_vmexit_supports_insn_bytes(struc= t kvm_vcpu *vcpu, return !(vmcb12->control.exit_info_1 & PFERR_FETCH_MASK); } =20 +static void nested_svm_clear_synthesized_insn_bytes(struct vcpu_svm *svm) +{ + svm->nested.synthesized_insn_bytes.prepared =3D false; + svm->nested.synthesized_insn_bytes.insn_len =3D 0; +} + +static void nested_svm_prepare_synthesized_insn_bytes(struct kvm_vcpu *vcp= u) +{ + struct vcpu_svm *svm =3D to_svm(vcpu); + struct nested_svm_insn_bytes *insn_bytes =3D + &svm->nested.synthesized_insn_bytes; + const u8 max_bytes =3D sizeof(insn_bytes->insn_bytes); + struct x86_emulate_ctxt *ctxt =3D vcpu->arch.emulate_ctxt; + + nested_svm_clear_synthesized_insn_bytes(svm); + + if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS)) + return; + + if (!ctxt || ctxt->eip !=3D kvm_rip_read(vcpu) || + ctxt->fetch.end < ctxt->fetch.data || + ctxt->fetch.end > ctxt->fetch.data + max_bytes) + return; + + insn_bytes->insn_len =3D ctxt->fetch.end - ctxt->fetch.data; + memcpy(insn_bytes->insn_bytes, ctxt->fetch.data, + insn_bytes->insn_len); + insn_bytes->prepared =3D true; +} + /* * Rebuild VMCB12's DecodeAssist bytes for the nested VM-Exit. Use fresh - * hardware VMCB02 state when available; otherwise report a zero byte coun= t. + * hardware VMCB02 state when available; otherwise use synthesized bytes f= rom + * the emulator fetch cache for KVM-generated #NPF/#PF exits. */ static void nested_svm_update_vmcb12_insn_bytes(struct kvm_vcpu *vcpu, struct vmcb *vmcb12, struct vmcb *vmcb02) { struct vcpu_svm *svm =3D to_svm(vcpu); + struct nested_svm_insn_bytes *insn_bytes =3D + &svm->nested.synthesized_insn_bytes; + const u8 max_bytes =3D sizeof(vmcb12->control.insn_bytes); bool vmcb02_insn_bytes_fresh =3D svm->nested.vmcb02_insn_bytes_fresh; + bool synthesized_prepared =3D insn_bytes->prepared; + u8 synthesized_len =3D insn_bytes->insn_len; =20 svm->nested.vmcb02_insn_bytes_fresh =3D false; + insn_bytes->prepared =3D false; =20 nested_svm_clear_insn_bytes(vmcb12); =20 if (!nested_svm_vmexit_supports_insn_bytes(vcpu, vmcb12)) return; =20 - if (vmcb02_insn_bytes_fresh) + if (vmcb02_insn_bytes_fresh) { nested_svm_copy_insn_bytes(vmcb12, vmcb02); + return; + } + + if (synthesized_prepared) { + vmcb12->control.insn_len =3D min(synthesized_len, max_bytes); + memcpy(vmcb12->control.insn_bytes, insn_bytes->insn_bytes, + vmcb12->control.insn_len); + return; + } } =20 static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu, @@ -112,6 +158,8 @@ static void nested_svm_inject_npf_exit(struct kvm_vcpu = *vcpu, vmcb->control.exit_info_1 |=3D fault->error_code; =20 svm->nested.vmcb02_insn_bytes_fresh =3D from_hardware; + if (!from_hardware && !(fault->error_code & PFERR_FETCH_MASK)) + nested_svm_prepare_synthesized_insn_bytes(vcpu); nested_svm_vmexit(svm); } =20 @@ -902,6 +950,7 @@ static void nested_vmcb02_prepare_control(struct vcpu_s= vm *svm) */ nested_svm_clear_insn_bytes(vmcb02); svm->nested.vmcb02_insn_bytes_fresh =3D false; + nested_svm_clear_synthesized_insn_bytes(svm); =20 if (guest_cpu_cap_has(vcpu, X86_FEATURE_VGIF) && (vmcb12_ctrl->int_ctl & V_GIF_ENABLE_MASK)) @@ -1709,6 +1758,9 @@ static void nested_svm_inject_exception_vmexit(struct= kvm_vcpu *vcpu) vmcb->control.exit_info_2 =3D ex->payload; else vmcb->control.exit_info_2 =3D vcpu->arch.cr2; + + if (!ex->has_error_code || !(ex->error_code & PFERR_FETCH_MASK)) + nested_svm_prepare_synthesized_insn_bytes(vcpu); } else if (ex->vector =3D=3D DB_VECTOR) { /* See kvm_check_and_inject_events(). */ kvm_deliver_exception_payload(vcpu, ex); diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index fa65f6a1a59b..ef7701ddaea0 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -205,6 +205,12 @@ struct vmcb_ctrl_area_cached { }; }; =20 +struct nested_svm_insn_bytes { + bool prepared; + u8 insn_len; + u8 insn_bytes[15]; +}; + struct svm_nested_state { struct kvm_vmcb_info vmcb02; u64 hsave_msr; @@ -242,9 +248,16 @@ struct svm_nested_state { /* * True if VMCB02's DecodeAssist instruction bytes belong to the hardware * VM-Exit currently being reflected to L1. KVM-synthesized exits leave - * it clear. + * it clear, in which case the #NPF/#PF instruction bytes are synthesized + * from the emulator fetch cache when possible. */ bool vmcb02_insn_bytes_fresh; + + /* + * DecodeAssist instruction bytes for a KVM-synthesized nested #NPF/#PF. + * Populated from the emulator's fetch cache when possible. + */ + struct nested_svm_insn_bytes synthesized_insn_bytes; }; =20 struct vcpu_sev_es_state { --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out198-19.us.a.mail.aliyun.com (out198-19.us.a.mail.aliyun.com [47.90.198.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 763E62F616B; Tue, 14 Jul 2026 05:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=47.90.198.19 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005863; cv=none; b=sUffWYQUmOpGjHmo1k7716CvT6EIWuz7gcOtNRVmoYVhaOLLJhL1WAaFoQGXQSbUIPhvw0GVPZc9gNTRjMgf9iVIlkuDiybzCe3HTwA7NjFRT4QXLoiqawiBzauLj2nFLHCwkVQQA2BrtdrZbd8k4OjoG0NUEYDxdVJTiYWCRZ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005863; c=relaxed/simple; bh=4cxnULvkI2mdVBmWNMmv8pyGI9dqx6Tl/lSDFG7fNh0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kVEEGURjZYYDZQILIwRGh0dL8ijARFCsb7PkTjmuTWTq829V6EITqLcRf33KdmkQAxhgaGEcdaWVXkAAnlyWqHQatKTqFDEzdet8bCkpO4KCGic/ixZicW9b0GINDkOi51M5qTSHSKi3fyH0yesw61RJWFrx63Lh3iE/Rd4w/qI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=47.90.198.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.07436457|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_regular_dialog|0.00326502-0.000548113-0.996187;FP=18042105206661779195|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037032089;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCcS_1784005838; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCcS_1784005838 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:39 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 6/8] KVM: nSVM: Fetch missing DecodeAssist bytes for synthesized #NPF/#PF Date: Tue, 14 Jul 2026 13:10:02 +0800 Message-ID: <341a0d64b31f03bf580beab32a36bf58042ccf2a.1783999988.git.zhang_wei@open-hieco.net> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The emulator fetch cache is not guaranteed to contain the full architected 15-byte DecodeAssist window, e.g. it may only contain the bytes needed to decode the instruction. Keep preparation of synthesized state limited to capturing a matching emulator fetch cache. When constructing VMCB12, copy those bytes and fetch any missing tail through L2 guest page tables, stopping at the first translation fault, read failure, or CS limit overrun. If no matching emulator bytes are available, fetch the full window from L2 RIP, e.g. for a #PF injected by userspace. Do not perform tail or fallback reads for SEV guests. KVM cannot read plaintext instruction bytes from encrypted guest memory, and the existing SEV emulation path treats missing hardware DecodeAssist bytes as unavailable instead of decoding guest memory. For nested SEV, report only matching emulator bytes that are already available, potentially a zero instruction-byte count. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/nested.c | 65 ++++++++++++++++++++++++++++++++++++++- arch/x86/kvm/svm/svm.h | 6 ++-- 2 files changed, 68 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 8cee9aeaf4f2..aaad36c23914 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -75,6 +75,54 @@ static void nested_svm_clear_synthesized_insn_bytes(stru= ct vcpu_svm *svm) svm->nested.synthesized_insn_bytes.insn_len =3D 0; } =20 +/* + * Fetch up to 15 bytes at L2's instruction pointer. Honor the architectu= ral + * fetch boundaries by stopping at a translation failure, read failure, or= CS + * limit. + */ +static u8 nested_svm_fetch_insn_bytes(struct kvm_vcpu *vcpu, u8 *bytes, + u8 count, u8 max_bytes) +{ + struct kvm_mmu *mmu =3D vcpu->arch.walk_mmu; + u64 access =3D PFERR_FETCH_MASK; + gva_t rip =3D kvm_get_linear_rip(vcpu); + struct x86_exception e; + + if (to_svm(vcpu)->vmcb->save.cpl =3D=3D 3) + access |=3D PFERR_USER_MASK; + + /* + * Hardware truncates the fetch at the CS limit. CS.base and CS.limit + * checks do not apply in 64-bit mode. + */ + if (!is_64_bit_mode(vcpu)) { + u32 eip =3D kvm_rip_read(vcpu); + u32 limit =3D to_svm(vcpu)->vmcb->save.cs.limit; + + if (eip > limit) + return 0; + max_bytes =3D min_t(u64, max_bytes, (u64)limit - eip + 1); + } + + count =3D min(count, max_bytes); + + while (count < max_bytes) { + unsigned int chunk =3D min_t(unsigned int, max_bytes - count, + PAGE_SIZE - offset_in_page(rip + count)); + gpa_t gpa =3D mmu->gva_to_gpa(vcpu, mmu, rip + count, access, &e); + + if (gpa =3D=3D INVALID_GPA || + kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(gpa), + bytes + count, + offset_in_page(gpa), chunk)) + break; + + count +=3D chunk; + } + + return count; +} + static void nested_svm_prepare_synthesized_insn_bytes(struct kvm_vcpu *vcp= u) { struct vcpu_svm *svm =3D to_svm(vcpu); @@ -102,7 +150,8 @@ static void nested_svm_prepare_synthesized_insn_bytes(s= truct kvm_vcpu *vcpu) /* * Rebuild VMCB12's DecodeAssist bytes for the nested VM-Exit. Use fresh * hardware VMCB02 state when available; otherwise use synthesized bytes f= rom - * the emulator fetch cache for KVM-generated #NPF/#PF exits. + * the emulator fetch cache for KVM-generated #NPF/#PF exits, or fetch from + * L2 RIP as a last resort. */ static void nested_svm_update_vmcb12_insn_bytes(struct kvm_vcpu *vcpu, struct vmcb *vmcb12, @@ -133,8 +182,22 @@ static void nested_svm_update_vmcb12_insn_bytes(struct= kvm_vcpu *vcpu, vmcb12->control.insn_len =3D min(synthesized_len, max_bytes); memcpy(vmcb12->control.insn_bytes, insn_bytes->insn_bytes, vmcb12->control.insn_len); + + if (!is_sev_guest(vcpu)) + vmcb12->control.insn_len =3D + nested_svm_fetch_insn_bytes(vcpu, + vmcb12->control.insn_bytes, + vmcb12->control.insn_len, + max_bytes); return; } + + if (is_sev_guest(vcpu)) + return; + + vmcb12->control.insn_len =3D + nested_svm_fetch_insn_bytes(vcpu, vmcb12->control.insn_bytes, + 0, max_bytes); } =20 static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu, diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index ef7701ddaea0..7fe5fb9706dd 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -249,13 +249,15 @@ struct svm_nested_state { * True if VMCB02's DecodeAssist instruction bytes belong to the hardware * VM-Exit currently being reflected to L1. KVM-synthesized exits leave * it clear, in which case the #NPF/#PF instruction bytes are synthesized - * from the emulator fetch cache when possible. + * from the emulator fetch cache and/or refetched through the guest page + * tables. */ bool vmcb02_insn_bytes_fresh; =20 /* * DecodeAssist instruction bytes for a KVM-synthesized nested #NPF/#PF. - * Populated from the emulator's fetch cache when possible. + * Populated from the emulator's fetch cache when it describes the + * instruction at L2's current RIP. */ struct nested_svm_insn_bytes synthesized_insn_bytes; }; --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out28-53.mail.aliyun.com (out28-53.mail.aliyun.com [115.124.28.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DE812F25F0; Tue, 14 Jul 2026 05:10:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005852; cv=none; b=GD6l3LF2Rwm6s91TG5GfUdBjA3jxkSlwHMzHfdxjogOawEaw3XgFK8garMZxd2XJmw9WKMMu9oUlQh57rP84uHkzN0PdgOAv2Uu+55hkaDWdH4WxVYcWskGo7yHKYXxdRFV5PI4iyr2UULOQkxvElkvZzT6dUgTYvxzbRWfuaHo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005852; c=relaxed/simple; bh=23F+VtdcVrbmDpkcoCuXvo9+OugVSSmNqxgGMXcsCqs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=R8xr/hYGUbCtwooXuPXzVsmtANqCgIla7S+JNjugNE/itVhy+Cfcf97Jff9yDz0Zhv74sRcDgNrPDc+P90tV4WIdf6Ke1F40x8rDHoG6esw3KxbMCOoSx3ho430wIfMld5ANmNGXSQQF1oI3+5HGLnjrXu2Mhr2y42pbdduI2Pk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.3995877|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.00661597-0.00587383-0.98751;FP=16638828215527998907|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037021130;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCdd_1784005839; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCdd_1784005839 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:39 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 7/8] KVM: nSVM: Advertise DecodeAssists to L1 Date: Tue, 14 Jul 2026 13:10:03 +0800 Message-ID: <8e5fe2e3ed6fbea8905ad18962540d0af4db15df.1783999988.git.zhang_wei@open-hieco.net> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Advertise DecodeAssists to L1 now that KVM virtualizes the guest-visible DecodeAssist state in VMCB12: EXITINFO1 decode data for MOV CR/DR, INTn, and INVLPG exits, plus instruction bytes for nested page faults and intercepted #PF exits. INVLPGA's linear address remains available directly from the saved guest rAX, as required by the APM. Expose the feature only when supported by hardware, as KVM still relies on hardware DecodeAssists for VM-Exits that are reflected directly from L2. With DecodeAssists exposed, QEMU configurations that require the feature (e.g. "-cpu ...,+decodeassists,...,enforce") are no longer rejected. Signed-off-by: Tina Zhang --- arch/x86/kvm/svm/svm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 2c04a8d9da29..4af5121070f4 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -5518,6 +5518,8 @@ static __init void svm_set_cpu_caps(void) */ kvm_cpu_cap_set(X86_FEATURE_FLUSHBYASID); =20 + kvm_cpu_cap_check_and_set(X86_FEATURE_DECODEASSISTS); + if (nrips) kvm_cpu_cap_set(X86_FEATURE_NRIPS); =20 --=20 2.43.7 From nobody Sat Jul 25 20:07:53 2026 Received: from out28-170.mail.aliyun.com (out28-170.mail.aliyun.com [115.124.28.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2B882F1FDE; Tue, 14 Jul 2026 05:10:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005853; cv=none; b=d5JlWzn6j+Nv6YjWRBMR0R3A625UQsygo6UwEHqVy7YC2vTvkSqv4NPkftQxE8Jtv0Ul4Y0XbAHLN4B9GsX3E3lRfJDfYslUJ08xyJNUhUDMf4BitgiNMEx2mIRTVdKFD9feeHR7G93LnWnf31u6dHFo1H9D1evli+67/5OyD54= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784005853; c=relaxed/simple; bh=8mL9MGI21qnKeWwvT74+o27GdDpV/zjhoUZFwRl4lDQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r83jHyBJUL2IoyQJ6hGfoIFd584Bd0+2auryFW+zwIJZC3IUbbOIHYUDMmFpyBLFi/ER+qEg53J06/jvNn7klp/hQFjw8BmU7FwxhBcy6rbAkQvDW0W5250oSaoM6gAAL31cJT9L0ssJZoIRVtyvuQG6H2XxIdQu//tn3PfLeL0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net; spf=pass smtp.mailfrom=open-hieco.net; arc=none smtp.client-ip=115.124.28.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=open-hieco.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=open-hieco.net X-Alimail-AntiSpam: AC=CONTINUE;BC=0.07436259|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.000971026-7.4805e-06-0.999021;FP=12595242393328617387|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033037006180;MF=zhang_wei@open-hieco.net;NM=1;PH=DS;RN=9;RT=9;SR=0;TI=SMTPD_---.iKeOCez_1784005839; Received: from localhost.localdomain(mailfrom:zhang_wei@open-hieco.net fp:SMTPD_---.iKeOCez_1784005839 cluster:ay29) by smtp.aliyun-inc.com; Tue, 14 Jul 2026 13:10:40 +0800 From: Tina Zhang To: Sean Christopherson , Paolo Bonzini , kvm@vger.kernel.org Cc: Shuah Khan , zhouyanjing@hygon.cn, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Jim Mattson , Tina Zhang Subject: [PATCH v2 8/8] KVM: selftests: Add nested SVM DecodeAssists test Date: Tue, 14 Jul 2026 13:10:04 +0800 Message-ID: <6ce7357cee9aac5e57434681b9aff9ab8d9f8162.1783999988.git.zhang_wei@open-hieco.net> X-Mailer: git-send-email 2.43.7 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a nested SVM selftest for DecodeAssists. Verify that KVM exposes the feature to L1 and provides the architectural exit state for MOV CR/DR, CLTS, LMSW, SMSW, INTn, INVLPG, and INVLPGA intercepts. For data #NPF and intercepted #PF exits, verify instruction bytes from hardware, the emulator fetch cache, and on-demand fetching from L2 RIP. Exercise full 15-byte windows and truncation at an unmapped page boundary and at the CS limit. Also verify that instruction-fetch faults and unrelated exits report no instruction bytes. Run exits back-to-back and prefill exit state to detect stale VMCB data. The synthesized OUTSB #NPF and userspace-injected #PF paths run by default; the remaining synthesized paths are covered when kvm.force_emulation_prefix=3D1 is enabled. Signed-off-by: Tina Zhang --- tools/testing/selftests/kvm/Makefile.kvm | 1 + .../selftests/kvm/include/x86/processor.h | 1 + .../kvm/x86/svm_nested_decode_assists_test.c | 694 ++++++++++++++++++ 3 files changed, 696 insertions(+) create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_decode_assis= ts_test.c diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selft= ests/kvm/Makefile.kvm index 9118a5a51b89..23bf51074392 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -114,6 +114,7 @@ TEST_GEN_PROGS_x86 +=3D x86/vmx_preemption_timer_test TEST_GEN_PROGS_x86 +=3D x86/svm_vmcall_test TEST_GEN_PROGS_x86 +=3D x86/svm_int_ctl_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_clear_efer_svme +TEST_GEN_PROGS_x86 +=3D x86/svm_nested_decode_assists_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_shutdown_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_soft_inject_test TEST_GEN_PROGS_x86 +=3D x86/svm_nested_vmcb12_gpa diff --git a/tools/testing/selftests/kvm/include/x86/processor.h b/tools/te= sting/selftests/kvm/include/x86/processor.h index 77f576ee7789..ee4520ff2f89 100644 --- a/tools/testing/selftests/kvm/include/x86/processor.h +++ b/tools/testing/selftests/kvm/include/x86/processor.h @@ -201,6 +201,7 @@ struct kvm_x86_cpu_feature { #define X86_FEATURE_LBRV KVM_X86_CPU_FEATURE(0x8000000A, 0, EDX, 1) #define X86_FEATURE_NRIPS KVM_X86_CPU_FEATURE(0x8000000A, 0, EDX, 3) #define X86_FEATURE_TSCRATEMSR KVM_X86_CPU_FEATURE(0x8000000A, 0,= EDX, 4) +#define X86_FEATURE_DECODEASSISTS KVM_X86_CPU_FEATURE(0x8000000A, 0,= EDX, 7) #define X86_FEATURE_PAUSEFILTER KVM_X86_CPU_FEATURE(0x8000000A, 0,= EDX, 10) #define X86_FEATURE_PFTHRESHOLD KVM_X86_CPU_FEATURE(0x8000000A, 0,= EDX, 12) #define X86_FEATURE_V_VMSAVE_VMLOAD KVM_X86_CPU_FEATURE(0x8000000A, 0, EDX= , 15) diff --git a/tools/testing/selftests/kvm/x86/svm_nested_decode_assists_test= .c b/tools/testing/selftests/kvm/x86/svm_nested_decode_assists_test.c new file mode 100644 index 000000000000..ac9601dda936 --- /dev/null +++ b/tools/testing/selftests/kvm/x86/svm_nested_decode_assists_test.c @@ -0,0 +1,694 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Test KVM's virtualization of SVM DecodeAssists for nested guests. + */ + +#include "test_util.h" +#include "kvm_util.h" +#include "processor.h" +#include "svm_util.h" + +#define L2_GUEST_STACK_SIZE 64 + +#define TEST_INT_VECTOR 0x81 + +/* Any canonical virtual address that is never mapped by the selftest VM. = */ +#define PF_TEST_GVA BIT_ULL(40) +#define PF_FETCH_TEST_GVA BIT_ULL(41) + +#define OUTSB_OPCODE 0x6e +#define INT3_OPCODE 0xcc +#define BOUNDARY_OUTSB_CODE_SIZE 15 +#define LIMIT_OUTSB_OPCODE_OFFSET 9 +#define USERSPACE_PF_STAGE 1 +#define TEST_IOPM_SIZE (3 * PAGE_SIZE) + +static u64 npf_target __aligned(PAGE_SIZE); +static u8 boundary_outsb_code[2 * PAGE_SIZE] __aligned(PAGE_SIZE); +static u8 limit_outsb_code[PAGE_SIZE] __aligned(PAGE_SIZE); +static unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE]; + +static void l2_read_code(void) +{ + asm volatile("mov (%0), %%rax" : : "r"(&npf_target) : "rax", "memory"); + GUEST_FAIL("L2 read did not cause a nested page fault"); +} + +static void l2_outsb_code(void) +{ + asm volatile("mov %0, %%rsi\n\t" + "mov $0x80, %%dx\n\t" + "outsb" + : : "r"(&npf_target) : "rsi", "rdx", "memory"); + GUEST_FAIL("L2 OUTSB did not cause a nested page fault"); +} + +static void l2_pf_code(void) +{ + asm volatile("mov (%0), %%rax" + : : "r"(PF_TEST_GVA) : "rax", "memory"); + GUEST_FAIL("L2 access to an unmapped VA did not #PF"); +} + +static void l2_fep_pf_code(void) +{ + asm volatile(KVM_FEP "mov (%0), %%rax" + : : "r"(PF_TEST_GVA) : "rax", "memory"); + GUEST_FAIL("L2 forced-emulated access to an unmapped VA did not #PF"); +} + +static void l2_userspace_pf_code(void) +{ + GUEST_SYNC(USERSPACE_PF_STAGE); + GUEST_FAIL("Userspace-injected #PF was not intercepted by L1"); +} + +static void l2_mov_from_cr4_code(void) +{ + asm volatile("mov %%cr4, %%r10" : : : "r10"); + GUEST_FAIL("L2 MOV-from-CR4 was not intercepted"); +} + +static void l2_fep_mov_from_cr4_code(void) +{ + asm volatile(KVM_FEP "mov %%cr4, %%r10" : : : "r10"); + GUEST_FAIL("L2 forced-emulated MOV-from-CR4 was not intercepted"); +} + +static void l2_mov_to_cr4_code(void) +{ + asm volatile("mov %%cr4, %%rax\n\t" + "mov %%rax, %%cr4" : : : "rax"); + GUEST_FAIL("L2 MOV-to-CR4 was not intercepted"); +} + +static void l2_fep_mov_to_cr4_code(void) +{ + asm volatile("mov %%cr4, %%rax\n\t" + KVM_FEP "mov %%rax, %%cr4" : : : "rax"); + GUEST_FAIL("L2 forced-emulated MOV-to-CR4 was not intercepted"); +} + +static void l2_mov_to_dr7_code(void) +{ + asm volatile("mov %%dr7, %%rax\n\t" + "mov %%rax, %%rbx\n\t" + "mov %%rbx, %%dr7" : : : "rax", "rbx"); + GUEST_FAIL("L2 MOV-to-DR7 was not intercepted"); +} + +static void l2_fep_mov_to_dr7_code(void) +{ + asm volatile("mov %%dr7, %%rax\n\t" + "mov %%rax, %%rbx\n\t" + KVM_FEP "mov %%rbx, %%dr7" : : : "rax", "rbx"); + GUEST_FAIL("L2 forced-emulated MOV-to-DR7 was not intercepted"); +} + +static void l2_mov_from_dr7_code(void) +{ + asm volatile("mov %%dr7, %%r10" : : : "r10"); + GUEST_FAIL("L2 MOV-from-DR7 was not intercepted"); +} + +static void l2_fep_mov_from_dr7_code(void) +{ + asm volatile(KVM_FEP "mov %%dr7, %%r10" : : : "r10"); + GUEST_FAIL("L2 forced-emulated MOV-from-DR7 was not intercepted"); +} + +static void l2_clts_code(void) +{ + asm volatile("clts" : : : "memory"); + GUEST_FAIL("L2 CLTS was not intercepted"); +} + +static void l2_fep_clts_code(void) +{ + asm volatile(KVM_FEP "clts" : : : "memory"); + GUEST_FAIL("L2 forced-emulated CLTS was not intercepted"); +} + +static void l2_lmsw_code(void) +{ + asm volatile("smsw %%ax\n\t" + "lmsw %%ax" : : : "rax", "memory"); + GUEST_FAIL("L2 LMSW was not intercepted"); +} + +static void l2_fep_lmsw_code(void) +{ + asm volatile("smsw %%ax\n\t" + KVM_FEP "lmsw %%ax" : : : "rax", "memory"); + GUEST_FAIL("L2 forced-emulated LMSW was not intercepted"); +} + +static void l2_smsw_code(void) +{ + asm volatile("smsw %%ax" : : : "rax", "memory"); + GUEST_FAIL("L2 SMSW was not intercepted"); +} + +static void l2_fep_smsw_code(void) +{ + asm volatile(KVM_FEP "smsw %%ax" : : : "rax", "memory"); + GUEST_FAIL("L2 forced-emulated SMSW was not intercepted"); +} + +static void l2_int_code(void) +{ + asm volatile("int %0" : : "i"(TEST_INT_VECTOR)); + GUEST_FAIL("L2 INTn was not intercepted"); +} + +static void l2_fep_int_code(void) +{ + asm volatile(KVM_FEP "int %0" : : "i"(TEST_INT_VECTOR)); + GUEST_FAIL("L2 forced-emulated INTn was not intercepted"); +} + +static void l2_invlpg_code(void) +{ + asm volatile("invlpg (%0)" : : "r"(&npf_target) : "memory"); + GUEST_FAIL("L2 INVLPG was not intercepted"); +} + +static void l2_fep_invlpg_code(void) +{ + asm volatile(KVM_FEP "invlpg (%0)" : : "r"(&npf_target) : "memory"); + GUEST_FAIL("L2 forced-emulated INVLPG was not intercepted"); +} + +static void l2_invlpga_code(void) +{ + asm volatile("invlpga" : : "a"(&npf_target), "c"(0) : "memory"); + GUEST_FAIL("L2 INVLPGA was not intercepted"); +} + +static void l2_fep_invlpga_code(void) +{ + asm volatile(KVM_FEP "invlpga" + : : "a"(&npf_target), "c"(0) : "memory"); + GUEST_FAIL("L2 forced-emulated INVLPGA was not intercepted"); +} + +static void l2_vmmcall_code(void) +{ + vmmcall(); + GUEST_FAIL("L2 did not exit on VMMCALL"); +} + +struct instruction_intercept_test { + const char *name; + void (*code)(void); + void (*fep_code)(void); + u64 intercept; + u32 intercept_cr; + u32 intercept_dr; + u64 exit_code; + u64 exit_info_1; + u64 exit_info_1_mask; + bool check_rax; + u64 rax; +}; + +static const struct instruction_intercept_test instruction_intercept_tests= [] =3D { + { + .name =3D "MOV-to-CR4", + .code =3D l2_mov_to_cr4_code, + .fep_code =3D l2_fep_mov_to_cr4_code, + .intercept_cr =3D BIT(INTERCEPT_CR4_WRITE), + .exit_code =3D SVM_EXIT_WRITE_CR4, + .exit_info_1 =3D BIT_ULL(63), + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "MOV-from-CR4", + .code =3D l2_mov_from_cr4_code, + .fep_code =3D l2_fep_mov_from_cr4_code, + .intercept_cr =3D BIT(INTERCEPT_CR4_READ), + .exit_code =3D SVM_EXIT_READ_CR4, + .exit_info_1 =3D BIT_ULL(63) | 10, + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "MOV-to-DR7", + .code =3D l2_mov_to_dr7_code, + .fep_code =3D l2_fep_mov_to_dr7_code, + .intercept_dr =3D BIT(INTERCEPT_DR7_WRITE), + .exit_code =3D SVM_EXIT_WRITE_DR7, + .exit_info_1 =3D 3, + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "MOV-from-DR7", + .code =3D l2_mov_from_dr7_code, + .fep_code =3D l2_fep_mov_from_dr7_code, + .intercept_dr =3D BIT(INTERCEPT_DR7_READ), + .exit_code =3D SVM_EXIT_READ_DR7, + .exit_info_1 =3D 10, + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "CLTS", + .code =3D l2_clts_code, + .fep_code =3D l2_fep_clts_code, + .intercept_cr =3D BIT(INTERCEPT_CR0_WRITE), + .exit_code =3D SVM_EXIT_WRITE_CR0, + .exit_info_1_mask =3D BIT_ULL(63), + }, { + .name =3D "LMSW", + .code =3D l2_lmsw_code, + .fep_code =3D l2_fep_lmsw_code, + .intercept_cr =3D BIT(INTERCEPT_CR0_WRITE), + .exit_code =3D SVM_EXIT_WRITE_CR0, + .exit_info_1_mask =3D BIT_ULL(63), + }, { + .name =3D "SMSW", + .code =3D l2_smsw_code, + .fep_code =3D l2_fep_smsw_code, + .intercept_cr =3D BIT(INTERCEPT_CR0_READ), + .exit_code =3D SVM_EXIT_READ_CR0, + .exit_info_1_mask =3D BIT_ULL(63), + }, { + .name =3D "INTn", + .code =3D l2_int_code, + .fep_code =3D l2_fep_int_code, + .intercept =3D BIT_ULL(INTERCEPT_INTn), + .exit_code =3D SVM_EXIT_SWINT, + .exit_info_1 =3D TEST_INT_VECTOR, + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "INVLPG", + .code =3D l2_invlpg_code, + .fep_code =3D l2_fep_invlpg_code, + .intercept =3D BIT_ULL(INTERCEPT_INVLPG), + .exit_code =3D SVM_EXIT_INVLPG, + .exit_info_1 =3D (u64)&npf_target, + .exit_info_1_mask =3D ~0ULL, + }, { + .name =3D "INVLPGA", + .code =3D l2_invlpga_code, + .fep_code =3D l2_fep_invlpga_code, + .intercept =3D BIT_ULL(INTERCEPT_INVLPGA), + .exit_code =3D SVM_EXIT_INVLPGA, + .exit_info_1_mask =3D ~0ULL, + .check_rax =3D true, + .rax =3D (u64)&npf_target, + }, +}; + +static void assert_decode_assist_insn_bytes(struct vmcb *vmcb) +{ + GUEST_ASSERT(vmcb->control.insn_len); + GUEST_ASSERT(vmcb->control.insn_len <=3D + sizeof(vmcb->control.insn_bytes)); + GUEST_ASSERT(!memcmp(vmcb->control.insn_bytes, + (void *)vmcb->save.rip, + vmcb->control.insn_len)); +} + +static void assert_full_decode_assist_insn_bytes(struct vmcb *vmcb) +{ + GUEST_ASSERT_EQ(vmcb->control.insn_len, + sizeof(vmcb->control.insn_bytes)); + assert_decode_assist_insn_bytes(vmcb); +} + +static void prepare_l2_for_vmrun(struct vmcb *vmcb, gva_t rip) +{ + vmcb->save.rip =3D rip; + vmcb->save.rsp =3D (u64)&l2_guest_stack[L2_GUEST_STACK_SIZE]; +} + +static void run_intercept_test(struct svm_test_data *svm, + const struct instruction_intercept_test *test, + bool synthesized) +{ + struct vmcb *vmcb =3D svm->vmcb; + struct vmcb_control_area *control =3D &vmcb->control; + const char *source =3D synthesized ? "synthesized" : "hardware"; + u64 expected_exit_info_1 =3D test->exit_info_1 & test->exit_info_1_mask; + + control->intercept |=3D test->intercept; + control->intercept_cr |=3D test->intercept_cr; + control->intercept_dr |=3D test->intercept_dr; + + if (synthesized) { + control->exit_info_1 =3D ~0ULL; + control->exit_info_2 =3D ~0ULL; + prepare_l2_for_vmrun(vmcb, (u64)test->fep_code); + } else { + prepare_l2_for_vmrun(vmcb, (u64)test->code); + } + + run_guest(vmcb, svm->vmcb_gpa); + + __GUEST_ASSERT(control->exit_code =3D=3D test->exit_code, + "%s (%s): expected exit code %#lx, got %#lx", + test->name, source, (unsigned long)test->exit_code, + (unsigned long)control->exit_code); + __GUEST_ASSERT((control->exit_info_1 & test->exit_info_1_mask) =3D=3D + expected_exit_info_1, + "%s (%s): expected EXITINFO1 %#lx with mask %#lx, got %#lx", + test->name, source, (unsigned long)expected_exit_info_1, + (unsigned long)test->exit_info_1_mask, + (unsigned long)control->exit_info_1); + __GUEST_ASSERT(!control->insn_len, + "%s (%s): expected no instruction bytes, got %u", + test->name, source, control->insn_len); + + if (test->check_rax) + __GUEST_ASSERT(vmcb->save.rax =3D=3D test->rax, + "%s (%s): expected rAX %#lx, got %#lx", + test->name, source, (unsigned long)test->rax, + (unsigned long)vmcb->save.rax); + + if (synthesized) + __GUEST_ASSERT(!control->exit_info_2, + "%s (%s): expected EXITINFO2 to be clear, got %#lx", + test->name, source, + (unsigned long)control->exit_info_2); + + control->intercept &=3D ~test->intercept; + control->intercept_cr &=3D ~test->intercept_cr; + control->intercept_dr &=3D ~test->intercept_dr; +} + +static void test_instruction_intercepts(struct svm_test_data *svm) +{ + int i; + + for (i =3D 0; i < ARRAY_SIZE(instruction_intercept_tests); i++) { + run_intercept_test(svm, &instruction_intercept_tests[i], false); + + if (is_forced_emulation_enabled) + run_intercept_test(svm, &instruction_intercept_tests[i], + true); + } +} + +/* + * A hardware #NPF (data read of a GPA not mapped in the NPT) must reflect + * the instruction bytes recorded by hardware. + */ +static void test_hardware_npf(struct svm_test_data *svm, gpa_t npf_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, (u64)l2_read_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_NPF); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, npf_gpa); + assert_decode_assist_insn_bytes(vmcb); +} + +/* An instruction-fetch #NPF must not report DecodeAssist instruction byte= s. */ +static void test_hardware_fetch_npf(struct svm_test_data *svm, + gva_t fetch_npf_gva, + gpa_t fetch_npf_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, fetch_npf_gva); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_NPF); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, fetch_npf_gpa); + GUEST_ASSERT(vmcb->control.exit_info_1 & PFERR_FETCH_MASK); + GUEST_ASSERT_EQ(vmcb->control.insn_len, 0); +} + +/* + * The IOIO intercept causes L0 to emulate OUTSB before accessing its sour= ce + * operand. The emulated read then faults on L1's NPT, resulting in a + * KVM-synthesized #NPF. + */ +static void test_synthesized_npf(struct svm_test_data *svm, gpa_t npf_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, (u64)l2_outsb_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_NPF); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, npf_gpa); + assert_full_decode_assist_insn_bytes(vmcb); +} + +/* + * OUTSB is the final byte of a mapped code page, and the following page is + * not present in L2's page tables. DecodeAssist byte fetching must stop = at + * the page boundary and report only the OUTSB opcode. + */ +static void test_synthesized_npf_truncated(struct svm_test_data *svm, + gpa_t npf_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, + (u64)&boundary_outsb_code[PAGE_SIZE - + BOUNDARY_OUTSB_CODE_SIZE]); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_NPF); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, npf_gpa); + GUEST_ASSERT_EQ(vmcb->save.rip, + (u64)&boundary_outsb_code[PAGE_SIZE - 1]); + GUEST_ASSERT_EQ(vmcb->control.insn_len, 1); + GUEST_ASSERT_EQ(vmcb->control.insn_bytes[0], OUTSB_OPCODE); +} + +/* A non-64-bit code segment must truncate the byte window at CS.limit. */ +static void test_synthesized_npf_cs_limit(struct svm_test_data *svm, + gpa_t npf_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + u16 cs_attrib =3D vmcb->save.cs.attrib; + u32 cs_limit =3D vmcb->save.cs.limit; + + vmcb->save.cs.attrib &=3D ~SVM_SELECTOR_L_MASK; + vmcb->save.cs.attrib |=3D SVM_SELECTOR_DB_MASK; + vmcb->save.cs.limit =3D + (u32)(u64)&limit_outsb_code[LIMIT_OUTSB_OPCODE_OFFSET]; + prepare_l2_for_vmrun(vmcb, (u64)limit_outsb_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_NPF); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, npf_gpa); + GUEST_ASSERT_EQ(vmcb->save.rip, + (u64)&limit_outsb_code[LIMIT_OUTSB_OPCODE_OFFSET]); + GUEST_ASSERT_EQ(vmcb->control.insn_len, 1); + GUEST_ASSERT_EQ(vmcb->control.insn_bytes[0], OUTSB_OPCODE); + vmcb->save.cs.attrib =3D cs_attrib; + vmcb->save.cs.limit =3D cs_limit; +} + +static void test_intercepted_pf(struct svm_test_data *svm) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, (u64)l2_pf_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_EXCP_BASE + PF_VECTOR); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, PF_TEST_GVA); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_PRESENT_MASK)); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_FETCH_MASK)); + assert_decode_assist_insn_bytes(vmcb); +} + +/* An intercepted instruction-fetch #PF likewise reports no instruction by= tes. */ +static void test_intercepted_fetch_pf(struct svm_test_data *svm) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, PF_FETCH_TEST_GVA); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_EXCP_BASE + PF_VECTOR); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, PF_FETCH_TEST_GVA); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_PRESENT_MASK)); + GUEST_ASSERT(vmcb->control.exit_info_1 & PFERR_FETCH_MASK); + GUEST_ASSERT_EQ(vmcb->control.insn_len, 0); +} + +static void test_synthesized_pf(struct svm_test_data *svm) +{ + struct vmcb *vmcb =3D svm->vmcb; + + if (!is_forced_emulation_enabled) + return; + + prepare_l2_for_vmrun(vmcb, (u64)l2_fep_pf_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_EXCP_BASE + PF_VECTOR); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, PF_TEST_GVA); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_PRESENT_MASK)); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_FETCH_MASK)); + assert_full_decode_assist_insn_bytes(vmcb); +} + +/* Userspace injects this #PF without a matching emulator fetch cache. */ +static void test_userspace_injected_pf(struct svm_test_data *svm) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, (u64)l2_userspace_pf_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_EXCP_BASE + PF_VECTOR); + GUEST_ASSERT_EQ(vmcb->control.exit_info_2, PF_TEST_GVA); + GUEST_ASSERT(!(vmcb->control.exit_info_1 & PFERR_FETCH_MASK)); + assert_full_decode_assist_insn_bytes(vmcb); +} + +static void test_vmmcall(struct svm_test_data *svm) +{ + struct vmcb *vmcb =3D svm->vmcb; + + prepare_l2_for_vmrun(vmcb, (u64)l2_vmmcall_code); + run_guest(vmcb, svm->vmcb_gpa); + GUEST_ASSERT_EQ(vmcb->control.exit_code, SVM_EXIT_VMMCALL); + GUEST_ASSERT_EQ(vmcb->control.insn_len, 0); +} + +static void l1_guest_code(struct svm_test_data *svm, gpa_t npf_gpa, + gva_t fetch_npf_gva, + gpa_t fetch_npf_gpa, gpa_t iopm_gpa) +{ + struct vmcb *vmcb =3D svm->vmcb; + + GUEST_ASSERT(this_cpu_has(X86_FEATURE_DECODEASSISTS)); + + generic_svm_setup(svm, l2_read_code, + &l2_guest_stack[L2_GUEST_STACK_SIZE]); + vmcb->control.iopm_base_pa =3D iopm_gpa; + + vmcb->control.intercept |=3D BIT_ULL(INTERCEPT_IOIO_PROT); + vmcb->control.intercept_exceptions |=3D 1U << PF_VECTOR; + + test_hardware_npf(svm, npf_gpa); + test_hardware_fetch_npf(svm, fetch_npf_gva, fetch_npf_gpa); + test_synthesized_npf(svm, npf_gpa); + test_synthesized_npf_truncated(svm, npf_gpa); + test_synthesized_npf_cs_limit(svm, npf_gpa); + test_intercepted_pf(svm); + test_intercepted_fetch_pf(svm); + test_synthesized_pf(svm); + test_userspace_injected_pf(svm); + test_instruction_intercepts(svm); + test_vmmcall(svm); + + GUEST_DONE(); +} + +static void prepare_boundary_outsb_code(struct kvm_vm *vm) +{ + gva_t code_gva =3D (gva_t)&boundary_outsb_code[PAGE_SIZE - + BOUNDARY_OUTSB_CODE_SIZE]; + u8 *code =3D addr_gva2hva(vm, code_gva); + u64 source =3D (u64)&npf_target; + + /* movabs $npf_target, %rsi */ + code[0] =3D 0x48; + code[1] =3D 0xbe; + memcpy(&code[2], &source, sizeof(source)); + + /* mov $0x80, %dx; outsb */ + code[10] =3D 0x66; + code[11] =3D 0xba; + code[12] =3D 0x80; + code[13] =3D 0x00; + code[14] =3D OUTSB_OPCODE; +} + +static void prepare_limit_outsb_code(struct kvm_vm *vm) +{ + u8 *code =3D addr_gva2hva(vm, (gva_t)limit_outsb_code); + u32 source =3D (u32)(u64)&npf_target; + + TEST_ASSERT((u64)&npf_target <=3D UINT32_MAX, + "npf_target must be addressable from compatibility mode"); + TEST_ASSERT((u64)&limit_outsb_code[LIMIT_OUTSB_OPCODE_OFFSET] <=3D + UINT32_MAX, + "limit_outsb_code must be addressable from compatibility mode"); + + /* mov $npf_target, %esi; mov $0x80, %dx; outsb */ + code[0] =3D 0xbe; + memcpy(&code[1], &source, sizeof(source)); + code[5] =3D 0x66; + code[6] =3D 0xba; + code[7] =3D 0x80; + code[8] =3D 0x00; + code[LIMIT_OUTSB_OPCODE_OFFSET] =3D OUTSB_OPCODE; +} + +static void queue_userspace_pf(struct kvm_vcpu *vcpu) +{ + struct kvm_vcpu_events events; + + vcpu_events_get(vcpu, &events); + TEST_ASSERT(!events.exception.pending && !events.exception.injected, + "Unexpected exception queued before userspace #PF injection"); + TEST_ASSERT(events.flags & KVM_VCPUEVENT_VALID_PAYLOAD, + "KVM_CAP_EXCEPTION_PAYLOAD was not enabled"); + + events.flags |=3D KVM_VCPUEVENT_VALID_PAYLOAD; + events.exception.injected =3D false; + events.exception.pending =3D true; + events.exception.nr =3D PF_VECTOR; + events.exception.has_error_code =3D true; + events.exception.error_code =3D 0; + events.exception_has_payload =3D true; + events.exception_payload =3D PF_TEST_GVA; + vcpu_events_set(vcpu, &events); +} + +int main(int argc, char *argv[]) +{ + gva_t svm_gva, npf_gva, fetch_npf_gva, boundary_page_gva, iopm_gva; + gpa_t npf_gpa, fetch_npf_gpa, iopm_gpa; + struct kvm_vcpu *vcpu; + struct kvm_vm *vm; + u64 *pte; + + TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_SVM)); + TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_NPT)); + TEST_REQUIRE(this_cpu_has(X86_FEATURE_DECODEASSISTS)); + TEST_ASSERT(kvm_cpu_has(X86_FEATURE_DECODEASSISTS), + "KVM failed to expose DecodeAssists"); + TEST_REQUIRE(kvm_has_cap(KVM_CAP_EXCEPTION_PAYLOAD)); + + vm =3D vm_create_with_one_vcpu(&vcpu, l1_guest_code); + vm_enable_cap(vm, KVM_CAP_EXCEPTION_PAYLOAD, 1); + prepare_boundary_outsb_code(vm); + prepare_limit_outsb_code(vm); + vm_enable_npt(vm); + vcpu_alloc_svm(vm, &svm_gva); + iopm_gva =3D vm_alloc_pages(vm, TEST_IOPM_SIZE / PAGE_SIZE); + iopm_gpa =3D addr_gva2gpa(vm, iopm_gva); + memset(addr_gva2hva(vm, iopm_gva), 0, TEST_IOPM_SIZE); + npf_gva =3D (gva_t)&npf_target; + npf_gpa =3D addr_gva2gpa(vm, npf_gva); + fetch_npf_gva =3D vm_alloc_page(vm); + fetch_npf_gpa =3D addr_gva2gpa(vm, fetch_npf_gva); + *(u8 *)addr_gva2hva(vm, fetch_npf_gva) =3D INT3_OPCODE; + + tdp_identity_map_default_memslots(vm); + pte =3D tdp_get_pte(vm, npf_gpa); + *pte &=3D ~PTE_PRESENT_MASK(&vm->stage2_mmu); + pte =3D tdp_get_pte(vm, fetch_npf_gpa); + *pte &=3D ~PTE_PRESENT_MASK(&vm->stage2_mmu); + + boundary_page_gva =3D (gva_t)&boundary_outsb_code[PAGE_SIZE]; + pte =3D vm_get_pte(vm, boundary_page_gva); + *pte &=3D ~PTE_PRESENT_MASK(&vm->mmu); + + vcpu_args_set(vcpu, 5, svm_gva, npf_gpa, fetch_npf_gva, + fetch_npf_gpa, iopm_gpa); + vcpu_run(vcpu); + TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); + { + struct ucall uc; + + TEST_ASSERT_EQ(get_ucall(vcpu, &uc), UCALL_SYNC); + TEST_ASSERT_EQ(uc.args[1], USERSPACE_PF_STAGE); + } + queue_userspace_pf(vcpu); + vcpu_run(vcpu); + TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO); + TEST_ASSERT_EQ(get_ucall(vcpu, NULL), UCALL_DONE); + + kvm_vm_free(vm); + return 0; +} --=20 2.43.7