The SVM DecodeAssists feature provides decode state for selected VM-Exits. KVM currently does not expose this feature to L1. Some L1 hypervisors may therefore treat the platform's SVM support as incomplete.
In practice, this was observed with Hyper-V running on top of KVM. Hyper-V appears to require DecodeAssists before enabling nested SVM for its guests. Virtualizing the feature lets users enable Hyper-V virtualization features inside a Windows VM when needed, e.g. to run QEMU/KVM in WSL. Without DecodeAssists, Hyper-V does not enable nested SVM because DecodeAssists is missing from KVM's virtual SVM model. Virtualize both parts of DecodeAssists for nested SVM. For emulated MOV CR/DR, INTn, INVLPG, and INVLPGA intercepts, synthesize the architectural EXITINFO state that hardware would provide to L1. For data #PF and #NPF VM-Exits, provide GuestInstrBytes from fresh VMCB02 state, matching emulator fetch bytes, or an on-demand fetch from the current L2 CS:RIP, depending on how the nested VM-Exit was produced. Instruction-fetch faults report no instruction bytes, and encrypted guests do not use the on-demand fallback. Add a focused selftest covering synthesized EXITINFO, hardware and synthesized GuestInstrBytes, truncated instruction fetching, and instruction-fetch faults. The test has been run with kvm.force_emulation_prefix both disabled and enabled. Changes since v4: - Drop the generic queued-exception provenance tracking for delayed and synthesized #PF VM-Exits. Fetch their instruction bytes from the current L2 CS:RIP when constructing VMCB12 instead. - Keep matching emulator fetch bytes only for synthesized #NPF exits, and use the on-demand fetch to fill any missing tail. - Reduce the series from nine to eight patches by removing the generic x86 exception-tracking patch. - Trim the selftest to focused cases that cover distinct implementation paths and regressions, removing redundant instruction variants, overlapping boundary cases, and userspace event-state coverage. v4: https://lore.kernel.org/r/[email protected] Changes since v3: - Rebase onto kvm-x86/next. - Register DecodeAssists in the CPUID 0x8000000A SVM capability initializer so that common code validates its CPUID word before the SVM code enables it for nested guests. - Make the VMCB02 instruction-byte source const and simplify the synthesized-byte copy and fallback-fetch flow. v3: https://lore.kernel.org/r/[email protected] Changes since v2: - Rebase onto kvm-x86/next. - Track hardware-provided instruction bytes independently of the VMCB02 exit code, and preserve the bytes when L0 handles an intercepted #PF before reflecting it to L1. - Select the instruction-byte source using host-owned VMCB02 state instead of control fields in guest-owned VMCB12. - Record whether a queued #PF VM-Exit has a matching emulator context, so userspace-injected #PF exits do not consume stale emulator bytes. - Stop fallback instruction fetches at noncanonical addresses and at the 32-bit linear-address boundary. - Extend the selftest with regression coverage for replacing a hardware #NPF with a synthesized #NPF and for userspace-injected #PF during emulation, and harden its page layout and ucall handling. v2: https://lore.kernel.org/r/[email protected] Changes since v1: - Split the implementation into seven patches to make the individual pieces easier to review. - Add EXITINFO virtualization for emulator-generated MOV CR/DR, INTn, INVLPG, and INVLPGA intercepts. - Limit GuestInstrBytes propagation to data #NPF and intercepted #PF exits, and clear the fields for instruction-fetch and unrelated exits. - Provide GuestInstrBytes for KVM-synthesized data #PF/#NPF exits. Use matching emulator bytes first and fetch missing bytes from L2 RIP as a fallback, while avoiding fallback reads for SEV guests. - Expand the selftest beyond hardware #NPF and stale-state coverage to exercise hardware, synthesized, userspace-injected, instruction-fetch, page-boundary, and CS-limit cases. v1: https://lore.kernel.org/r/[email protected] Tina Zhang (8): KVM: x86: Add helper to provide intercept linear addresses KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts KVM: nSVM: Track fresh hardware DecodeAssist bytes KVM: nSVM: Propagate hardware DecodeAssist bytes to VMCB12 KVM: nSVM: Use emulator bytes for synthesized nested #NPF KVM: nSVM: Fetch missing DecodeAssist bytes for synthesized #NPF/#PF KVM: nSVM: Advertise DecodeAssists to L1 KVM: selftests: Add nested SVM DecodeAssists test arch/x86/kvm/cpuid.c | 1 + arch/x86/kvm/emulate.c | 29 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/svm/nested.c | 180 ++++++- arch/x86/kvm/svm/svm.c | 56 +- arch/x86/kvm/svm/svm.h | 17 +- tools/testing/selftests/kvm/Makefile.kvm | 1 + .../selftests/kvm/include/x86/processor.h | 1 + .../kvm/x86/svm_nested_decode_assists_test.c | 482 ++++++++++++++++++ 9 files changed, 754 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_decode_assists_test.c base-commit: 1b731e5ded480bd1e5546aed35584238661ce72e -- 2.43.7
