[PATCH v7 5/8] KVM: nSVM: Fetch DecodeAssist bytes for synthesized faults
From: Tina Zhang
Date: Fri Sep 18 2026 - 04:57:46 EST
Hardware-reflected #NPF and #PF VM-Exits can propagate instruction bytes
from VMCB02, but KVM-synthesized exits have no hardware-provided state for
the current exit.
Extend kvm_read_guest_virt_helper() to optionally report the number of
bytes read, including partial reads. Add kvm_fetch_guest_virt() to apply
instruction-fetch permissions and return that count, reusing the generic
helper's page-by-page read loop.
When a synthesized data #NPF or #PF has no valid VMCB02 instruction bytes,
fetch up to 15 bytes from L2's RIP while constructing VMCB12. Preserve
the bytes already read if a subsequent read cannot be completed.
For instruction fetches, truncate each linear address to 32 bits outside
64-bit mode and stop at a non-canonical address in 64-bit mode. Limit
the fetch window at the code-segment limit outside 64-bit mode.
Do not attempt the fallback for SEV guests, as KVM cannot read encrypted
guest memory directly.
Signed-off-by: Tina Zhang <zhang_wei@xxxxxxxxxxxxxx>
---
arch/x86/kvm/svm/nested.c | 41 +++++++++++++++++++++++++---
arch/x86/kvm/x86.c | 56 +++++++++++++++++++++++++++++++--------
arch/x86/kvm/x86.h | 2 ++
3 files changed, 85 insertions(+), 14 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index d99706e1b9c0..c17df8c2e75f 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -78,22 +78,57 @@ static void nested_svm_invalidate_vmcb02_insn_bytes(struct vcpu_svm *svm)
svm->nested.vmcb02_insn_bytes_valid = false;
}
+static u8 nested_svm_get_insn_bytes_len(struct kvm_vcpu *vcpu, u8 max_bytes)
+{
+ if (!is_64_bit_mode(vcpu)) {
+ u32 eip = kvm_rip_read(vcpu);
+ u32 limit = to_svm(vcpu)->vmcb->save.cs.limit;
+
+ if (eip > limit)
+ return 0;
+ max_bytes = min_t(u64, max_bytes, (u64)limit - eip + 1);
+ }
+
+ return max_bytes;
+}
+
+static u8 nested_svm_fetch_insn_bytes(struct kvm_vcpu *vcpu, u8 *bytes,
+ u8 max_bytes)
+{
+ gva_t rip = kvm_get_linear_rip(vcpu);
+
+ max_bytes = nested_svm_get_insn_bytes_len(vcpu, max_bytes);
+
+ return kvm_fetch_guest_virt(vcpu, rip, bytes, max_bytes);
+}
+
static void nested_svm_update_vmcb12_insn_bytes(struct kvm_vcpu *vcpu,
struct vmcb *vmcb12,
const struct vmcb *vmcb02)
{
struct vcpu_svm *svm = to_svm(vcpu);
+ const u8 max_bytes = sizeof(vmcb12->control.insn_bytes);
if (!guest_cpu_cap_has(vcpu, X86_FEATURE_DECODEASSISTS))
goto out;
- if (!nested_svm_vmexit_supports_insn_bytes(vmcb02) ||
- !svm->nested.vmcb02_insn_bytes_valid) {
+ if (!nested_svm_vmexit_supports_insn_bytes(vmcb02)) {
nested_svm_invalidate_insn_bytes(vmcb12);
goto out;
}
- nested_svm_copy_insn_bytes(vmcb12, vmcb02);
+ if (svm->nested.vmcb02_insn_bytes_valid) {
+ nested_svm_copy_insn_bytes(vmcb12, vmcb02);
+ goto out;
+ }
+
+ if (!is_sev_guest(vcpu))
+ vmcb12->control.insn_len =
+ nested_svm_fetch_insn_bytes(vcpu,
+ vmcb12->control.insn_bytes,
+ max_bytes);
+ else
+ nested_svm_invalidate_insn_bytes(vmcb12);
out:
svm->nested.vmcb02_insn_bytes_valid = false;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index af3ceee714c9..3c706a4627d8 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4772,20 +4772,34 @@ gpa_t kvm_mmu_gva_to_gpa_system(struct kvm_vcpu *vcpu, gva_t gva,
static int kvm_read_guest_virt_helper(gva_t addr, void *val, unsigned int bytes,
struct kvm_vcpu *vcpu, u64 access,
- struct x86_exception *exception)
+ struct x86_exception *exception,
+ unsigned int *bytes_read)
{
struct kvm_pagewalk *gva_walk = &vcpu->arch.gva_walk;
void *data = val;
int r = X86EMUL_CONTINUE;
while (bytes) {
- gpa_t gpa = gva_walk->gva_to_gpa(vcpu, gva_walk, addr, access, exception);
+ gpa_t gpa;
unsigned offset = addr & (PAGE_SIZE-1);
unsigned toread = min(bytes, (unsigned)PAGE_SIZE - offset);
int ret;
- if (gpa == INVALID_GPA)
- return X86EMUL_PROPAGATE_FAULT;
+ /* Apply address wrapping or canonicality checks before each fetch chunk. */
+ if (access & PFERR_FETCH_MASK) {
+ if (!is_64_bit_mode(vcpu))
+ addr = (u32)addr;
+ else if (is_noncanonical_address(addr, vcpu, 0)) {
+ r = X86EMUL_UNHANDLEABLE;
+ goto out;
+ }
+ }
+
+ gpa = gva_walk->gva_to_gpa(vcpu, gva_walk, addr, access, exception);
+ if (gpa == INVALID_GPA) {
+ r = X86EMUL_PROPAGATE_FAULT;
+ goto out;
+ }
ret = kvm_vcpu_read_guest_page(vcpu, gpa >> PAGE_SHIFT, data,
offset, toread);
if (ret < 0) {
@@ -4798,13 +4812,32 @@ static int kvm_read_guest_virt_helper(gva_t addr, void *val, unsigned int bytes,
addr += toread;
}
out:
+ if (bytes_read)
+ *bytes_read = data - val;
return r;
}
-/* used for instruction fetching */
-static int kvm_fetch_guest_virt(struct x86_emulate_ctxt *ctxt,
- gva_t addr, void *val, unsigned int bytes,
- struct x86_exception *exception)
+/* Return the number of instruction bytes read, including partial reads. */
+unsigned int kvm_fetch_guest_virt(struct kvm_vcpu *vcpu, gva_t addr,
+ void *val, unsigned int bytes)
+{
+ struct x86_exception exception = {};
+ unsigned int bytes_read;
+ u64 access = PFERR_FETCH_MASK;
+
+ if (kvm_x86_call(get_cpl)(vcpu) == 3)
+ access |= PFERR_USER_MASK;
+
+ kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
+ &exception, &bytes_read);
+ return bytes_read;
+}
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_fetch_guest_virt);
+
+static int emulator_fetch_guest_virt(struct x86_emulate_ctxt *ctxt,
+ gva_t addr, void *val,
+ unsigned int bytes,
+ struct x86_exception *exception)
{
struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
struct kvm_pagewalk *gva_walk = &vcpu->arch.gva_walk;
@@ -4843,7 +4876,7 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
*/
memset(exception, 0, sizeof(*exception));
return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
- exception);
+ exception, NULL);
}
EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_read_guest_virt);
@@ -4859,7 +4892,8 @@ static int emulator_read_std(struct x86_emulate_ctxt *ctxt,
else if (kvm_x86_call(get_cpl)(vcpu) == 3)
access |= PFERR_USER_MASK;
- return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, exception);
+ return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
+ exception, NULL);
}
static int kvm_write_guest_virt_helper(gva_t addr, void *val, unsigned int bytes,
@@ -5771,7 +5805,7 @@ static const struct x86_emulate_ops emulate_ops = {
.write_gpr = emulator_write_gpr,
.read_std = emulator_read_std,
.write_std = emulator_write_std,
- .fetch = kvm_fetch_guest_virt,
+ .fetch = emulator_fetch_guest_virt,
.read_emulated = emulator_read_emulated,
.write_emulated = emulator_write_emulated,
.cmpxchg_emulated = emulator_cmpxchg_emulated,
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 1d9a66048b01..dbf0a4e6e9c1 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -357,6 +357,8 @@ static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
gva_t addr, void *val, unsigned int bytes,
struct x86_exception *exception);
+unsigned int kvm_fetch_guest_virt(struct kvm_vcpu *vcpu, gva_t addr,
+ void *val, unsigned int bytes);
int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu,
gva_t addr, void *val, unsigned int bytes,
--
2.43.7