[PATCH v6 0/8] KVM: nSVM: Enable DecodeAssists for nested guests

[Tina Zhang]

The SVM DecodeAssists feature provides decode state for selected
VM-Exits.  KVM currently does not expose this feature to L1.  Some L1
hypervisors may therefore treat the platform's SVM support as
incomplete.

In practice, this was observed with Hyper-V running on top of KVM.
Hyper-V appears to require DecodeAssists before enabling nested SVM for
its guests.  Virtualizing the feature lets users enable Hyper-V
virtualization features inside a Windows VM when needed, e.g. to run
QEMU/KVM in WSL.

Virtualize both parts of DecodeAssists for nested SVM.  For emulated
MOV CR/DR, INTn, INVLPG, and related intercepts, populate EXITINFO1 as
specified by the architecture.  INVLPGA's address remains in saved guest
rAX.  Leave EXITINFO1 unchanged when DecodeAssists is not exposed.

For data #NPF and intercepted data #PF exits, propagate current hardware
instruction bytes when available.  For an emulator-generated #NPF, keep
the bytes used to decode the instruction and fetch any missing tail.
Queued #PF exits, including userspace-injected exceptions, use an
on-demand fetch from the current L2 CS:RIP.  Instruction-fetch faults
report zero bytes, and SEV guests do not use the memory-fetch fallback.

The selftest covers synthesized EXITINFO1, hardware and synthesized
instruction bytes, and truncated fetches.  Two MMIO cases check that
emulator-generated #NPF exits retain cached bytes after instruction
memory changes, while userspace-injected #PF exits do not reuse an old
emulator cache after MMIO completion.

The updated selftest passed with kvm.force_emulation_prefix both disabled
and enabled in an isolated VM using the v6 implementation.  SEV paths
have not been tested.

Changes since v5:
- Rebase onto kvm-x86/next at the base commit listed below.
- Reuse __linearize() for INVLPG and name the instruction-info field
  invlpg_linear_addr.
- Integrate EXITINFO1 generation into svm_check_intercept() instead of
  using a separate switch.  Leave undefined EXITINFO2 fields unchanged.
- Invalidate instruction bytes by clearing only insn_len.  Leave the
  VMCB12 fields untouched when DecodeAssists is not exposed, and stop
  clearing unused instruction-byte buffer tails.
- Remove the extra argument to nested_svm_exit_handled(); opcode exits
  are excluded by the instruction-byte applicability check.
- Replace the synthesized-byte staging buffer with direct VMCB02
  updates, and add an emulator accessor instead of inspecting the fetch
  cache in nSVM.  Reuse the cache only for the current emulator exception.
- Add the complete fallback before cache reuse so that no intermediate
  patch depends on a later patch to fetch missing bytes.  Reuse the
  generic guest-memory read helper with instruction-fetch permissions,
  checking address boundaries between page-sized chunks.
- Extend the MOVSB regression test to modify the opcode while MMIO is
  pending, restore userspace-injected #PF coverage, and give the MMIO
  source its own page.  Both MMIO cases run without forced emulation.

Previous versions:
v5:
https://lore.kernel.org/r/20260824123954.315112-1-zhang_wei@xxxxxxxxxxxxxx
v4:
https://lore.kernel.org/r/cover.1787116250.git.zhang_wei@xxxxxxxxxxxxxx
v3:
https://lore.kernel.org/r/cover.1785411877.git.zhang_wei@xxxxxxxxxxxxxx
v2:
https://lore.kernel.org/r/cover.1783999988.git.zhang_wei@xxxxxxxxxxxxxx
v1:
https://lore.kernel.org/r/20260629125205.52394-1-zhang_wei@xxxxxxxxxxxxxx

Tina Zhang (8):
  KVM: x86: Provide INVLPG linear address to intercept handlers
  KVM: nSVM: Synthesize DecodeAssists EXITINFO for emulated intercepts
  KVM: nSVM: Track valid hardware DecodeAssist bytes
  KVM: nSVM: Propagate hardware DecodeAssist bytes to VMCB12
  KVM: nSVM: Fetch DecodeAssist bytes for synthesized faults
  KVM: nSVM: Use emulator bytes for synthesized nested #NPF
  KVM: nSVM: Advertise DecodeAssists to L1
  KVM: selftests: Add nested SVM DecodeAssists test

 arch/x86/kvm/cpuid.c                          |   1 +
 arch/x86/kvm/emulate.c                        |  40 ++
 arch/x86/kvm/kvm_emulate.h                    |   4 +
 arch/x86/kvm/svm/nested.c                     | 163 +++++-
 arch/x86/kvm/svm/svm.c                        |  34 +-
 arch/x86/kvm/svm/svm.h                        |   3 +
 arch/x86/kvm/x86.c                            |  23 +-
 arch/x86/kvm/x86.h                            |   3 +
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../selftests/kvm/include/x86/processor.h     |   1 +
 .../kvm/x86/svm_nested_decode_assists_test.c  | 547 ++++++++++++++++++
 11 files changed, 814 insertions(+), 6 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/x86/svm_nested_decode_assists_test.c


base-commit: 76671054f9a1ff6abb976583cd8da37650acdc97
-- 
2.43.7