Re: [kvm-unit-tests] x86: Add #PF test case for the SVM DecodeAssists feature

[Sean Christopherson <seanjc@google.com>]

+Kevin and Yosry, who are working on similar tests

On Thu, Jan 15, 2026, Alejandro Vallejo wrote:
> Tests an intercepted #PF accesing the last (unmapped) qword of the
> virtual address space. The assist ought provides a prefetched
> code stream starting at the offending instruction.
> 
> This is little more than a smoke test. There's more cases not covered.
> Namely, CR/DR MOVs, INTn, INVLPG, nested PFs, and fault-on-fetch.
> 
> Signed-off-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
> ---
> I'm not a big fan of using a literal -8ULL as "unbacked va", but I'm not
> sure how to instruct the harness to give me a hole.

Allocate a page, then use install_pte() or install_page_prot() to create a mapping
that will #PF.

> Likewise, some cases remain
> untested, with the interesting one (fault-on-fetch) requiring some cumbersome
> setup (put the codestream in the 14 bytes leading to a non-present NPT page.

Not _that_ cumbersome though.  Allocate a page, install_page_prot() with NX,
copy/write an instruction to the page, jump/call into the page.

run_in_user_ex() makes it even easier to do that at CPL3.

All the above said, I would rather piggyback the access test and not reinvent the
wheel.  E.g. wrap ac_test_run() a la vmx_pf_exception_test(), then intercept #PF
to verify the instruction information is filled as expected.  We'd need to modify
ac_test_do_access() to record what instruction it expected to fault, but that
shouldn't be _too_ hard, and it might even force us to improve the inscrutable
asm blob.