Skip to content

[x86_64] fetch MMIO fault instructions across guest pages safely - #406

Draft
Solicey wants to merge 1 commit into
syswonder:devfrom
Solicey:fix_mmio_fault_inst
Draft

Solicey wants to merge 1 commit into
syswonder:devfrom
Solicey:fix_mmio_fault_inst

Conversation

@Solicey

@Solicey Solicey commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

Summary

Fix x86_64 MMIO instruction fetching when a guest instruction crosses a page boundary. (Issue #405)

Problem

The MMIO emulator previously translated guest RIP once, then read 15 consecutive bytes from the resulting host address. Adjacent guest pages are not necessarily adjacent in host memory, so this could read unrelated or unmapped memory.

Changes

  • Fetch only the instruction bytes needed by the decoder, translating each guest page independently.
  • Limit instruction reads to the x86 maximum of 15 bytes.
  • Inject a guest page fault when a required instruction page is not present, preserving RIP and setting guest CR2.
  • Preserve guest CR2 across VM entry and exit.
  • Pass the MMIO handler its original argument separately from the region base.
  • Add focused tests for page-boundary reads and the instruction-length limit.

@Solicey
Solicey force-pushed the fix_mmio_fault_inst branch from 569a325 to 4985d44 Compare October 13, 2026 16:00
@Solicey Solicey changed the title fetch MMIO fault instructions across guest pages safely [x86_64] fetch MMIO fault instructions across guest pages safely Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant