work around AMD SVM NPT flush bug on hyper-v

Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>

Author: ludfjig

src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs

@@ -86,6 +86,145 @@ fn release_file_mapping(view_base: *mut c_void, mapping_handle: HandleWrapper) {
     }
 }
 
+/// Workaround for a Hyper-V bug on AMD SVM where the `ObScrubPartition`
+/// path (invoked by `WHvResetPartition`) does not flush the Nested Page
+/// Table (NPT) TLB. After reset, stale GPA-to-HPA translations from
+/// the previous guest execution persist, causing the guest to read
+/// wrong physical memory. Intel is unaffected.
+///
+/// This bug most commonly surfaces as the `interrupt_same_thread_no_barrier`
+/// integration test failing on AMD Windows hosts. @ludfjig has verified
+/// the fix works on Windows Insider builds; this workaround can be
+/// removed once that fix ships in a released version of Windows.
+///
+/// The workaround unmaps and remaps a dummy page after each
+/// `WHvResetPartition`, which forces the hypervisor to invalidate
+/// NPT entries.
+mod npt_flush {
+    use std::os::raw::c_void;
+
+    use hyperlight_common::mem::PAGE_SIZE_USIZE;
+    use windows::Win32::Foundation::{CloseHandle, HANDLE, INVALID_HANDLE_VALUE};
+    use windows::Win32::System::Hypervisor::*;
+    use windows::Win32::System::Memory::{CreateFileMappingA, PAGE_READWRITE};
+    use windows::core::PCSTR;
+
+    use super::WHvMapGpaRange2Func;
+    use crate::hypervisor::surrogate_process::SurrogateProcess;
+    use crate::hypervisor::virtual_machine::{CreateVmError, RegisterError};
+    use crate::mem::layout::SandboxMemoryLayout;
+    use crate::mem::memory_region::SurrogateMapping;
+
+    /// GPA for the dummy page. Placed just past the maximum snapshot
+    /// region so it can never collide with guest memory.
+    const GPA: u64 =
+        (SandboxMemoryLayout::BASE_ADDRESS + SandboxMemoryLayout::MAX_MEMORY_SIZE) as u64;
+
+    #[derive(Debug)]
+    pub(super) struct NptInvalidator {
+        handle: HANDLE,
+        surrogate_addr: *mut c_void,
+        map_gpa_range2: WHvMapGpaRange2Func,
+    }
+
+    impl NptInvalidator {
+        const FLAGS: WHV_MAP_GPA_RANGE_FLAGS = WHvMapGpaRangeFlagRead;
+
+        /// Allocate a dummy page, map it into the surrogate process, and
+        /// create the initial GPA mapping.
+        pub(super) fn new(
+            partition: WHV_PARTITION_HANDLE,
+            surrogate_process: &mut SurrogateProcess,
+        ) -> Result<Self, CreateVmError> {
+            let handle = unsafe {
+                CreateFileMappingA(
+                    INVALID_HANDLE_VALUE,
+                    None,
+                    PAGE_READWRITE,
+                    0,
+                    PAGE_SIZE_USIZE as u32,
+                    PCSTR::null(),
+                )
+                .map_err(|e| CreateVmError::InitializeVm(e.into()))?
+            };
+
+            let surrogate_addr = surrogate_process
+                .map(
+                    handle.into(),
+                    0, // sentinel key; MapViewOfFile never returns 0
+                    PAGE_SIZE_USIZE,
+                    &SurrogateMapping::SandboxMemory,
+                )
+                .map_err(|e| CreateVmError::SurrogateProcess(e.to_string()))?;
+
+            let map_gpa_range2 = unsafe {
+                super::try_load_whv_map_gpa_range2()
+                    .map_err(|e| CreateVmError::InitializeVm(e.into()))?
+            };
+
+            let res = unsafe {
+                map_gpa_range2(
+                    partition,
+                    surrogate_process.process_handle.into(),
+                    surrogate_addr,
+                    GPA,
+                    PAGE_SIZE_USIZE as u64,
+                    Self::FLAGS,
+                )
+            };
+            if res.is_err() {
+                return Err(CreateVmError::InitializeVm(
+                    windows_result::Error::from_hresult(res).into(),
+                ));
+            }
+
+            Ok(Self {
+                handle,
+                surrogate_addr,
+                map_gpa_range2,
+            })
+        }
+
+        /// Force an NPT TLB flush by unmapping and remapping the dummy page.
+        pub(super) fn flush(
+            &mut self,
+            partition: WHV_PARTITION_HANDLE,
+            surrogate_process: &SurrogateProcess,
+        ) -> std::result::Result<(), RegisterError> {
+            unsafe {
+                WHvUnmapGpaRange(partition, GPA, PAGE_SIZE_USIZE as u64)
+                    .map_err(|e| RegisterError::ResetPartition(e.into()))?;
+            }
+            let res = unsafe {
+                (self.map_gpa_range2)(
+                    partition,
+                    surrogate_process.process_handle.into(),
+                    self.surrogate_addr,
+                    GPA,
+                    PAGE_SIZE_USIZE as u64,
+                    Self::FLAGS,
+                )
+            };
+            if res.is_err() {
+                return Err(RegisterError::ResetPartition(
+                    windows_result::Error::from_hresult(res).into(),
+                ));
+            }
+            Ok(())
+        }
+    }
+
+    impl Drop for NptInvalidator {
+        fn drop(&mut self) {
+            // The surrogate mapping is freed when SurrogateProcess drops;
+            // we only need to close the file-mapping handle.
+            if let Err(e) = unsafe { CloseHandle(self.handle) } {
+                tracing::error!("Failed to close NptInvalidator handle: {:?}", e);
+            }
+        }
+    }
+}
+
 /// A Windows Hypervisor Platform implementation of a single-vcpu VM
 #[derive(Debug)]
 pub(crate) struct WhpVm {
@@ -98,15 +237,19 @@ pub(crate) struct WhpVm {
     /// Handle to the background timer (if started).
     #[cfg(feature = "hw-interrupts")]
     timer: Option<TimerThread>,
+    /// Dummy page that is unmapped and remapped to force NPT TLB
+    /// flushes after `WHvResetPartition` on AMD SVM hosts.
+    /// See the [`npt_flush`] module for details.
+    npt_flush: npt_flush::NptInvalidator,
 }
 
 // Safety: `WhpVm` is !Send because it holds `SurrogateProcess` which contains a raw pointer
 // `allocated_address` (*mut c_void). This pointer represents a memory mapped view address
 // in the surrogate process. It is never dereferenced, only used for address arithmetic and
 // resource management (unmapping). This is a system resource that is not bound to the creating
 // thread and can be safely transferred between threads.
-// `file_mappings` contains raw pointers that are also kernel resource handles,
-// safe to use from any thread.
+// `file_mappings` and `NptInvalidator` contain raw pointers that are also kernel
+// resource handles, safe to use from any thread.
 unsafe impl Send for WhpVm {}
 
 impl WhpVm {
@@ -144,16 +287,19 @@ impl WhpVm {
 
         let mgr = get_surrogate_process_manager()
             .map_err(|e| CreateVmError::SurrogateProcess(e.to_string()))?;
-        let surrogate_process = mgr
+        let mut surrogate_process = mgr
             .get_surrogate_process()
             .map_err(|e| CreateVmError::SurrogateProcess(e.to_string()))?;
 
+        let npt_flush = npt_flush::NptInvalidator::new(partition, &mut surrogate_process)?;
+
         Ok(WhpVm {
             partition,
             surrogate_process,
             file_mappings: Vec::new(),
             #[cfg(feature = "hw-interrupts")]
             timer: None,
+            npt_flush,
         })
     }
 
@@ -717,6 +863,10 @@ impl VirtualMachine for WhpVm {
             WHvResetPartition(self.partition)
                 .map_err(|e| RegisterError::ResetPartition(e.into()))?;
 
+            // Flush NPT TLB (AMD SVM workaround, see npt_flush module).
+            self.npt_flush
+                .flush(self.partition, &self.surrogate_process)?;
+
             // WHvResetPartition resets LAPIC to power-on defaults.
             // Re-initialize it when LAPIC emulation is active.
             //

src/hyperlight_host/src/mem/layout.rs

@@ -313,7 +313,7 @@ impl SandboxMemoryLayout {
     /// Both the scratch region and the snapshot region are bounded by
     /// this size. The value is arbitrary but chosen to be large enough
     /// for most workloads while preventing accidental resource exhaustion.
-    const MAX_MEMORY_SIZE: usize = (16 * 1024 * 1024 * 1024) - Self::BASE_ADDRESS; // 16 GiB - BASE_ADDRESS
+    pub(crate) const MAX_MEMORY_SIZE: usize = (16 * 1024 * 1024 * 1024) - Self::BASE_ADDRESS; // 16 GiB - BASE_ADDRESS
 
     /// The base address of the sandbox's memory.
     #[cfg(not(feature = "nanvix-unstable"))]