diff --git a/.github/workflows/ValidatePullRequest.yml b/.github/workflows/ValidatePullRequest.yml index e690cefcf..ac06bcd82 100644 --- a/.github/workflows/ValidatePullRequest.yml +++ b/.github/workflows/ValidatePullRequest.yml @@ -89,7 +89,7 @@ jobs: # See: https://github.com/actions/runner/issues/2205 if: ${{ !cancelled() && !failure() }} strategy: - fail-fast: true + fail-fast: false matrix: hypervisor: ['hyperv-ws2025', mshv3, kvm] cpu: [amd, intel] @@ -112,7 +112,7 @@ jobs: # See: https://github.com/actions/runner/issues/2205 if: ${{ !cancelled() && !failure() }} strategy: - fail-fast: true + fail-fast: false matrix: hypervisor: ['hyperv-ws2025', mshv3, kvm] cpu: [amd, intel] diff --git a/Justfile b/Justfile index d71630d47..a039e1626 100644 --- a/Justfile +++ b/Justfile @@ -235,7 +235,7 @@ test-integration target=default-target features="": {{ cargo-cmd }} test {{ if features =="" {"--features executable_heap"} else if features=="no-default-features" {"--no-default-features --features executable_heap"} else {"--no-default-features -F executable_heap," + features } }} --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }} --test integration_test execute_on_heap @# run the rest of the integration tests - {{ cargo-cmd }} test -p hyperlight-host {{ if features =="" {''} else if features=="no-default-features" {"--no-default-features" } else {"--no-default-features -F " + features } }} --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }} --test '*' + {{ cargo-cmd }} test -p hyperlight-host {{ if features =="" {''} else if features=="no-default-features" {"--no-default-features" } else {"--no-default-features -F " + features } }} --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }} --test '*' -- --nocapture # tests compilation with no default features on different platforms test-compilation-no-default-features target=default-target: @@ -323,6 +323,11 @@ clippy target=default-target: (witguest-wit) clippyw target=default-target: (witguest-wit) {{ cargo-cmd }} clippy --all-targets --all-features --target x86_64-pc-windows-gnu --profile={{ if target == "debug" { "dev" } else { target } }} -- -D warnings +# Cross-check for linux from a windows host using clippy (no linking needed). +# Only checks lib targets to avoid dev-dependencies (criterion->alloca) that need a C cross-compiler. +clippyl target=default-target: + {{ cargo-cmd }} clippy --lib --all-features --target x86_64-unknown-linux-gnu --profile={{ if target == "debug" { "dev" } else { target } }} -- -D warnings + clippy-guests target=default-target: (witguest-wit) (ensure-cargo-hyperlight) cd src/tests/rust_guests/simpleguest && cargo hyperlight clippy --profile={{ if target == "debug" { "dev" } else { target } }} -- -D warnings cd src/tests/rust_guests/witguest && cargo hyperlight clippy --profile={{ if target == "debug" { "dev" } else { target } }} -- -D warnings diff --git a/src/hyperlight_host/src/hypervisor/hyperlight_vm/aarch64.rs b/src/hyperlight_host/src/hypervisor/hyperlight_vm/aarch64.rs index c4288ae60..b1a2150f5 100644 --- a/src/hyperlight_host/src/hypervisor/hyperlight_vm/aarch64.rs +++ b/src/hyperlight_host/src/hypervisor/hyperlight_vm/aarch64.rs @@ -89,11 +89,15 @@ impl HyperlightVm { unimplemented!("get_snapshot_sregs") } - pub(crate) fn reset_vcpu( + pub(crate) fn reset_vm_state(&mut self) -> std::result::Result<(), RegisterError> { + unimplemented!("reset_vm_state") + } + + pub(crate) fn restore_sregs( &mut self, _cr3: u64, _sregs: &CommonSpecialRegisters, ) -> std::result::Result<(), RegisterError> { - unimplemented!("reset_vcpu") + unimplemented!("restore_sregs") } } diff --git a/src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs b/src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs index e8f21e119..4c4487f01 100644 --- a/src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs +++ b/src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs @@ -40,9 +40,9 @@ use crate::hypervisor::gdb::{ }; #[cfg(gdb)] use crate::hypervisor::gdb::{DebugError, DebugMemoryAccessError}; -use crate::hypervisor::regs::{ - CommonDebugRegs, CommonFpu, CommonRegisters, CommonSpecialRegisters, -}; +#[cfg(not(target_os = "windows"))] +use crate::hypervisor::regs::CommonDebugRegs; +use crate::hypervisor::regs::{CommonFpu, CommonRegisters, CommonSpecialRegisters}; #[cfg(not(gdb))] use crate::hypervisor::virtual_machine::VirtualMachine; #[cfg(kvm)] @@ -292,7 +292,10 @@ impl HyperlightVm { let mut rflags = 1 << 1; // RFLAGS.1 is RES1 if self.pending_tlb_flush { rflags |= 1 << 6; // set ZF if we need a tlb flush done before anything else executes - self.pending_tlb_flush = false; + // Note: pending_tlb_flush is cleared AFTER run() returns successfully, + // not here. If the guest is cancelled before executing the flush + // (e.g. CancelPending causes WHvRunVirtualProcessor to return + // immediately), we must retry the flush on the next dispatch. } // set RIP and RSP, reset others let regs = CommonRegisters { @@ -319,37 +322,60 @@ impl HyperlightVm { .set_fpu(&CommonFpu::default()) .map_err(DispatchGuestCallError::SetupRegs)?; - self.run( - mem_mgr, - host_funcs, - #[cfg(gdb)] - dbg_mem_access_fn, - ) - .map_err(DispatchGuestCallError::Run) + let result = self + .run( + mem_mgr, + host_funcs, + #[cfg(gdb)] + dbg_mem_access_fn, + ) + .map_err(DispatchGuestCallError::Run); + + // Clear the TLB flush flag only after run() returns. The guest + // may have been cancelled before it executed the flush (the CR4 + // PGE toggle in dispatch_function). If we cleared the flag + // eagerly before run(), a cancelled dispatch would consume it + // and the next dispatch would skip the flush, leaving stale + // GVA→GPA TLB entries from the pre-restore page tables. + self.pending_tlb_flush = false; + + result } /// Resets the following vCPU state: - /// - General purpose registers - /// - Debug registers - /// - XSAVE (includes FPU/SSE state with proper FCW and MXCSR defaults) - /// - Special registers (restored from snapshot, with CR3 updated to new page table location) + /// - On Windows: calls WHvResetPartition (resets all per-VP state including + /// GP registers, debug registers, XSAVE, MSRs, APIC, etc.) + /// - On Linux: explicitly resets GP registers, debug registers, and XSAVE + /// + /// This does NOT restore special registers — call `restore_sregs` separately + /// after memory mappings are established. // TODO: check if other state needs to be reset - pub(crate) fn reset_vcpu( + pub(crate) fn reset_vm_state(&mut self) -> std::result::Result<(), RegisterError> { + #[cfg(target_os = "windows")] + self.vm.reset_partition()?; + + #[cfg(not(target_os = "windows"))] + { + self.vm.set_regs(&CommonRegisters { + rflags: 1 << 1, // Reserved bit always set + ..Default::default() + })?; + self.vm.set_debug_regs(&CommonDebugRegs::default())?; + self.vm.reset_xsave()?; + } + + Ok(()) + } + + /// Restores special registers from snapshot with CR3 updated to the + /// new page table location. + pub(crate) fn restore_sregs( &mut self, cr3: u64, sregs: &CommonSpecialRegisters, ) -> std::result::Result<(), RegisterError> { - self.vm.set_regs(&CommonRegisters { - rflags: 1 << 1, // Reserved bit always set - ..Default::default() - })?; - self.vm.set_debug_regs(&CommonDebugRegs::default())?; - self.vm.reset_xsave()?; - #[cfg(not(feature = "nanvix-unstable"))] { - // Restore the full special registers from snapshot, but update CR3 - // to point to the new (relocated) page tables let mut sregs = *sregs; sregs.cr3 = cr3; self.pending_tlb_flush = true; @@ -879,7 +905,9 @@ mod tests { use super::*; #[cfg(kvm)] use crate::hypervisor::regs::FP_CONTROL_WORD_DEFAULT; - use crate::hypervisor::regs::{CommonSegmentRegister, CommonTableRegister, MXCSR_DEFAULT}; + use crate::hypervisor::regs::{ + CommonDebugRegs, CommonSegmentRegister, CommonTableRegister, MXCSR_DEFAULT, + }; use crate::hypervisor::virtual_machine::VirtualMachine; use crate::mem::layout::SandboxMemoryLayout; use crate::mem::memory_region::{GuestMemoryRegion, MemoryRegionFlags}; @@ -906,7 +934,7 @@ mod tests { // Dirty State Builders - Create non-default vCPU state for testing reset // ========================================================================== - /// Build dirty general purpose registers for testing reset_vcpu. + /// Build dirty general purpose registers for testing reset. fn dirty_regs() -> CommonRegisters { CommonRegisters { rax: 0x1111111111111111, @@ -930,7 +958,7 @@ mod tests { } } - /// Build dirty FPU state for testing reset_vcpu. + /// Build dirty FPU state for testing reset. fn dirty_fpu() -> CommonFpu { CommonFpu { fpr: [[0xAB; 16]; 8], @@ -945,7 +973,7 @@ mod tests { } } - /// Build dirty special registers for testing reset_vcpu. + /// Build dirty special registers for testing reset. /// Must be consistent for 64-bit long mode (CR0/CR4/EFER). fn dirty_sregs(_pml4_addr: u64) -> CommonSpecialRegisters { let segment = CommonSegmentRegister { @@ -1014,7 +1042,7 @@ mod tests { } } - /// Build dirty debug registers for testing reset_vcpu. + /// Build dirty debug registers for testing reset. /// /// DR6 bit layout (Intel SDM / AMD APM): /// Bits 0-3 (B0-B3): Breakpoint condition detected - software writable/clearable @@ -1058,8 +1086,8 @@ mod tests { } } - /// Returns default test values for reset_vcpu parameters. - /// Uses standard 64-bit defaults since reset_vcpu now restores full sregs from snapshot. + /// Returns default test values for restore_sregs parameters. + /// Uses standard 64-bit defaults since restore_sregs restores full sregs from snapshot. fn default_sregs() -> CommonSpecialRegisters { CommonSpecialRegisters::standard_64bit_defaults(0) } @@ -1183,9 +1211,18 @@ mod tests { // Assertion Helpers - Verify vCPU state after reset // ========================================================================== - /// Assert that debug registers are in reset state. - /// Reserved bits in DR6/DR7 are read-only (set by CPU), so we only check - /// that writable bits are cleared to 0 and DR0-DR3 are zeroed. + /// Assert that debug registers are in architectural reset state. + /// + /// On Linux (KVM/MSHV): reset_vm_state explicitly zeroes debug registers. + /// + /// On Windows: WHvResetPartition resets to power-on defaults per + /// Intel SDM Vol. 3, Table 10-1: + /// DR0-DR3 = 0 (breakpoint addresses cleared) + /// DR6 = 0xFFFF0FF0 (reserved bits set, writable bits cleared) + /// DR7 = 0x00000400 (reserved bit 10 set, all enables cleared) + /// + /// Reserved bits in DR6/DR7 are read-only and CPU-dependent, so we only + /// verify that writable bits are cleared to 0 and DR0-DR3 are zeroed. fn assert_debug_regs_reset(vm: &dyn VirtualMachine) { let debug_regs = vm.debug_regs().unwrap(); let expected = CommonDebugRegs { @@ -1200,19 +1237,58 @@ mod tests { } /// Assert that general-purpose registers are in reset state. - /// After reset, all registers should be zeroed except rflags which has - /// reserved bit 1 always set. + /// + /// On Linux (KVM/MSHV): reset_vm_state explicitly zeroes all GP regs and sets + /// rflags = 0x2, so we verify all-zeros. + /// + /// On Windows: WHvResetPartition sets architectural power-on defaults + /// per Intel SDM Vol. 3, Table 10-1: + /// RIP = 0xFFF0 (reset vector) + /// RDX = CPUID signature (CPU-dependent stepping/model/family) + /// RFLAGS = 0x2 (only reserved bit 1 set) + /// All other GP regs = 0 + /// These are overwritten by dispatch_call_from_host before guest execution, + /// but we still verify the power-on state is correct. fn assert_regs_reset(vm: &dyn VirtualMachine) { + let regs = vm.regs().unwrap(); + #[cfg(not(target_os = "windows"))] assert_eq!( - vm.regs().unwrap(), + regs, CommonRegisters { - rflags: 1 << 1, // Reserved bit 1 is always set + rflags: 1 << 1, ..Default::default() } ); + #[cfg(target_os = "windows")] + { + // WHvResetPartition sets x86 power-on reset values + // (Intel SDM Vol. 3, Table 10-1) + let expected = CommonRegisters { + rip: 0xFFF0, // Reset vector + rdx: regs.rdx, // CPUID signature (CPU-dependent) + rflags: 0x2, // Reserved bit 1 + ..Default::default() + }; + assert_ne!( + regs.rdx, 0x4444444444444444, + "RDX should not retain dirty value" + ); + assert_eq!(regs, expected); + } } /// Assert that FPU state is in reset state. + /// + /// On Linux (KVM/MSHV): reset_vm_state calls reset_xsave which zeroes FPU state + /// and sets FCW/MXCSR to defaults. + /// + /// On Windows: WHvResetPartition resets to power-on defaults per + /// Intel SDM Vol. 3, Table 10-1 (FINIT-equivalent state): + /// FCW = 0x037F (all exceptions masked, precision=64-bit, round=nearest) + /// FSW = 0, FTW = 0 (all empty), FOP = 0, FIP = 0, FDP = 0 + /// MXCSR = 0x1F80 (all SIMD exceptions masked, round=nearest) + /// ST0-ST7 = 0, XMM0-XMM15 = 0 + /// /// Handles hypervisor-specific quirks (KVM MXCSR, empty FPU registers). fn assert_fpu_reset(vm: &dyn VirtualMachine) { let fpu = vm.fpu().unwrap(); @@ -1222,8 +1298,14 @@ mod tests { assert_eq!(fpu, expected_fpu); } - /// Assert that special registers are in reset state. - /// Handles hypervisor-specific differences in hidden descriptor cache fields. + /// Assert that special registers match the expected snapshot state. + /// + /// After reset, sregs are explicitly restored from the snapshot + /// (with CR3 updated). This verifies they match the expected 64-bit + /// long mode configuration from CommonSpecialRegisters::standard_64bit_defaults. + /// + /// Handles hypervisor-specific differences in hidden descriptor cache fields + /// (unusable, granularity, type_ for unused segments). fn assert_sregs_reset(vm: &dyn VirtualMachine, pml4_addr: u64) { let defaults = CommonSpecialRegisters::standard_64bit_defaults(pml4_addr); let sregs = vm.sregs().unwrap(); @@ -1333,7 +1415,7 @@ mod tests { dirtied_mask } - /// Dirty the legacy XSAVE region (bytes 0-511) for testing reset_vcpu. + /// Dirty the legacy XSAVE region (bytes 0-511) for testing reset. /// This includes FPU/x87 state, SSE state, and reserved areas. /// /// Layout (from Intel SDM Table 13-1): @@ -1621,7 +1703,8 @@ mod tests { assert_eq!(got_sregs, expected_sregs); // Reset the vCPU - hyperlight_vm.reset_vcpu(0, &default_sregs()).unwrap(); + hyperlight_vm.reset_vm_state().unwrap(); + hyperlight_vm.restore_sregs(0, &default_sregs()).unwrap(); // Verify registers are reset to defaults assert_regs_reset(hyperlight_vm.vm.as_ref()); @@ -1686,7 +1769,7 @@ mod tests { "xsave should be zeroed except for hypervisor-specific fields" ); - // Verify sregs are reset to defaults (CR3 is 0 as passed to reset_vcpu) + // Verify sregs are reset to defaults assert_sregs_reset(hyperlight_vm.vm.as_ref(), 0); } @@ -1750,7 +1833,8 @@ mod tests { assert_eq!(regs, expected_dirty); // Reset vcpu - hyperlight_vm.reset_vcpu(0, &default_sregs()).unwrap(); + hyperlight_vm.reset_vm_state().unwrap(); + hyperlight_vm.restore_sregs(0, &default_sregs()).unwrap(); // Check registers are reset to defaults assert_regs_reset(hyperlight_vm.vm.as_ref()); @@ -1874,7 +1958,8 @@ mod tests { } // Reset vcpu - hyperlight_vm.reset_vcpu(0, &default_sregs()).unwrap(); + hyperlight_vm.reset_vm_state().unwrap(); + hyperlight_vm.restore_sregs(0, &default_sregs()).unwrap(); // Check FPU is reset to defaults assert_fpu_reset(hyperlight_vm.vm.as_ref()); @@ -1925,7 +2010,8 @@ mod tests { assert_eq!(debug_regs, expected_dirty); // Reset vcpu - hyperlight_vm.reset_vcpu(0, &default_sregs()).unwrap(); + hyperlight_vm.reset_vm_state().unwrap(); + hyperlight_vm.restore_sregs(0, &default_sregs()).unwrap(); // Check debug registers are reset to default values assert_debug_regs_reset(hyperlight_vm.vm.as_ref()); @@ -1974,9 +2060,10 @@ mod tests { assert_eq!(sregs, expected_dirty); // Reset vcpu - hyperlight_vm.reset_vcpu(0, &default_sregs()).unwrap(); + hyperlight_vm.reset_vm_state().unwrap(); + hyperlight_vm.restore_sregs(0, &default_sregs()).unwrap(); - // Check registers are reset to defaults (CR3 is 0 as passed to reset_vcpu) + // Check registers are reset to defaults let sregs = hyperlight_vm.vm.sregs().unwrap(); let mut expected_reset = CommonSpecialRegisters::standard_64bit_defaults(0); normalize_sregs_for_run_tests(&mut expected_reset, &sregs); @@ -2012,7 +2099,11 @@ mod tests { let root_pt_addr = ctx.ctx.vm.get_root_pt().unwrap(); let segment_state = ctx.ctx.vm.get_snapshot_sregs().unwrap(); - ctx.ctx.vm.reset_vcpu(root_pt_addr, &segment_state).unwrap(); + ctx.ctx.vm.reset_vm_state().unwrap(); + ctx.ctx + .vm + .restore_sregs(root_pt_addr, &segment_state) + .unwrap(); // Re-run from entrypoint (flag=1 means guest skips dirty phase, just does FXSAVE) // Use stack_top - 8 to match initialise()'s behavior (simulates call pushing return addr) diff --git a/src/hyperlight_host/src/hypervisor/virtual_machine/mod.rs b/src/hyperlight_host/src/hypervisor/virtual_machine/mod.rs index 9edaa1f87..e919505b1 100644 --- a/src/hyperlight_host/src/hypervisor/virtual_machine/mod.rs +++ b/src/hyperlight_host/src/hypervisor/virtual_machine/mod.rs @@ -107,7 +107,7 @@ pub(crate) enum HypervisorType { /// Minimum XSAVE buffer size: 512 bytes legacy region + 64 bytes header. /// Only used by MSHV and WHP which use compacted XSAVE format and need to /// validate buffer size before accessing XCOMP_BV. -#[cfg(any(mshv3, target_os = "windows"))] +#[cfg(mshv3)] pub(crate) const XSAVE_MIN_SIZE: usize = 576; /// Standard XSAVE buffer size (4KB) used by KVM and MSHV. @@ -244,6 +244,9 @@ pub enum RegisterError { #[cfg(target_os = "windows")] #[error("Failed to convert WHP registers: {0}")] ConversionFailed(String), + #[cfg(target_os = "windows")] + #[error("Failed to reset partition: {0}")] + ResetPartition(HypervisorError), } /// Map memory error @@ -341,18 +344,32 @@ pub(crate) trait VirtualMachine: Debug + Send { #[allow(dead_code)] fn debug_regs(&self) -> std::result::Result; /// Set the debug registers of the vCPU + #[allow(dead_code)] // Called on Linux (reset_vcpu_state) and via gdb, but dead on Windows release builds without gdb fn set_debug_regs(&self, drs: &CommonDebugRegs) -> std::result::Result<(), RegisterError>; /// Get xsave #[allow(dead_code)] fn xsave(&self) -> std::result::Result, RegisterError>; /// Reset xsave to default state + #[cfg(any(kvm, mshv3))] fn reset_xsave(&self) -> std::result::Result<(), RegisterError>; /// Set xsave - only used for tests #[cfg(test)] #[cfg(not(feature = "nanvix-unstable"))] fn set_xsave(&self, xsave: &[u32]) -> std::result::Result<(), RegisterError>; + /// Reset the partition using WHvResetPartition. + /// + /// Resets all per-VP state to architectural defaults: GP registers, segment + /// registers, control registers, EFER, MSRs, debug registers, full XSAVE + /// state (x87/SSE/AVX/AVX-512/AMX), XCR0, APIC/LAPIC, pending interrupts, + /// and VMCS/VMCB internals. + /// + /// Does NOT reset: GPA memory mappings or contents, partition configuration, + /// notification ports, or VPCI device state. + #[cfg(target_os = "windows")] + fn reset_partition(&mut self) -> std::result::Result<(), RegisterError>; + /// Get partition handle #[cfg(target_os = "windows")] fn partition_handle(&self) -> windows::Win32::System::Hypervisor::WHV_PARTITION_HANDLE; diff --git a/src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs b/src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs index 3c6ae5a9d..0844bb8af 100644 --- a/src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs +++ b/src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs @@ -32,9 +32,8 @@ use windows_result::HRESULT; use crate::hypervisor::gdb::{DebugError, DebuggableVm}; use crate::hypervisor::regs::{ Align16, CommonDebugRegs, CommonFpu, CommonRegisters, CommonSpecialRegisters, - FP_CONTROL_WORD_DEFAULT, MXCSR_DEFAULT, WHP_DEBUG_REGS_NAMES, WHP_DEBUG_REGS_NAMES_LEN, - WHP_FPU_NAMES, WHP_FPU_NAMES_LEN, WHP_REGS_NAMES, WHP_REGS_NAMES_LEN, WHP_SREGS_NAMES, - WHP_SREGS_NAMES_LEN, + WHP_DEBUG_REGS_NAMES, WHP_DEBUG_REGS_NAMES_LEN, WHP_FPU_NAMES, WHP_FPU_NAMES_LEN, + WHP_REGS_NAMES, WHP_REGS_NAMES_LEN, WHP_SREGS_NAMES, WHP_SREGS_NAMES_LEN, }; use crate::hypervisor::surrogate_process::SurrogateProcess; use crate::hypervisor::surrogate_process_manager::get_surrogate_process_manager; @@ -42,7 +41,7 @@ use crate::hypervisor::surrogate_process_manager::get_surrogate_process_manager; use crate::hypervisor::virtual_machine::x86_64::hw_interrupts::TimerThread; use crate::hypervisor::virtual_machine::{ CreateVmError, HypervisorError, MapMemoryError, RegisterError, RunVcpuError, UnmapMemoryError, - VirtualMachine, VmExit, XSAVE_MIN_SIZE, + VirtualMachine, VmExit, }; use crate::hypervisor::wrappers::HandleWrapper; use crate::mem::memory_region::{MemoryRegion, MemoryRegionFlags, MemoryRegionType}; @@ -556,6 +555,12 @@ impl VirtualMachine for WhpVm { let whp_regs: [(WHV_REGISTER_NAME, Align16); WHP_SREGS_NAMES_LEN] = sregs.into(); + // TODO: Remove this filter and instead fix the callers to pass + // the correct APIC_BASE value (e.g. read it from the VP before + // the first set_sregs, or use 0xFEE00900 in standard_64bit_defaults). + // Filtering here causes AMD/SVM bugs because SVM_CLEAN_FIELD_AVIC + // is never dirtied after WHvResetPartition (see reset_partition). + // // When LAPIC emulation is active (always with hw-interrupts), // skip writing APIC_BASE. The generic CommonSpecialRegisters // defaults APIC_BASE to 0 which would globally disable the LAPIC. @@ -607,6 +612,7 @@ impl VirtualMachine for WhpVm { }) } + #[allow(dead_code)] fn set_debug_regs(&self, drs: &CommonDebugRegs) -> std::result::Result<(), RegisterError> { let whp_regs: [(WHV_REGISTER_NAME, Align16); WHP_DEBUG_REGS_NAMES_LEN] = drs.into(); @@ -666,85 +672,6 @@ impl VirtualMachine for WhpVm { Ok(xsave_buffer) } - fn reset_xsave(&self) -> std::result::Result<(), RegisterError> { - // WHP uses compacted XSAVE format (bit 63 of XCOMP_BV set). - // We cannot just zero out the xsave area, we need to preserve the XCOMP_BV. - - // Get the required buffer size by calling with NULL buffer. - let mut buffer_size_needed: u32 = 0; - - let result = unsafe { - WHvGetVirtualProcessorXsaveState( - self.partition, - 0, - std::ptr::null_mut(), - 0, - &mut buffer_size_needed, - ) - }; - - // Expect insufficient buffer error; any other error is unexpected - if let Err(e) = result - && e.code() != windows::Win32::Foundation::WHV_E_INSUFFICIENT_BUFFER - { - return Err(RegisterError::GetXsaveSize(e.into())); - } - - if buffer_size_needed < XSAVE_MIN_SIZE as u32 { - return Err(RegisterError::XsaveSizeMismatch { - expected: XSAVE_MIN_SIZE as u32, - actual: buffer_size_needed, - }); - } - - // Create a buffer to hold the current state (to get the correct XCOMP_BV) - let mut current_state = vec![0u8; buffer_size_needed as usize]; - let mut written_bytes = 0; - unsafe { - WHvGetVirtualProcessorXsaveState( - self.partition, - 0, - current_state.as_mut_ptr() as *mut std::ffi::c_void, - buffer_size_needed, - &mut written_bytes, - ) - .map_err(|e| RegisterError::GetXsave(e.into()))?; - }; - - // Zero out most of the buffer, preserving only XCOMP_BV (520-528). - // Extended components with XSTATE_BV bit=0 will use their init values. - // - // - Legacy region (0-512): x87 FPU + SSE state - // - XSTATE_BV (512-520): Feature bitmap - // - XCOMP_BV (520-528): Compaction bitmap + format bit (KEEP) - // - Reserved (528-576): Header padding - // - Extended (576+): AVX, AVX-512, MPX, PKRU, AMX, etc. - current_state[0..520].fill(0); - current_state[528..].fill(0); - - // XSAVE area layout from Intel SDM Vol. 1 Section 13.4.1: - // - Bytes 0-1: FCW (x87 FPU Control Word) - // - Bytes 24-27: MXCSR - // - Bytes 512-519: XSTATE_BV (bitmap of valid state components) - current_state[0..2].copy_from_slice(&FP_CONTROL_WORD_DEFAULT.to_le_bytes()); - current_state[24..28].copy_from_slice(&MXCSR_DEFAULT.to_le_bytes()); - // XSTATE_BV = 0x3: bits 0,1 = x87 + SSE valid. Explicitly tell hypervisor - // to apply the legacy region from this buffer for consistent behavior. - current_state[512..520].copy_from_slice(&0x3u64.to_le_bytes()); - - unsafe { - WHvSetVirtualProcessorXsaveState( - self.partition, - 0, - current_state.as_ptr() as *const std::ffi::c_void, - buffer_size_needed, - ) - .map_err(|e| RegisterError::SetXsave(e.into()))?; - } - - Ok(()) - } - #[cfg(test)] #[cfg(not(feature = "nanvix-unstable"))] fn set_xsave(&self, xsave: &[u32]) -> std::result::Result<(), RegisterError> { @@ -791,6 +718,45 @@ impl VirtualMachine for WhpVm { Ok(()) } + fn reset_partition(&mut self) -> std::result::Result<(), RegisterError> { + // Stop any active timer before reset — WHvResetPartition wipes the + // LAPIC, so stale WHvRequestInterrupt calls from the timer thread + // would hit an unconfigured interrupt controller. + #[cfg(feature = "hw-interrupts")] + if let Some(mut t) = self.timer.take() { + t.stop(); + } + + unsafe { + WHvResetPartition(self.partition) + .map_err(|e| RegisterError::ResetPartition(e.into()))?; + + // WHvResetPartition resets LAPIC to power-on defaults. + // Re-initialize it when LAPIC emulation is active. + #[cfg(feature = "hw-interrupts")] + Self::init_lapic_bulk(self.partition) + .map_err(|e| RegisterError::ResetPartition(e.into()))?; + + // With hw-interrupts, set_sregs filters out APIC_BASE to + // avoid disabling the LAPIC (the snapshot sregs default it + // to 0). On AMD/SVM this means SVM_CLEAN_FIELD_AVIC is + // never dirtied after the VMCB rebuild, causing the CPU to + // use stale cached AVIC state on VMRUN which corrupts guest + // memory reads. Re-writing APIC_BASE to its post-reset + // value forces the dirty bit via ValSetEmulatedApicBase. + #[cfg(feature = "hw-interrupts")] + { + let apic_base = self.sregs()?.apic_base; + self.set_registers(&[( + WHvX64RegisterApicBase, + Align16(WHV_REGISTER_VALUE { Reg64: apic_base }), + )]) + .map_err(|e| RegisterError::ResetPartition(e.into()))?; + } + } + Ok(()) + } + /// Get the partition handle for this VM fn partition_handle(&self) -> WHV_PARTITION_HANDLE { self.partition diff --git a/src/hyperlight_host/src/sandbox/initialized_multi_use.rs b/src/hyperlight_host/src/sandbox/initialized_multi_use.rs index 8f147c11c..ad6209d0b 100644 --- a/src/hyperlight_host/src/sandbox/initialized_multi_use.rs +++ b/src/hyperlight_host/src/sandbox/initialized_multi_use.rs @@ -291,6 +291,14 @@ impl MultiUseSandbox { return Err(SnapshotSandboxMismatch); } + // Reset VM/vCPU state before memory restore. On Windows with AMD cpu, + // WHvResetPartition must happen before GPA remapping to avoid + // guest memory corruption. Unclear why. + self.vm.reset_vm_state().map_err(|e| { + self.poisoned = true; + HyperlightVmError::Restore(e) + })?; + let (gsnapshot, gscratch) = self.mem_mgr.restore_snapshot(&snapshot)?; if let Some(gsnapshot) = gsnapshot { self.vm @@ -306,10 +314,12 @@ impl MultiUseSandbox { let sregs = snapshot.sregs().ok_or_else(|| { HyperlightError::Error("snapshot from running sandbox should have sregs".to_string()) })?; + // Restore special registers (CR3 etc.) after memory is in place + // so the page tables are already mapped at the target GPA. // TODO (ludfjig): Go through the rest of possible errors in this `MultiUseSandbox::restore` function // and determine if they should also poison the sandbox. self.vm - .reset_vcpu(snapshot.root_pt_gpa(), sregs) + .restore_sregs(snapshot.root_pt_gpa(), sregs) .map_err(|e| { self.poisoned = true; HyperlightVmError::Restore(e) @@ -1446,7 +1456,7 @@ mod tests { } /// Test that snapshot restore properly resets vCPU debug registers. This test verifies - /// that restore() calls reset_vcpu(). + /// that restore() calls reset_vm_state(). #[test] fn snapshot_restore_resets_debug_registers() { let mut sandbox: MultiUseSandbox = { @@ -1476,7 +1486,7 @@ mod tests { let dr0_after_restore: u64 = sandbox.call("GetDr0", ()).unwrap(); assert_eq!( dr0_after_restore, 0, - "DR0 should be 0 after restore (reset_vcpu should have been called)" + "DR0 should be 0 after restore (reset_vm_state should have been called)" ); } diff --git a/src/hyperlight_host/tests/integration_test.rs b/src/hyperlight_host/tests/integration_test.rs index 1f823dc49..c510fce71 100644 --- a/src/hyperlight_host/tests/integration_test.rs +++ b/src/hyperlight_host/tests/integration_test.rs @@ -195,7 +195,7 @@ fn interrupt_same_thread() { // Only allow successful calls or interrupted. // The call can be successful in case the call is finished before kill() is called. Ok(_) | Err(HyperlightError::ExecutionCanceledByHost()) => {} - _ => panic!("Unexpected return"), + other => panic!("Unexpected return: {:?}", other), }; if sbox2.poisoned() { sbox2.restore(snapshot2.clone()).unwrap(); @@ -968,6 +968,8 @@ fn interrupt_random_kill_stress_test() { NUM_THREADS, ITERATIONS_PER_THREAD ); + let start_time = std::time::Instant::now(); + // Spawn worker threads let mut thread_handles = vec![]; for thread_id in 0..NUM_THREADS { @@ -1221,11 +1223,15 @@ fn interrupt_random_kill_stress_test() { // Progress reporting let current_total = total_iterations_clone.load(Ordering::Relaxed); - if current_total.is_multiple_of(5000) { + if current_total.is_multiple_of(1000) { + let elapsed = start_time.elapsed(); println!( - "Progress: {}/{} iterations completed", + "Progress: {}/{} iterations ({:.1}s elapsed, {} restores, {} replacements)", current_total, - NUM_THREADS * ITERATIONS_PER_THREAD + NUM_THREADS * ITERATIONS_PER_THREAD, + elapsed.as_secs_f64(), + actually_killed_count_clone.load(Ordering::Relaxed), + sandbox_replaced_count_clone.load(Ordering::Relaxed), ); } @@ -1721,14 +1727,19 @@ fn fill_heap_and_cause_exception() { #[test] #[cfg(target_os = "windows")] fn interrupt_cancel_delete_race() { + use std::sync::atomic::AtomicUsize; + const NUM_THREADS: usize = 8; const NUM_KILL_THREADS: usize = 4; const ITERATIONS_PER_THREAD: usize = 1000; + let total_iterations = Arc::new(AtomicUsize::new(0)); + let start_time = std::time::Instant::now(); let mut handles = vec![]; for _ in 0..NUM_THREADS { - handles.push(thread::spawn(|| { + let total_iterations_clone = Arc::clone(&total_iterations); + handles.push(thread::spawn(move || { for _ in 0..ITERATIONS_PER_THREAD { let mut sandbox = new_rust_sandbox(); let interrupt_handle = sandbox.interrupt_handle(); @@ -1760,6 +1771,16 @@ fn interrupt_cancel_delete_race() { for kill_handle in kill_handles { kill_handle.join().expect("Kill thread panicked!"); } + + let current = total_iterations_clone.fetch_add(1, Ordering::Relaxed) + 1; + if current % 500 == 0 { + println!( + "interrupt_cancel_delete_race: {}/{} iterations ({:.1}s elapsed)", + current, + NUM_THREADS * ITERATIONS_PER_THREAD, + start_time.elapsed().as_secs_f64(), + ); + } } })); }