loader: fix page table relocation identity mapping - #4384
Closed
Ben Hillis (benhillis) wants to merge 2 commits into
Closed
loader: fix page table relocation identity mapping#4384Ben Hillis (benhillis) wants to merge 2 commits into
Ben Hillis (benhillis) wants to merge 2 commits into
Conversation
The page table region is declared relocatable by its own IGVM_VHS_PAGE_TABLE_RELOCATION header and must remain identity mapped (VA = PA), but the loader only fixed up entries against the IGVM_VHS_RELOCATABLE_REGION range. The leaf mapping the page tables kept its pre-relocation VA, so the relocated root was unmapped and the first page table access triple faulted VTL2 with no IDT loaded. This only tripped when the page table region started exactly on a large page boundary; otherwise the leaf covering it happened to also overlap the relocation region and was fixed up by luck. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Deployed loaders only fix up identity map entries that overlap the relocation region, so a page table region starting exactly on a large page boundary is left identity mapped at its pre-relocation address and VTL2 triple faults on the relocated root. The loader side is fixed separately, but images must keep booting on loaders that already shipped. Pad by a page so the region always shares a large page with the relocation region. The two regions stay disjoint, as the spec requires. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
the
release_1.8.2607
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It affects low-level boot/relocation and page-table correctness, which is difficult to validate fully without targeted runtime testing on the failing scenarios described.
Pull request overview
This PR backports a fix for IGVM page table relocation where the relocated page table root could become unmapped if the page table region started exactly on a large-page boundary (leaving the large-page identity-map leaf entry un-fixed-up).
Changes:
- Pad the paravisor memory layout (x86_64 + aarch64) by 4K when the pre-page-table offset lands on a large-page boundary, ensuring the relocation region and page-table region share the same large-page leaf mapping.
- Update the OpenVMM IGVM x86 loader relocation fixups to include the page table region itself, so its identity mapping is also adjusted during relocation.
File summaries
| File | Description |
|---|---|
vm/loader/src/paravisor.rs |
Adds a 4K padding mitigation so page tables won’t start on a large-page boundary (x86 + arm paths). |
openvmm/openvmm_core/src/worker/vm_loaders/igvm.rs |
Extends relocation fixup range map to include the page table region itself during page table rebuild/import. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of the page table relocation fix to
release/1.8.2607. Opened ahead of the main PR because 1.8 is currently red.A relocating loader must keep the page table region identity mapped (VA = PA) after it moves it. Both the OpenVMM loader and the Hyper-V loader only fixed up identity map entries against the
IGVM_VHS_RELOCATABLE_REGIONrange, so a page table region starting exactly on a large page boundary kept its pre-relocation VA, leaving the relocated root unmapped:Latent — the region start is the running total of everything loaded before it, so unrelated image growth decides whether it lands on the boundary. 1.8 landed on
0xca00000and every test that relocates VTL2 failed.Two commits:
The upstream crate fix is microsoft/igvm#135, which fixes this for all consumers of
PageTableRelocationBuilder; the Hyper-V loader needs an equivalent fix separately.