Related issue:

This is a bug in the hypervisor implementation populating htval2 starting from ebe27d6.

The core isn’t making forward progress because the ITLB is thrashing (it only has one copy of the GPA register, hence can’t support multiple speculative accesses that each need their own GPAs). The resulting ITLB misses result in D$ conflict misses, which prevent an older load instruction from making progress.

The bug can only manifest when executing within a guest. When not using the hypervisor extension, it can’t occur.

The RTL fix is to disable speculative ITLB refill unless recent forward progress has been made (perf impact should be imperceptible).

Andrew was able to demonstrate the bug can occur with both direct-mapped and 2-way associativity. His test case couldn’t trip the bug on 4-way, which isn’t proof the bug can’t manifest on 4-way, but at minimum, it’s rarer, though.

Type of change: bug report

Impact: functional fix for forward progress, hopefully minimal-to-no performance degradation

Development Phase: implementation quoting both RTL and explanation from @aswaterman

Release Notes
Speculative ITLB misses under Hypervisor thrash in D$, preventing an older load from making forward progress. Fix is to prevent speculative ITLB misses unless recent forward progress has been made.