[PATCH 0/2] target/arm: Fix timer deadlines when the offset puts the count ahead

[PATCH 0/2] target/arm: Fix timer deadlines when the offset puts the count ahead

[Fuad Tabba]

Hi folks,

Two fixes for the same bug in three places: the next-tick calculation
for the generic timers, WFIT and WFET each treat a 64-bit overflow of
cval + offset (or timeout + offset) as a deadline beyond the counter's
wrap. Once CNTVOFF_EL2 (or CNTPOFF_EL2 for the physical timer) puts
the timer's view of the counter ahead of the physical count, that sum
overflows for every deadline still in the future and QEMU arms the
timer at INT64_MAX. The first site regressed in 8.2 (8d37a1425b99).
The WFxT sites have the same overflow test.

The KVM arch_timer_edge_cases selftest, which sets the guest counter
to 2^59 - 1, hangs in every host mode on QEMU 11.0.0 and passes on
hardware under an nVHE host. With patch 1 it completes under nVHE and
pKVM hosts. Under a VHE host its physical-timer half still stops, on a
KVM bug in the same arithmetic (KVM programs cval + offset where the
timer compares unsigned). That fix goes to kvmarm separately.

Each patch adds a tcg system test that fails before it and passes
after.

Based on master (3b5d71cc36).

Cheers,
/fuad

Fuad Tabba (2):
  target/arm: Fix next timer tick when the offset puts the count ahead
  target/arm: Fix WFxT timeouts when the offset puts the count ahead

 target/arm/helper.c                  |   9 +-
 target/arm/tcg/op_helper.c           |   6 +-
 tests/tcg/aarch64/system/meson.build |   7 ++
 tests/tcg/aarch64/system/vtimer.c    |  28 +++++++
 tests/tcg/aarch64/system/wfxt.c      | 118 +++++++++++++++++++++++++++
 5 files changed, 162 insertions(+), 6 deletions(-)
 create mode 100644 tests/tcg/aarch64/system/wfxt.c

-- 
2.39.5

[PATCH 1/2] target/arm: Fix next timer tick when the offset puts the count ahead

[Fuad Tabba]

gt_recalc_timer() arms the timer for the ISTATUS 0->1 transition at
count == cval + offset, treating an overflow of that sum as "beyond
the counter's wrap" and arming at INT64_MAX. That reading is valid
only when offset <= count. When offset > count (a CNTVOFF_EL2 or
CNTPOFF_EL2 that puts the timer's counter ahead of the physical
count), the sum overflows for every cval still in the future and the
wrapped value is the correct next tick, which is what the code used
before commit 8d37a1425b99. The timer then never fires on its own.

A KVM guest whose counter is set ahead of the host's, as the
arch_timer_edge_cases selftest does via KVM_REG_ARM_TIMER_CNT, gets
its timer interrupt only when the vCPU is next loaded and KVM
rewrites the timer registers, so a guest polling for the interrupt
hangs.
Reproduced with VHE, nVHE and pKVM hosts on QEMU 11.0.0. The test
passes on hardware.

Test count + (cval - (count - offset)) for overflow instead, so only a
physical count past 2^64 is "never", and add a vtimer test case with
an offset that puts the count ahead.

Fixes: 8d37a1425b99 ("target/arm: Handle overflow in calculation of next timer tick")
Cc: qemu-stable@nongnu.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 target/arm/helper.c               |  9 +++++----
 tests/tcg/aarch64/system/vtimer.c | 28 ++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index c3f607e6d6..f89f41fe63 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1575,11 +1575,12 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
         } else {
             /*
              * Next transition is when (count - offset) == cval, i.e.
-             * when count == (cval + offset).
-             * If that would overflow, then again we set up the next interrupt
-             * for "as far in the future as possible" for the code below.
+             * cval - (count - offset) ticks from now. If count plus that
+             * overflows, set up "as far in the future as possible" below.
              */
-            if (uadd64_overflow(gt->cval, offset, &nexttick)) {
+            uint64_t remaining = gt->cval - (count - offset);
+
+            if (uadd64_overflow(count, remaining, &nexttick)) {
                 nexttick = UINT64_MAX;
             }
         }
diff --git a/tests/tcg/aarch64/system/vtimer.c b/tests/tcg/aarch64/system/vtimer.c
index 7d725eced3..e1cfad36be 100644
--- a/tests/tcg/aarch64/system/vtimer.c
+++ b/tests/tcg/aarch64/system/vtimer.c
@@ -27,6 +27,7 @@
 
 int main(void)
 {
+    uint64_t freq, now;
     int i;
 
     ml_printf("VTimer Test\n");
@@ -44,5 +45,32 @@ int main(void)
         ml_printf("%d: cntv_cval_el0=%lx\n", i, read_sysreg(cntv_cval_el0));
     }
 
+    /*
+     * An offset that puts the virtual count ahead of the physical one,
+     * so cval + cntvoff wraps for every future cval. The timer must
+     * still fire. ISTATUS is set by the expiry, so poll it with a bound.
+     */
+    write_sysreg(cntv_ctl_el0, 0);
+    write_sysreg(cntvoff_el2, -(1ULL << 60));
+    asm volatile("isb");
+
+    freq = read_sysreg(cntfrq_el0);
+    now = read_sysreg(cntvct_el0);
+    write_sysreg(cntv_cval_el0, now + freq / 100);
+    write_sysreg(cntv_ctl_el0, 1);
+
+    ml_printf("cntvoff_el2=%lx\n", read_sysreg(cntvoff_el2));
+    ml_printf("cntvct_el0=%lx\n", now);
+    ml_printf("cntv_cval_el0=%lx\n", read_sysreg(cntv_cval_el0));
+
+    while (!(read_sysreg(cntv_ctl_el0) & 4)) {
+        if (read_sysreg(cntvct_el0) - now > freq) {
+            ml_printf("FAIL: ISTATUS not set within 1s: cntv_ctl_el0=%lx\n",
+                      read_sysreg(cntv_ctl_el0));
+            return 1;
+        }
+    }
+    ml_printf("ISTATUS set at cntvct_el0=%lx\n", read_sysreg(cntvct_el0));
+
     return 0;
 }
-- 
2.39.5

[PATCH 2/2] target/arm: Fix WFxT timeouts when the offset puts the count ahead

[Fuad Tabba]

The WFIT and WFET helpers arm the wakeup timer at count == timeout +
offset, treating an overflow of that sum as "beyond the counter's
wrap" and arming at INT64_MAX. As in gt_recalc_timer(), that reading
is valid only when offset <= count: with a CNTVOFF_EL2 that puts the
virtual count ahead of the physical count, the sum overflows for
every timeout still in the future and the wrapped value was the
correct wakeup. The CPU then waits until an interrupt or event
instead of waking at its timeout. A Linux guest uses WFIT and WFET in
__delay() when FEAT_WFxT is present, which -cpu max advertises.

Arm cntval + (timeout - cntvct) instead, so only a physical count past
2^64 is "never", and add a tcg system test that issues WFIT and WFET
with such an offset, with a timer interrupt 1s out so a broken WFxT
still returns: before this change both wake at the interrupt, after
it at their timeout.

Fixes: a96edb687e76 ("target/arm: Implement FEAT WFxT and enable for '-cpu max'")
Fixes: da9b86c35fa8 ("target/arm: implement WFET")
Cc: qemu-stable@nongnu.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 target/arm/tcg/op_helper.c           |   6 +-
 tests/tcg/aarch64/system/meson.build |   7 ++
 tests/tcg/aarch64/system/wfxt.c      | 118 +++++++++++++++++++++++++++
 3 files changed, 129 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/aarch64/system/wfxt.c

diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index c2b09176cb..562f11f390 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -448,7 +448,8 @@ void HELPER(wfit)(CPUARMState *env, uint32_t rd)
         raise_exception(env, excp, syn_wfx(1, 0xe, rd, true, WFIT, false), target_el);
     }
 
-    if (uadd64_overflow(timeout, offset, &nexttick)) {
+    /* Physical count at the timeout. Only an overflow of it is "never". */
+    if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) {
         nexttick = UINT64_MAX;
     }
     if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
@@ -705,7 +706,8 @@ void HELPER(wfet)(CPUARMState *env, uint32_t rd)
      * The WFET should time out when CNTVCT_EL0 >= the specified value.
      */
     cpu = env_archcpu(env);
-    if (uadd64_overflow(timeout, offset, &nexttick)) {
+    /* Physical count at the timeout. Only an overflow of it is "never". */
+    if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) {
         nexttick = UINT64_MAX;
     }
     if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
diff --git a/tests/tcg/aarch64/system/meson.build b/tests/tcg/aarch64/system/meson.build
index 94e16ba330..5d96a9c25a 100644
--- a/tests/tcg/aarch64/system/meson.build
+++ b/tests/tcg/aarch64/system/meson.build
@@ -72,6 +72,13 @@ tests += {
                   '-semihosting-config', 'enable=on,arg=2',
                   qemu_base_args]
   },
+  'wfxt.c': {
+    'cflags': cflags,
+    'qemu_args': ['-M', 'virt,virtualization=on,gic-version=2',
+                  '-cpu', 'max', '-smp', '1',
+                  '-semihosting-config', 'enable=on,arg=2',
+                  qemu_base_args]
+  },
 }
 
 tests += {
diff --git a/tests/tcg/aarch64/system/wfxt.c b/tests/tcg/aarch64/system/wfxt.c
new file mode 100644
index 0000000000..9d50590a68
--- /dev/null
+++ b/tests/tcg/aarch64/system/wfxt.c
@@ -0,0 +1,118 @@
+/*
+ * WFIT/WFET timeout test
+ *
+ * Copyright (c) 2026 Google LLC
+ * Author: Fuad Tabba <fuad.tabba@linux.dev>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <stdint.h>
+#include <minilib.h>
+
+/* from Linux's include/linux/stringify.h */
+#define __stringify_1(x...) #x
+#define __stringify(x...)   __stringify_1(x)
+
+#define read_sysreg(r) ({                                           \
+            uint64_t __val;                                         \
+            asm volatile("mrs %0, " __stringify(r) : "=r" (__val)); \
+            __val;                                                  \
+})
+
+#define write_sysreg(r, v) do {                     \
+        uint64_t __val = (uint64_t)(v);             \
+        asm volatile("msr " __stringify(r) ", %x0"  \
+                 : : "rZ" (__val));                 \
+} while (0)
+
+/* .inst forms of WFIT x0 and WFET x0, for assemblers without FEAT_WFxT */
+static inline void wfit(uint64_t timeout)
+{
+    register uint64_t x0 asm("x0") = timeout;
+
+    asm volatile(".inst 0xd5031020" : : "r" (x0) : "memory");
+}
+
+static inline void wfet(uint64_t timeout)
+{
+    register uint64_t x0 asm("x0") = timeout;
+
+    asm volatile(".inst 0xd5031000" : : "r" (x0) : "memory");
+}
+
+/* virt machine, GICv2 */
+#define GICD_BASE 0x08000000UL
+#define GICC_BASE 0x08010000UL
+#define GICD_CTLR 0x000
+#define GICD_ISENABLER0 0x100
+#define GICC_CTLR 0x000
+#define GICC_PMR 0x004
+#define VTIMER_PPI 27
+
+static inline void mmio_write32(uintptr_t addr, uint32_t val)
+{
+    /* GIC registers: MMIO, MMU off at EL2 */
+    *(volatile uint32_t *)addr = val;
+}
+
+static int test_one(const char *name, void (*wait)(uint64_t), uint64_t freq)
+{
+    uint64_t now, timeout, elapsed;
+    int early = 0;
+
+    /*
+     * The virtual timer interrupt, 1s out, wakes the CPU even with
+     * interrupts masked. The timeout, 10ms out, must be what wakes it.
+     */
+    now = read_sysreg(cntvct_el0);
+    write_sysreg(cntv_cval_el0, now + freq);
+    write_sysreg(cntv_ctl_el0, 1);
+    timeout = now + freq / 100;
+
+    do {
+        wait(timeout);
+        early++;
+    } while (read_sysreg(cntvct_el0) < timeout && early < 1000);
+
+    elapsed = read_sysreg(cntvct_el0) - now;
+    write_sysreg(cntv_ctl_el0, 0);
+
+    ml_printf("%s: woke after %ld ticks (%d wakes)\n", name, elapsed, early);
+    if (early >= 1000) {
+        ml_printf("FAIL: %s kept waking before its timeout\n", name);
+        return 1;
+    }
+    if (elapsed > freq / 2) {
+        ml_printf("FAIL: %s woke on the timer interrupt, not its timeout\n",
+                  name);
+        return 1;
+    }
+    return 0;
+}
+
+int main(void)
+{
+    uint64_t freq;
+    int ret;
+
+    ml_printf("WFxT Test\n");
+
+    mmio_write32(GICD_BASE + GICD_ISENABLER0, 1u << VTIMER_PPI);
+    mmio_write32(GICD_BASE + GICD_CTLR, 1);
+    mmio_write32(GICC_BASE + GICC_PMR, 0xff);
+    mmio_write32(GICC_BASE + GICC_CTLR, 1);
+
+    /* Put the virtual count ahead of the physical count */
+    write_sysreg(cntvoff_el2, -(1ULL << 60));
+    asm volatile("isb");
+    freq = read_sysreg(cntfrq_el0);
+
+    ml_printf("cntvoff_el2=%lx cntfrq_el0=%ld\n",
+              read_sysreg(cntvoff_el2), freq);
+
+    ret = test_one("wfit", wfit, freq);
+    ret |= test_one("wfet", wfet, freq);
+
+    return ret;
+}
-- 
2.39.5

Re: [PATCH 0/2] target/arm: Fix timer deadlines when the offset puts the count ahead

[Peter Maydell]

On Mon, 21 Sept 2026 at 08:44, Fuad Tabba <fuad.tabba@linux.dev> wrote:
>
> Hi folks,
>
> Two fixes for the same bug in three places: the next-tick calculation
> for the generic timers, WFIT and WFET each treat a 64-bit overflow of
> cval + offset (or timeout + offset) as a deadline beyond the counter's
> wrap. Once CNTVOFF_EL2 (or CNTPOFF_EL2 for the physical timer) puts
> the timer's view of the counter ahead of the physical count, that sum
> overflows for every deadline still in the future and QEMU arms the
> timer at INT64_MAX. The first site regressed in 8.2 (8d37a1425b99).
> The WFxT sites have the same overflow test.
>
> The KVM arch_timer_edge_cases selftest, which sets the guest counter
> to 2^59 - 1, hangs in every host mode on QEMU 11.0.0 and passes on
> hardware under an nVHE host. With patch 1 it completes under nVHE and
> pKVM hosts. Under a VHE host its physical-timer half still stops, on a
> KVM bug in the same arithmetic (KVM programs cval + offset where the
> timer compares unsigned). That fix goes to kvmarm separately.
>
> Each patch adds a tcg system test that fails before it and passes
> after.
>
> Based on master (3b5d71cc36).
>
> Cheers,
> /fuad
>
> Fuad Tabba (2):
>   target/arm: Fix next timer tick when the offset puts the count ahead
>   target/arm: Fix WFxT timeouts when the offset puts the count ahead

Thanks for the bugfixes and the clear explanation.

Applied to target-arm.next, thanks.

-- PMM

Re: [PATCH 2/2] target/arm: Fix WFxT timeouts when the offset puts the count ahead

[Michael Tokarev]

[This has been applied to the master branch as 998b6db69e3ec58fd52ddc7a06ece6cf286f3c77]

On 9/21/26 10:44, Fuad Tabba wrote:
> The WFIT and WFET helpers arm the wakeup timer at count == timeout +
> offset, treating an overflow of that sum as "beyond the counter's
> wrap" and arming at INT64_MAX. As in gt_recalc_timer(), that reading
> is valid only when offset <= count: with a CNTVOFF_EL2 that puts the
> virtual count ahead of the physical count, the sum overflows for
> every timeout still in the future and the wrapped value was the
> correct wakeup. The CPU then waits until an interrupt or event
> instead of waking at its timeout. A Linux guest uses WFIT and WFET in
> __delay() when FEAT_WFxT is present, which -cpu max advertises.
> 
> Arm cntval + (timeout - cntvct) instead, so only a physical count past
> 2^64 is "never", and add a tcg system test that issues WFIT and WFET
> with such an offset, with a timer interrupt 1s out so a broken WFxT
> still returns: before this change both wake at the interrupt, after
> it at their timeout.
> 
> Fixes: a96edb687e76 ("target/arm: Implement FEAT WFxT and enable for '-cpu max'")
> Fixes: da9b86c35fa8 ("target/arm: implement WFET")

Hi.

For stable-10.0.x LTS series, which does not support WFET (commit
da9b86c35fa8), I'm picking up just the first half of this patch,
and half of the test.

An alternative is to pick da9b86c35fa8 ("target/arm: implement WFET")
for 10.0.x, which does not actually look bad.  It will probably require
v11.0.0-332-g4575da5ecb7 "target/arm: report register in WFIT syndromes"
too.

What do you think?

Thanks,

/mjt

> Cc: qemu-stable@nongnu.org
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
> ---
>   target/arm/tcg/op_helper.c           |   6 +-
>   tests/tcg/aarch64/system/meson.build |   7 ++
>   tests/tcg/aarch64/system/wfxt.c      | 118 +++++++++++++++++++++++++++
>   3 files changed, 129 insertions(+), 2 deletions(-)
>   create mode 100644 tests/tcg/aarch64/system/wfxt.c
> 
> diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
> index c2b09176cb..562f11f390 100644
> --- a/target/arm/tcg/op_helper.c
> +++ b/target/arm/tcg/op_helper.c
> @@ -448,7 +448,8 @@ void HELPER(wfit)(CPUARMState *env, uint32_t rd)
>           raise_exception(env, excp, syn_wfx(1, 0xe, rd, true, WFIT, false), target_el);
>       }
>   
> -    if (uadd64_overflow(timeout, offset, &nexttick)) {
> +    /* Physical count at the timeout. Only an overflow of it is "never". */
> +    if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) {
>           nexttick = UINT64_MAX;
>       }
>       if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
> @@ -705,7 +706,8 @@ void HELPER(wfet)(CPUARMState *env, uint32_t rd)
>        * The WFET should time out when CNTVCT_EL0 >= the specified value.
>        */
>       cpu = env_archcpu(env);
> -    if (uadd64_overflow(timeout, offset, &nexttick)) {
> +    /* Physical count at the timeout. Only an overflow of it is "never". */
> +    if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) {
>           nexttick = UINT64_MAX;
>       }
>       if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {

Re: [PATCH 2/2] target/arm: Fix WFxT timeouts when the offset puts the count ahead

[Peter Maydell]

On Wed, 30 Sept 2026 at 09:56, Michael Tokarev <mjt@tls.msk.ru> wrote:
>
> [This has been applied to the master branch as 998b6db69e3ec58fd52ddc7a06ece6cf286f3c77]
>
> On 9/21/26 10:44, Fuad Tabba wrote:
> > The WFIT and WFET helpers arm the wakeup timer at count == timeout +
> > offset, treating an overflow of that sum as "beyond the counter's
> > wrap" and arming at INT64_MAX. As in gt_recalc_timer(), that reading
> > is valid only when offset <= count: with a CNTVOFF_EL2 that puts the
> > virtual count ahead of the physical count, the sum overflows for
> > every timeout still in the future and the wrapped value was the
> > correct wakeup. The CPU then waits until an interrupt or event
> > instead of waking at its timeout. A Linux guest uses WFIT and WFET in
> > __delay() when FEAT_WFxT is present, which -cpu max advertises.
> >
> > Arm cntval + (timeout - cntvct) instead, so only a physical count past
> > 2^64 is "never", and add a tcg system test that issues WFIT and WFET
> > with such an offset, with a timer interrupt 1s out so a broken WFxT
> > still returns: before this change both wake at the interrupt, after
> > it at their timeout.
> >
> > Fixes: a96edb687e76 ("target/arm: Implement FEAT WFxT and enable for '-cpu max'")
> > Fixes: da9b86c35fa8 ("target/arm: implement WFET")
>
> Hi.
>
> For stable-10.0.x LTS series, which does not support WFET (commit
> da9b86c35fa8), I'm picking up just the first half of this patch,
> and half of the test.
>
> An alternative is to pick da9b86c35fa8 ("target/arm: implement WFET")
> for 10.0.x, which does not actually look bad.  It will probably require
> v11.0.0-332-g4575da5ecb7 "target/arm: report register in WFIT syndromes"
> too.

The WFET implementation relies on the preceding set of patches
which implement the event stream, SEV and SEVL (and on some
later patches that fix a bug or two). I think the feature as
a whole is a bit large to try to backport, especially since the
failure mode for "we forgot one of the bits it depends on" is
"the guest silently hangs because it doesn't get woken up from
the WFE when it should".

thanks
-- PMM