[PATCH v3 0/2] LoongArch: KVM: Fix timer restore issues

[PATCH v3 0/2] LoongArch: KVM: Fix timer restore issues

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

Fix two issues in kvm_restore_timer():

Patch 1 fixes a one-shot timer firing immediately after migration because
vcpu->arch.expire is not migrated.

Patch 2 fixes a division-by-zero crash when a guest programs a periodic
timer with a period value of zero.

Both are in the same function (kvm_restore_timer) and are sent as a
series for convenience.

Tao Cui (2):
  LoongArch: KVM: Reload one-shot TVAL on migration destination
  LoongArch: KVM: Prevent division by zero in periodic timer restore

 arch/loongarch/kvm/timer.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

---
Changes in v3:
- Add patch 2 (division by zero fix, found by Sashiko AI review).
- Reuse the existing now timestamp instead of a redundant ktime_get().

Changes in v2:
- Move the expire check before ktime_before() (suggested by Bibo Mao)
- Remove the old else-if branch that was one-shot only.
-- 
2.43.0

[PATCH v3 1/2] LoongArch: KVM: Reload one-shot TVAL on migration destination

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

kvm_restore_timer() rebuilds the remaining timer countdown from
vcpu->arch.expire, which is host-internal and is not part of the migrated
vCPU state. On the migration destination it is still 0, so for a one-shot
timer that has not expired yet the computed delta is 0 and
write_gcsr_timertick(0) injects the timer interrupt immediately instead of
after the remaining time.

The expired one-shot case (TVAL = -1) is already handled earlier. When
expire has not been set (i.e. on the migration destination), reload the
remaining countdown from the migrated TVAL. This covers both one-shot and
periodic timers. The regular preempt/resume path on the source, where
expire is valid, is unchanged.

Suggested-by: Bibo Mao <maobibo@loongson.cn>
Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/timer.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
index 3829f35a4070..96f33e34855a 100644
--- a/arch/loongarch/kvm/timer.c
+++ b/arch/loongarch/kvm/timer.c
@@ -119,6 +119,18 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
 	delta = 0;
 	now = ktime_get();
 	expire = vcpu->arch.expire;
+	if (!expire) {
+		/*
+		 * vcpu->arch.expire is host-internal and is not migrated,
+		 * so it is 0 after migration. Reload the remaining countdown
+		 * from the migrated TVAL. This covers both one-shot and
+		 * periodic timers.
+		 */
+		if (ticks < cfg)
+			delta = tick_to_ns(vcpu, ticks);
+		expire = ktime_add_ns(now, delta);
+	}
+
 	if (ktime_before(now, expire))
 		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
 	else if (cfg & CSR_TCFG_PERIOD) {
-- 
2.43.0

[PATCH v3 2/2] LoongArch: KVM: Prevent division by zero in periodic timer restore

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

A guest can write CSR_TCFG with the periodic bit set but a period value
of zero.  When kvm_restore_timer() later enters the periodic branch,
period = cfg & CSR_TCFG_VAL evaluates to 0, causing delta % period to
trigger a division by zero and crash the host kernel.

Clamp the period to 1 to avoid the panic.

Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/timer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
index 96f33e34855a..524d4096bac0 100644
--- a/arch/loongarch/kvm/timer.c
+++ b/arch/loongarch/kvm/timer.c
@@ -135,6 +135,8 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
 		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
 	else if (cfg & CSR_TCFG_PERIOD) {
 		period = cfg & CSR_TCFG_VAL;
+		if (!period)
+			period = 1;
 		delta = ktime_to_tick(vcpu, ktime_sub(now, expire));
 		delta = period - (delta % period);
 
-- 
2.43.0