Re: [PATCH 1/3] KVM: arm64: timers: Fix percpu address space issues in kvm_timer_hyp_init()

[Marc Zyngier <maz@kernel.org>]

On Thu, 16 Jan 2025 14:25:09 +0000,
Uros Bizjak <ubizjak@gmail.com> wrote:
> 
> On Fri, Dec 13, 2024 at 6:15 PM Marc Zyngier <maz@kernel.org> wrote:
> >
> > On Fri, 13 Dec 2024 14:57:52 +0000,
> > Uros Bizjak <ubizjak@gmail.com> wrote:
> > >
> > > Cast return value from kvm_get_running_vcpus() in the __percpu
> > > address space to the generic address space via uintptr_t [1]
> > > to fix a couple of:
> > >
> > > arch_timer.c:1395:66: warning: incorrect type in argument 2 (different address spaces)
> > > arch_timer.c:1395:66:    expected void *vcpu_info
> > > arch_timer.c:1395:66:    got struct kvm_vcpu *[noderef] __percpu *
> > >
> > > sparse warnings.
> > >
> > > There were no changes in the resulting object files.
> > >
> > > [1] https://sparse.docs.kernel.org/en/latest/annotations.html#address-space-name
> > >
> > > Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
> > > Cc: Marc Zyngier <maz@kernel.org>
> > > Cc: Oliver Upton <oliver.upton@linux.dev>
> > > Cc: Joey Gouly <joey.gouly@arm.com>
> > > Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
> > > Cc: Zenghui Yu <yuzenghui@huawei.com>
> > > Cc: Catalin Marinas <catalin.marinas@arm.com>
> > > Cc: Will Deacon <will@kernel.org>
> > > ---
> > >  arch/arm64/kvm/arch_timer.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
> > > index 1215df590418..a13bb9e8dc19 100644
> > > --- a/arch/arm64/kvm/arch_timer.c
> > > +++ b/arch/arm64/kvm/arch_timer.c
> > > @@ -1392,7 +1392,7 @@ int __init kvm_timer_hyp_init(bool has_gic)
> > >
> > >       if (has_gic) {
> > >               err = irq_set_vcpu_affinity(host_vtimer_irq,
> > > -                                         kvm_get_running_vcpus());
> > > +                                         (void *)(uintptr_t)kvm_get_running_vcpus());
> > >               if (err) {
> > >                       kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
> > >                       goto out_free_vtimer_irq;
> > > @@ -1416,7 +1416,7 @@ int __init kvm_timer_hyp_init(bool has_gic)
> > >
> > >               if (has_gic) {
> > >                       err = irq_set_vcpu_affinity(host_ptimer_irq,
> > > -                                                 kvm_get_running_vcpus());
> > > +                                                 (void *)(uintptr_t)kvm_get_running_vcpus());
> > >                       if (err) {
> > >                               kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
> > >                               goto out_free_ptimer_irq;
> >
> > I think the fix is worse than the current code, because there is no
> > real semantics behind the pointer being passed to
> > irq_set_vcpu_affinity(). All that is required is that it is a non-NULL
> > pointer.
> 
> If this is the case, we can just remove dependence on the pointer in
> the called function.

No, we can't.

> 
> Something like in the attached patch.

[...]

> diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c
> index 1215df590418..10c293c2d2f5 100644
> --- a/arch/arm64/kvm/arch_timer.c
> +++ b/arch/arm64/kvm/arch_timer.c
> @@ -1238,12 +1238,10 @@ void kvm_arm_timer_write_sysreg(struct kvm_vcpu *vcpu,
>  	}
>  }
>  
> -static int timer_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu)
> +static int timer_irq_set_vcpu_affinity(struct irq_data *d,
> +				       void __always_unused *vcpu)
>  {
> -	if (vcpu)
> -		irqd_set_forwarded_to_vcpu(d);
> -	else
> -		irqd_clr_forwarded_to_vcpu(d);
> +	irqd_set_forwarded_to_vcpu(d);
>  
>  	return 0;
>  }
> @@ -1391,8 +1389,7 @@ int __init kvm_timer_hyp_init(bool has_gic)
>  	}
>  
>  	if (has_gic) {
> -		err = irq_set_vcpu_affinity(host_vtimer_irq,
> -					    kvm_get_running_vcpus());
> +		err = irq_set_vcpu_affinity(host_vtimer_irq, NULL);
>  		if (err) {
>  			kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
>  			goto out_free_vtimer_irq;
> @@ -1415,8 +1412,7 @@ int __init kvm_timer_hyp_init(bool has_gic)
>  		}
>  
>  		if (has_gic) {
> -			err = irq_set_vcpu_affinity(host_ptimer_irq,
> -						    kvm_get_running_vcpus());
> +			err = irq_set_vcpu_affinity(host_ptimer_irq, NULL);

And now you breaking everything by ignoring the semantics of
irq_set_vcpu_affinity(), which uses a NULL pointer to *stop* the
forwarding.

Congratulations, KVM doesn't work anymore, except on systems such as
the Apple stuff (which are the only systems requiring the
timer_irq_set_vcpu_affinity() hack). Just look at what the irqchips
are implementing to convince yourself.

	M.

-- 
Without deviation from the norm, progress is not possible.