[PATCH] KVM: arm64: Convert timer offset VA when accessed in HYP code

[PATCH] KVM: arm64: Convert timer offset VA when accessed in HYP code

[Marc Zyngier]

Now that EL2 has gained some early timer emulation, it accesses
the offsets pointed to by the timer structure, both of which
live in the KVM structure.

Of course, these are *kernel* pointers, so the dereferencing
of these pointers in non-kernel code must be itself be offset.

Given switch.h its own version of timer_get_offset() and use that
instead.

Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context")
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/kvm/hyp/include/hyp/switch.h | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h
index f5e882a358e2d..23bbe28eaaf95 100644
--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
@@ -581,9 +581,22 @@ static inline bool handle_tx2_tvm(struct kvm_vcpu *vcpu)
 	return true;
 }
 
+/* Open-coded version of timer_get_offset() to allow for kern_hyp_va() */
+static inline u64 hyp_timer_get_offset(struct arch_timer_context *ctxt)
+{
+	u64 offset = 0;
+
+	if (ctxt->offset.vm_offset)
+		offset += *kern_hyp_va(ctxt->offset.vm_offset);
+	if (ctxt->offset.vcpu_offset)
+		offset += *kern_hyp_va(ctxt->offset.vcpu_offset);
+
+	return offset;
+}
+
 static inline u64 compute_counter_value(struct arch_timer_context *ctxt)
 {
-	return arch_timer_read_cntpct_el0() - timer_get_offset(ctxt);
+	return arch_timer_read_cntpct_el0() - hyp_timer_get_offset(ctxt);
 }
 
 static bool kvm_handle_cntxct(struct kvm_vcpu *vcpu)
-- 
2.39.2

Re: [PATCH] KVM: arm64: Convert timer offset VA when accessed in HYP code

[Oliver Upton]

On Wed, Feb 12, 2025 at 05:34:54PM +0000, Marc Zyngier wrote:
> Now that EL2 has gained some early timer emulation, it accesses
> the offsets pointed to by the timer structure, both of which
> live in the KVM structure.
> 
> Of course, these are *kernel* pointers, so the dereferencing
> of these pointers in non-kernel code must be itself be offset.
> 
> Given switch.h its own version of timer_get_offset() and use that
> instead.
> 
> Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context")
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> Signed-off-by: Marc Zyngier <maz@kernel.org>

Reviewed-by: Oliver Upton <oliver.upton@linux.dev>

Re: [PATCH] KVM: arm64: Convert timer offset VA when accessed in HYP code

[Anders Roxell]

On Wed, 12 Feb 2025 at 18:35, 'Marc Zyngier' via lkft <lkft@linaro.org> wrote:
>
> Now that EL2 has gained some early timer emulation, it accesses
> the offsets pointed to by the timer structure, both of which
> live in the KVM structure.
>
> Of course, these are *kernel* pointers, so the dereferencing
> of these pointers in non-kernel code must be itself be offset.
>
> Given switch.h its own version of timer_get_offset() and use that
> instead.
>
> Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context")
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> Signed-off-by: Marc Zyngier <maz@kernel.org>

Tested-by: Anders Roxell <anders.roxell@linaro.org>

Build this patch ontop of next-20250212 and ran kvm-unit-tests on a rockpi4.
And it ran fine without any kernel panic.

Cheers,
Anders

Re: [PATCH] KVM: arm64: Convert timer offset VA when accessed in HYP code

[Marc Zyngier]

On Wed, 12 Feb 2025 17:34:54 +0000, Marc Zyngier wrote:
> Now that EL2 has gained some early timer emulation, it accesses
> the offsets pointed to by the timer structure, both of which
> live in the KVM structure.
> 
> Of course, these are *kernel* pointers, so the dereferencing
> of these pointers in non-kernel code must be itself be offset.
> 
> [...]

Applied to fixes, thanks!

[1/1] KVM: arm64: Convert timer offset VA when accessed in HYP code
      commit: 18ec0be672a4a27aa045cf692eeb1e180a202e0c

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.