KVM/arm64: timer fixes for 6.14

When updating the interrupt state for an emulated timer, we return early and skip the setup of a soft timer that runs in parallel with the guest.

While this is OK if we have set the interrupt pending, it is pretty wrong if the guest moved CVAL into the future. In that case, no timer is armed and the guest can wait for a very long time (it will take a full put/load cycle for the situation to resolve).

This is specially visible with EDK2 running at EL2, but still using the EL1 virtual timer, which in that case is fully emulated. Any key-press takes ages to be captured, as there is no UART interrupt and EDK2 relies on polling from a timer...

The fix is simply to drop the early return. If the timer interrupt is pending, we will still return early, and otherwise arm the soft timer.

Fixes 4d74ecfa6458b ("KVM: arm64: Don't arm a hrtimer for an already pending timer")

Signed-off-by Marc Zyngier <[email protected]>

Cc [email protected]

---
  arch/arm64/kvm/arch_timer.c | 4 +---
  1 file changed, 1 insertion(+), 3 deletions(-)

arch/arm64/kvm/arch_timer.c +1 -3

index d3d243366536c..035e43f5d4f9a 100644
@@ -471,10 +471,8 @@ static void timer_emulate(struct arch_timer_context *ctx)
 
  	trace_kvm_timer_emulate(ctx, should_fire);
 
-	if (should_fire != ctx->irq.level) {
+	if (should_fire != ctx->irq.level)
  		kvm_timer_update_irq(ctx->vcpu, should_fire, ctx);
-		return;
-	}
 
  	kvm_timer_update_status(ctx, should_fire);
 

Both Wei-Lin Chang and Volodymyr Babchuk report that the way we handle the emulation of EL1 timers with NV is completely wrong, specially in the case of HCR_EL2.E2H==0.

There are three problems in about as many lines of code:

- With E2H==0, the EL1 timers are overwritten with the EL1 state, while they should actually contain the EL2 state (as per the timer map)

- With E2H==1, we run the full EL1 timer emulation even when ECV is present, hiding a bug in timer_emulate() (see previous patch)

- The comments are actively misleading, and say all the wrong things.

This is only attributable to the code having been initially written for FEAT_NV, hacked up to handle FEAT_NV2 *in parallel*, and vaguely hacked again to be FEAT_NV2 only. Oh, and yours truly being a gold plated idiot.

The fix is obvious: just delete most of the E2H==0 code, have a unified handling of the timers (because they really are E2H agnostic), and make sure we don't execute any of that when FEAT_ECV is present.

Fixes 4bad3068cfa9f ("KVM: arm64: nv: Sync nested timer state with FEAT_NV2")

Reported-by Wei-Lin Chang <[email protected]>

Reported-by Volodymyr Babchuk <[email protected]>

Signed-off-by Marc Zyngier <[email protected]>

Link https://lore.kernel.org/r/fqiqfjzwpgbzdtouu2pwqlu7llhnf5lmy4hzv5vo6ph4v3vyls@jdcfy3fjjc5k open here

Link https://lore.kernel.org/r/[email protected] open here

---
  arch/arm64/kvm/arch_timer.c | 30 ++++++++++--------------------
  1 file changed, 10 insertions(+), 20 deletions(-)

arch/arm64/kvm/arch_timer.c +10 -20

index 035e43f5d4f9a..e59836e0260cf 100644
@@ -974,31 +974,21 @@ void kvm_timer_sync_nested(struct kvm_vcpu *vcpu)
  	 * which allows trapping of the timer registers even with NV2.
  	 * Still, this is still worse than FEAT_NV on its own. Meh.
  	 */
-	if (!vcpu_el2_e2h_is_set(vcpu)) {
-		if (cpus_have_final_cap(ARM64_HAS_ECV))
-			return;
-
-		/*
-		 * A non-VHE guest hypervisor doesn't have any direct access
-		 * to its timers: the EL2 registers trap (and the HW is
-		 * fully emulated), while the EL0 registers access memory
-		 * despite the access being notionally direct. Boo.
-		 *
-		 * We update the hardware timer registers with the
-		 * latest value written by the guest to the VNCR page
-		 * and let the hardware take care of the rest.
-		 */
-		write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTV_CTL_EL0),  SYS_CNTV_CTL);
-		write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTV_CVAL_EL0), SYS_CNTV_CVAL);
-		write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTP_CTL_EL0),  SYS_CNTP_CTL);
-		write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTP_CVAL_EL0), SYS_CNTP_CVAL);
-	} else {
+	if (!cpus_have_final_cap(ARM64_HAS_ECV)) {
  		/*
  		 * For a VHE guest hypervisor, the EL2 state is directly
-		 * stored in the host EL1 timers, while the emulated EL0
+		 * stored in the host EL1 timers, while the emulated EL1
  		 * state is stored in the VNCR page. The latter could have
  		 * been updated behind our back, and we must reset the
  		 * emulation of the timers.
+		 *
+		 * A non-VHE guest hypervisor doesn't have any direct access
+		 * to its timers: the EL2 registers trap despite being
+		 * notionally direct (we use the EL1 HW, as for VHE), while
+		 * the EL1 registers access memory.
+		 *
+		 * In both cases, process the emulated timers on each guest
+		 * exit. Boo.
  		 */
  		struct timer_map map;
  		get_timer_map(vcpu, &map);

It's been recently pointed out that the NV timer code that is (hopefully) on its way upstream is marginally sub-optimal (read:
terminally broken). This short series attempts to fix things:

- Correctly arm a background timer in all situations

- Avoid corrupting the EL2 state by shoving the EL1 state into it, and simplify the handling of emulated timers

- Drop the weird HV timer offset dance dance on E2H switch that never happens and make HV timer correctly UNDEF on E2H==0.

Thanks to Volodymyr Babchuk and Wei-Lin Chang for their help.

Patches on top of kvmarm/fixes, and merged back on top of my kvm-arm64/nv-next branch.

It's been recently pointed out that the NV timer code that is (hopefully) on its way upstream is marginally sub-optimal (read:
terminally broken). This short series attempts to fix things:

- Correctly arm a background timer in all situations

- Avoid corrupting the EL2 state by shoving the EL1 state into it, and simplify the handling of emulated timers

[...]