| Message ID | 20250212173454.2864462-1-maz@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | KVM: arm64: Convert timer offset VA when accessed in HYP code | expand |
On Wed, Feb 12, 2025 at 05:34:54PM +0000, Marc Zyngier wrote: > Now that EL2 has gained some early timer emulation, it accesses > the offsets pointed to by the timer structure, both of which > live in the KVM structure. > > Of course, these are *kernel* pointers, so the dereferencing > of these pointers in non-kernel code must be itself be offset. > > Given switch.h its own version of timer_get_offset() and use that > instead. > > Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context") > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
On Wed, 12 Feb 2025 at 18:35, 'Marc Zyngier' via lkft <lkft@linaro.org> wrote: > > Now that EL2 has gained some early timer emulation, it accesses > the offsets pointed to by the timer structure, both of which > live in the KVM structure. > > Of course, these are *kernel* pointers, so the dereferencing > of these pointers in non-kernel code must be itself be offset. > > Given switch.h its own version of timer_get_offset() and use that > instead. > > Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context") > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > Signed-off-by: Marc Zyngier <maz@kernel.org> Tested-by: Anders Roxell <anders.roxell@linaro.org> Build this patch ontop of next-20250212 and ran kvm-unit-tests on a rockpi4. And it ran fine without any kernel panic. Cheers, Anders
On Wed, 12 Feb 2025 17:34:54 +0000, Marc Zyngier wrote: > Now that EL2 has gained some early timer emulation, it accesses > the offsets pointed to by the timer structure, both of which > live in the KVM structure. > > Of course, these are *kernel* pointers, so the dereferencing > of these pointers in non-kernel code must be itself be offset. > > [...] Applied to fixes, thanks! [1/1] KVM: arm64: Convert timer offset VA when accessed in HYP code commit: 18ec0be672a4a27aa045cf692eeb1e180a202e0c Cheers, M.
diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h index f5e882a358e2d..23bbe28eaaf95 100644 --- a/arch/arm64/kvm/hyp/include/hyp/switch.h +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h @@ -581,9 +581,22 @@ static inline bool handle_tx2_tvm(struct kvm_vcpu *vcpu) return true; } +/* Open-coded version of timer_get_offset() to allow for kern_hyp_va() */ +static inline u64 hyp_timer_get_offset(struct arch_timer_context *ctxt) +{ + u64 offset = 0; + + if (ctxt->offset.vm_offset) + offset += *kern_hyp_va(ctxt->offset.vm_offset); + if (ctxt->offset.vcpu_offset) + offset += *kern_hyp_va(ctxt->offset.vcpu_offset); + + return offset; +} + static inline u64 compute_counter_value(struct arch_timer_context *ctxt) { - return arch_timer_read_cntpct_el0() - timer_get_offset(ctxt); + return arch_timer_read_cntpct_el0() - hyp_timer_get_offset(ctxt); } static bool kvm_handle_cntxct(struct kvm_vcpu *vcpu)
Now that EL2 has gained some early timer emulation, it accesses the offsets pointed to by the timer structure, both of which live in the KVM structure. Of course, these are *kernel* pointers, so the dereferencing of these pointers in non-kernel code must be itself be offset. Given switch.h its own version of timer_get_offset() and use that instead. Fixes: b86fc215dc26d ("KVM: arm64: Handle counter access early in non-HYP context") Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> Signed-off-by: Marc Zyngier <maz@kernel.org> --- arch/arm64/kvm/hyp/include/hyp/switch.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)