[PATCH v3 0/2] LoongArch: KVM: Fix timer restore issues

[PATCH v3 0/2] LoongArch: KVM: Fix timer restore issues

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

Fix two issues in kvm_restore_timer():

Patch 1 fixes a one-shot timer firing immediately after migration because
vcpu->arch.expire is not migrated.

Patch 2 fixes a division-by-zero crash when a guest programs a periodic
timer with a period value of zero.

Both are in the same function (kvm_restore_timer) and are sent as a
series for convenience.

Tao Cui (2):
  LoongArch: KVM: Reload one-shot TVAL on migration destination
  LoongArch: KVM: Prevent division by zero in periodic timer restore

 arch/loongarch/kvm/timer.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

---
Changes in v3:
- Add patch 2 (division by zero fix, found by Sashiko AI review).
- Reuse the existing now timestamp instead of a redundant ktime_get().

Changes in v2:
- Move the expire check before ktime_before() (suggested by Bibo Mao)
- Remove the old else-if branch that was one-shot only.
-- 
2.43.0

[PATCH v3 1/2] LoongArch: KVM: Reload one-shot TVAL on migration destination

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

kvm_restore_timer() rebuilds the remaining timer countdown from
vcpu->arch.expire, which is host-internal and is not part of the migrated
vCPU state. On the migration destination it is still 0, so for a one-shot
timer that has not expired yet the computed delta is 0 and
write_gcsr_timertick(0) injects the timer interrupt immediately instead of
after the remaining time.

The expired one-shot case (TVAL = -1) is already handled earlier. When
expire has not been set (i.e. on the migration destination), reload the
remaining countdown from the migrated TVAL. This covers both one-shot and
periodic timers. The regular preempt/resume path on the source, where
expire is valid, is unchanged.

Suggested-by: Bibo Mao <maobibo@loongson.cn>
Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/timer.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
index 3829f35a4070..96f33e34855a 100644
--- a/arch/loongarch/kvm/timer.c
+++ b/arch/loongarch/kvm/timer.c
@@ -119,6 +119,18 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
 	delta = 0;
 	now = ktime_get();
 	expire = vcpu->arch.expire;
+	if (!expire) {
+		/*
+		 * vcpu->arch.expire is host-internal and is not migrated,
+		 * so it is 0 after migration. Reload the remaining countdown
+		 * from the migrated TVAL. This covers both one-shot and
+		 * periodic timers.
+		 */
+		if (ticks < cfg)
+			delta = tick_to_ns(vcpu, ticks);
+		expire = ktime_add_ns(now, delta);
+	}
+
 	if (ktime_before(now, expire))
 		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
 	else if (cfg & CSR_TCFG_PERIOD) {
-- 
2.43.0

Re: [PATCH v3 1/2] LoongArch: KVM: Reload one-shot TVAL on migration destination

[Bibo Mao]

On 2026/7/15 下午6:06, Tao Cui wrote:
> From: Tao Cui <cuitao@kylinos.cn>
> 
> kvm_restore_timer() rebuilds the remaining timer countdown from
> vcpu->arch.expire, which is host-internal and is not part of the migrated
> vCPU state. On the migration destination it is still 0, so for a one-shot
> timer that has not expired yet the computed delta is 0 and
> write_gcsr_timertick(0) injects the timer interrupt immediately instead of
> after the remaining time.
> 
> The expired one-shot case (TVAL = -1) is already handled earlier. When
> expire has not been set (i.e. on the migration destination), reload the
> remaining countdown from the migrated TVAL. This covers both one-shot and
> periodic timers. The regular preempt/resume path on the source, where
> expire is valid, is unchanged.
> 
> Suggested-by: Bibo Mao <maobibo@loongson.cn>
> Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>   arch/loongarch/kvm/timer.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
> 
> diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
> index 3829f35a4070..96f33e34855a 100644
> --- a/arch/loongarch/kvm/timer.c
> +++ b/arch/loongarch/kvm/timer.c
> @@ -119,6 +119,18 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
>   	delta = 0;
>   	now = ktime_get();
>   	expire = vcpu->arch.expire;
> +	if (!expire) {
> +		/*
> +		 * vcpu->arch.expire is host-internal and is not migrated,
> +		 * so it is 0 after migration. Reload the remaining countdown
> +		 * from the migrated TVAL. This covers both one-shot and
> +		 * periodic timers.
> +		 */
> +		if (ticks < cfg)
> +			delta = tick_to_ns(vcpu, ticks);
> +		expire = ktime_add_ns(now, delta);
> +	}
> +
>   	if (ktime_before(now, expire))
>   		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
>   	else if (cfg & CSR_TCFG_PERIOD) {
> 
Reviewed-by: Bibo Mao <maobibo@loongson.cn>

[PATCH v3 2/2] LoongArch: KVM: Prevent division by zero in periodic timer restore

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

A guest can write CSR_TCFG with the periodic bit set but a period value
of zero.  When kvm_restore_timer() later enters the periodic branch,
period = cfg & CSR_TCFG_VAL evaluates to 0, causing delta % period to
trigger a division by zero and crash the host kernel.

Clamp the period to 1 to avoid the panic.

Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 arch/loongarch/kvm/timer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
index 96f33e34855a..524d4096bac0 100644
--- a/arch/loongarch/kvm/timer.c
+++ b/arch/loongarch/kvm/timer.c
@@ -135,6 +135,8 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
 		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
 	else if (cfg & CSR_TCFG_PERIOD) {
 		period = cfg & CSR_TCFG_VAL;
+		if (!period)
+			period = 1;
 		delta = ktime_to_tick(vcpu, ktime_sub(now, expire));
 		delta = period - (delta % period);
 
-- 
2.43.0

Re: [PATCH v3 2/2] LoongArch: KVM: Prevent division by zero in periodic timer restore

[Bibo Mao]

On 2026/7/15 下午6:06, Tao Cui wrote:
> From: Tao Cui <cuitao@kylinos.cn>
> 
> A guest can write CSR_TCFG with the periodic bit set but a period value
> of zero.  When kvm_restore_timer() later enters the periodic branch,
> period = cfg & CSR_TCFG_VAL evaluates to 0, causing delta % period to
> trigger a division by zero and crash the host kernel.
> 
> Clamp the period to 1 to avoid the panic.
> 
> Fixes: a5857b9ff6e0 ("LoongArch: KVM: Implement vcpu timer operations")
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>   arch/loongarch/kvm/timer.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
> index 96f33e34855a..524d4096bac0 100644
> --- a/arch/loongarch/kvm/timer.c
> +++ b/arch/loongarch/kvm/timer.c
> @@ -135,6 +135,8 @@ void kvm_restore_timer(struct kvm_vcpu *vcpu)
>   		delta = ktime_to_tick(vcpu, ktime_sub(expire, now));
>   	else if (cfg & CSR_TCFG_PERIOD) {
>   		period = cfg & CSR_TCFG_VAL;
> +		if (!period)
> +			period = 1;
>   		delta = ktime_to_tick(vcpu, ktime_sub(now, expire));
>   		delta = period - (delta % period);
>   
> 
Reviewed-by: Bibo Mao <maobibo@loongson.cn>