hypervisor: aarch64: advance the guest counter on restore and migration

Currently, Cloud Hypervisor round-trips CNTVCT_EL0 through
KVM_GET_REG_LIST/SET_ONE_REG, which leaves a cold-restored or migrated
guest behind real UTC by the downtime. Same-host pause/resume
self-corrects (the physical counter keeps running across the pause), so
only restore and migration cases required the clock to catch up to wall
clock time.

Since ARM has no kernel helper, compute the difference in wall clock
time and compute the ticks so that it can advance the CNTVCT correctly.
It is set via vcpu0 only as it affects a single VM wide value after
Linux 6.4. For older kernels, it was a truly vcpu value which needs to
be invoked for every vcpu.

Gated on all(target_arch = "aarch64", feature = "kvm"); x86 is
unchanged.

Basic manual test case (aarch64 + KVM) verified both in intra host and
inter host snapshot save/restore:

1. Boot a Linux guest; in the guest, `date -u` tracks the host's UTC.
2. Pause and snapshot the VM (ch-remote pause; ch-remote snapshot
   file:///<dir>).
3. Leave it down for several minutes (the off-host interval).
4. Restore and resume into a fresh VMM (ch-remote restore
   source_url=file:///<dir>,resume=true).
5. In the guest, run `date -u` again and compare to the host: the guest
   now tracks current UTC, having advanced by ~the time it spent down.

Before this change the restored guest reads behind real UTC by the
downtime; after it, the guest clock is back in sync (to within the
snapshot-to-restore sampling slop).

Signed-off-by: Atish Patra <atishp@meta.com>

hypervisor/src/kvm/mod.rs

@@ -81,13 +81,13 @@ pub use x86_64::{CpuId, ExtendedControlRegisters, MsrEntries, VcpuKvmState};
 
 #[cfg(target_arch = "x86_64")]
 use crate::ClockData;
-#[cfg(any(target_arch = "x86_64", all(target_arch = "aarch64", feature = "kvm")))]
-use crate::ClockState;
 #[cfg(target_arch = "x86_64")]
 use crate::arch::x86::{
     CpuIdEntry, FpuState, LapicState, MTRR_MSR_INDICES, MsrEntry, NUM_IOAPIC_PINS,
     SpecialRegisters, XsaveState,
 };
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+use crate::{ClockRestoreMode, ClockState};
 use crate::{
     CpuState, HypervisorType, HypervisorVmConfig, InterruptSourceConfig, IoEventAddress,
     IrqRoutingEntry, MpState, StandardRegisters, USER_MEMORY_REGION_GUEST_MEMFD,
@@ -168,6 +168,9 @@ const KVM_REG_ARM_TIMER_CNT: u64 = KVM_REG_ARM64
     | ((3_u64 << KVM_REG_ARM64_SYSREG_CRM_SHIFT) & KVM_REG_ARM64_SYSREG_CRM_MASK as u64)
     | (2_u64 & KVM_REG_ARM64_SYSREG_OP2_MASK as u64);
 
+#[cfg(target_arch = "aarch64")]
+const NANOS_PER_SECOND: u128 = 1_000_000_000;
+
 #[cfg(target_arch = "x86_64")]
 ioctl_io_nr!(KVM_NMI, kvm_bindings::KVMIO, 0x9a);
 
@@ -1315,10 +1318,60 @@ impl vm::Vm for KvmVm {
 
     /// Restore kvmclock before the vCPUs resume.
     #[cfg(target_arch = "x86_64")]
-    fn restore_clock(&self, state: &ClockState) -> vm::Result<()> {
+    fn restore_clock(
+        &self,
+        _vcpus: &[&dyn cpu::Vcpu],
+        state: &ClockState,
+        _mode: ClockRestoreMode,
+    ) -> vm::Result<()> {
         self.set_clock(state)
     }
 
+    /// Advance the guest virtual counter to current wall time before the vCPUs
+    /// resume. A no-op for a `SameHostResume` (the counter free-ran across the
+    /// pause); on `SnapshotRestore`/migration-receive it must catch up.
+    #[cfg(target_arch = "aarch64")]
+    fn restore_clock(
+        &self,
+        vcpus: &[&dyn cpu::Vcpu],
+        saved: &ClockState,
+        mode: ClockRestoreMode,
+    ) -> vm::Result<()> {
+        if mode == ClockRestoreMode::SameHostResume {
+            return Ok(());
+        }
+        // KVM does not rescale the counter frequency across hosts (unlike x86
+        // TSC), so a differing destination frequency would scale the elapsed
+        // ticks incorrectly. Reject rather than corrupt the guest clock.
+        let host_cntfrq = get_cntfrq();
+        if host_cntfrq != saved.cntfrq {
+            return Err(vm::HypervisorVmError::CntfrqMismatch {
+                saved: saved.cntfrq,
+                host: host_cntfrq,
+            });
+        }
+        let now_ns = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map_err(|e| vm::HypervisorVmError::RestoreTimerState(e.into()))?
+            .as_nanos() as u64;
+        let elapsed_ns = now_ns.saturating_sub(saved.host_realtime_ns);
+        let elapsed_ticks = (elapsed_ns as u128 * saved.cntfrq as u128 / NANOS_PER_SECOND) as u64;
+        let target = saved.cntvct.wrapping_add(elapsed_ticks);
+        // Linux >= 6.4 (KVM_CAP_COUNTER_OFFSET) tracks the vtimer offset VM-wide, so one
+        // write advances every vCPU; older kernels track it per-vCPU, so program each.
+        // Restore is the snapshot-boot hot path, so skip the redundant writes when we can.
+        let targets = if self.check_extension(Cap::CounterOffset) {
+            &vcpus[..1]
+        } else {
+            vcpus
+        };
+        for vcpu in targets {
+            vcpu.set_cntvct(target)
+                .map_err(|e| vm::HypervisorVmError::RestoreTimerState(e.into()))?;
+        }
+        Ok(())
+    }
+
     /// Create a device that is used for passthrough
     fn create_passthrough_device(&self) -> vm::Result<VfioDeviceFd> {
         let mut vfio_dev = kvm_create_device {
@@ -2789,6 +2842,17 @@ impl cpu::Vcpu for KvmVcpu {
         Ok(u64::from_le_bytes(bytes))
     }
 
+    ///
+    /// Sets the guest virtual counter via `KVM_REG_ARM_TIMER_CNT`.
+    ///
+    #[cfg(target_arch = "aarch64")]
+    fn set_cntvct(&self, val: u64) -> cpu::Result<()> {
+        self.fd
+            .set_one_reg(KVM_REG_ARM_TIMER_CNT, &val.to_le_bytes())
+            .map_err(|e| cpu::HypervisorCpuError::SetSysRegister(e.into()))?;
+        Ok(())
+    }
+
     ///
     /// Gets the value of a non-core register
     ///