On Thu, 2025-11-27 at 19:00 +0100, Ilya Leoshkevich wrote:
> On Thu, 2025-11-27 at 17:43 +0100, Thomas Huth wrote:
> > On 16/10/2025 19.58, Ilya Leoshkevich wrote:
> > > Suppose TOD clock value is 0x1111111111111111 and clock-
> > > comparator
> > > value is 0, in which case clock-comparator interruption should
> > > occur
> > > immediately.
> > >
> > > With the current code, tod2time(env->ckc - td->base.low) ends up
> > > being
> > > a very large number, so this interruption never happens.
> > >
> > > Fix by firing the timer immediately if env->ckc < td->base.low.
> > >
> > > Cc: [email protected]
> > > Reviewed-by: Thomas Huth <[email protected]>
> > > Signed-off-by: Ilya Leoshkevich <[email protected]>
> > > ---
> >
> > Hi Ilya,
> >
> > this patch unfortunately broke reverse debugging on the s390x
> > target.
> > Something like this used to work before:
> >
> > qemu-img create -f qcow2 /tmp/disk.qcow2 2G
> > ./qemu-system-s390x -nographic \
> > -icount shift=6,rr=record,rrfile=replay.bin,rrsnapshot=init \
> > -net none -drive file=/tmp/disk.qcow2,if=none
> > ./qemu-system-s390x -nographic \
> > -icount shift=6,rr=replay,rrfile=replay.bin,rrsnapshot=init \
> > -net none -drive file=/tmp/disk.qcow2,if=none
> >
> > With this commit and later, the replay hangs somewhere in an
> > endless
> > loop.
> > Do you have any ideas what could go wrong here?
> >
> > Thanks,
> > Thomas
>
> [...]
>
> Hi Thomas,
>
> Thanks for letting me know, I will look at this ASAP.
>
> Best regards,
> Ilya
Intermediate finding:
update_ckc_timer() is called only during replay, but not during normal
runs or record. The call chain during replay is as follows:
main()
qemu_init()
qmp_x_exit_preconfig()
replay_vmstate_init()
load_snapshot()
qemu_loadvm_state()
qemu_loadvm_state_main()
qemu_loadvm_section_start_full()
vmstate_load()
vmstate_load_state()
cpu_post_load()
tcg_s390_tod_updated()
update_ckc_timer()
The end result is that during record CHECKPOINT_CLOCK_VIRTUAL is not
written to replay.bin. But during replay it's expected here:
if (replay_mode != REPLAY_MODE_NONE
&& timer_list->clock->type == QEMU_CLOCK_VIRTUAL
&& !(ts->attributes & QEMU_TIMER_ATTR_EXTERNAL)
&& !replay_checkpoint(CHECKPOINT_CLOCK_VIRTUAL)) {
qemu_mutex_unlock(&timer_list->active_timers_lock);
goto out;
}
The lack of it prevents the timer callback from running. So the timer
associated with s390x_tod_timer() remains active forever and causes the
rr_cpu_thread_fn() to loop.
IIUC these things really have to be symmetric between record and
replay, so we probably need to add this call to some strategic location
during record.
I will continue tomorrow.
