Suppose TOD clock value is 0x1111111111111111 and clock-comparator
value is 0, in which case clock-comparator interruption should occur
immediately.
With the current code, tod2time(env->ckc - td->base.low) ends up being
a very large number, so this interruption never happens.
Fix by firing the timer immediately if env->ckc < td->base.low.
Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
target/s390x/tcg/misc_helper.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index 6d9d601d29a..215b5b9d933 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -199,11 +199,15 @@ static void update_ckc_timer(CPUS390XState *env)
return;
}
- /* difference between origins */
- time = env->ckc - td->base.low;
+ if (env->ckc < td->base.low) {
+ time = 0;
+ } else {
+ /* difference between origins */
+ time = env->ckc - td->base.low;
- /* nanoseconds */
- time = tod2time(time);
+ /* nanoseconds */
+ time = tod2time(time);
+ }
timer_mod(env->tod_timer, time);
}
--
2.51.0On 16/10/2025 19.58, Ilya Leoshkevich wrote:
> Suppose TOD clock value is 0x1111111111111111 and clock-comparator
> value is 0, in which case clock-comparator interruption should occur
> immediately.
>
> With the current code, tod2time(env->ckc - td->base.low) ends up being
> a very large number, so this interruption never happens.
>
> Fix by firing the timer immediately if env->ckc < td->base.low.
>
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
Hi Ilya,
this patch unfortunately broke reverse debugging on the s390x target.
Something like this used to work before:
qemu-img create -f qcow2 /tmp/disk.qcow2 2G
./qemu-system-s390x -nographic \
-icount shift=6,rr=record,rrfile=replay.bin,rrsnapshot=init \
-net none -drive file=/tmp/disk.qcow2,if=none
./qemu-system-s390x -nographic \
-icount shift=6,rr=replay,rrfile=replay.bin,rrsnapshot=init \
-net none -drive file=/tmp/disk.qcow2,if=none
With this commit and later, the replay hangs somewhere in an endless loop.
Do you have any ideas what could go wrong here?
Thanks,
Thomas
> diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
> index 6d9d601d29a..215b5b9d933 100644
> --- a/target/s390x/tcg/misc_helper.c
> +++ b/target/s390x/tcg/misc_helper.c
> @@ -199,11 +199,15 @@ static void update_ckc_timer(CPUS390XState *env)
> return;
> }
>
> - /* difference between origins */
> - time = env->ckc - td->base.low;
> + if (env->ckc < td->base.low) {
> + time = 0;
> + } else {
> + /* difference between origins */
> + time = env->ckc - td->base.low;
>
> - /* nanoseconds */
> - time = tod2time(time);
> + /* nanoseconds */
> + time = tod2time(time);
> + }
>
> timer_mod(env->tod_timer, time);
> }
On Thu, 2025-11-27 at 17:43 +0100, Thomas Huth wrote: > On 16/10/2025 19.58, Ilya Leoshkevich wrote: > > Suppose TOD clock value is 0x1111111111111111 and clock-comparator > > value is 0, in which case clock-comparator interruption should > > occur > > immediately. > > > > With the current code, tod2time(env->ckc - td->base.low) ends up > > being > > a very large number, so this interruption never happens. > > > > Fix by firing the timer immediately if env->ckc < td->base.low. > > > > Cc: qemu-stable@nongnu.org > > Reviewed-by: Thomas Huth <thuth@redhat.com> > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> > > --- > > Hi Ilya, > > this patch unfortunately broke reverse debugging on the s390x target. > Something like this used to work before: > > qemu-img create -f qcow2 /tmp/disk.qcow2 2G > ./qemu-system-s390x -nographic \ > -icount shift=6,rr=record,rrfile=replay.bin,rrsnapshot=init \ > -net none -drive file=/tmp/disk.qcow2,if=none > ./qemu-system-s390x -nographic \ > -icount shift=6,rr=replay,rrfile=replay.bin,rrsnapshot=init \ > -net none -drive file=/tmp/disk.qcow2,if=none > > With this commit and later, the replay hangs somewhere in an endless > loop. > Do you have any ideas what could go wrong here? > > Thanks, > Thomas [...] Hi Thomas, Thanks for letting me know, I will look at this ASAP. Best regards, Ilya
On Thu, 2025-11-27 at 19:00 +0100, Ilya Leoshkevich wrote:
> On Thu, 2025-11-27 at 17:43 +0100, Thomas Huth wrote:
> > On 16/10/2025 19.58, Ilya Leoshkevich wrote:
> > > Suppose TOD clock value is 0x1111111111111111 and clock-
> > > comparator
> > > value is 0, in which case clock-comparator interruption should
> > > occur
> > > immediately.
> > >
> > > With the current code, tod2time(env->ckc - td->base.low) ends up
> > > being
> > > a very large number, so this interruption never happens.
> > >
> > > Fix by firing the timer immediately if env->ckc < td->base.low.
> > >
> > > Cc: qemu-stable@nongnu.org
> > > Reviewed-by: Thomas Huth <thuth@redhat.com>
> > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > > ---
> >
> > Hi Ilya,
> >
> > this patch unfortunately broke reverse debugging on the s390x
> > target.
> > Something like this used to work before:
> >
> > qemu-img create -f qcow2 /tmp/disk.qcow2 2G
> > ./qemu-system-s390x -nographic \
> > -icount shift=6,rr=record,rrfile=replay.bin,rrsnapshot=init \
> > -net none -drive file=/tmp/disk.qcow2,if=none
> > ./qemu-system-s390x -nographic \
> > -icount shift=6,rr=replay,rrfile=replay.bin,rrsnapshot=init \
> > -net none -drive file=/tmp/disk.qcow2,if=none
> >
> > With this commit and later, the replay hangs somewhere in an
> > endless
> > loop.
> > Do you have any ideas what could go wrong here?
> >
> > Thanks,
> > Thomas
>
> [...]
>
> Hi Thomas,
>
> Thanks for letting me know, I will look at this ASAP.
>
> Best regards,
> Ilya
Intermediate finding:
update_ckc_timer() is called only during replay, but not during normal
runs or record. The call chain during replay is as follows:
main()
qemu_init()
qmp_x_exit_preconfig()
replay_vmstate_init()
load_snapshot()
qemu_loadvm_state()
qemu_loadvm_state_main()
qemu_loadvm_section_start_full()
vmstate_load()
vmstate_load_state()
cpu_post_load()
tcg_s390_tod_updated()
update_ckc_timer()
The end result is that during record CHECKPOINT_CLOCK_VIRTUAL is not
written to replay.bin. But during replay it's expected here:
if (replay_mode != REPLAY_MODE_NONE
&& timer_list->clock->type == QEMU_CLOCK_VIRTUAL
&& !(ts->attributes & QEMU_TIMER_ATTR_EXTERNAL)
&& !replay_checkpoint(CHECKPOINT_CLOCK_VIRTUAL)) {
qemu_mutex_unlock(&timer_list->active_timers_lock);
goto out;
}
The lack of it prevents the timer callback from running. So the timer
associated with s390x_tod_timer() remains active forever and causes the
rr_cpu_thread_fn() to loop.
IIUC these things really have to be symmetric between record and
replay, so we probably need to add this call to some strategic location
during record.
I will continue tomorrow.
© 2016 - 2026 Red Hat, Inc.