Re: [PATCH v4 1/4] target/s390x: Fix missing interrupts for small CKC values

[Ilya Leoshkevich <iii@linux.ibm.com>]

On Thu, 2025-11-27 at 19:00 +0100, Ilya Leoshkevich wrote:
> On Thu, 2025-11-27 at 17:43 +0100, Thomas Huth wrote:
> > On 16/10/2025 19.58, Ilya Leoshkevich wrote:
> > > Suppose TOD clock value is 0x1111111111111111 and clock-
> > > comparator
> > > value is 0, in which case clock-comparator interruption should
> > > occur
> > > immediately.
> > > 
> > > With the current code, tod2time(env->ckc - td->base.low) ends up
> > > being
> > > a very large number, so this interruption never happens.
> > > 
> > > Fix by firing the timer immediately if env->ckc < td->base.low.
> > > 
> > > Cc: qemu-stable@nongnu.org
> > > Reviewed-by: Thomas Huth <thuth@redhat.com>
> > > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> > > ---
> > 
> >   Hi Ilya,
> > 
> > this patch unfortunately broke reverse debugging on the s390x
> > target.
> > Something like this used to work before:
> > 
> >   qemu-img create -f qcow2 /tmp/disk.qcow2 2G
> >   ./qemu-system-s390x -nographic \
> >     -icount shift=6,rr=record,rrfile=replay.bin,rrsnapshot=init \
> >     -net none -drive file=/tmp/disk.qcow2,if=none
> >   ./qemu-system-s390x -nographic \
> >     -icount shift=6,rr=replay,rrfile=replay.bin,rrsnapshot=init \
> >     -net none -drive file=/tmp/disk.qcow2,if=none
> > 
> > With this commit and later, the replay hangs somewhere in an
> > endless
> > loop.
> > Do you have any ideas what could go wrong here?
> > 
> >   Thanks,
> >    Thomas
> 
> [...]
> 
> Hi Thomas,
> 
> Thanks for letting me know, I will look at this ASAP.
> 
> Best regards,
> Ilya

Intermediate finding:

update_ckc_timer() is called only during replay, but not during normal
runs or record. The call chain during replay is as follows:

main()
  qemu_init()
    qmp_x_exit_preconfig()
      replay_vmstate_init()
        load_snapshot()
          qemu_loadvm_state()
            qemu_loadvm_state_main()
              qemu_loadvm_section_start_full()
                vmstate_load()
                  vmstate_load_state()
                    cpu_post_load()
                      tcg_s390_tod_updated()
                        update_ckc_timer()

The end result is that during record CHECKPOINT_CLOCK_VIRTUAL is not
written to replay.bin. But during replay it's expected here:

        if (replay_mode != REPLAY_MODE_NONE
            && timer_list->clock->type == QEMU_CLOCK_VIRTUAL
            && !(ts->attributes & QEMU_TIMER_ATTR_EXTERNAL)
            && !replay_checkpoint(CHECKPOINT_CLOCK_VIRTUAL)) {
            qemu_mutex_unlock(&timer_list->active_timers_lock);
            goto out;
        }

The lack of it prevents the timer callback from running. So the timer
associated with s390x_tod_timer() remains active forever and causes the
rr_cpu_thread_fn() to loop.

IIUC these things really have to be symmetric between record and
replay, so we probably need to add this call to some strategic location
during record.

I will continue tomorrow.