From 63181b069be342c49b2bb95344654d3667250f46 Mon Sep 17 00:00:00 2001 From: TANG Tiancheng Date: Thu, 11 Sep 2025 17:56:13 +0800 Subject: hw/intc: Save time_delta in RISC-V mtimer VMState In QEMU's RISC-V ACLINT timer model, 'mtime' is not stored directly as a state variable. It is computed on demand as: mtime = rtc_r + time_delta where: - 'rtc_r' is the current VM virtual time (in ticks) obtained via cpu_riscv_read_rtc_raw() from QEMU_CLOCK_VIRTUAL. - 'time_delta' is an offset applied when the guest writes a new 'mtime' value via riscv_aclint_mtimer_write(): time_delta = value - rtc_r Under this design, 'rtc_r' is assumed to be monotonically increasing during VM execution. Even if the guest writes an 'mtime' value smaller than the current one (making 'time_delta' negative in signed arithmetic, or underflow in unsigned arithmetic), the computed 'mtime' remains correct because 'rtc_r_new > rtc_r_old': mtime_new = rtc_r_new + (value - rtc_r_old) However, this monotonicity assumption breaks on snapshot load. Before restoring a snapshot, QEMU resets the guest, which calls riscv_aclint_mtimer_reset_enter() to set 'mtime' to 0 and recompute 'time_delta' as: time_delta = 0 - rtc_r_reset Here, the time_delta differs from the value that was present when the snapshot was saved. As a result, subsequent reads produce a fixed offset from the true mtime. This can be observed with the 'date' command inside the guest: after loading a snapshot, the reported time appears "frozen" at the save point, and only resumes correctly after the guest has run long enough to compensate for the erroneous offset. The fix is to treat 'time_delta' as part of the device's migratable state and save/restore it via vmstate. This preserves the correct relation between 'rtc_r' and 'mtime' across snapshot save/load, ensuring 'mtime' continues incrementing from the precise saved value after restore. Reviewed-by: LIU Zhiwei Reviewed-by: Daniel Henrique Barboza Signed-off-by: TANG Tiancheng Reviewed-by: Alistair Francis Message-ID: <20250911-timers-v3-1-60508f640050@linux.alibaba.com> Signed-off-by: Alistair Francis --- hw/intc/riscv_aclint.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'hw/intc') diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c index 4623cfa029..318a9c8248 100644 --- a/hw/intc/riscv_aclint.c +++ b/hw/intc/riscv_aclint.c @@ -323,9 +323,10 @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type) static const VMStateDescription vmstate_riscv_mtimer = { .name = "riscv_mtimer", - .version_id = 1, - .minimum_version_id = 1, + .version_id = 2, + .minimum_version_id = 2, .fields = (const VMStateField[]) { + VMSTATE_UINT64(time_delta, RISCVAclintMTimerState), VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState, num_harts, 0, vmstate_info_uint64, uint64_t), -- cgit 1.4.1 From 09f89ccc9763a20c0cf9030661af2c04647c1eec Mon Sep 17 00:00:00 2001 From: TANG Tiancheng Date: Thu, 11 Sep 2025 17:56:15 +0800 Subject: hw/intc: Save timers array in RISC-V mtimer VMState The current 'timecmp' field in vmstate_riscv_mtimer is insufficient to keep timers functional after migration. If an mtimer's entry in 'mtimer->timers' is active at the time the snapshot is taken, it means riscv_aclint_mtimer_write_timecmp() has written to 'mtimecmp' and scheduled a timer into QEMU's main loop 'timer_list'. During snapshot save, these active timers must also be migrated; otherwise, after snapshot load there is no mechanism to restore 'mtimer->timers' back into the 'timer_list', and any pending timer events would be lost. QEMU's migration framework commonly uses VMSTATE_TIMER_xxx macros to save and restore 'QEMUTimer' variables. However, 'timers' is a pointer array with variable length, and vmstate.h did not previously provide a helper macro for such type. This commit adds a new macro, 'VMSTATE_TIMER_PTR_VARRAY', to handle saving and restoring a variable-length array of 'QEMUTimer *'. We then use this macro to migrate the 'mtimer->timers' array, ensuring that timer events remain scheduled correctly after snapshot load. Reviewed-by: LIU Zhiwei Signed-off-by: TANG Tiancheng Reviewed-by: Alistair Francis Message-ID: <20250911-timers-v3-3-60508f640050@linux.alibaba.com> Signed-off-by: Alistair Francis --- hw/intc/riscv_aclint.c | 6 ++++-- include/hw/intc/riscv_aclint.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) (limited to 'hw/intc') diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c index 318a9c8248..9f4c36e965 100644 --- a/hw/intc/riscv_aclint.c +++ b/hw/intc/riscv_aclint.c @@ -323,13 +323,15 @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type) static const VMStateDescription vmstate_riscv_mtimer = { .name = "riscv_mtimer", - .version_id = 2, - .minimum_version_id = 2, + .version_id = 3, + .minimum_version_id = 3, .fields = (const VMStateField[]) { VMSTATE_UINT64(time_delta, RISCVAclintMTimerState), VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState, num_harts, 0, vmstate_info_uint64, uint64_t), + VMSTATE_TIMER_PTR_VARRAY(timers, RISCVAclintMTimerState, + num_harts), VMSTATE_END_OF_LIST() } }; diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h index 693415eb6d..4b7406eec0 100644 --- a/include/hw/intc/riscv_aclint.h +++ b/include/hw/intc/riscv_aclint.h @@ -80,4 +80,8 @@ enum { RISCV_ACLINT_SWI_SIZE = 0x4000 }; +#define VMSTATE_TIMER_PTR_VARRAY(_f, _s, _f_n) \ +VMSTATE_VARRAY_OF_POINTER_UINT32(_f, _s, _f_n, 0, vmstate_info_timer, \ + QEMUTimer *) + #endif -- cgit 1.4.1