The source excerpts below are from QEMU `master` at `ff1d2d19d7e24893e2012d879f8e73077e17b9bd`. ## Host environment - Operating system: Linux - OS/kernel version: 6.0 - Architecture: x86 - QEMU flavor: `qemu-system-riscv64` - QEMU version: qemu.git `ff1d2d19d7e24893e2012d879f8e73077e17b9bd` ## Emulated/Virtualized environment - Operating system: RISC-V guest using Sscofpmf - Architecture: RISC-V - Accelerator: `TCG` - Relevant CPU/device configuration: Sscofpmf enabled; a cycle/instret event is armed beyond the QEMU timer horizon ## Description of problem ### Background and terminology QEMU live migration serializes CPU state through `VMStateDescription`. A field in `CPURISCVState` is not migrated merely because it exists in the C structure: it must be listed in the main VMState or in a versioned subsection. Omitting guest-visible state makes the destination CPU resume with a reset, zero, or reconstructed value instead of the source value. ### Affected code path The affected implementation locations are: `target/riscv/cpu.h, target/riscv/tcg/pmu.c, target/riscv/tcg/tcg-cpu.c, and target/riscv/machine.c: PMU timer and PMUCTRState migration` `riscv_pmu_setup_timer()` arms `cpu->pmu_timer` and may store time beyond `INT64_MAX` in `PMUCTRState.irq_overflow_left`. The PMU VMState saves only `mhpmcounter_val` and `mhpmcounter_prev`; it serializes neither the QEMUTimer nor the staged remainder. ### Current source evidence [target/riscv/cpu.h:233](https://gitlab.com/qemu-project/qemu/-/blob/ff1d2d19d7e24893e2012d879f8e73077e17b9bd/target/riscv/cpu.h#L233) ```c 233 | 234 | typedef struct PMUCTRState { 235 | /* Current value of a counter */ 236 | uint64_t mhpmcounter_val; 237 | /* Snapshot value of a counter */ 238 | uint64_t mhpmcounter_prev; 239 | /* Value beyond INT64_MAX before overflow interrupt trigger */ 240 | uint64_t irq_overflow_left; 241 | } PMUCTRState; 242 | 243 | typedef struct PMUFixedCtrState { 244 | /* Track cycle and icount for each privilege mode */ 245 | uint64_t counter[4]; ``` [target/riscv/tcg/pmu.c:373](https://gitlab.com/qemu-project/qemu/-/blob/ff1d2d19d7e24893e2012d879f8e73077e17b9bd/target/riscv/tcg/pmu.c#L373) ```c 373 | if (get_field(env->mhpmevent_val[ctr_idx], MHPMEVENT_BIT_OF)) { 374 | return; 375 | } 376 | 377 | counter = &env->pmu_ctrs[ctr_idx]; 378 | if (counter->irq_overflow_left > 0) { 379 | irq_trigger_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 380 | counter->irq_overflow_left; 381 | timer_mod_anticipate_ns(cpu->pmu_timer, irq_trigger_at); 382 | counter->irq_overflow_left = 0; 383 | return; 384 | } 385 | 386 | riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctr_val, false, ctr_idx); 387 | ctr_val = counter->mhpmcounter_val; 388 | if (riscv_cpu_mxl(env) == MXL_RV32) { 389 | riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctrh_val, true, ctr_idx); 390 | curr_ctr_val = curr_ctr_val | (curr_ctrh_val << 32); ``` [target/riscv/tcg/tcg-cpu.c:1202](https://gitlab.com/qemu-project/qemu/-/blob/ff1d2d19d7e24893e2012d879f8e73077e17b9bd/target/riscv/tcg/tcg-cpu.c#L1202) ```c 1202 | if (cpu->cfg.pmu_mask) { 1203 | riscv_pmu_init(cpu, &local_err); 1204 | if (local_err != NULL) { 1205 | error_propagate(errp, local_err); 1206 | return; 1207 | } 1208 | 1209 | if (cpu->cfg.ext_sscofpmf) { 1210 | cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, 1211 | riscv_pmu_timer_cb, cpu); 1212 | } 1213 | } 1214 | #endif 1215 | } 1216 | 1217 | void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu) ``` [target/riscv/machine.c:388](https://gitlab.com/qemu-project/qemu/-/blob/ff1d2d19d7e24893e2012d879f8e73077e17b9bd/target/riscv/machine.c#L388) ```c 388 | 389 | static const VMStateDescription vmstate_pmu_ctr_state = { 390 | .name = "cpu/pmu", 391 | .version_id = 3, 392 | .minimum_version_id = 3, 393 | .needed = pmu_needed, 394 | .fields = (const VMStateField[]) { 395 | VMSTATE_UINT64(mhpmcounter_val, PMUCTRState), 396 | VMSTATE_UINT64(mhpmcounter_prev, PMUCTRState), 397 | VMSTATE_END_OF_LIST() 398 | } 399 | }; 400 | 401 | static bool jvt_needed(void *opaque) 402 | { 403 | RISCVCPU *cpu = opaque; 404 | 405 | return cpu->cfg.ext_zcmt; ``` ### Root cause analysis The active overflow schedule has two pieces: the deadline of the currently armed QEMU timer and, for very long delays, an additional `irq_overflow_left` interval. Neither is in VMState, and `riscv_cpu_post_load()` does not reconstruct the schedule. This is not merely a missing cache: the destination has no event that will call `pmu_timer_trigger_irq()` at the intended time. The migrated counter values do not by themselves re-arm the timer. The reasoning, step by step: 1. A monitored cycle or instruction counter is programmed far enough from overflow that the delay exceeds the signed timer limit. 2. QEMU arms `cpu->pmu_timer` and may save an additional interval in `irq_overflow_left`. 3. Migration serializes programmable counter values but neither scheduling component. 4. No post-load callback re-arms the event from the restored counter configuration. 5. The destination can miss the overflow event entirely; long-delay cases additionally lose the staged remainder. ### Worked example and boundary cases Begin with a PMU overflow timer scheduled but not expired. After migration the destination needs a corresponding event, not just a numeric counter snapshot. First test an ordinary short deadline; then test the staged irq_overflow_left case. A huge remainder is not required to expose a missing timer and should not make the minimal test unnecessarily expensive. ### Conditions needed to reach the problem - Sscofpmf is enabled and a counter monitors cycles or instructions. - An overflow timer is armed at migration; the strongest remainder-specific case also has `irq_overflow_left != 0`. - Live migration occurs before the staged timer completes. ### Expected or potential effect - The overflow interrupt may be lost; if later code re-arms it indirectly, its timing can be early or late. - Most short-running PMU tests miss the issue because the remainder remains zero. ### Expected behavior An armed Sscofpmf overflow event and any additional staged delay must retain their virtual-time deadline across migration. ## Steps to reproduce The following validation design covers the expected and current-code results. 1. configure a cycle/instret event and counter value that arms `cpu->pmu_timer`. 2. Test both an ordinary near overflow and a long delay that produces nonzero `irq_overflow_left`. 3. Confirm the source scheduling state at a deterministic stop point. 4. Migrate and measure virtual time until the OF bit/LCOFIP is asserted. 5. Compare with an uninterrupted control run and a near-overflow case where the remainder is zero. Expected result: The complete armed overflow schedule, including any staged remainder, survives migration. Current behavior: The VMState schema omits both the QEMUTimer and `irq_overflow_left`, and post-load only recomputes XLEN. ## Suggested fix direction Migrate the PMU timer deadline with `VMSTATE_TIMER_PTR` or reconstruct it in a versioned PMU post-load hook, and serialize `irq_overflow_left`. Pre-save must update counters/deadlines to one coherent virtual-time point; post-load must combine the timer and remainder exactly once. The fix should be covered by the following focused regression checks: - Armed ordinary timer plus nonzero and zero remainder cases. - Cycle and instruction event mappings. - OF already set and event disabled controls. ## References - QEMU source baseline: https://gitlab.com/qemu-project/qemu/-/commit/ff1d2d19d7e24893e2012d879f8e73077e17b9bd ## Additional information - Source baseline: QEMU `master` at `ff1d2d19d7e24893e2012d879f8e73077e17b9bd` (checked 2026-09-05).