diff options
| author | Alex Horn <alex.horn@cs.ox.ac.uk> | 2012-11-26 17:32:54 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2012-11-27 11:04:33 -0600 |
| commit | 02c6ccc6dde90dcbf5975b1cfe2ab199e525ec11 (patch) | |
| tree | 0a4286587fa357224cdaebe6c14ff2255b9b84ef /hw | |
| parent | 03a36f17d7788e4a1e07b3341b18028aa0206845 (diff) | |
| download | qemu-02c6ccc6dde90dcbf5975b1cfe2ab199e525ec11.tar.gz | |
rtc: Only call rtc_set_cmos when Register B SET flag is disabled.
This bug occurs when the SET flag of Register B is enabled. When an RTC
data register (i.e. any of the ten time/calender CMOS bytes) is set, the
data is (as expected) correctly stored in the cmos_data array. However,
since the SET flag is enabled, the function rtc_set_time is not invoked.
As a result, the field base_rtc in RTCState remains uninitialized. This
causes a problem on subsequent writes which can end up overwriting data.
To see this, consider writing data to Register A after having written
data to any of the RTC data registers; the following figure illustrates
the call stack for the Register A write operation:
+- cmos_io_port_write
+-- check_update_timer
+---- get_next_alarm
+------ rtc_update_time
In rtc_update_time, get_guest_rtc calculates the wrong time and
overwrites the previously written RTC data register values.
Signed-off-by: Alex Horn <alex.horn@cs.ox.ac.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/mc146818rtc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c index 7d84ce3d74..c79fca7d68 100644 --- a/hw/mc146818rtc.c +++ b/hw/mc146818rtc.c @@ -570,7 +570,11 @@ static void rtc_update_time(RTCState *s) guest_nsec = get_guest_rtc_ns(s); guest_sec = guest_nsec / NSEC_PER_SEC; gmtime_r(&guest_sec, &ret); - rtc_set_cmos(s, &ret); + + /* Is SET flag of Register B disabled? */ + if ((s->cmos_data[RTC_REG_B] & REG_B_SET) == 0) { + rtc_set_cmos(s, &ret); + } } static int update_in_progress(RTCState *s) |