mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtc: Only call rtc_set_cmos when Register B SET flag is disabled.

Browse Source 
This bug occurs when the SET flag of Register B is enabled. When an RTC
data register (i.e. any of the ten time/calender CMOS bytes) is set, the
data is (as expected) correctly stored in the cmos_data array. However,
since the SET flag is enabled, the function rtc_set_time is not invoked.
As a result, the field base_rtc in RTCState remains uninitialized. This
causes a problem on subsequent writes which can end up overwriting data.
To see this, consider writing data to Register A after having written
data to any of the RTC data registers; the following figure illustrates
the call stack for the Register A write operation:

 +- cmos_io_port_write
 +-- check_update_timer
 +---- get_next_alarm
 +------ rtc_update_time

In rtc_update_time, get_guest_rtc calculates the wrong time and
overwrites the previously written RTC data register values.

Signed-off-by: Alex Horn <alex.horn@cs.ox.ac.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Alex Horn 2012-11-26 17:32:54 +01:00 committed by Anthony Liguori
parent 03a36f17d7
commit 02c6ccc6dd
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/mc146818rtc.c
View File

@ -570,7 +570,11 @@ static void rtc_update_time(RTCState *s)
guest_nsec = get_guest_rtc_ns(s);
guest_sec = guest_nsec / NSEC_PER_SEC;
gmtime_r(&guest_sec, &ret);
rtc_set_cmos(s, &ret);
/* Is SET flag of Register B disabled? */
if ((s->cmos_data[RTC_REG_B] & REG_B_SET) == 0) {
rtc_set_cmos(s, &ret);
}
}
static int update_in_progress(RTCState *s)

40
tests/rtc-test.c
View File

@ -327,6 +327,45 @@ static void fuzz_registers(void)
}
}
static void register_b_set_flag(void)
{
/* Enable binary-coded decimal (BCD) mode and SET flag in Register B*/
cmos_write(RTC_REG_B, (cmos_read(RTC_REG_B) & ~REG_B_DM) | REG_B_SET);
cmos_write(RTC_REG_A, 0x76);
cmos_write(RTC_YEAR, 0x11);
cmos_write(RTC_CENTURY, 0x20);
cmos_write(RTC_MONTH, 0x02);
cmos_write(RTC_DAY_OF_MONTH, 0x02);
cmos_write(RTC_HOURS, 0x02);
cmos_write(RTC_MINUTES, 0x04);
cmos_write(RTC_SECONDS, 0x58);
cmos_write(RTC_REG_A, 0x26);
/* Since SET flag is still enabled, these are equality checks. */
g_assert_cmpint(cmos_read(RTC_HOURS), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_MINUTES), ==, 0x04);
g_assert_cmpint(cmos_read(RTC_SECONDS), ==, 0x58);
g_assert_cmpint(cmos_read(RTC_DAY_OF_MONTH), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_MONTH), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_YEAR), ==, 0x11);
g_assert_cmpint(cmos_read(RTC_CENTURY), ==, 0x20);
/* Disable SET flag in Register B */
cmos_write(RTC_REG_B, cmos_read(RTC_REG_B) & ~REG_B_SET);
g_assert_cmpint(cmos_read(RTC_HOURS), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_MINUTES), ==, 0x04);
/* Since SET flag is disabled, this is an inequality check.
* We (reasonably) assume that no (sexagesimal) overflow occurs. */
g_assert_cmpint(cmos_read(RTC_SECONDS), >=, 0x58);
g_assert_cmpint(cmos_read(RTC_DAY_OF_MONTH), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_MONTH), ==, 0x02);
g_assert_cmpint(cmos_read(RTC_YEAR), ==, 0x11);
g_assert_cmpint(cmos_read(RTC_CENTURY), ==, 0x20);
}
int main(int argc, char **argv)
{
QTestState *s = NULL;
@ -342,6 +381,7 @@ int main(int argc, char **argv)
qtest_add_func("/rtc/alarm-time", alarm_time);
qtest_add_func("/rtc/set-year/20xx", set_year_20xx);
qtest_add_func("/rtc/set-year/1980", set_year_1980);
qtest_add_func("/rtc/register_b_set_flag", register_b_set_flag);
qtest_add_func("/rtc/fuzz-registers", fuzz_registers);
ret = g_test_run();