02c6ccc6dd
This bug occurs when the SET flag of Register B is enabled. When an RTC data register (i.e. any of the ten time/calender CMOS bytes) is set, the data is (as expected) correctly stored in the cmos_data array. However, since the SET flag is enabled, the function rtc_set_time is not invoked. As a result, the field base_rtc in RTCState remains uninitialized. This causes a problem on subsequent writes which can end up overwriting data. To see this, consider writing data to Register A after having written data to any of the RTC data registers; the following figure illustrates the call stack for the Register A write operation: +- cmos_io_port_write +-- check_update_timer +---- get_next_alarm +------ rtc_update_time In rtc_update_time, get_guest_rtc calculates the wrong time and overwrites the previously written RTC data register values. Signed-off-by: Alex Horn <alex.horn@cs.ox.ac.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Read the documentation in qemu-doc.html or on http://wiki.qemu.org - QEMU team