Re: [PATCH for-4.22 3/5] x86/vRTC: support century field

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Wed, May 13, 2026 at 05:24:13PM +0200, Jan Beulich wrote:
> On 13.05.2026 17:14, Roger Pau Monné wrote:
> > On Wed, May 13, 2026 at 04:58:57PM +0200, Jan Beulich wrote:
> >> On 13.05.2026 16:24, Roger Pau Monné wrote:
> >>> On Tue, May 12, 2026 at 04:59:35PM +0200, Jan Beulich wrote:
> >>>> --- a/tools/libacpi/static_tables.c
> >>>> +++ b/tools/libacpi/static_tables.c
> >>>> @@ -33,6 +33,8 @@ struct acpi_20_facs Facs = {
> >>>>  #define ACPI_PM_TMR_BLK_BIT_WIDTH           0x20
> >>>>  #define ACPI_PM_TMR_BLK_BIT_OFFSET          0x00
> >>>>  
> >>>> +#define CMOS_CENTURY 0x32 /* Conventional index used also without ACPI 
> >>>> */
> >>>
> >>> IMO this define (together with the RTC_CENTURY one below) need to be
> >>> in a public header so it can be consumed by both the hypervisor and
> >>> the toolstack.  Having two separate defines, one for the hypervisor,
> >>> and another for the toolstack will just create confusion.
> >>
> >> I first thought I'd do it like this, but (a) this isn't a value Xen
> >> defines (hence the comments in both places) and (b) I'm not entirely
> >> happy with such a(n) (ab)use of the public headers (yes, we have other
> >> such examples there, which I also don't really like).
> > 
> > Yeah, it's not great, but it's better than having the same value
> > defined in two different files, and having to keep them in-sync for
> > the CMOS century field to work correctly?
> 
> As the values come from the outside, they necessarily need to stay the
> way they are (and hence implicitly in sync). If we meant to announce
> another value to guests in the FADT we produce (breaking non-ACPI
> guests), we then couldn't use RTC_CENTURY in hvm/rtc.c anyway. Instead
> we'd have to track and migrate the index to use.

Hm, OK, so the value is well-known enough to be considered part of the
standard CMOS index layout, I guess that's fair enough.

> >>>> --- a/xen/arch/x86/hvm/rtc.c
> >>>> +++ b/xen/arch/x86/hvm/rtc.c
> >>>> @@ -47,6 +47,12 @@
> >>>>  #define epoch_year     1900
> >>>>  #define get_year(x)    ((x) + epoch_year)
> >>>>  
> >>>> +static inline bool is_century(unsigned int x)
> >>>> +{
> >>>> +    /* Constant below should match epoch_year above, just as BCD value. 
> >>>> */
> >>>> +    return x >= 0x19 && (x & 0xf) < 10 && (x >> 4) < 10;
> >>>> +}
> >>>> +
> >>>>  enum rtc_mode {
> >>>>     rtc_mode_no_ack,
> >>>>     rtc_mode_strict
> >>>> @@ -482,16 +488,32 @@ static int rtc_ioport_write(void *opaque
> >>>>          data &= 0x7f;
> >>>>          s->hw.cmos_index = data;
> >>>>          spin_unlock(&s->lock);
> >>>> +        /* RTC_CENTURY always forwarded to DM. */
> >>>>          return (data < RTC_CMOS_SIZE);
> >>>>      }
> >>>>  
> >>>> -    if ( s->hw.cmos_index >= RTC_CMOS_SIZE )
> >>>> +    switch ( s->hw.cmos_index )
> >>>>      {
> >>>> +    case 0 ... RTC_CMOS_SIZE - 1:
> >>>> +        orig = s->hw.cmos_data[s->hw.cmos_index];
> >>>> +        break;
> >>>> +
> >>>> +    case RTC_CENTURY:
> >>>> +        orig = s->hw.century;
> >>>> +        if ( !is_century(orig) || !is_century(data) )
> >>>
> >>> Is a real RTC strict in such a way, ie: will it refuse to set the
> >>> century value to < 19 (0x19)?  For example QEMU seems to be way more
> >>> relaxed, and allow any century value.
> >>
> >> I can switch to rejecting merely 0. Unlike centuries in the future, it
> >> didn't look very useful to me to permit anything below 19. Please clarify
> >> which way you prefer it.
> > 
> > QEMU seems to tolerate everything, so I lean towards tolerating
> > everything that's not 0.  That's solely based on what QEMU does, which
> > I think it's likely to be (quite) widely tested.
> 
> Will do.

We need to keep 0 as the sentinel invalid value, because that's the
content of the pad field in the structure when not supported.
Otherwise we could just use 0xff (or any other invalid) BCD value.

> >>>> @@ -515,7 +538,10 @@ static int rtc_ioport_write(void *opaque
> >>>>              /* Fetch the current time and update just this field. */
> >>>>              s->current_tm = gmtime(get_localtime(d));
> >>>>              rtc_copy_date(s);
> >>>> -            s->hw.cmos_data[s->hw.cmos_index] = data;
> >>>> +            if ( s->hw.cmos_index != RTC_CENTURY )
> >>>> +                s->hw.cmos_data[s->hw.cmos_index] = data;
> >>>> +            else
> >>>> +                s->hw.century = data;
> >>>>              rtc_set_time(s);
> >>>>          }
> >>>>          alarm_timer_update(s);
> >>>
> >>> Don't you need to adjust the tail return of rtc_ioport_write() (below
> >>> the context here) to return 0 when s->hw.cmos_index == RTC_CENTURY, so
> >>> the set value is also propagated to the DM, and not only the index?
> >>
> >> I don't think so. The case of us not handling RTC_CENTURY is dealt with
> >> earlier in the function. Whereas when we handle the field, we don't want
> >> to forward (like for all the other RTC fields).
> > 
> > Right, so then you also want to adjust the top part of
> > rtc_ioport_write() to not propagate the write to the 0x70 IO port when
> > data is RTC_CENTURY?  Otherwise you propagate the write to port 0x70,
> > but not the read/write to port 0x71?
> 
> I can't, as whether to forward depends on the data subsequently written.
> Propagating the index "just in case" is the only workable model that I
> can think of. And as guests can do any number of successive port 70
> writes, the DM needs to cope with this anyway.

Hm, I see, the newly written value to port 0x71 is taken into account
to decide whether to forward to the DM or not.

I wonder: would it be simpler to extend the size of the hvm_hw_rtc
structure so that Xen can detect whether the incoming VM has support
for the century field, and then avoid having to play heuristics
with the value itself?  We would know ahead of starting the guest
whether RTC_CENTURY is supposed to be handled by Xen or forwarded to
the DM, and we won't be limited to use 0 as the sentinel value for not
exposing RTC_CENTURY.

Thanks, Roger.