Re: [Qemu-devel] [RFC/PATCH] Fix guest OS panic when 64bit BAR is present

[Avi Kivity]

On 01/26/2012 04:05 PM, Michael S. Tsirkin wrote:
> > 
> > Let me see if I get this right: during BAR sizing, the guest sets the
> > BAR to ~1, which means 4GB-32MB -> 4GB, which overlaps the HPET.  If so,
> > that's expected behaviour.
>
> Yes BAR sizing temporarily sets the BAR to an invalid value then
> restores it.  What I don't understand is how come something accesses the
> HPET range in between.

Interrupt -> read time.

> > If the guest doesn't want this memory there,
> > it should disable mmio.
>
> Recent kernels do this for most devices, but not for
> platform devices.

Then they are vulnerable to this issue.

The i440fx spec states that the entire top-of-memory range to 4GB if
forwarded to PCI, so qemu appears to be correct here.

-- 
error compiling committee.c: too many arguments to function