From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:43432)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <avi@redhat.com>) id 1RqQOm-00028A-Po
	for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:34:08 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <avi@redhat.com>) id 1RqQOg-0002sy-Q8
	for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:34:00 -0500
Received: from mx1.redhat.com ([209.132.183.28]:53977)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <avi@redhat.com>) id 1RqQOg-0002rm-IF
	for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:33:54 -0500
Message-ID: <4F21641C.9010600@redhat.com>
Date: Thu, 26 Jan 2012 16:33:00 +0200
From: Avi Kivity <avi@redhat.com>
MIME-Version: 1.0
References: <4F1F971B.4020309@endace.com> <20120125153415.GA10267@redhat.com>
	<1327517961.26484.124.camel@bling.home>
	<4F20C651.2010108@endace.com> <4F215A4A.1000400@redhat.com>
	<20120126140543.GC17198@redhat.com>
In-Reply-To: <20120126140543.GC17198@redhat.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [RFC/PATCH] Fix guest OS panic when 64bit BAR is
 present
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Alexey Korolev <alexey.korolev@endace.com>, sfd@endace.com, Alex Williamson <alex.williamson@redhat.com>, Kevin O'Connor <kevin@koconnor.net>, "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>

On 01/26/2012 04:05 PM, Michael S. Tsirkin wrote:
> > 
> > Let me see if I get this right: during BAR sizing, the guest sets the
> > BAR to ~1, which means 4GB-32MB -> 4GB, which overlaps the HPET.  If so,
> > that's expected behaviour.
>
> Yes BAR sizing temporarily sets the BAR to an invalid value then
> restores it.  What I don't understand is how come something accesses the
> HPET range in between.

Interrupt -> read time.

> > If the guest doesn't want this memory there,
> > it should disable mmio.
>
> Recent kernels do this for most devices, but not for
> platform devices.

Then they are vulnerable to this issue.

The i440fx spec states that the entire top-of-memory range to 4GB if
forwarded to PCI, so qemu appears to be correct here.

-- 
error compiling committee.c: too many arguments to function