The kvmvapic code remaps a section of ROM as RAM to allow the guest to
maintain state there.  It is careful to align the section size to a page
boundary, to avoid creating subpages, but neglects to do the same for
the start address.  These leads to an assert later on when the memory
core tries to create a page which is half RAM and half ROM.

Fix by aligning the start address to a page boundary.

This can be triggered by running qemu-system-x86_64 -enable-kvm -vga none.

Signed-off-by: Avi Kivity <a...@redhat.com>
---
 hw/kvmvapic.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/hw/kvmvapic.c b/hw/kvmvapic.c
index 36ccfbc..e8bfeec 100644
--- a/hw/kvmvapic.c
+++ b/hw/kvmvapic.c
@@ -578,8 +578,10 @@ static void vapic_map_rom_writable(VAPICROMState *s)
     rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
     s->rom_size = rom_size;
 
-    /* We need to round up to avoid creating subpages
+    /* We need to round to avoid creating subpages
      * from which we cannot run code. */
+    rom_size += rom_paddr & ~TARGET_PAGE_MASK;
+    rom_paddr &= TARGET_PAGE_MASK;
     rom_size = TARGET_PAGE_ALIGN(rom_size);
 
     memory_region_init_alias(&s->rom, "kvmvapic-rom", section.mr, rom_paddr,
-- 
1.7.9


Reply via email to