The VAPIC region is mapped as writable RAM, at very high priority, above existing memory. If the guest is allowed to map it everywhere, it can overlap PCI BARs or even SMRAM. Ensure that the whole region first in the 128K of low memory that are reserved to option ROMs.
Patch 1 is a separate bugfix that I noticed while working on this area, while patch 2 is the actual fix. Paolo Bonzini (2): i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails vapic: confine the VAPIC region to 0xc0000..0xe0000 hw/i386/vapic.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) -- 2.55.0
