On 01/26/2012 04:05 PM, Michael S. Tsirkin wrote: > > > > Let me see if I get this right: during BAR sizing, the guest sets the > > BAR to ~1, which means 4GB-32MB -> 4GB, which overlaps the HPET. If so, > > that's expected behaviour. > > Yes BAR sizing temporarily sets the BAR to an invalid value then > restores it. What I don't understand is how come something accesses the > HPET range in between.
Interrupt -> read time. > > If the guest doesn't want this memory there, > > it should disable mmio. > > Recent kernels do this for most devices, but not for > platform devices. Then they are vulnerable to this issue. The i440fx spec states that the entire top-of-memory range to 4GB if forwarded to PCI, so qemu appears to be correct here. -- error compiling committee.c: too many arguments to function
