VAPIC writable window could cover SMRAM or PCI BARs
Brief
The window has to stay inside the 128K option-ROM range.
Notes
Landed on qemu master tip 0a1ebd448b38 via Bonzini for-upstream merge 415436d9d2a8 (previously staging-only HOLD).
- Fix:
d61c8a6fb738vapic: confine the VAPIC region to 0xc0000..0xe0000(Cc: stable) - Cleanup:
cfa6e2c52ca8i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails - Public issue: qemu#4206 (closed, not confidential). Title: VAPIC writable ROM alias can escape the option-ROM window and expose locked SMRAM.
- Reported-by: Artem Dinaburg
x86 + VAPIC path. Sibling SCSI WRITE SAME heap read in the same merge is a separate card.
Commit d61c8a6fb738