In build_crs(), the calculation & merging of the ranges already happens in
64-bit, but the entry boundaries are silently truncated to 32-bit in the
call to aml_dword_memory(). Use aml_qword_memory() when necessary -- this
fixes 64-bit BARs behind PXBs.

Cc: Marcel Apfelbaum <mar...@redhat.com>
Cc: Michael S. Tsirkin <m...@redhat.com>
Signed-off-by: Laszlo Ersek <ler...@redhat.com>
---
 hw/i386/acpi-build.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index b88800883944..3157cc36db98 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -938,13 +938,25 @@ static Aml *build_crs(PCIHostState *host,
 
     crs_range_merge(host_mem_ranges);
     for (i = 0; i < host_mem_ranges->len; i++) {
+        Aml *mem;
+        uint64_t length;
+
         entry = g_ptr_array_index(host_mem_ranges, i);
-        aml_append(crs,
-                   aml_dword_memory(AML_POS_DECODE, AML_MIN_FIXED,
-                                    AML_MAX_FIXED, AML_NON_CACHEABLE,
-                                    AML_READ_WRITE,
-                                    0, entry->base, entry->limit, 0,
-                                    entry->limit - entry->base + 1));
+        length = entry->limit - entry->base + 1;
+        if (entry->limit <= UINT32_MAX && length <= UINT32_MAX) {
+          mem = aml_dword_memory(AML_POS_DECODE, AML_MIN_FIXED,
+                                 AML_MAX_FIXED, AML_NON_CACHEABLE,
+                                 AML_READ_WRITE,
+                                 0, entry->base, entry->limit, 0,
+                                 length);
+        } else {
+          mem = aml_qword_memory(AML_POS_DECODE, AML_MIN_FIXED,
+                                 AML_MAX_FIXED, AML_NON_CACHEABLE,
+                                 AML_READ_WRITE,
+                                 0, entry->base, entry->limit, 0,
+                                 length);
+        }
+        aml_append(crs, mem);
         crs_range_insert(mem_ranges, entry->base, entry->limit);
     }
     g_ptr_array_free(host_mem_ranges, true);
-- 
1.8.3.1


Reply via email to