On Wednesday 15 November 2006 00:43, Herbert Xu wrote: > Hi: > > A number of qemu driver backends (such as rtl8139) call the function > cpu_physical_memory_rw to read/write guest memory. The target guest > memory address is often supplied by the guest. This opens up the > possibility of a guest giving an address which happens to be an MMIO > address which can potentially lead to infinite recursion involving > cpu_physical_memory_rw. > > Since these driver backends really only need to access system memory, > we could simply provide a new access interface that does not allow > MMIO addresses.
It isn't always system memory. Some DMA controllers deliberately write to device FIFOs. There are also several devices which map areas of onboard RAM. At minimum you need to make those to use RAM mappings rather than MMIO. If a device is recursively writing to itself I'd take this as sign that the guest OS is already pretty screwed. I'm not sure what happens in this situation on real hardware, but I wouldn't be surprised if it caused similar effects by flooding the bus. Paul _______________________________________________ Qemu-devel mailing list Qemu-devel@nongnu.org http://lists.nongnu.org/mailman/listinfo/qemu-devel
