Re: [Qemu-devel] Recursion in cpu_physical_memory_rw

[Paul Brook]

On Wednesday 15 November 2006 00:43, Herbert Xu wrote:
> Hi:
>
> A number of qemu driver backends (such as rtl8139) call the function
> cpu_physical_memory_rw to read/write guest memory.  The target guest
> memory address is often supplied by the guest.  This opens up the
> possibility of a guest giving an address which happens to be an MMIO
> address which can potentially lead to infinite recursion involving
> cpu_physical_memory_rw.
>
> Since these driver backends really only need to access system memory,
> we could simply provide a new access interface that does not allow
> MMIO addresses.

It isn't always system memory. Some DMA controllers deliberately write to 
device FIFOs. There are also several devices which map areas of onboard RAM. 
At minimum you need to make those to use RAM mappings rather than MMIO.

If a device is recursively writing to itself I'd take this as sign that the 
guest OS is already pretty screwed. I'm not sure what happens in this 
situation on real hardware, but I wouldn't be surprised if it caused similar 
effects by flooding the bus.

Paul