Mailing List Archive: Recursion in cpu_physical_memory

Recursion in cpu_physical_memory_rw

Nov 14, 2006, 5:43 PM

Post #1 of 3 (126 views)

Hi:

A number of qemu driver backends (such as rtl8139) call the function
cpu_physical_memory_rw to read/write guest memory. The target guest
memory address is often supplied by the guest. This opens up the
possibility of a guest giving an address which happens to be an MMIO
address which can potentially lead to infinite recursion involving
cpu_physical_memory_rw.

Since these driver backends really only need to access system memory,
we could simply provide a new access interface that does not allow
MMIO addresses.

Any comments on this problem?

Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

RE: Recursion in cpu_physical_memory_rw [ In reply to ]

xin.b.li at intel

Nov 14, 2006, 5:50 PM

Post #2 of 3 (127 views)

Permalink

>
>A number of qemu driver backends (such as rtl8139) call the function
>cpu_physical_memory_rw to read/write guest memory. The target guest
>memory address is often supplied by the guest. This opens up the
>possibility of a guest giving an address which happens to be an MMIO
>address which can potentially lead to infinite recursion involving
>cpu_physical_memory_rw.
>
>Since these driver backends really only need to access system memory,
>we could simply provide a new access interface that does not allow
>MMIO addresses.
>
>Any comments on this problem?
>

The interface called paddr_is_ram should help.
-Xin

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [Qemu-devel] Recursion in cpu_physical_memory_rw [ In reply to ]

paul at codesourcery

Nov 14, 2006, 5:57 PM

Post #3 of 3 (128 views)

Permalink

On Wednesday 15 November 2006 00:43, Herbert Xu wrote:
> Hi:
>
> A number of qemu driver backends (such as rtl8139) call the function
> cpu_physical_memory_rw to read/write guest memory. The target guest
> memory address is often supplied by the guest. This opens up the
> possibility of a guest giving an address which happens to be an MMIO
> address which can potentially lead to infinite recursion involving
> cpu_physical_memory_rw.
>
> Since these driver backends really only need to access system memory,
> we could simply provide a new access interface that does not allow
> MMIO addresses.

It isn't always system memory. Some DMA controllers deliberately write to
device FIFOs. There are also several devices which map areas of onboard RAM.
At minimum you need to make those to use RAM mappings rather than MMIO.

If a device is recursively writing to itself I'd take this as sign that the
guest OS is already pretty screwed. I'm not sure what happens in this
situation on real hardware, but I wouldn't be surprised if it caused similar
effects by flooding the bus.

Paul

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel