A new address space has an empty FlatView. In order to create it, we must (a) call memory_region_transaction_commit after the address space is inserted into the list; (b) force memory_region_transaction_commit to do something.
This bug was latent so far because all address spaces started empty, including the PCI address space where the bus master region is initially disabled. However, the target address space of an IOMMU is usually rooted at get_system_memory(), which might not be empty at the time the IOMMU is created. Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- memory.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/memory.c b/memory.c index fc4515b..a8929aa 100644 --- a/memory.c +++ b/memory.c @@ -1577,8 +1577,9 @@ void address_space_init(AddressSpace *as, MemoryRegion *root) as->ioeventfds = NULL; QTAILQ_INSERT_TAIL(&address_spaces, as, address_spaces_link); as->name = NULL; - memory_region_transaction_commit(); address_space_init_dispatch(as); + memory_region_update_pending |= root->enabled; + memory_region_transaction_commit(); } void address_space_destroy(AddressSpace *as) -- 1.7.1