One of the changes comprising the fixes for XSA-378 disallows replacing
MMIO mappings by code paths not intended for this purpose. At least in
the case of PVH Dom0 hitting an RMRR covered by an E820 ACPI region,
this is too strict. Generally short-circuit requests establishing the
same kind of mapping that's already in place, while otherwise adjusting
permissions without - as before - allowing MFN or type to change.
While there, also add a log message to the other domain_crash()
invocation that did prevent PVH Dom0 from coming up after the XSA-378
changes.
Fixes: 753cb68e6530 ("x86/p2m: guard (in particular) identity mapping entries")
Signed-off-by: Jan Beulich <jbeul...@suse.com>
---
I may have gone too far by allowing "access" to change for all special
types now.
---
v2: Format string and comment adjustments. Split off access
accumulation.
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -958,9 +958,13 @@ guest_physmap_add_entry(struct domain *d
if ( p2m_is_special(ot) )
{
/* Don't permit unmapping grant/foreign/direct-MMIO this way. */
- domain_crash(d);
p2m_unlock(p2m);
-
+ printk(XENLOG_G_ERR
+ "%pd: GFN %#lx (%#lx,%u,%u) -> (%#lx,%u,%u) not
permitted\n",
+ d, gfn_x(gfn) + i,
+ mfn_x(omfn), ot, a,
+ mfn_x(mfn) + i, t, p2m->default_access);
+ domain_crash(d);
return -EPERM;
}
else if ( p2m_is_ram(ot) && !p2m_is_paged(ot) )
@@ -1302,9 +1306,24 @@ static int set_typed_p2m_entry(struct do
}
if ( p2m_is_special(ot) )
{
- gfn_unlock(p2m, gfn, order);
- domain_crash(d);
- return -EPERM;
+ /* Special-case (almost) identical mappings. */
+ if ( !mfn_eq(mfn, omfn) || gfn_p2mt != ot )
+ {
+ gfn_unlock(p2m, gfn, order);
+ printk(XENLOG_G_ERR
+ "%pd: GFN %#lx (%#lx,%u,%u,%u) -> (%#lx,%u,%u,%u) not
permitted\n",
+ d, gfn_l,
+ mfn_x(omfn), cur_order, ot, a,
+ mfn_x(mfn), order, gfn_p2mt, access);
+ domain_crash(d);
+ return -EPERM;
+ }
+
+ if ( access == a )
+ {
+ gfn_unlock(p2m, gfn, order);
+ return 0;
+ }
}
else if ( p2m_is_ram(ot) )
{
