On 02/09/2021 09:32, Jan Beulich wrote:
> One of the changes comprising the fixes for XSA-378 disallows replacing
> MMIO mappings by code paths not intended for this purpose. At least in
> the case of PVH Dom0 hitting an RMRR covered by an E820 ACPI region,
> this is too strict. Generally short-circuit requests establishing the
> same kind of mapping that's already in place, while otherwise adjusting
> permissions without - as before - allowing MFN or type to change.
"Generally short-circuit requests establishing the same kind of mapping
(mfn, type) but allow the permissions to differ".
> While there, also add a log message to the other domain_crash()
> invocation that did prevent PVH Dom0 from coming up after the XSA-378
> changes.
>
> Fixes: 753cb68e6530 ("x86/p2m: guard (in particular) identity mapping
> entries")
> Signed-off-by: Jan Beulich <jbeul...@suse.com>
> ---
> I may have gone too far by allowing "access" to change for all special
> types now.
I think this is appropriate. After all, it is the pre-existing
behaviour, and the type change is the important thing to restrict.
Acked-by: Andrew Cooper <andrew.coop...@citrix.com>
