Re: [PATCH v3 1/2] x86/domctl: don't imply I/O port permissions from I/O port mapping

[Jan Beulich <jbeulich@xxxxxxxx>]

On 21.07.2026 17:07, Roger Pau Monné wrote:
> On Tue, Jul 21, 2026 at 04:57:36PM +0200, Jan Beulich wrote:
>> On 21.07.2026 16:49, Roger Pau Monné wrote:
>>> On Tue, Jun 30, 2026 at 03:54:04PM +0200, Jan Beulich wrote:
>>>> Rather than granting permissions when mapping (an operation that DM-s are
>>>> allowed to carry out, while they can't invoke ioport-permission), check
>>>> whether permissions actually were granted when adding a mapping. This then
>>>> also allows relaxing the necessary locking.
>>>>
>>>> While no longer granting permissions upon mapping is "only" at risk of
>>>> breaking guests, no longer revoking permissions upon unmapping strictly
>>>> requires callers to additionally invoke XEN_DOMCTL_ioport_permission. Or
>>>> else a security issue would arise. In-tree code already does so.
>>>>
>>>> While there switch to using %pd in the two log messages.
>>>>
>>>> Fixes: 192c4dabc344 ("domctl and p2m changes for PCI passthru")
>>>> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
>>>
>>> It's difficult to not think about someone appearing in 3 or 4 years
>>> complaining that this change in behavior has caused them a security
>>> issue, but I do agree that the previous behavior was inconsistent at
>>> best:
>>
>> A positive aspect here is that the similar change for MMIO went without
>> any fallout, as far as I'm aware.
>>
>>> Acked-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
>>
>> Thanks, but ...
>>
>>> However you need to bump XEN_DOMCTL_INTERFACE_VERSION to note the ABI
>>> change as we are in 4.23 now.
>>
>> ... there's no interface change here. A bump therefore won't buy us
>> anything. I'm hesitant to take your ack as long as we disagree here.
> 
> It's not an interface change, but it's a change in behavior of an
> existing hypercall in a security-relevant way, so people would
> generally need to be aware of it, just in case.

But the interface version bump won't necessarily make anyone aware. Things
will continue to build as before, and there's also no binary incompatibility.
The best way of making people aware is the ChangeLog entry that iirc you had
asked for (and that's now there).

Jan