On Mon, Nov 07, 2016 at 07:22:40AM +0000, Wei Liu wrote:
> On Fri, Nov 04, 2016 at 11:35:20AM -0400, Daniel De Graaf wrote:
> > Add two missing allow rules:
> >
> > 1. Device model domain construction uses getvcpucontext, discovered by
> > Andrew Cooper in an (apparently) unrelated bisection.
> >
> > 2. When a domain is destroyed with a device passthrough active, the
> > calls to remove_{irq,ioport,iomem} can be made by the hypervisor itself
> > (which results in an XSM check with the source xen_t). It does not make
> > sense to deny these permissions; no domain should be using xen_t, and
> > forbidding the hypervisor from performing cleanup is not useful.
> >
> > Signed-off-by: Daniel De Graaf <dgde...@tycho.nsa.gov>
> > Cc: Andrew Cooper <andrew.coop...@citrix.com>
>
> Acked-by: Wei Liu <wei.l...@citrix.com>
>
> I will pick this up for 4.8.
Updated commit message and applied.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
