* [PATCH 00/24] XSM: follow-on to XSAs 492 and 499
@ 2026-07-28 13:10 Jan Beulich
2026-07-28 13:13 ` [PATCH 01/24] XSM: reduce redundancy in hook machinery Jan Beulich
` (23 more replies)
0 siblings, 24 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:10 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
Working on those XSAs made pretty apparent that there's a lot of redundancy,
requiring changes in too many separate places if e.g. adding / altering /
removing a hook. Obviously while dealing with that, some other, smaller
tidying opportunities turned up as well.
01: XSM: reduce redundancy in hook machinery
02: XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y
03: XSM: make .{,un}map_domain_pirq() hooks dependent upon HAS_PIRQ=y
04: XSM: make PCI hooks dependent upon HAS_PCI=y
05: XSM: make .iomem_mapping_vcpi() hook dependent upon HAS_VPCI=y
06: XSM: make .kexec() hook dependent upon KEXEC=y
07: XSM: make .hypfs() hook dependent upon HYPFS=y
08: XSM: make .hvm_altp2mhvm_op() hook dependent upon ALTP2M=y
09: XSM: make .hvm_param*() hooks dependent upon HVM=y
10: XSM: make .dm_op() hook dependent upon IORE_SERVER=y
11: XSM: make certain x86-specific hooks dependent upon PV=y
12: x86/mm: get_page_from_l1e() is PV-or-shadow-only
13: x86: restrict PHYSDEVOP_* when PV=n
14: XSM/dummy: fold cf_check into XSM_INLINE
15: XSM/dummy: drop redundant return statements
16: XSM: suppress hypercall when XSM=n
17: XSM: make Argo hooks well-formed ones
18: XSM: make XSM hooks well-formed ones
19: XSM: convert "allow" (Flask: "access") parameters to bool
20: XSM: fold xsm_{,un}map_domain_pirq() hooks
21: x86: type-correct last parameter of map_domain_pirq()
22: XSM: pass just SBDF to xsm_{,un}map_domain_irq()
23: XSM: fold xsm_{,un}map_domain_irq() hooks
24: XSM: fold xsm_{,un}bind_pt_irq() hooks
Jan
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 01/24] XSM: reduce redundancy in hook machinery
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
@ 2026-07-28 13:13 ` Jan Beulich
2026-07-28 13:14 ` [PATCH 02/24] XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y Jan Beulich
` (22 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:13 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
Hook definition (in struct xsm_ops), wrappers, dummy_ops, and flask_ops
need keeping in sync (including any involved #ifdef-ary), i.e. require
consistent adjustments in multiple places when a change is necessary.
Reduce this by introducing a multi-use helper header file. (However,
hooks not taking xsm_default_t as first argument in the wrappers aren't
covered.)
As there's some re-arrangement of field order in struct xsm_ops anyway,
also group together everything depending on SYSCTL=y. Similarly move
.mem_sharing_op() into the MEM_SHARING conditional.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
RFC: In principle dummy.h could also be covered, by further specifying
both the expected xsm_default_t value and the actual operation as
further arguments to XSM_HOOK(). I'm worried that this may end up a
little unwieldy in hooks.h, though.
Hooks not taking xsm_default_t as first argument could of course be
adjusted to take one, at which point they could be covered here as well.
Question is why there is this difference in the first place.
.{alloc,free}_security_evtchns() and their dummy wrappers use struct
evtchn[] notation, while xsm_{alloc,free}_security_evtchns() use struct
evtchn *. Is there a reason for this inconsistency?
--- /dev/null
+++ b/xen/include/xsm/hooks.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/* This file is intended to be included multiple times. */
+
+#ifndef XSM_HOOK
+
+#include <xen/macros.h>
+
+#define XSM_HOOK__(rtype, name, nargs, types...) \
+ XSM_HOOK ## nargs(rtype, name, ## types)
+
+#define XSM_HOOK_(rtype, name, nargs, types...) \
+ XSM_HOOK__(rtype, name, nargs, ## types)
+
+#define XSM_HOOK(rtype, name, types...) \
+ XSM_HOOK_(rtype, name, count_args(types), ## types)
+
+#endif /* XSM_HOOK */
+
+XSM_HOOK(int, domain_create, struct domain *, uint32_t)
+XSM_HOOK(int, getdomaininfo, struct domain *)
+XSM_HOOK(int, get_domain_state, struct domain *)
+
+#ifdef CONFIG_SYSCTL
+XSM_HOOK(int, sysctl, const struct xen_sysctl *)
+#endif
+
+XSM_HOOK(int, set_target, struct domain *, struct domain *)
+XSM_HOOK(int, domctl, struct domain *, struct xen_domctl *)
+
+XSM_HOOK(int, evtchn_unbound, struct domain *, struct evtchn *, domid_t)
+XSM_HOOK(int, evtchn_interdomain, struct domain *, struct evtchn *,
+ struct domain *, struct evtchn *)
+XSM_HOOK(int, evtchn_send, struct domain *, struct evtchn *)
+XSM_HOOK(int, evtchn_status, struct domain *, struct evtchn *)
+XSM_HOOK(int, evtchn_reset, struct domain *, struct domain *)
+
+XSM_HOOK(int, grant_mapref, struct domain *, struct domain *, uint32_t)
+XSM_HOOK(int, grant_unmapref, struct domain *, struct domain *)
+XSM_HOOK(int, grant_setup, struct domain *, struct domain *)
+XSM_HOOK(int, grant_transfer, struct domain *, struct domain *)
+XSM_HOOK(int, grant_copy, struct domain *, struct domain *)
+XSM_HOOK(int, grant_query_size, struct domain *, struct domain *)
+
+XSM_HOOK(int, init_hardware_domain, struct domain *)
+
+XSM_HOOK(int, get_pod_target, struct domain *)
+XSM_HOOK(int, set_pod_target, struct domain *)
+
+XSM_HOOK(int, memory_exchange, struct domain *)
+XSM_HOOK(int, memory_adjust_reservation, struct domain *, struct domain *)
+XSM_HOOK(int, memory_stat_reservation, struct domain *, struct domain *)
+XSM_HOOK(int, memory_pin_page, struct domain *, struct domain *,
+ struct page_info *)
+XSM_HOOK(int, add_to_physmap, struct domain *, struct domain *)
+XSM_HOOK(int, remove_from_physmap, struct domain *, struct domain *)
+XSM_HOOK(int, map_gmfn_foreign, struct domain *, struct domain *)
+XSM_HOOK(int, claim_pages, struct domain *)
+
+XSM_HOOK(int, console_io, struct domain *, int)
+
+XSM_HOOK(int, kexec)
+
+XSM_HOOK(int, schedop_shutdown, struct domain *, struct domain *)
+
+XSM_HOOK(int, map_domain_pirq, struct domain *)
+XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
+XSM_HOOK(int, unmap_domain_pirq, struct domain *)
+XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const void *)
+XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
+XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
+
+XSM_HOOK(int, irq_permission, struct domain *, int, uint8_t)
+XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, uint8_t)
+XSM_HOOK(int, pci_config_permission, struct domain *, uint32_t, uint16_t,
+ uint16_t, uint8_t)
+
+XSM_HOOK(int, iomem_mapping, struct domain *, uint64_t, uint64_t, uint8_t)
+XSM_HOOK(int, iomem_mapping_vpci, struct domain *, uint64_t, uint64_t, uint8_t)
+
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+XSM_HOOK(int, get_device_group, uint32_t)
+#endif
+
+XSM_HOOK(int, resource_plug_pci, uint32_t)
+XSM_HOOK(int, resource_unplug_pci, uint32_t)
+XSM_HOOK(int, resource_setup_pci, uint32_t)
+XSM_HOOK(int, resource_setup_gsi, int)
+XSM_HOOK(int, resource_setup_misc)
+
+XSM_HOOK(int, hypfs_op)
+
+XSM_HOOK(int, hvm_param, struct domain *, unsigned long)
+XSM_HOOK(int, hvm_param_altp2mhvm, struct domain *)
+XSM_HOOK(int, hvm_altp2mhvm_op, struct domain *, uint64_t, uint32_t)
+XSM_HOOK(int, get_vnumainfo, struct domain *)
+
+#ifdef CONFIG_VM_EVENT
+XSM_HOOK(int, mem_access, struct domain *)
+#endif
+
+#ifdef CONFIG_MEM_PAGING
+XSM_HOOK(int, mem_paging, struct domain *)
+#endif
+
+#ifdef CONFIG_MEM_SHARING
+XSM_HOOK(int, mem_sharing, struct domain *)
+XSM_HOOK(int, mem_sharing_op, struct domain *, struct domain *, int)
+#endif
+
+XSM_HOOK(int, platform_op, uint32_t)
+
+#ifdef CONFIG_X86
+XSM_HOOK(int, do_mca)
+XSM_HOOK(int, apic, struct domain *, int)
+XSM_HOOK(int, machine_memory_map)
+XSM_HOOK(int, domain_memory_map, struct domain *)
+XSM_HOOK(int, mmu_update, struct domain *, struct domain *, struct domain *,
+ uint32_t)
+XSM_HOOK(int, mmuext_op, struct domain *, struct domain *)
+XSM_HOOK(int, update_va_mapping, struct domain *, struct domain *, l1_pgentry_t)
+XSM_HOOK(int, priv_mapping, struct domain *, struct domain *)
+XSM_HOOK(int, ioport_permission, struct domain *, uint32_t, uint32_t, uint8_t)
+XSM_HOOK(int, ioport_mapping, struct domain *, uint32_t, uint32_t, uint8_t)
+XSM_HOOK(int, pmu_op, struct domain *, unsigned int)
+#endif /* CONFIG_X86 */
+
+XSM_HOOK(int, dm_op, struct domain *)
+XSM_HOOK(int, xen_version, uint32_t)
+XSM_HOOK(int, domain_resource_map, struct domain *)
+
+#undef XSM_HOOK0
+#undef XSM_HOOK1
+#undef XSM_HOOK2
+#undef XSM_HOOK3
+#undef XSM_HOOK4
+#undef XSM_HOOK5
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -41,6 +41,13 @@ enum xsm_default {
};
typedef enum xsm_default xsm_default_t;
+#ifdef CONFIG_X86
+#define XSM_MMU_UPDATE_READ 1
+#define XSM_MMU_UPDATE_WRITE 2
+#define XSM_MMU_NORMAL_UPDATE 4
+#define XSM_MMU_MACHPHYS_UPDATE 8
+#endif /* CONFIG_X86 */
+
/*
* !!! WARNING !!!
*
@@ -54,131 +61,36 @@ struct xsm_ops {
int (*set_system_active)(void);
void (*security_domaininfo)(struct domain *d,
struct xen_domctl_getdomaininfo *info);
- int (*domain_create)(struct domain *d, uint32_t ssidref);
- int (*getdomaininfo)(struct domain *d);
- int (*set_target)(struct domain *d, struct domain *e);
- int (*domctl)(struct domain *d, struct xen_domctl *op);
-#ifdef CONFIG_SYSCTL
- int (*sysctl)(const struct xen_sysctl *op);
-#endif
- int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2);
- int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1,
- struct domain *d2, struct evtchn *chn2);
+#define XSM_HOOK0(rtype, name) rtype (*name)(void);
+#define XSM_HOOK1(rtype, name, type1) \
+ rtype (*name)(type1 arg1);
+#define XSM_HOOK2(rtype, name, type1, type2) \
+ rtype (*name)(type1 arg1, type2 arg2);
+#define XSM_HOOK3(rtype, name, type1, type2, type3) \
+ rtype (*name)(type1 arg1, type2 arg2, type3 arg3);
+#define XSM_HOOK4(rtype, name, type1, type2, type3, type4) \
+ rtype (*name)(type1 arg1, type2 arg2, type3 arg3, type4 arg4);
+#define XSM_HOOK5(rtype, name, type1, type2, type3, type4, type5) \
+ rtype (*name)(type1 arg1, type2 arg2, type3 arg3, type4 arg4, type5 arg5);
+
+#include "hooks.h"
+
void (*evtchn_close_post)(struct evtchn *chn);
- int (*evtchn_send)(struct domain *d, struct evtchn *chn);
- int (*evtchn_status)(struct domain *d, struct evtchn *chn);
- int (*evtchn_reset)(struct domain *d1, struct domain *d2);
-
- int (*grant_mapref)(struct domain *d1, struct domain *d2, uint32_t flags);
- int (*grant_unmapref)(struct domain *d1, struct domain *d2);
- int (*grant_setup)(struct domain *d1, struct domain *d2);
- int (*grant_transfer)(struct domain *d1, struct domain *d2);
- int (*grant_copy)(struct domain *d1, struct domain *d2);
- int (*grant_query_size)(struct domain *d1, struct domain *d2);
int (*alloc_security_domain)(struct domain *d);
void (*free_security_domain)(struct domain *d);
int (*alloc_security_evtchns)(struct evtchn chn[], unsigned int nr);
void (*free_security_evtchns)(struct evtchn chn[], unsigned int nr);
char *(*show_security_evtchn)(struct domain *d, const struct evtchn *chn);
- int (*init_hardware_domain)(struct domain *d);
-
- int (*get_pod_target)(struct domain *d);
- int (*set_pod_target)(struct domain *d);
- int (*memory_exchange)(struct domain *d);
- int (*memory_adjust_reservation)(struct domain *d1, struct domain *d2);
- int (*memory_stat_reservation)(struct domain *d1, struct domain *d2);
- int (*memory_pin_page)(struct domain *d1, struct domain *d2,
- struct page_info *page);
- int (*add_to_physmap)(struct domain *d1, struct domain *d2);
- int (*remove_from_physmap)(struct domain *d1, struct domain *d2);
- int (*map_gmfn_foreign)(struct domain *d, struct domain *t);
- int (*claim_pages)(struct domain *d);
-
- int (*console_io)(struct domain *d, int cmd);
-
- int (*kexec)(void);
- int (*schedop_shutdown)(struct domain *d1, struct domain *d2);
char *(*show_irq_sid)(int irq);
- int (*map_domain_pirq)(struct domain *d);
- int (*map_domain_irq)(struct domain *d, int irq, const void *data);
- int (*unmap_domain_pirq)(struct domain *d);
- int (*unmap_domain_irq)(struct domain *d, int irq, const void *data);
- int (*bind_pt_irq)(struct domain *d, struct xen_domctl_bind_pt_irq *bind);
- int (*unbind_pt_irq)(struct domain *d, struct xen_domctl_bind_pt_irq *bind);
- int (*irq_permission)(struct domain *d, int pirq, uint8_t allow);
- int (*iomem_permission)(struct domain *d, uint64_t s, uint64_t e,
- uint8_t allow);
- int (*iomem_mapping)(struct domain *d, uint64_t s, uint64_t e,
- uint8_t allow);
- int (*iomem_mapping_vpci)(struct domain *d, uint64_t s, uint64_t e,
- uint8_t allow);
- int (*pci_config_permission)(struct domain *d, uint32_t machine_bdf,
- uint16_t start, uint16_t end, uint8_t access);
-
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
- int (*get_device_group)(uint32_t machine_bdf);
-#endif
-
- int (*resource_plug_pci)(uint32_t machine_bdf);
- int (*resource_unplug_pci)(uint32_t machine_bdf);
- int (*resource_setup_pci)(uint32_t machine_bdf);
- int (*resource_setup_gsi)(int gsi);
- int (*resource_setup_misc)(void);
-
- int (*hypfs_op)(void);
long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op);
#ifdef CONFIG_COMPAT
int (*do_compat_op)(XEN_GUEST_HANDLE_PARAM(void) op);
#endif
- int (*hvm_param)(struct domain *d, unsigned long op);
- int (*hvm_param_altp2mhvm)(struct domain *d);
- int (*hvm_altp2mhvm_op)(struct domain *d, uint64_t mode, uint32_t op);
- int (*get_vnumainfo)(struct domain *d);
-
-#ifdef CONFIG_VM_EVENT
- int (*mem_access)(struct domain *d);
-#endif
-
-#ifdef CONFIG_MEM_PAGING
- int (*mem_paging)(struct domain *d);
-#endif
-
-#ifdef CONFIG_MEM_SHARING
- int (*mem_sharing)(struct domain *d);
-#endif
-
- int (*platform_op)(uint32_t cmd);
-
-#ifdef CONFIG_X86
- int (*do_mca)(void);
- int (*mem_sharing_op)(struct domain *d, struct domain *cd, int op);
- int (*apic)(struct domain *d, int cmd);
- int (*machine_memory_map)(void);
- int (*domain_memory_map)(struct domain *d);
-#define XSM_MMU_UPDATE_READ 1
-#define XSM_MMU_UPDATE_WRITE 2
-#define XSM_MMU_NORMAL_UPDATE 4
-#define XSM_MMU_MACHPHYS_UPDATE 8
- int (*mmu_update)(struct domain *d, struct domain *t,
- struct domain *f, uint32_t flags);
- int (*mmuext_op)(struct domain *d, struct domain *f);
- int (*update_va_mapping)(struct domain *d, struct domain *f,
- l1_pgentry_t pte);
- int (*priv_mapping)(struct domain *d, struct domain *t);
- int (*ioport_permission)(struct domain *d, uint32_t s, uint32_t e,
- uint8_t allow);
- int (*ioport_mapping)(struct domain *d, uint32_t s, uint32_t e,
- uint8_t allow);
- int (*pmu_op)(struct domain *d, unsigned int op);
-#endif
- int (*dm_op)(struct domain *d);
- int (*xen_version)(uint32_t cmd);
- int (*domain_resource_map)(struct domain *d);
#ifdef CONFIG_ARGO
int (*argo_enable)(const struct domain *d);
int (*argo_register_single_source)(const struct domain *d,
@@ -186,7 +98,6 @@ struct xsm_ops {
int (*argo_register_any_source)(const struct domain *d);
int (*argo_send)(const struct domain *d, const struct domain *t);
#endif
- int (*get_domain_state)(struct domain *d);
};
#ifdef CONFIG_XSM
@@ -206,113 +117,57 @@ static inline void xsm_security_domainin
alternative_vcall(xsm_ops.security_domaininfo, d, info);
}
-static inline int xsm_domain_create(
- xsm_default_t def, struct domain *d, uint32_t ssidref)
-{
- return alternative_call(xsm_ops.domain_create, d, ssidref);
-}
+#define XSM_ALT_void alternative_vcall
+#define XSM_ALT_int return alternative_call
-static inline int xsm_getdomaininfo(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.getdomaininfo, d);
+#define XSM_HOOK0(rtype, name) \
+static inline rtype xsm_ ## name(xsm_default_t def) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name); \
}
-static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.get_domain_state, d);
+#define XSM_HOOK1(rtype, name, type1) \
+static inline rtype xsm_ ## name(xsm_default_t def, type1 arg1) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name, arg1); \
}
-static inline int xsm_set_target(
- xsm_default_t def, struct domain *d, struct domain *e)
-{
- return alternative_call(xsm_ops.set_target, d, e);
+#define XSM_HOOK2(rtype, name, type1, type2) \
+static inline rtype xsm_ ## name( \
+ xsm_default_t def, type1 arg1, type2 arg2) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name, arg1, arg2); \
}
-static inline int xsm_domctl(xsm_default_t def, struct domain *d,
- struct xen_domctl *op)
-{
- return alternative_call(xsm_ops.domctl, d, op);
+#define XSM_HOOK3(rtype, name, type1, type2, type3) \
+static inline rtype xsm_ ## name( \
+ xsm_default_t def, type1 arg1, type2 arg2, type3 arg3) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name, arg1, arg2, arg3); \
}
-#ifdef CONFIG_SYSCTL
-static inline int xsm_sysctl(xsm_default_t def, const struct xen_sysctl *op)
-{
- return alternative_call(xsm_ops.sysctl, op);
+#define XSM_HOOK4(rtype, name, type1, type2, type3, type4) \
+static inline rtype xsm_ ## name( \
+ xsm_default_t def, type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name, arg1, arg2, arg3, arg4); \
}
-#endif
-static inline int xsm_evtchn_unbound(
- xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2)
-{
- return alternative_call(xsm_ops.evtchn_unbound, d1, chn, id2);
+#define XSM_HOOK5(rtype, name, type1, type2, type3, type4, type5) \
+static inline rtype xsm_ ## name( \
+ xsm_default_t def, type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
+ type4 arg5) \
+{ \
+ XSM_ALT_ ## rtype(xsm_ops.name, arg1, arg2, arg3, arg4, arg5); \
}
-static inline int xsm_evtchn_interdomain(
- xsm_default_t def, struct domain *d1, struct evtchn *chan1,
- struct domain *d2, struct evtchn *chan2)
-{
- return alternative_call(xsm_ops.evtchn_interdomain, d1, chan1, d2, chan2);
-}
+#include "hooks.h"
static inline void xsm_evtchn_close_post(struct evtchn *chn)
{
alternative_vcall(xsm_ops.evtchn_close_post, chn);
}
-static inline int xsm_evtchn_send(
- xsm_default_t def, struct domain *d, struct evtchn *chn)
-{
- return alternative_call(xsm_ops.evtchn_send, d, chn);
-}
-
-static inline int xsm_evtchn_status(
- xsm_default_t def, struct domain *d, struct evtchn *chn)
-{
- return alternative_call(xsm_ops.evtchn_status, d, chn);
-}
-
-static inline int xsm_evtchn_reset(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.evtchn_reset, d1, d2);
-}
-
-static inline int xsm_grant_mapref(
- xsm_default_t def, struct domain *d1, struct domain *d2, uint32_t flags)
-{
- return alternative_call(xsm_ops.grant_mapref, d1, d2, flags);
-}
-
-static inline int xsm_grant_unmapref(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.grant_unmapref, d1, d2);
-}
-
-static inline int xsm_grant_setup(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.grant_setup, d1, d2);
-}
-
-static inline int xsm_grant_transfer(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.grant_transfer, d1, d2);
-}
-
-static inline int xsm_grant_copy(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.grant_copy, d1, d2);
-}
-
-static inline int xsm_grant_query_size(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.grant_query_size, d1, d2);
-}
-
static inline int xsm_alloc_security_domain(struct domain *d)
{
return alternative_call(xsm_ops.alloc_security_domain, d);
@@ -341,193 +196,11 @@ static inline char *xsm_show_security_ev
return alternative_call(xsm_ops.show_security_evtchn, d, chn);
}
-static inline int xsm_init_hardware_domain(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.init_hardware_domain, d);
-}
-
-static inline int xsm_get_pod_target(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.get_pod_target, d);
-}
-
-static inline int xsm_set_pod_target(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.set_pod_target, d);
-}
-
-static inline int xsm_memory_exchange(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.memory_exchange, d);
-}
-
-static inline int xsm_memory_adjust_reservation(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.memory_adjust_reservation, d1, d2);
-}
-
-static inline int xsm_memory_stat_reservation(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.memory_stat_reservation, d1, d2);
-}
-
-static inline int xsm_memory_pin_page(
- xsm_default_t def, struct domain *d1, struct domain *d2,
- struct page_info *page)
-{
- return alternative_call(xsm_ops.memory_pin_page, d1, d2, page);
-}
-
-static inline int xsm_add_to_physmap(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.add_to_physmap, d1, d2);
-}
-
-static inline int xsm_remove_from_physmap(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.remove_from_physmap, d1, d2);
-}
-
-static inline int xsm_map_gmfn_foreign(
- xsm_default_t def, struct domain *d, struct domain *t)
-{
- return alternative_call(xsm_ops.map_gmfn_foreign, d, t);
-}
-
-static inline int xsm_claim_pages(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.claim_pages, d);
-}
-
-static inline int xsm_console_io(xsm_default_t def, struct domain *d, int cmd)
-{
- return alternative_call(xsm_ops.console_io, d, cmd);
-}
-
-static inline int xsm_kexec(xsm_default_t def)
-{
- return alternative_call(xsm_ops.kexec);
-}
-
-static inline int xsm_schedop_shutdown(
- xsm_default_t def, struct domain *d1, struct domain *d2)
-{
- return alternative_call(xsm_ops.schedop_shutdown, d1, d2);
-}
-
static inline char *xsm_show_irq_sid(int irq)
{
return alternative_call(xsm_ops.show_irq_sid, irq);
}
-static inline int xsm_map_domain_pirq(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.map_domain_pirq, d);
-}
-
-static inline int xsm_map_domain_irq(
- xsm_default_t def, struct domain *d, int irq, void *data)
-{
- return alternative_call(xsm_ops.map_domain_irq, d, irq, data);
-}
-
-static inline int xsm_unmap_domain_pirq(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.unmap_domain_pirq, d);
-}
-
-static inline int xsm_unmap_domain_irq(
- xsm_default_t def, struct domain *d, int irq, void *data)
-{
- return alternative_call(xsm_ops.unmap_domain_irq, d, irq, data);
-}
-
-static inline int xsm_bind_pt_irq(
- xsm_default_t def, struct domain *d, struct xen_domctl_bind_pt_irq *bind)
-{
- return alternative_call(xsm_ops.bind_pt_irq, d, bind);
-}
-
-static inline int xsm_unbind_pt_irq(
- xsm_default_t def, struct domain *d, struct xen_domctl_bind_pt_irq *bind)
-{
- return alternative_call(xsm_ops.unbind_pt_irq, d, bind);
-}
-
-static inline int xsm_irq_permission(
- xsm_default_t def, struct domain *d, int pirq, uint8_t allow)
-{
- return alternative_call(xsm_ops.irq_permission, d, pirq, allow);
-}
-
-static inline int xsm_iomem_permission(
- xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.iomem_permission, d, s, e, allow);
-}
-
-static inline int xsm_iomem_mapping(
- xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.iomem_mapping, d, s, e, allow);
-}
-
-static inline int xsm_iomem_mapping_vpci(
- xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.iomem_mapping_vpci, d, s, e, allow);
-}
-
-static inline int xsm_pci_config_permission(
- xsm_default_t def, struct domain *d, uint32_t machine_bdf, uint16_t start,
- uint16_t end, uint8_t access)
-{
- return alternative_call(xsm_ops.pci_config_permission, d, machine_bdf, start, end, access);
-}
-
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
-static inline int xsm_get_device_group(xsm_default_t def, uint32_t machine_bdf)
-{
- return alternative_call(xsm_ops.get_device_group, machine_bdf);
-}
-#endif /* HAS_PASSTHROUGH && HAS_PCI) */
-
-static inline int xsm_resource_plug_pci(xsm_default_t def, uint32_t machine_bdf)
-{
- return alternative_call(xsm_ops.resource_plug_pci, machine_bdf);
-}
-
-static inline int xsm_resource_unplug_pci(
- xsm_default_t def, uint32_t machine_bdf)
-{
- return alternative_call(xsm_ops.resource_unplug_pci, machine_bdf);
-}
-
-static inline int xsm_resource_setup_pci(
- xsm_default_t def, uint32_t machine_bdf)
-{
- return alternative_call(xsm_ops.resource_setup_pci, machine_bdf);
-}
-
-static inline int xsm_resource_setup_gsi(xsm_default_t def, int gsi)
-{
- return alternative_call(xsm_ops.resource_setup_gsi, gsi);
-}
-
-static inline int xsm_resource_setup_misc(xsm_default_t def)
-{
- return alternative_call(xsm_ops.resource_setup_misc);
-}
-
-static inline int xsm_hypfs_op(xsm_default_t def)
-{
- return alternative_call(xsm_ops.hypfs_op);
-}
-
static inline long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return alternative_call(xsm_ops.do_xsm_op, op);
@@ -540,141 +213,6 @@ static inline int xsm_do_compat_op(XEN_G
}
#endif
-static inline int xsm_hvm_param(
- xsm_default_t def, struct domain *d, unsigned long op)
-{
- return alternative_call(xsm_ops.hvm_param, d, op);
-}
-
-static inline int xsm_hvm_param_altp2mhvm(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.hvm_param_altp2mhvm, d);
-}
-
-static inline int xsm_hvm_altp2mhvm_op(
- xsm_default_t def, struct domain *d, uint64_t mode, uint32_t op)
-{
- return alternative_call(xsm_ops.hvm_altp2mhvm_op, d, mode, op);
-}
-
-static inline int xsm_get_vnumainfo(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.get_vnumainfo, d);
-}
-
-#ifdef CONFIG_VM_EVENT
-static inline int xsm_mem_access(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.mem_access, d);
-}
-#endif
-
-#ifdef CONFIG_MEM_PAGING
-static inline int xsm_mem_paging(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.mem_paging, d);
-}
-#endif
-
-#ifdef CONFIG_MEM_SHARING
-static inline int xsm_mem_sharing(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.mem_sharing, d);
-}
-#endif
-
-static inline int xsm_platform_op(xsm_default_t def, uint32_t op)
-{
- return alternative_call(xsm_ops.platform_op, op);
-}
-
-#ifdef CONFIG_X86
-static inline int xsm_do_mca(xsm_default_t def)
-{
- return alternative_call(xsm_ops.do_mca);
-}
-
-static inline int xsm_mem_sharing_op(
- xsm_default_t def, struct domain *d, struct domain *cd, int op)
-{
- return alternative_call(xsm_ops.mem_sharing_op, d, cd, op);
-}
-
-static inline int xsm_apic(xsm_default_t def, struct domain *d, int cmd)
-{
- return alternative_call(xsm_ops.apic, d, cmd);
-}
-
-static inline int xsm_machine_memory_map(xsm_default_t def)
-{
- return alternative_call(xsm_ops.machine_memory_map);
-}
-
-static inline int xsm_domain_memory_map(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.domain_memory_map, d);
-}
-
-static inline int xsm_mmu_update(
- xsm_default_t def, struct domain *d, struct domain *t, struct domain *f,
- uint32_t flags)
-{
- return alternative_call(xsm_ops.mmu_update, d, t, f, flags);
-}
-
-static inline int xsm_mmuext_op(
- xsm_default_t def, struct domain *d, struct domain *f)
-{
- return alternative_call(xsm_ops.mmuext_op, d, f);
-}
-
-static inline int xsm_update_va_mapping(
- xsm_default_t def, struct domain *d, struct domain *f, l1_pgentry_t pte)
-{
- return alternative_call(xsm_ops.update_va_mapping, d, f, pte);
-}
-
-static inline int xsm_priv_mapping(
- xsm_default_t def, struct domain *d, struct domain *t)
-{
- return alternative_call(xsm_ops.priv_mapping, d, t);
-}
-
-static inline int xsm_ioport_permission(
- xsm_default_t def, struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.ioport_permission, d, s, e, allow);
-}
-
-static inline int xsm_ioport_mapping(
- xsm_default_t def, struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.ioport_mapping, d, s, e, allow);
-}
-
-static inline int xsm_pmu_op(
- xsm_default_t def, struct domain *d, unsigned int op)
-{
- return alternative_call(xsm_ops.pmu_op, d, op);
-}
-
-#endif /* CONFIG_X86 */
-
-static inline int xsm_dm_op(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.dm_op, d);
-}
-
-static inline int xsm_xen_version(xsm_default_t def, uint32_t op)
-{
- return alternative_call(xsm_ops.xen_version, op);
-}
-
-static inline int xsm_domain_resource_map(xsm_default_t def, struct domain *d)
-{
- return alternative_call(xsm_ops.domain_resource_map, d);
-}
-
#ifdef CONFIG_ARGO
static inline int xsm_argo_enable(const struct domain *d)
{
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -16,124 +16,37 @@
static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.set_system_active = xsm_set_system_active,
.security_domaininfo = xsm_security_domaininfo,
- .domain_create = xsm_domain_create,
- .getdomaininfo = xsm_getdomaininfo,
- .set_target = xsm_set_target,
- .domctl = xsm_domctl,
-#ifdef CONFIG_SYSCTL
- .sysctl = xsm_sysctl,
-#endif
- .evtchn_unbound = xsm_evtchn_unbound,
- .evtchn_interdomain = xsm_evtchn_interdomain,
+#define XSM_HOOK0(rtype, name) .name = xsm_ ## name,
+#define XSM_HOOK1(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK2(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK3(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK4(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK5(rtype, name, ...) XSM_HOOK0(rtype, name)
+
+#include <xsm/hooks.h>
+
.evtchn_close_post = xsm_evtchn_close_post,
- .evtchn_send = xsm_evtchn_send,
- .evtchn_status = xsm_evtchn_status,
- .evtchn_reset = xsm_evtchn_reset,
-
- .grant_mapref = xsm_grant_mapref,
- .grant_unmapref = xsm_grant_unmapref,
- .grant_setup = xsm_grant_setup,
- .grant_transfer = xsm_grant_transfer,
- .grant_copy = xsm_grant_copy,
- .grant_query_size = xsm_grant_query_size,
.alloc_security_domain = xsm_alloc_security_domain,
.free_security_domain = xsm_free_security_domain,
.alloc_security_evtchns = xsm_alloc_security_evtchns,
.free_security_evtchns = xsm_free_security_evtchns,
.show_security_evtchn = xsm_show_security_evtchn,
- .init_hardware_domain = xsm_init_hardware_domain,
-
- .get_pod_target = xsm_get_pod_target,
- .set_pod_target = xsm_set_pod_target,
-
- .memory_exchange = xsm_memory_exchange,
- .memory_adjust_reservation = xsm_memory_adjust_reservation,
- .memory_stat_reservation = xsm_memory_stat_reservation,
- .memory_pin_page = xsm_memory_pin_page,
- .claim_pages = xsm_claim_pages,
-
- .console_io = xsm_console_io,
-
- .kexec = xsm_kexec,
- .schedop_shutdown = xsm_schedop_shutdown,
.show_irq_sid = xsm_show_irq_sid,
- .map_domain_pirq = xsm_map_domain_pirq,
- .map_domain_irq = xsm_map_domain_irq,
- .unmap_domain_pirq = xsm_unmap_domain_pirq,
- .unmap_domain_irq = xsm_unmap_domain_irq,
- .bind_pt_irq = xsm_bind_pt_irq,
- .unbind_pt_irq = xsm_unbind_pt_irq,
- .irq_permission = xsm_irq_permission,
- .iomem_permission = xsm_iomem_permission,
- .iomem_mapping = xsm_iomem_mapping,
- .iomem_mapping_vpci = xsm_iomem_mapping_vpci,
- .pci_config_permission = xsm_pci_config_permission,
- .get_vnumainfo = xsm_get_vnumainfo,
-
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
- .get_device_group = xsm_get_device_group,
-#endif
-
- .resource_plug_pci = xsm_resource_plug_pci,
- .resource_unplug_pci = xsm_resource_unplug_pci,
- .resource_setup_pci = xsm_resource_setup_pci,
- .resource_setup_gsi = xsm_resource_setup_gsi,
- .resource_setup_misc = xsm_resource_setup_misc,
-
- .hypfs_op = xsm_hypfs_op,
- .hvm_param = xsm_hvm_param,
- .hvm_param_altp2mhvm = xsm_hvm_param_altp2mhvm,
- .hvm_altp2mhvm_op = xsm_hvm_altp2mhvm_op,
.do_xsm_op = xsm_do_xsm_op,
#ifdef CONFIG_COMPAT
.do_compat_op = xsm_do_compat_op,
#endif
- .add_to_physmap = xsm_add_to_physmap,
- .remove_from_physmap = xsm_remove_from_physmap,
- .map_gmfn_foreign = xsm_map_gmfn_foreign,
-
-#ifdef CONFIG_VM_EVENT
- .mem_access = xsm_mem_access,
-#endif
-
-#ifdef CONFIG_MEM_PAGING
- .mem_paging = xsm_mem_paging,
-#endif
-
-#ifdef CONFIG_MEM_SHARING
- .mem_sharing = xsm_mem_sharing,
-#endif
-
- .platform_op = xsm_platform_op,
-#ifdef CONFIG_X86
- .do_mca = xsm_do_mca,
- .mem_sharing_op = xsm_mem_sharing_op,
- .apic = xsm_apic,
- .machine_memory_map = xsm_machine_memory_map,
- .domain_memory_map = xsm_domain_memory_map,
- .mmu_update = xsm_mmu_update,
- .mmuext_op = xsm_mmuext_op,
- .update_va_mapping = xsm_update_va_mapping,
- .priv_mapping = xsm_priv_mapping,
- .ioport_permission = xsm_ioport_permission,
- .ioport_mapping = xsm_ioport_mapping,
- .pmu_op = xsm_pmu_op,
-#endif
- .dm_op = xsm_dm_op,
- .xen_version = xsm_xen_version,
- .domain_resource_map = xsm_domain_resource_map,
#ifdef CONFIG_ARGO
.argo_enable = xsm_argo_enable,
.argo_register_single_source = xsm_argo_register_single_source,
.argo_register_any_source = xsm_argo_register_any_source,
.argo_send = xsm_argo_send,
#endif
- .get_domain_state = xsm_get_domain_state,
};
void __init xsm_fixup_ops(struct xsm_ops *ops)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1215,6 +1215,7 @@ static int cf_check flask_iomem_mapping(
{
return flask_iomem_permission(d, start, end, access);
}
+#define flask_iomem_mapping_vpci flask_iomem_mapping
static int cf_check flask_pci_config_permission(
struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end,
@@ -1713,6 +1714,7 @@ static int cf_check flask_ioport_mapping
return flask_ioport_permission(d, start, end, access);
}
+#ifdef CONFIG_MEM_SHARING
static int cf_check flask_mem_sharing_op(
struct domain *d, struct domain *cd, int op)
{
@@ -1721,6 +1723,7 @@ static int cf_check flask_mem_sharing_op
return rc;
return domain_has_perm(d, cd, SECCLASS_HVM, HVM__SHARE_MEM);
}
+#endif
static int cf_check flask_apic(struct domain *d, int cmd)
{
@@ -1911,125 +1914,38 @@ static int cf_check flask_get_domain_sta
static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.set_system_active = flask_set_system_active,
.security_domaininfo = flask_security_domaininfo,
- .domain_create = flask_domain_create,
- .getdomaininfo = flask_getdomaininfo,
- .set_target = flask_set_target,
- .domctl = flask_domctl,
-#ifdef CONFIG_SYSCTL
- .sysctl = flask_sysctl,
-#endif
- .evtchn_unbound = flask_evtchn_unbound,
- .evtchn_interdomain = flask_evtchn_interdomain,
+#define XSM_HOOK0(rtype, name) .name = flask_ ## name,
+#define XSM_HOOK1(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK2(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK3(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK4(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK5(rtype, name, ...) XSM_HOOK0(rtype, name)
+
+#include <xsm/hooks.h>
+
.evtchn_close_post = flask_evtchn_close_post,
- .evtchn_send = flask_evtchn_send,
- .evtchn_status = flask_evtchn_status,
- .evtchn_reset = flask_evtchn_reset,
-
- .grant_mapref = flask_grant_mapref,
- .grant_unmapref = flask_grant_unmapref,
- .grant_setup = flask_grant_setup,
- .grant_transfer = flask_grant_transfer,
- .grant_copy = flask_grant_copy,
- .grant_query_size = flask_grant_query_size,
.alloc_security_domain = flask_domain_alloc_security,
.free_security_domain = flask_domain_free_security,
.alloc_security_evtchns = flask_alloc_security_evtchns,
.free_security_evtchns = flask_free_security_evtchns,
.show_security_evtchn = flask_show_security_evtchn,
- .init_hardware_domain = flask_init_hardware_domain,
-
- .get_pod_target = flask_get_pod_target,
- .set_pod_target = flask_set_pod_target,
- .memory_exchange = flask_memory_exchange,
- .memory_adjust_reservation = flask_memory_adjust_reservation,
- .memory_stat_reservation = flask_memory_stat_reservation,
- .memory_pin_page = flask_memory_pin_page,
- .claim_pages = flask_claim_pages,
-
- .console_io = flask_console_io,
-
- .kexec = flask_kexec,
- .schedop_shutdown = flask_schedop_shutdown,
.show_irq_sid = flask_show_irq_sid,
- .map_domain_pirq = flask_map_domain_pirq,
- .map_domain_irq = flask_map_domain_irq,
- .unmap_domain_pirq = flask_unmap_domain_pirq,
- .unmap_domain_irq = flask_unmap_domain_irq,
- .bind_pt_irq = flask_bind_pt_irq,
- .unbind_pt_irq = flask_unbind_pt_irq,
- .irq_permission = flask_irq_permission,
- .iomem_permission = flask_iomem_permission,
- .iomem_mapping = flask_iomem_mapping,
- .iomem_mapping_vpci = flask_iomem_mapping,
- .pci_config_permission = flask_pci_config_permission,
-
- .resource_plug_pci = flask_resource_plug_pci,
- .resource_unplug_pci = flask_resource_unplug_pci,
- .resource_setup_pci = flask_resource_setup_pci,
- .resource_setup_gsi = flask_resource_setup_gsi,
- .resource_setup_misc = flask_resource_setup_misc,
-
- .hypfs_op = flask_hypfs_op,
- .hvm_param = flask_hvm_param,
- .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm,
- .hvm_altp2mhvm_op = flask_hvm_altp2mhvm_op,
-
.do_xsm_op = do_flask_op,
- .get_vnumainfo = flask_get_vnumainfo,
-
-#ifdef CONFIG_VM_EVENT
- .mem_access = flask_mem_access,
-#endif
-
-#ifdef CONFIG_MEM_PAGING
- .mem_paging = flask_mem_paging,
-#endif
-
-#ifdef CONFIG_MEM_SHARING
- .mem_sharing = flask_mem_sharing,
-#endif
#ifdef CONFIG_COMPAT
.do_compat_op = compat_flask_op,
#endif
- .add_to_physmap = flask_add_to_physmap,
- .remove_from_physmap = flask_remove_from_physmap,
- .map_gmfn_foreign = flask_map_gmfn_foreign,
-
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
- .get_device_group = flask_get_device_group,
-#endif
-
- .platform_op = flask_platform_op,
-#ifdef CONFIG_X86
- .do_mca = flask_do_mca,
- .mem_sharing_op = flask_mem_sharing_op,
- .apic = flask_apic,
- .machine_memory_map = flask_machine_memory_map,
- .domain_memory_map = flask_domain_memory_map,
- .mmu_update = flask_mmu_update,
- .mmuext_op = flask_mmuext_op,
- .update_va_mapping = flask_update_va_mapping,
- .priv_mapping = flask_priv_mapping,
- .ioport_permission = flask_ioport_permission,
- .ioport_mapping = flask_ioport_mapping,
- .pmu_op = flask_pmu_op,
-#endif
- .dm_op = flask_dm_op,
- .xen_version = flask_xen_version,
- .domain_resource_map = flask_domain_resource_map,
#ifdef CONFIG_ARGO
.argo_enable = flask_argo_enable,
.argo_register_single_source = flask_argo_register_single_source,
.argo_register_any_source = flask_argo_register_any_source,
.argo_send = flask_argo_send,
#endif
- .get_domain_state = flask_get_domain_state,
};
const struct xsm_ops *__init flask_init(
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 02/24] XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
2026-07-28 13:13 ` [PATCH 01/24] XSM: reduce redundancy in hook machinery Jan Beulich
@ 2026-07-28 13:14 ` Jan Beulich
2026-07-28 13:14 ` [PATCH 03/24] XSM: make .{,un}map_domain_pirq() hooks dependent upon HAS_PIRQ=y Jan Beulich
` (21 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:14 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -191,6 +191,8 @@ static XSM_INLINE void cf_check xsm_free
return;
}
+#ifdef CONFIG_GRANT_TABLE
+
static XSM_INLINE int cf_check xsm_grant_mapref(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2, uint32_t flags)
{
@@ -233,6 +235,8 @@ static XSM_INLINE int cf_check xsm_grant
return xsm_default_action(action, d1, d2);
}
+#endif /* CONFIG_GRANT_TABLE */
+
static XSM_INLINE int cf_check xsm_memory_exchange(
XSM_DEFAULT_ARG struct domain *d)
{
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -35,12 +35,14 @@ XSM_HOOK(int, evtchn_send, struct domain
XSM_HOOK(int, evtchn_status, struct domain *, struct evtchn *)
XSM_HOOK(int, evtchn_reset, struct domain *, struct domain *)
+#ifdef CONFIG_GRANT_TABLE
XSM_HOOK(int, grant_mapref, struct domain *, struct domain *, uint32_t)
XSM_HOOK(int, grant_unmapref, struct domain *, struct domain *)
XSM_HOOK(int, grant_setup, struct domain *, struct domain *)
XSM_HOOK(int, grant_transfer, struct domain *, struct domain *)
XSM_HOOK(int, grant_copy, struct domain *, struct domain *)
XSM_HOOK(int, grant_query_size, struct domain *, struct domain *)
+#endif
XSM_HOOK(int, init_hardware_domain, struct domain *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -434,6 +434,8 @@ static int cf_check flask_init_hardware_
return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CREATE_HARDWARE_DOMAIN);
}
+#ifdef CONFIG_GRANT_TABLE
+
static int cf_check flask_grant_mapref(
struct domain *d1, struct domain *d2, uint32_t flags)
{
@@ -470,6 +472,8 @@ static int cf_check flask_grant_query_si
return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__QUERY);
}
+#endif /* CONFIG_GRANT_TABLE */
+
static int cf_check flask_get_pod_target(struct domain *d)
{
return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETPODTARGET);
--- a/xen/xsm/silo.c
+++ b/xen/xsm/silo.c
@@ -60,6 +60,8 @@ static int cf_check silo_evtchn_interdom
return -EPERM;
}
+#ifdef CONFIG_GRANT_TABLE
+
static int cf_check silo_grant_mapref(
struct domain *d1, struct domain *d2, uint32_t flags)
{
@@ -82,6 +84,8 @@ static int cf_check silo_grant_copy(stru
return -EPERM;
}
+#endif /* CONFIG_GRANT_TABLE */
+
#ifdef CONFIG_ARGO
static int cf_check silo_argo_register_single_source(
@@ -105,9 +109,11 @@ static int cf_check silo_argo_send(
static const struct xsm_ops __initconst_cf_clobber silo_xsm_ops = {
.evtchn_unbound = silo_evtchn_unbound,
.evtchn_interdomain = silo_evtchn_interdomain,
+#ifdef CONFIG_GRANT_TABLE
.grant_mapref = silo_grant_mapref,
.grant_transfer = silo_grant_transfer,
.grant_copy = silo_grant_copy,
+#endif
#ifdef CONFIG_ARGO
.argo_register_single_source = silo_argo_register_single_source,
.argo_send = silo_argo_send,
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 03/24] XSM: make .{,un}map_domain_pirq() hooks dependent upon HAS_PIRQ=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
2026-07-28 13:13 ` [PATCH 01/24] XSM: reduce redundancy in hook machinery Jan Beulich
2026-07-28 13:14 ` [PATCH 02/24] XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y Jan Beulich
@ 2026-07-28 13:14 ` Jan Beulich
2026-07-28 13:14 ` [PATCH 04/24] XSM: make PCI hooks dependent upon HAS_PCI=y Jan Beulich
` (20 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:14 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -450,6 +450,8 @@ static XSM_INLINE char *cf_check xsm_sho
return NULL;
}
+#ifdef CONFIG_HAS_PIRQ
+
static XSM_INLINE int cf_check xsm_map_domain_pirq(
XSM_DEFAULT_ARG struct domain *d)
{
@@ -457,17 +459,19 @@ static XSM_INLINE int cf_check xsm_map_d
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_map_domain_irq(
- XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
+static XSM_INLINE int cf_check xsm_unmap_domain_pirq(
+ XSM_DEFAULT_ARG struct domain *d)
{
- XSM_ASSERT_ACTION(XSM_HOOK);
+ XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_unmap_domain_pirq(
- XSM_DEFAULT_ARG struct domain *d)
+#endif /* CONFIG_HAS_PIRQ */
+
+static XSM_INLINE int cf_check xsm_map_domain_irq(
+ XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
{
- XSM_ASSERT_ACTION(XSM_DM_PRIV);
+ XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -65,9 +65,12 @@ XSM_HOOK(int, kexec)
XSM_HOOK(int, schedop_shutdown, struct domain *, struct domain *)
+#ifdef CONFIG_HAS_PIRQ
XSM_HOOK(int, map_domain_pirq, struct domain *)
-XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
XSM_HOOK(int, unmap_domain_pirq, struct domain *)
+#endif
+
+XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const void *)
XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1018,11 +1018,20 @@ static char *cf_check flask_show_irq_sid
return ctx;
}
+#ifdef CONFIG_HAS_PIRQ
+
static int cf_check flask_map_domain_pirq(struct domain *d)
{
return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__ADD);
}
+static int cf_check flask_unmap_domain_pirq(struct domain *d)
+{
+ return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
+}
+
+#endif /* CONFIG_HAS_PIRQ */
+
static int flask_map_domain_msi (
struct domain *d, int irq, const void *data, uint32_t *sid,
struct avc_audit_data *ad)
@@ -1085,11 +1094,6 @@ static int cf_check flask_map_domain_irq
return rc;
}
-static int cf_check flask_unmap_domain_pirq(struct domain *d)
-{
- return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
-}
-
static int flask_unmap_domain_msi (
struct domain *d, int irq, const void *data, uint32_t *sid,
struct avc_audit_data *ad)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 04/24] XSM: make PCI hooks dependent upon HAS_PCI=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (2 preceding siblings ...)
2026-07-28 13:14 ` [PATCH 03/24] XSM: make .{,un}map_domain_pirq() hooks dependent upon HAS_PIRQ=y Jan Beulich
@ 2026-07-28 13:14 ` Jan Beulich
2026-07-28 13:15 ` [PATCH 05/24] XSM: make .iomem_mapping_vcpi() hook dependent upon HAS_VPCI=y Jan Beulich
` (19 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:14 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're unreachable / dead otherwise. Really resource_{,un}plug_pci() is
further limited to PCI pass-through.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -394,6 +394,8 @@ static XSM_INLINE int cf_check xsm_get_d
}
#endif /* HAS_PASSTHROUGH && HAS_PCI */
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+
static XSM_INLINE int cf_check xsm_resource_plug_pci(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
@@ -408,6 +410,10 @@ static XSM_INLINE int cf_check xsm_resou
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_HAS_PCI */
+
+#ifdef CONFIG_HAS_PCI
+
static XSM_INLINE int cf_check xsm_resource_setup_pci(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
@@ -421,6 +427,8 @@ static XSM_INLINE int cf_check xsm_resou
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_HAS_PCI */
+
static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -524,6 +532,7 @@ static XSM_INLINE int cf_check xsm_iomem
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_HAS_PCI
static XSM_INLINE int cf_check xsm_pci_config_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start,
uint16_t end, uint8_t access)
@@ -531,6 +540,7 @@ static XSM_INLINE int cf_check xsm_pci_c
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
+#endif /* CONFIG_HAS_PCI */
static XSM_INLINE int cf_check xsm_add_to_physmap(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -77,21 +77,24 @@ XSM_HOOK(int, unbind_pt_irq, struct doma
XSM_HOOK(int, irq_permission, struct domain *, int, uint8_t)
XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, uint8_t)
-XSM_HOOK(int, pci_config_permission, struct domain *, uint32_t, uint16_t,
- uint16_t, uint8_t)
XSM_HOOK(int, iomem_mapping, struct domain *, uint64_t, uint64_t, uint8_t)
XSM_HOOK(int, iomem_mapping_vpci, struct domain *, uint64_t, uint64_t, uint8_t)
#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+XSM_HOOK(int, resource_plug_pci, uint32_t)
+XSM_HOOK(int, resource_unplug_pci, uint32_t)
XSM_HOOK(int, get_device_group, uint32_t)
#endif
-XSM_HOOK(int, resource_plug_pci, uint32_t)
-XSM_HOOK(int, resource_unplug_pci, uint32_t)
+XSM_HOOK(int, resource_setup_misc)
+
+#ifdef CONFIG_HAS_PCI
XSM_HOOK(int, resource_setup_pci, uint32_t)
XSM_HOOK(int, resource_setup_gsi, int)
-XSM_HOOK(int, resource_setup_misc)
+XSM_HOOK(int, pci_config_permission, struct domain *, uint32_t, uint16_t,
+ uint16_t, uint8_t)
+#endif
XSM_HOOK(int, hypfs_op)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1225,6 +1225,7 @@ static int cf_check flask_iomem_mapping(
}
#define flask_iomem_mapping_vpci flask_iomem_mapping
+#ifdef CONFIG_HAS_PCI
static int cf_check flask_pci_config_permission(
struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end,
uint8_t access)
@@ -1250,6 +1251,7 @@ static int cf_check flask_pci_config_per
return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, perm, &ad);
}
+#endif /* CONFIG_HAS_PCI */
#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86)
static int flask_resource_plug_core(void)
@@ -1270,6 +1272,8 @@ static int flask_resource_use_core(void)
}
#endif /* CONFIG_SYSCTL */
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+
static int cf_check flask_resource_plug_pci(uint32_t machine_bdf)
{
uint32_t rsid;
@@ -1300,6 +1304,10 @@ static int cf_check flask_resource_unplu
return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__UNPLUG, &ad);
}
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_HAS_PCI */
+
+#ifdef CONFIG_HAS_PCI
+
static int cf_check flask_resource_setup_pci(uint32_t machine_bdf)
{
uint32_t rsid;
@@ -1328,6 +1336,8 @@ static int cf_check flask_resource_setup
return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__SETUP, &ad);
}
+#endif /* CONFIG_HAS_PCI */
+
static int cf_check flask_resource_setup_misc(void)
{
return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 05/24] XSM: make .iomem_mapping_vcpi() hook dependent upon HAS_VPCI=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (3 preceding siblings ...)
2026-07-28 13:14 ` [PATCH 04/24] XSM: make PCI hooks dependent upon HAS_PCI=y Jan Beulich
@ 2026-07-28 13:15 ` Jan Beulich
2026-07-28 13:15 ` [PATCH 06/24] XSM: make .kexec() hook dependent upon KEXEC=y Jan Beulich
` (18 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:15 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
It's unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -525,12 +525,14 @@ static XSM_INLINE int cf_check xsm_iomem
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_HAS_VPCI
static XSM_INLINE int cf_check xsm_iomem_mapping_vpci(
XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
+#endif
#ifdef CONFIG_HAS_PCI
static XSM_INLINE int cf_check xsm_pci_config_permission(
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -79,7 +79,9 @@ XSM_HOOK(int, irq_permission, struct dom
XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, uint8_t)
XSM_HOOK(int, iomem_mapping, struct domain *, uint64_t, uint64_t, uint8_t)
+#ifdef CONFIG_HAS_VPCI
XSM_HOOK(int, iomem_mapping_vpci, struct domain *, uint64_t, uint64_t, uint8_t)
+#endif
#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
XSM_HOOK(int, resource_plug_pci, uint32_t)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 06/24] XSM: make .kexec() hook dependent upon KEXEC=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (4 preceding siblings ...)
2026-07-28 13:15 ` [PATCH 05/24] XSM: make .iomem_mapping_vcpi() hook dependent upon HAS_VPCI=y Jan Beulich
@ 2026-07-28 13:15 ` Jan Beulich
2026-07-28 13:15 ` [PATCH 07/24] XSM: make .hypfs() hook dependent upon HYPFS=y Jan Beulich
` (17 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:15 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
It's unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -271,11 +271,13 @@ static XSM_INLINE int cf_check xsm_conso
return xsm_default_action(XSM_PRIV, d, NULL);
}
+#ifdef CONFIG_KEXEC
static XSM_INLINE int cf_check xsm_kexec(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
+#endif
static XSM_INLINE int cf_check xsm_schedop_shutdown(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -61,7 +61,9 @@ XSM_HOOK(int, claim_pages, struct domain
XSM_HOOK(int, console_io, struct domain *, int)
+#ifdef CONFIG_KEXEC
XSM_HOOK(int, kexec)
+#endif
XSM_HOOK(int, schedop_shutdown, struct domain *, struct domain *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -536,10 +536,12 @@ static int cf_check flask_console_io(str
return domain_has_xen(d, perm);
}
+#ifdef CONFIG_KEXEC
static int cf_check flask_kexec(void)
{
return domain_has_xen(current->domain, XEN__KEXEC);
}
+#endif
static int cf_check flask_schedop_shutdown(struct domain *d1, struct domain *d2)
{
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 07/24] XSM: make .hypfs() hook dependent upon HYPFS=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (5 preceding siblings ...)
2026-07-28 13:15 ` [PATCH 06/24] XSM: make .kexec() hook dependent upon KEXEC=y Jan Beulich
@ 2026-07-28 13:15 ` Jan Beulich
2026-07-28 13:16 ` [PATCH 08/24] XSM: make .hvm_altp2mhvm_op() hook dependent upon ALTP2M=y Jan Beulich
` (16 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:15 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
It's unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -437,11 +437,13 @@ static XSM_INLINE int cf_check xsm_resou
return xsm_default_action(action, current->domain, NULL);
}
+#ifdef CONFIG_HYPFS
static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
+#endif
static XSM_INLINE long cf_check xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -100,7 +100,9 @@ XSM_HOOK(int, pci_config_permission, str
uint16_t, uint8_t)
#endif
+#ifdef CONFIG_HYPFS
XSM_HOOK(int, hypfs_op)
+#endif
XSM_HOOK(int, hvm_param, struct domain *, unsigned long)
XSM_HOOK(int, hvm_param_altp2mhvm, struct domain *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1345,10 +1345,12 @@ static int cf_check flask_resource_setup
return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL);
}
+#ifdef CONFIG_HYPFS
static inline int cf_check flask_hypfs_op(void)
{
return domain_has_xen(current->domain, XEN__HYPFS_OP);
}
+#endif
static int cf_check flask_add_to_physmap(struct domain *d1, struct domain *d2)
{
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 08/24] XSM: make .hvm_altp2mhvm_op() hook dependent upon ALTP2M=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (6 preceding siblings ...)
2026-07-28 13:15 ` [PATCH 07/24] XSM: make .hypfs() hook dependent upon HYPFS=y Jan Beulich
@ 2026-07-28 13:16 ` Jan Beulich
2026-07-28 13:17 ` [PATCH 09/24] XSM: make .hvm_param*() hooks dependent upon HVM=y Jan Beulich
` (15 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:16 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
It's unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -583,6 +583,7 @@ static XSM_INLINE int cf_check xsm_hvm_p
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_ALTP2M
static XSM_INLINE int cf_check xsm_hvm_altp2mhvm_op(
XSM_DEFAULT_ARG struct domain *d, uint64_t mode, uint32_t op)
{
@@ -602,6 +603,7 @@ static XSM_INLINE int cf_check xsm_hvm_a
return -EPERM;
}
}
+#endif /* CONFIG_ALTP2M */
#ifdef CONFIG_VM_EVENT
static XSM_INLINE int cf_check xsm_mem_access(XSM_DEFAULT_ARG struct domain *d)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -106,7 +106,11 @@ XSM_HOOK(int, hypfs_op)
XSM_HOOK(int, hvm_param, struct domain *, unsigned long)
XSM_HOOK(int, hvm_param_altp2mhvm, struct domain *)
+
+#ifdef CONFIG_ALTP2M
XSM_HOOK(int, hvm_altp2mhvm_op, struct domain *, uint64_t, uint32_t)
+#endif
+
XSM_HOOK(int, get_vnumainfo, struct domain *)
#ifdef CONFIG_VM_EVENT
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1393,6 +1393,7 @@ static int cf_check flask_hvm_param_altp
return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM);
}
+#ifdef CONFIG_ALTP2M
static int cf_check flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op)
{
/*
@@ -1416,6 +1417,7 @@ static int cf_check flask_hvm_altp2mhvm_
return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP);
}
+#endif /* CONFIG_ALTP2M */
#ifdef CONFIG_VM_EVENT
static int cf_check flask_mem_access(struct domain *d)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 09/24] XSM: make .hvm_param*() hooks dependent upon HVM=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (7 preceding siblings ...)
2026-07-28 13:16 ` [PATCH 08/24] XSM: make .hvm_altp2mhvm_op() hook dependent upon ALTP2M=y Jan Beulich
@ 2026-07-28 13:17 ` Jan Beulich
2026-07-28 13:17 ` [PATCH 10/24] XSM: make .dm_op() hook dependent upon IOREQ_SERVER=y Jan Beulich
` (14 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:17 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Strictly speaking .hvm_param_altp2mhvm() is dependent upon X86=y as well
(but oddly not dependent upon ALTP2M=y).
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -569,6 +569,8 @@ static XSM_INLINE int cf_check xsm_map_g
return xsm_default_action(action, d, t);
}
+#ifdef CONFIG_HVM
+
static XSM_INLINE int cf_check xsm_hvm_param(
XSM_DEFAULT_ARG struct domain *d, unsigned long op)
{
@@ -583,6 +585,8 @@ static XSM_INLINE int cf_check xsm_hvm_p
return xsm_default_action(action, current->domain, d);
}
+#endif /* CONFIG_HVM */
+
#ifdef CONFIG_ALTP2M
static XSM_INLINE int cf_check xsm_hvm_altp2mhvm_op(
XSM_DEFAULT_ARG struct domain *d, uint64_t mode, uint32_t op)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -104,8 +104,10 @@ XSM_HOOK(int, pci_config_permission, str
XSM_HOOK(int, hypfs_op)
#endif
+#ifdef CONFIG_HVM
XSM_HOOK(int, hvm_param, struct domain *, unsigned long)
XSM_HOOK(int, hvm_param_altp2mhvm, struct domain *)
+#endif
#ifdef CONFIG_ALTP2M
XSM_HOOK(int, hvm_altp2mhvm_op, struct domain *, uint64_t, uint32_t)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1368,6 +1368,8 @@ static int cf_check flask_map_gmfn_forei
return domain_has_perm(d, t, SECCLASS_MMU, MMU__MAP_READ | MMU__MAP_WRITE);
}
+#ifdef CONFIG_HVM
+
static int cf_check flask_hvm_param(struct domain *d, unsigned long op)
{
uint32_t perm;
@@ -1393,6 +1395,8 @@ static int cf_check flask_hvm_param_altp
return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM);
}
+#endif /* CONFIG_HVM */
+
#ifdef CONFIG_ALTP2M
static int cf_check flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op)
{
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 10/24] XSM: make .dm_op() hook dependent upon IOREQ_SERVER=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (8 preceding siblings ...)
2026-07-28 13:17 ` [PATCH 09/24] XSM: make .hvm_param*() hooks dependent upon HVM=y Jan Beulich
@ 2026-07-28 13:17 ` Jan Beulich
2026-07-28 13:18 ` [PATCH 11/24] XSM: make certain x86-specific hooks dependent upon PV=y Jan Beulich
` (13 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:17 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
It's unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -739,11 +739,13 @@ static XSM_INLINE int cf_check xsm_pmu_o
#endif /* CONFIG_X86 */
+#ifdef CONFIG_IOREQ_SERVER
static XSM_INLINE int cf_check xsm_dm_op(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
+#endif
#ifdef CONFIG_ARGO
static XSM_INLINE int cf_check xsm_argo_enable(const struct domain *d)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -145,7 +145,10 @@ XSM_HOOK(int, ioport_mapping, struct dom
XSM_HOOK(int, pmu_op, struct domain *, unsigned int)
#endif /* CONFIG_X86 */
+#ifdef CONFIG_IOREQ_SERVER
XSM_HOOK(int, dm_op, struct domain *)
+#endif
+
XSM_HOOK(int, xen_version, uint32_t)
XSM_HOOK(int, domain_resource_map, struct domain *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1852,10 +1852,12 @@ static int cf_check flask_pmu_op(struct
}
#endif /* CONFIG_X86 */
+#ifdef CONFIG_IOREQ_SERVER
static int cf_check flask_dm_op(struct domain *d)
{
return current_has_perm(d, SECCLASS_HVM, HVM__DM);
}
+#endif
static int cf_check flask_xen_version(uint32_t op)
{
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 11/24] XSM: make certain x86-specific hooks dependent upon PV=y
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (9 preceding siblings ...)
2026-07-28 13:17 ` [PATCH 10/24] XSM: make .dm_op() hook dependent upon IOREQ_SERVER=y Jan Beulich
@ 2026-07-28 13:18 ` Jan Beulich
2026-07-28 13:18 ` [PATCH 12/24] x86/mm: get_page_from_l1e() is PV-or-shadow-only Jan Beulich
` (12 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:18 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're unreachable / dead otherwise.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -640,11 +640,6 @@ static XSM_INLINE int cf_check xsm_platf
}
#ifdef CONFIG_X86
-static XSM_INLINE int cf_check xsm_do_mca(XSM_DEFAULT_VOID)
-{
- XSM_ASSERT_ACTION(XSM_PRIV);
- return xsm_default_action(action, current->domain, NULL);
-}
static XSM_INLINE int cf_check xsm_mem_sharing_op(
XSM_DEFAULT_ARG struct domain *d, struct domain *cd, int op)
@@ -673,6 +668,14 @@ static XSM_INLINE int cf_check xsm_domai
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_PV
+
+static XSM_INLINE int cf_check xsm_do_mca(XSM_DEFAULT_VOID)
+{
+ XSM_ASSERT_ACTION(XSM_PRIV);
+ return xsm_default_action(action, current->domain, NULL);
+}
+
static XSM_INLINE int cf_check xsm_mmu_update(
XSM_DEFAULT_ARG struct domain *d, struct domain *t, struct domain *f,
uint32_t flags)
@@ -700,6 +703,8 @@ static XSM_INLINE int cf_check xsm_updat
return xsm_default_action(action, d, f);
}
+#endif /* CONFIG_PV */
+
static XSM_INLINE int cf_check xsm_priv_mapping(
XSM_DEFAULT_ARG struct domain *d, struct domain *t)
{
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -131,14 +131,16 @@ XSM_HOOK(int, mem_sharing_op, struct dom
XSM_HOOK(int, platform_op, uint32_t)
#ifdef CONFIG_X86
-XSM_HOOK(int, do_mca)
XSM_HOOK(int, apic, struct domain *, int)
XSM_HOOK(int, machine_memory_map)
XSM_HOOK(int, domain_memory_map, struct domain *)
+#ifdef CONFIG_PV
+XSM_HOOK(int, do_mca)
XSM_HOOK(int, mmu_update, struct domain *, struct domain *, struct domain *,
uint32_t)
XSM_HOOK(int, mmuext_op, struct domain *, struct domain *)
XSM_HOOK(int, update_va_mapping, struct domain *, struct domain *, l1_pgentry_t)
+#endif /* CONFIG_PV */
XSM_HOOK(int, priv_mapping, struct domain *, struct domain *)
XSM_HOOK(int, ioport_permission, struct domain *, uint32_t, uint32_t, uint8_t)
XSM_HOOK(int, ioport_mapping, struct domain *, uint32_t, uint32_t, uint8_t)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1654,10 +1654,6 @@ static int cf_check flask_platform_op(ui
}
#ifdef CONFIG_X86
-static int cf_check flask_do_mca(void)
-{
- return domain_has_xen(current->domain, XEN__MCA_OP);
-}
static int flask_shadow_control(struct domain *d, unsigned int op)
{
@@ -1783,6 +1779,13 @@ static int cf_check flask_domain_memory_
return current_has_perm(d, SECCLASS_MMU, MMU__MEMORYMAP);
}
+#ifdef CONFIG_PV
+
+static int cf_check flask_do_mca(void)
+{
+ return domain_has_xen(current->domain, XEN__MCA_OP);
+}
+
static int cf_check flask_mmu_update(
struct domain *d, struct domain *t, struct domain *f, uint32_t flags)
{
@@ -1823,6 +1826,8 @@ static int cf_check flask_update_va_mapp
return domain_has_perm(d, f, SECCLASS_MMU, map_perms);
}
+#endif /* CONFIG_PV */
+
static int cf_check flask_priv_mapping(struct domain *d, struct domain *t)
{
return domain_has_perm(d, t, SECCLASS_MMU, MMU__TARGET_HACK);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 12/24] x86/mm: get_page_from_l1e() is PV-or-shadow-only
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (10 preceding siblings ...)
2026-07-28 13:18 ` [PATCH 11/24] XSM: make certain x86-specific hooks dependent upon PV=y Jan Beulich
@ 2026-07-28 13:18 ` Jan Beulich
2026-07-28 13:19 ` [PATCH 13/24] x86: restrict PHYSDEVOP_* when PV=n Jan Beulich
` (11 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:18 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné
Otherwise the function is unreachable, violating MISRA C:2012 rule 2.1.
With the function compiled out, its dedicated XSM hook also becomes
unreachable, so it is similarly guarded.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
It feels suspicious that the .priv_mapping() check is used for HVM guests
in shadow mode, but not for ones in HAP mode.
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -837,6 +837,8 @@ static int cf_check print_mmio_emul_rang
}
#endif
+#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
+
/*
* get_page_from_l1e returns:
* 0 => success (page not present also counts as such)
@@ -1038,6 +1040,8 @@ get_page_from_l1e(
return -EBUSY;
}
+#endif /* CONFIG_PV || CONFIG_SHADOW_PAGING */
+
/*
* The following flags are used to specify behavior of various get and
* put commands. The first is also stored in page->partial_flags to
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -705,12 +705,14 @@ static XSM_INLINE int cf_check xsm_updat
#endif /* CONFIG_PV */
+#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
static XSM_INLINE int cf_check xsm_priv_mapping(
XSM_DEFAULT_ARG struct domain *d, struct domain *t)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d, t);
}
+#endif
static XSM_INLINE int cf_check xsm_ioport_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -141,7 +141,9 @@ XSM_HOOK(int, mmu_update, struct domain
XSM_HOOK(int, mmuext_op, struct domain *, struct domain *)
XSM_HOOK(int, update_va_mapping, struct domain *, struct domain *, l1_pgentry_t)
#endif /* CONFIG_PV */
+#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
XSM_HOOK(int, priv_mapping, struct domain *, struct domain *)
+#endif
XSM_HOOK(int, ioport_permission, struct domain *, uint32_t, uint32_t, uint8_t)
XSM_HOOK(int, ioport_mapping, struct domain *, uint32_t, uint32_t, uint8_t)
XSM_HOOK(int, pmu_op, struct domain *, unsigned int)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1828,10 +1828,12 @@ static int cf_check flask_update_va_mapp
#endif /* CONFIG_PV */
+#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
static int cf_check flask_priv_mapping(struct domain *d, struct domain *t)
{
return domain_has_perm(d, t, SECCLASS_MMU, MMU__TARGET_HACK);
}
+#endif
static int cf_check flask_pmu_op(struct domain *d, unsigned int op)
{
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 13/24] x86: restrict PHYSDEVOP_* when PV=n
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (11 preceding siblings ...)
2026-07-28 13:18 ` [PATCH 12/24] x86/mm: get_page_from_l1e() is PV-or-shadow-only Jan Beulich
@ 2026-07-28 13:19 ` Jan Beulich
2026-07-28 13:19 ` [PATCH 14/24] XSM/dummy: fold cf_check into XSM_INLINE Jan Beulich
` (10 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:19 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné
hvm_physdev_op() permits through only a subset of sub-ops. The code
handling other sub-ops is therefore unreachable when PV=n, violating MISRA
C:2012 rule 2.1. With that the XSM .apic() hook also becomes unreachable /
dead when PV=n.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
At least for the sub-ops using xsm_apic() IS_ENABLED() cannot be used.
Therefore #ifdef is used throughout.
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -233,6 +233,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#ifdef CONFIG_PV
+
case PHYSDEVOP_pirq_eoi_gmfn_v2:
case PHYSDEVOP_pirq_eoi_gmfn_v1: {
struct physdev_pirq_eoi_gmfn info;
@@ -281,6 +283,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#endif /* CONFIG_PV */
+
case PHYSDEVOP_irq_status_query: {
struct physdev_irq_status_query irq_status_query;
ret = -EFAULT;
@@ -379,6 +383,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#ifdef CONFIG_PV
+
case PHYSDEVOP_apic_read: {
struct physdev_apic apic;
ret = -EFAULT;
@@ -524,6 +530,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#endif /* CONFIG_PV */
+
case PHYSDEVOP_pci_mmcfg_reserved: {
struct physdev_pci_mmcfg_reserved info;
@@ -558,6 +566,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#ifdef CONFIG_PV
+
case PHYSDEVOP_restore_msi: {
struct physdev_restore_msi restore_msi;
struct pci_dev *pdev;
@@ -589,6 +599,8 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
break;
}
+#endif /* CONFIG_PV */
+
case PHYSDEVOP_setup_gsi: {
struct physdev_setup_gsi setup_gsi;
@@ -608,6 +620,7 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
setup_gsi.polarity);
break;
}
+
case PHYSDEVOP_get_free_pirq: {
struct physdev_get_free_pirq out;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -648,13 +648,6 @@ static XSM_INLINE int cf_check xsm_mem_s
return xsm_default_action(action, current->domain, cd);
}
-static XSM_INLINE int cf_check xsm_apic(
- XSM_DEFAULT_ARG struct domain *d, int cmd)
-{
- XSM_ASSERT_ACTION(XSM_PRIV);
- return xsm_default_action(action, d, NULL);
-}
-
static XSM_INLINE int cf_check xsm_machine_memory_map(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -670,6 +663,13 @@ static XSM_INLINE int cf_check xsm_domai
#ifdef CONFIG_PV
+static XSM_INLINE int cf_check xsm_apic(
+ XSM_DEFAULT_ARG struct domain *d, int cmd)
+{
+ XSM_ASSERT_ACTION(XSM_PRIV);
+ return xsm_default_action(action, d, NULL);
+}
+
static XSM_INLINE int cf_check xsm_do_mca(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -131,10 +131,10 @@ XSM_HOOK(int, mem_sharing_op, struct dom
XSM_HOOK(int, platform_op, uint32_t)
#ifdef CONFIG_X86
-XSM_HOOK(int, apic, struct domain *, int)
XSM_HOOK(int, machine_memory_map)
XSM_HOOK(int, domain_memory_map, struct domain *)
#ifdef CONFIG_PV
+XSM_HOOK(int, apic, struct domain *, int)
XSM_HOOK(int, do_mca)
XSM_HOOK(int, mmu_update, struct domain *, struct domain *, struct domain *,
uint32_t)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1749,6 +1749,19 @@ static int cf_check flask_mem_sharing_op
}
#endif
+static int cf_check flask_machine_memory_map(void)
+{
+ return avc_current_has_perm(SECINITSID_XEN, SECCLASS_MMU, MMU__MEMORYMAP,
+ NULL);
+}
+
+static int cf_check flask_domain_memory_map(struct domain *d)
+{
+ return current_has_perm(d, SECCLASS_MMU, MMU__MEMORYMAP);
+}
+
+#ifdef CONFIG_PV
+
static int cf_check flask_apic(struct domain *d, int cmd)
{
uint32_t perm;
@@ -1769,18 +1782,6 @@ static int cf_check flask_apic(struct do
return domain_has_xen(d, perm);
}
-static int cf_check flask_machine_memory_map(void)
-{
- return avc_current_has_perm(SECINITSID_XEN, SECCLASS_MMU, MMU__MEMORYMAP, NULL);
-}
-
-static int cf_check flask_domain_memory_map(struct domain *d)
-{
- return current_has_perm(d, SECCLASS_MMU, MMU__MEMORYMAP);
-}
-
-#ifdef CONFIG_PV
-
static int cf_check flask_do_mca(void)
{
return domain_has_xen(current->domain, XEN__MCA_OP);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 14/24] XSM/dummy: fold cf_check into XSM_INLINE
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (12 preceding siblings ...)
2026-07-28 13:19 ` [PATCH 13/24] x86: restrict PHYSDEVOP_* when PV=n Jan Beulich
@ 2026-07-28 13:19 ` Jan Beulich
2026-07-28 13:20 ` [PATCH 15/24] XSM/dummy: drop redundant return statements Jan Beulich
` (9 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:19 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
Use of cf_check together with always_inline is pretty pointless, and with
XSM=n none of the dummy handlers are supposed to have their address taken.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -54,7 +54,7 @@ void __xsm_action_mismatch_detected(void
* There is no xsm_default_t argument available, so the value from the assertion
* is used to initialize the variable.
*/
-#define XSM_INLINE __maybe_unused
+#define XSM_INLINE __maybe_unused cf_check
#define XSM_DEFAULT_ARG /* */
#define XSM_DEFAULT_VOID void
@@ -104,7 +104,7 @@ static always_inline int xsm_default_act
}
}
-static XSM_INLINE int cf_check xsm_set_system_active(void)
+static XSM_INLINE int xsm_set_system_active(void)
{
struct domain *d = current->domain;
@@ -121,34 +121,34 @@ static XSM_INLINE int cf_check xsm_set_s
return 0;
}
-static XSM_INLINE void cf_check xsm_security_domaininfo(
+static XSM_INLINE void xsm_security_domaininfo(
struct domain *d, struct xen_domctl_getdomaininfo *info)
{
return;
}
-static XSM_INLINE int cf_check xsm_domain_create(
+static XSM_INLINE int xsm_domain_create(
XSM_DEFAULT_ARG struct domain *d, uint32_t ssidref)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_getdomaininfo(
+static XSM_INLINE int xsm_getdomaininfo(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_XS_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_set_target(
+static XSM_INLINE int xsm_set_target(
XSM_DEFAULT_ARG struct domain *d, struct domain *e)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_domctl(
+static XSM_INLINE int xsm_domctl(
XSM_DEFAULT_ARG struct domain *d, struct xen_domctl *op)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -174,61 +174,61 @@ static XSM_INLINE int cf_check xsm_domct
}
}
-static XSM_INLINE int cf_check xsm_sysctl(
+static XSM_INLINE int xsm_sysctl(
XSM_DEFAULT_ARG const struct xen_sysctl *op)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d)
+static XSM_INLINE int xsm_alloc_security_domain(struct domain *d)
{
return 0;
}
-static XSM_INLINE void cf_check xsm_free_security_domain(struct domain *d)
+static XSM_INLINE void xsm_free_security_domain(struct domain *d)
{
return;
}
#ifdef CONFIG_GRANT_TABLE
-static XSM_INLINE int cf_check xsm_grant_mapref(
+static XSM_INLINE int xsm_grant_mapref(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2, uint32_t flags)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_grant_unmapref(
+static XSM_INLINE int xsm_grant_unmapref(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_grant_setup(
+static XSM_INLINE int xsm_grant_setup(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_grant_transfer(
+static XSM_INLINE int xsm_grant_transfer(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_grant_copy(
+static XSM_INLINE int xsm_grant_copy(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_grant_query_size(
+static XSM_INLINE int xsm_grant_query_size(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -237,28 +237,28 @@ static XSM_INLINE int cf_check xsm_grant
#endif /* CONFIG_GRANT_TABLE */
-static XSM_INLINE int cf_check xsm_memory_exchange(
+static XSM_INLINE int xsm_memory_exchange(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_memory_adjust_reservation(
+static XSM_INLINE int xsm_memory_adjust_reservation(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_memory_stat_reservation(
+static XSM_INLINE int xsm_memory_stat_reservation(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_console_io(
+static XSM_INLINE int xsm_console_io(
XSM_DEFAULT_ARG struct domain *d, int cmd)
{
XSM_ASSERT_ACTION(XSM_OTHER);
@@ -272,21 +272,21 @@ static XSM_INLINE int cf_check xsm_conso
}
#ifdef CONFIG_KEXEC
-static XSM_INLINE int cf_check xsm_kexec(XSM_DEFAULT_VOID)
+static XSM_INLINE int xsm_kexec(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
#endif
-static XSM_INLINE int cf_check xsm_schedop_shutdown(
+static XSM_INLINE int xsm_schedop_shutdown(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_memory_pin_page(
+static XSM_INLINE int xsm_memory_pin_page(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2,
struct page_info *page)
{
@@ -294,20 +294,20 @@ static XSM_INLINE int cf_check xsm_memor
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_claim_pages(XSM_DEFAULT_ARG struct domain *d)
+static XSM_INLINE int xsm_claim_pages(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_evtchn_unbound(
+static XSM_INLINE int xsm_evtchn_unbound(
XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn, domid_t id2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_evtchn_interdomain(
+static XSM_INLINE int xsm_evtchn_interdomain(
XSM_DEFAULT_ARG struct domain *d1, struct evtchn *chan1, struct domain *d2,
struct evtchn *chan2)
{
@@ -315,72 +315,72 @@ static XSM_INLINE int cf_check xsm_evtch
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE void cf_check xsm_evtchn_close_post(struct evtchn *chn)
+static XSM_INLINE void xsm_evtchn_close_post(struct evtchn *chn)
{
return;
}
-static XSM_INLINE int cf_check xsm_evtchn_send(
+static XSM_INLINE int xsm_evtchn_send(
XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, d, NULL);
}
-static XSM_INLINE int cf_check xsm_evtchn_status(
+static XSM_INLINE int xsm_evtchn_status(
XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_evtchn_reset(
+static XSM_INLINE int xsm_evtchn_reset(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_alloc_security_evtchns(
+static XSM_INLINE int xsm_alloc_security_evtchns(
struct evtchn chn[], unsigned int nr)
{
return 0;
}
-static XSM_INLINE void cf_check xsm_free_security_evtchns(
+static XSM_INLINE void xsm_free_security_evtchns(
struct evtchn chn[], unsigned int nr)
{
return;
}
-static XSM_INLINE char *cf_check xsm_show_security_evtchn(
+static XSM_INLINE char *xsm_show_security_evtchn(
struct domain *d, const struct evtchn *chn)
{
return NULL;
}
-static XSM_INLINE int cf_check xsm_init_hardware_domain(
+static XSM_INLINE int xsm_init_hardware_domain(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_get_pod_target(
+static XSM_INLINE int xsm_get_pod_target(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_set_pod_target(
+static XSM_INLINE int xsm_set_pod_target(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_get_vnumainfo(
+static XSM_INLINE int xsm_get_vnumainfo(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -388,7 +388,7 @@ static XSM_INLINE int cf_check xsm_get_v
}
#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
-static XSM_INLINE int cf_check xsm_get_device_group(
+static XSM_INLINE int xsm_get_device_group(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -398,14 +398,14 @@ static XSM_INLINE int cf_check xsm_get_d
#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
-static XSM_INLINE int cf_check xsm_resource_plug_pci(
+static XSM_INLINE int xsm_resource_plug_pci(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_resource_unplug_pci(
+static XSM_INLINE int xsm_resource_unplug_pci(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -416,14 +416,14 @@ static XSM_INLINE int cf_check xsm_resou
#ifdef CONFIG_HAS_PCI
-static XSM_INLINE int cf_check xsm_resource_setup_pci(
+static XSM_INLINE int xsm_resource_setup_pci(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_resource_setup_gsi(XSM_DEFAULT_ARG int gsi)
+static XSM_INLINE int xsm_resource_setup_gsi(XSM_DEFAULT_ARG int gsi)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
@@ -431,47 +431,47 @@ static XSM_INLINE int cf_check xsm_resou
#endif /* CONFIG_HAS_PCI */
-static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID)
+static XSM_INLINE int xsm_resource_setup_misc(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
#ifdef CONFIG_HYPFS
-static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID)
+static XSM_INLINE int xsm_hypfs_op(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
#endif
-static XSM_INLINE long cf_check xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
+static XSM_INLINE long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return -ENOSYS;
}
#ifdef CONFIG_COMPAT
-static XSM_INLINE int cf_check xsm_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) op)
+static XSM_INLINE int xsm_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return -ENOSYS;
}
#endif
-static XSM_INLINE char *cf_check xsm_show_irq_sid(int irq)
+static XSM_INLINE char *xsm_show_irq_sid(int irq)
{
return NULL;
}
#ifdef CONFIG_HAS_PIRQ
-static XSM_INLINE int cf_check xsm_map_domain_pirq(
+static XSM_INLINE int xsm_map_domain_pirq(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_unmap_domain_pirq(
+static XSM_INLINE int xsm_unmap_domain_pirq(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
@@ -480,49 +480,49 @@ static XSM_INLINE int cf_check xsm_unmap
#endif /* CONFIG_HAS_PIRQ */
-static XSM_INLINE int cf_check xsm_map_domain_irq(
+static XSM_INLINE int xsm_map_domain_irq(
XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_bind_pt_irq(
+static XSM_INLINE int xsm_bind_pt_irq(
XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_unbind_pt_irq(
+static XSM_INLINE int xsm_unbind_pt_irq(
XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_unmap_domain_irq(
+static XSM_INLINE int xsm_unmap_domain_irq(
XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_irq_permission(
+static XSM_INLINE int xsm_irq_permission(
XSM_DEFAULT_ARG struct domain *d, int pirq, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_iomem_permission(
+static XSM_INLINE int xsm_iomem_permission(
XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_iomem_mapping(
+static XSM_INLINE int xsm_iomem_mapping(
XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
@@ -530,7 +530,7 @@ static XSM_INLINE int cf_check xsm_iomem
}
#ifdef CONFIG_HAS_VPCI
-static XSM_INLINE int cf_check xsm_iomem_mapping_vpci(
+static XSM_INLINE int xsm_iomem_mapping_vpci(
XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_HOOK);
@@ -539,7 +539,7 @@ static XSM_INLINE int cf_check xsm_iomem
#endif
#ifdef CONFIG_HAS_PCI
-static XSM_INLINE int cf_check xsm_pci_config_permission(
+static XSM_INLINE int xsm_pci_config_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start,
uint16_t end, uint8_t access)
{
@@ -548,21 +548,21 @@ static XSM_INLINE int cf_check xsm_pci_c
}
#endif /* CONFIG_HAS_PCI */
-static XSM_INLINE int cf_check xsm_add_to_physmap(
+static XSM_INLINE int xsm_add_to_physmap(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_remove_from_physmap(
+static XSM_INLINE int xsm_remove_from_physmap(
XSM_DEFAULT_ARG struct domain *d1, struct domain *d2)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d1, d2);
}
-static XSM_INLINE int cf_check xsm_map_gmfn_foreign(
+static XSM_INLINE int xsm_map_gmfn_foreign(
XSM_DEFAULT_ARG struct domain *d, struct domain *t)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -571,14 +571,14 @@ static XSM_INLINE int cf_check xsm_map_g
#ifdef CONFIG_HVM
-static XSM_INLINE int cf_check xsm_hvm_param(
+static XSM_INLINE int xsm_hvm_param(
XSM_DEFAULT_ARG struct domain *d, unsigned long op)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_hvm_param_altp2mhvm(
+static XSM_INLINE int xsm_hvm_param_altp2mhvm(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -588,7 +588,7 @@ static XSM_INLINE int cf_check xsm_hvm_p
#endif /* CONFIG_HVM */
#ifdef CONFIG_ALTP2M
-static XSM_INLINE int cf_check xsm_hvm_altp2mhvm_op(
+static XSM_INLINE int xsm_hvm_altp2mhvm_op(
XSM_DEFAULT_ARG struct domain *d, uint64_t mode, uint32_t op)
{
XSM_ASSERT_ACTION(XSM_OTHER);
@@ -610,7 +610,7 @@ static XSM_INLINE int cf_check xsm_hvm_a
#endif /* CONFIG_ALTP2M */
#ifdef CONFIG_VM_EVENT
-static XSM_INLINE int cf_check xsm_mem_access(XSM_DEFAULT_ARG struct domain *d)
+static XSM_INLINE int xsm_mem_access(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
@@ -618,7 +618,7 @@ static XSM_INLINE int cf_check xsm_mem_a
#endif
#ifdef CONFIG_MEM_PAGING
-static XSM_INLINE int cf_check xsm_mem_paging(XSM_DEFAULT_ARG struct domain *d)
+static XSM_INLINE int xsm_mem_paging(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
@@ -626,14 +626,14 @@ static XSM_INLINE int cf_check xsm_mem_p
#endif
#ifdef CONFIG_MEM_SHARING
-static XSM_INLINE int cf_check xsm_mem_sharing(XSM_DEFAULT_ARG struct domain *d)
+static XSM_INLINE int xsm_mem_sharing(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
#endif
-static XSM_INLINE int cf_check xsm_platform_op(XSM_DEFAULT_ARG uint32_t op)
+static XSM_INLINE int xsm_platform_op(XSM_DEFAULT_ARG uint32_t op)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
@@ -641,20 +641,20 @@ static XSM_INLINE int cf_check xsm_platf
#ifdef CONFIG_X86
-static XSM_INLINE int cf_check xsm_mem_sharing_op(
+static XSM_INLINE int xsm_mem_sharing_op(
XSM_DEFAULT_ARG struct domain *d, struct domain *cd, int op)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, cd);
}
-static XSM_INLINE int cf_check xsm_machine_memory_map(XSM_DEFAULT_VOID)
+static XSM_INLINE int xsm_machine_memory_map(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_domain_memory_map(
+static XSM_INLINE int xsm_domain_memory_map(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -663,20 +663,20 @@ static XSM_INLINE int cf_check xsm_domai
#ifdef CONFIG_PV
-static XSM_INLINE int cf_check xsm_apic(
+static XSM_INLINE int xsm_apic(
XSM_DEFAULT_ARG struct domain *d, int cmd)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, d, NULL);
}
-static XSM_INLINE int cf_check xsm_do_mca(XSM_DEFAULT_VOID)
+static XSM_INLINE int xsm_do_mca(XSM_DEFAULT_VOID)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, NULL);
}
-static XSM_INLINE int cf_check xsm_mmu_update(
+static XSM_INLINE int xsm_mmu_update(
XSM_DEFAULT_ARG struct domain *d, struct domain *t, struct domain *f,
uint32_t flags)
{
@@ -689,14 +689,14 @@ static XSM_INLINE int cf_check xsm_mmu_u
return rc;
}
-static XSM_INLINE int cf_check xsm_mmuext_op(
+static XSM_INLINE int xsm_mmuext_op(
XSM_DEFAULT_ARG struct domain *d, struct domain *f)
{
XSM_ASSERT_ACTION(XSM_TARGET);
return xsm_default_action(action, d, f);
}
-static XSM_INLINE int cf_check xsm_update_va_mapping(
+static XSM_INLINE int xsm_update_va_mapping(
XSM_DEFAULT_ARG struct domain *d, struct domain *f, l1_pgentry_t pte)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -706,7 +706,7 @@ static XSM_INLINE int cf_check xsm_updat
#endif /* CONFIG_PV */
#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
-static XSM_INLINE int cf_check xsm_priv_mapping(
+static XSM_INLINE int xsm_priv_mapping(
XSM_DEFAULT_ARG struct domain *d, struct domain *t)
{
XSM_ASSERT_ACTION(XSM_TARGET);
@@ -714,21 +714,21 @@ static XSM_INLINE int cf_check xsm_priv_
}
#endif
-static XSM_INLINE int cf_check xsm_ioport_permission(
+static XSM_INLINE int xsm_ioport_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_ioport_mapping(
+static XSM_INLINE int xsm_ioport_mapping(
XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_pmu_op(
+static XSM_INLINE int xsm_pmu_op(
XSM_DEFAULT_ARG struct domain *d, unsigned int op)
{
XSM_ASSERT_ACTION(XSM_OTHER);
@@ -747,7 +747,7 @@ static XSM_INLINE int cf_check xsm_pmu_o
#endif /* CONFIG_X86 */
#ifdef CONFIG_IOREQ_SERVER
-static XSM_INLINE int cf_check xsm_dm_op(XSM_DEFAULT_ARG struct domain *d)
+static XSM_INLINE int xsm_dm_op(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
@@ -755,24 +755,24 @@ static XSM_INLINE int cf_check xsm_dm_op
#endif
#ifdef CONFIG_ARGO
-static XSM_INLINE int cf_check xsm_argo_enable(const struct domain *d)
+static XSM_INLINE int xsm_argo_enable(const struct domain *d)
{
return 0;
}
-static XSM_INLINE int cf_check xsm_argo_register_single_source(
+static XSM_INLINE int xsm_argo_register_single_source(
const struct domain *d, const struct domain *t)
{
return 0;
}
-static XSM_INLINE int cf_check xsm_argo_register_any_source(
+static XSM_INLINE int xsm_argo_register_any_source(
const struct domain *d)
{
return 0;
}
-static XSM_INLINE int cf_check xsm_argo_send(
+static XSM_INLINE int xsm_argo_send(
const struct domain *d, const struct domain *t)
{
return 0;
@@ -780,7 +780,7 @@ static XSM_INLINE int cf_check xsm_argo_
#endif /* CONFIG_ARGO */
-static XSM_INLINE int cf_check xsm_get_domain_state(
+static XSM_INLINE int xsm_get_domain_state(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_XS_PRIV);
@@ -788,7 +788,7 @@ static XSM_INLINE int cf_check xsm_get_d
}
#include <public/version.h>
-static XSM_INLINE int cf_check xsm_xen_version(XSM_DEFAULT_ARG uint32_t op)
+static XSM_INLINE int xsm_xen_version(XSM_DEFAULT_ARG uint32_t op)
{
XSM_ASSERT_ACTION(XSM_OTHER);
switch ( op )
@@ -815,7 +815,7 @@ static XSM_INLINE int cf_check xsm_xen_v
}
}
-static XSM_INLINE int cf_check xsm_domain_resource_map(
+static XSM_INLINE int xsm_domain_resource_map(
XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 15/24] XSM/dummy: drop redundant return statements
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (13 preceding siblings ...)
2026-07-28 13:19 ` [PATCH 14/24] XSM/dummy: fold cf_check into XSM_INLINE Jan Beulich
@ 2026-07-28 13:20 ` Jan Beulich
2026-07-28 13:20 ` [PATCH 16/24] XSM: suppress hypercall when XSM=n Jan Beulich
` (8 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:20 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
They're meaningless when no value is returned.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -123,9 +123,7 @@ static XSM_INLINE int xsm_set_system_act
static XSM_INLINE void xsm_security_domaininfo(
struct domain *d, struct xen_domctl_getdomaininfo *info)
-{
- return;
-}
+{}
static XSM_INLINE int xsm_domain_create(
XSM_DEFAULT_ARG struct domain *d, uint32_t ssidref)
@@ -187,9 +185,7 @@ static XSM_INLINE int xsm_alloc_security
}
static XSM_INLINE void xsm_free_security_domain(struct domain *d)
-{
- return;
-}
+{}
#ifdef CONFIG_GRANT_TABLE
@@ -316,9 +312,7 @@ static XSM_INLINE int xsm_evtchn_interdo
}
static XSM_INLINE void xsm_evtchn_close_post(struct evtchn *chn)
-{
- return;
-}
+{}
static XSM_INLINE int xsm_evtchn_send(
XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn)
@@ -349,9 +343,7 @@ static XSM_INLINE int xsm_alloc_security
static XSM_INLINE void xsm_free_security_evtchns(
struct evtchn chn[], unsigned int nr)
-{
- return;
-}
+{}
static XSM_INLINE char *xsm_show_security_evtchn(
struct domain *d, const struct evtchn *chn)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 16/24] XSM: suppress hypercall when XSM=n
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (14 preceding siblings ...)
2026-07-28 13:20 ` [PATCH 15/24] XSM/dummy: drop redundant return statements Jan Beulich
@ 2026-07-28 13:20 ` Jan Beulich
2026-07-28 13:22 ` [PATCH 17/24] XSM: make Argo hooks well-formed ones Jan Beulich
` (7 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:20 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Julien Grall, Stefano Stabellini,
Anthony PERARD, Michal Orzel
This can be easily done in hypercall-defs.c, thus avoiding the need to
dive into xsm/ when building Xen, just to add code which does what is done
for an absent hypercall handler anyway (returning -ENOSYS).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/Makefile
+++ b/xen/Makefile
@@ -458,7 +458,7 @@ CFLAGS += -I$(objtree)/arch/$(SRCARCH)/i
ALL_OBJS-y := common/built_in.o
ALL_OBJS-y += drivers/built_in.o
ALL_OBJS-y += lib/built_in.o
-ALL_OBJS-y += xsm/built_in.o
+ALL_OBJS-$(CONFIG_XSM) += xsm/built_in.o
ALL_OBJS-y += arch/$(SRCARCH)/built_in.o
ALL_OBJS-$(CONFIG_CRYPTO) += crypto/built_in.o
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -119,7 +119,9 @@ prefix: do PREFIX_compat
xen_version(int cmd, void *arg)
vcpu_op(int cmd, unsigned int vcpuid, void *arg)
sched_op(int cmd, void *arg)
+#ifdef CONFIG_XSM
xsm_op(void *op)
+#endif
callback_op(int cmd, const void *arg)
#ifdef CONFIG_ARGO
argo_op(unsigned int cmd, void *arg1, void *arg2, unsigned long arg3, unsigned long arg4)
@@ -264,7 +266,9 @@ set_segment_base do:2
#ifdef CONFIG_PV
mmuext_op compat:2 do:2 compat do -
#endif
+#ifdef CONFIG_XSM
xsm_op compat do compat do do
+#endif
nmi_op compat do - - -
sched_op compat do compat do do
callback_op compat do - - -
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -437,6 +437,8 @@ static XSM_INLINE int xsm_hypfs_op(XSM_D
}
#endif
+#ifdef CONFIG_XSM
+
static XSM_INLINE long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return -ENOSYS;
@@ -449,6 +451,8 @@ static XSM_INLINE int xsm_do_compat_op(X
}
#endif
+#endif /* CONFIG_XSM */
+
static XSM_INLINE char *xsm_show_irq_sid(int irq)
{
return NULL;
--- a/xen/xsm/Makefile
+++ b/xen/xsm/Makefile
@@ -1,6 +1,6 @@
obj-y += xsm_core.o
-obj-$(CONFIG_XSM) += xsm_policy.o
-obj-$(CONFIG_XSM) += dummy.o
+obj-y += xsm_policy.o
+obj-y += dummy.o
obj-$(CONFIG_XSM_SILO) += silo.o
obj-$(CONFIG_XSM_FLASK) += flask/
--- a/xen/xsm/xsm_core.c
+++ b/xen/xsm/xsm_core.c
@@ -18,8 +18,6 @@
#include <xen/hypercall.h>
#include <xsm/xsm.h>
-#ifdef CONFIG_XSM
-
#ifdef CONFIG_MULTIBOOT
#include <asm/bootinfo.h>
#include <asm/setup.h>
@@ -216,8 +214,6 @@ bool __init has_xsm_magic(paddr_t start)
}
#endif
-#endif
-
long do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return xsm_do_xsm_op(op);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 17/24] XSM: make Argo hooks well-formed ones
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (15 preceding siblings ...)
2026-07-28 13:20 ` [PATCH 16/24] XSM: suppress hypercall when XSM=n Jan Beulich
@ 2026-07-28 13:22 ` Jan Beulich
2026-07-28 13:22 ` [PATCH 18/24] XSM: make XSM " Jan Beulich
` (6 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:22 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith, Jason Andryuk
For whatever reason they didn't have an xsm_default_t first argument (to
cope with XSM=n mode), making it impossible to (easily) cover them in
xsm/hooks.h.
To be able to retain the const on their function parameters, adjust
xsm_default_action() accordingly.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -1341,7 +1341,7 @@ fill_ring_data(const struct domain *curr
* Don't supply information about rings that a guest is not
* allowed to send to.
*/
- ret = xsm_argo_send(currd, dst_d);
+ ret = xsm_argo_send(XSM_HOOK, currd, dst_d);
if ( ret )
goto out;
@@ -1666,8 +1666,9 @@ register_ring(struct domain *currd,
if ( reg.partner_id == XEN_ARGO_DOMID_ANY )
{
- ret = opt_argo_mac_permissive ? xsm_argo_register_any_source(currd) :
- -EPERM;
+ ret = opt_argo_mac_permissive
+ ? xsm_argo_register_any_source(XSM_HOOK, currd)
+ : -EPERM;
if ( ret )
return ret;
}
@@ -1680,7 +1681,7 @@ register_ring(struct domain *currd,
return -ESRCH;
}
- ret = xsm_argo_register_single_source(currd, dst_d);
+ ret = xsm_argo_register_single_source(XSM_HOOK, currd, dst_d);
if ( ret )
goto out;
@@ -2002,7 +2003,7 @@ sendv(struct domain *src_d, xen_argo_add
if ( !dst_d )
return -ESRCH;
- ret = xsm_argo_send(src_d, dst_d);
+ ret = xsm_argo_send(XSM_HOOK, src_d, dst_d);
if ( ret )
{
gprintk(XENLOG_ERR, "argo: XSM REJECTED %i -> %i\n",
@@ -2100,7 +2101,7 @@ do_argo_op(unsigned int cmd, XEN_GUEST_H
if ( unlikely(!opt_argo) )
return -EOPNOTSUPP;
- rc = xsm_argo_enable(currd);
+ rc = xsm_argo_enable(XSM_HOOK, currd);
if ( rc )
return rc;
@@ -2242,7 +2243,7 @@ compat_argo_op(unsigned int cmd, XEN_GUE
if ( unlikely(!opt_argo) )
return -EOPNOTSUPP;
- rc = xsm_argo_enable(currd);
+ rc = xsm_argo_enable(XSM_HOOK, currd);
if ( rc )
return rc;
@@ -2307,7 +2308,7 @@ argo_init(struct domain *d)
{
struct argo_domain *argo;
- if ( !opt_argo || xsm_argo_enable(d) )
+ if ( !opt_argo || xsm_argo_enable(XSM_HOOK, d) )
{
argo_dprintk("argo disabled, domid: %u\n", d->domain_id);
return 0;
@@ -2365,8 +2366,8 @@ argo_soft_reset(struct domain *d)
wildcard_rings_pending_remove(d);
/*
- * Since neither opt_argo or xsm_argo_enable(d) can change at runtime,
- * if d->argo is true then both opt_argo and xsm_argo_enable(d) must be
+ * Since neither opt_argo nor xsm_argo_enable() can change at runtime,
+ * if d->argo is true then both opt_argo and xsm_argo_enable() must be
* true, and we can assume that init is allowed to proceed again here.
*/
argo_domain_init(d->argo);
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -76,7 +76,7 @@ void __xsm_action_mismatch_detected(void
#endif /* CONFIG_XSM */
static always_inline int xsm_default_action(
- xsm_default_t action, struct domain *src, struct domain *target)
+ xsm_default_t action, const struct domain *src, const struct domain *target)
{
switch ( action ) {
case XSM_HOOK:
@@ -751,27 +751,32 @@ static XSM_INLINE int xsm_dm_op(XSM_DEFA
#endif
#ifdef CONFIG_ARGO
-static XSM_INLINE int xsm_argo_enable(const struct domain *d)
+
+static XSM_INLINE int xsm_argo_enable(XSM_DEFAULT_ARG const struct domain *d)
{
- return 0;
+ XSM_ASSERT_ACTION(XSM_HOOK);
+ return xsm_default_action(action, current->domain, d);
}
static XSM_INLINE int xsm_argo_register_single_source(
- const struct domain *d, const struct domain *t)
+ XSM_DEFAULT_ARG const struct domain *d, const struct domain *t)
{
- return 0;
+ XSM_ASSERT_ACTION(XSM_HOOK);
+ return xsm_default_action(action, d, t);
}
static XSM_INLINE int xsm_argo_register_any_source(
- const struct domain *d)
+ XSM_DEFAULT_ARG const struct domain *d)
{
- return 0;
+ XSM_ASSERT_ACTION(XSM_HOOK);
+ return xsm_default_action(action, current->domain, d);
}
static XSM_INLINE int xsm_argo_send(
- const struct domain *d, const struct domain *t)
+ XSM_DEFAULT_ARG const struct domain *d, const struct domain *t)
{
- return 0;
+ XSM_ASSERT_ACTION(XSM_HOOK);
+ return xsm_default_action(action, d, t);
}
#endif /* CONFIG_ARGO */
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -156,6 +156,14 @@ XSM_HOOK(int, dm_op, struct domain *)
XSM_HOOK(int, xen_version, uint32_t)
XSM_HOOK(int, domain_resource_map, struct domain *)
+#ifdef CONFIG_ARGO
+XSM_HOOK(int, argo_enable, const struct domain *)
+XSM_HOOK(int, argo_register_single_source, const struct domain *,
+ const struct domain *)
+XSM_HOOK(int, argo_register_any_source, const struct domain *)
+XSM_HOOK(int, argo_send, const struct domain *, const struct domain *)
+#endif
+
#undef XSM_HOOK0
#undef XSM_HOOK1
#undef XSM_HOOK2
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -90,14 +90,6 @@ struct xsm_ops {
#ifdef CONFIG_COMPAT
int (*do_compat_op)(XEN_GUEST_HANDLE_PARAM(void) op);
#endif
-
-#ifdef CONFIG_ARGO
- int (*argo_enable)(const struct domain *d);
- int (*argo_register_single_source)(const struct domain *d,
- const struct domain *t);
- int (*argo_register_any_source)(const struct domain *d);
- int (*argo_send)(const struct domain *d, const struct domain *t);
-#endif
};
#ifdef CONFIG_XSM
@@ -213,30 +205,6 @@ static inline int xsm_do_compat_op(XEN_G
}
#endif
-#ifdef CONFIG_ARGO
-static inline int xsm_argo_enable(const struct domain *d)
-{
- return alternative_call(xsm_ops.argo_enable, d);
-}
-
-static inline int xsm_argo_register_single_source(
- const struct domain *d, const struct domain *t)
-{
- return alternative_call(xsm_ops.argo_register_single_source, d, t);
-}
-
-static inline int xsm_argo_register_any_source(const struct domain *d)
-{
- return alternative_call(xsm_ops.argo_register_any_source, d);
-}
-
-static inline int xsm_argo_send(const struct domain *d, const struct domain *t)
-{
- return alternative_call(xsm_ops.argo_send, d, t);
-}
-
-#endif /* CONFIG_ARGO */
-
#endif /* XSM_NO_WRAPPERS */
#ifdef CONFIG_MULTIBOOT
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -40,13 +40,6 @@ static const struct xsm_ops __initconst_
#ifdef CONFIG_COMPAT
.do_compat_op = xsm_do_compat_op,
#endif
-
-#ifdef CONFIG_ARGO
- .argo_enable = xsm_argo_enable,
- .argo_register_single_source = xsm_argo_register_single_source,
- .argo_register_any_source = xsm_argo_register_any_source,
- .argo_send = xsm_argo_send,
-#endif
};
void __init xsm_fixup_ops(struct xsm_ops *ops)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1977,13 +1977,6 @@ static const struct xsm_ops __initconst_
#ifdef CONFIG_COMPAT
.do_compat_op = compat_flask_op,
#endif
-
-#ifdef CONFIG_ARGO
- .argo_enable = flask_argo_enable,
- .argo_register_single_source = flask_argo_register_single_source,
- .argo_register_any_source = flask_argo_register_any_source,
- .argo_send = flask_argo_send,
-#endif
};
const struct xsm_ops *__init flask_init(
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 18/24] XSM: make XSM hooks well-formed ones
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (16 preceding siblings ...)
2026-07-28 13:22 ` [PATCH 17/24] XSM: make Argo hooks well-formed ones Jan Beulich
@ 2026-07-28 13:22 ` Jan Beulich
2026-07-28 13:23 ` [PATCH 19/24] XSM: convert "allow" (Flask: "access") parameters to bool Jan Beulich
` (5 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:22 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org; +Cc: Daniel Smith
For whatever reason they didn't have an xsm_default_t first argument (to
cope with XSM=n mode), making it impossible to (easily) cover them in
xsm/hooks.h.
flask_do_xsm_op() is also changed to return int, as all the function ever
returns is an int. This way no new machinery needs adding to xsm/hooks.h.
Instead one piece of compat machinery can then be dropped from
xsm/flask/flask_op.c.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Instead of XSM_HOOK, using XSM_OTHER may also be a sensible option here.
Question is whether some/all of the other hooks still declared explicitly
in struct xsm_ops should follow suit.
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -439,7 +439,7 @@ static XSM_INLINE int xsm_hypfs_op(XSM_D
#ifdef CONFIG_XSM
-static XSM_INLINE long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
+static XSM_INLINE int xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
return -ENOSYS;
}
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -156,6 +156,11 @@ XSM_HOOK(int, dm_op, struct domain *)
XSM_HOOK(int, xen_version, uint32_t)
XSM_HOOK(int, domain_resource_map, struct domain *)
+XSM_HOOK(int, do_xsm_op, XEN_GUEST_HANDLE_PARAM(void))
+#ifdef CONFIG_COMPAT
+XSM_HOOK(int, do_compat_op, XEN_GUEST_HANDLE_PARAM(void))
+#endif
+
#ifdef CONFIG_ARGO
XSM_HOOK(int, argo_enable, const struct domain *)
XSM_HOOK(int, argo_register_single_source, const struct domain *,
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -85,11 +85,6 @@ struct xsm_ops {
char *(*show_security_evtchn)(struct domain *d, const struct evtchn *chn);
char *(*show_irq_sid)(int irq);
-
- long (*do_xsm_op)(XEN_GUEST_HANDLE_PARAM(void) op);
-#ifdef CONFIG_COMPAT
- int (*do_compat_op)(XEN_GUEST_HANDLE_PARAM(void) op);
-#endif
};
#ifdef CONFIG_XSM
@@ -193,18 +188,6 @@ static inline char *xsm_show_irq_sid(int
return alternative_call(xsm_ops.show_irq_sid, irq);
}
-static inline long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
-{
- return alternative_call(xsm_ops.do_xsm_op, op);
-}
-
-#ifdef CONFIG_COMPAT
-static inline int xsm_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) op)
-{
- return alternative_call(xsm_ops.do_compat_op, op);
-}
-#endif
-
#endif /* XSM_NO_WRAPPERS */
#ifdef CONFIG_MULTIBOOT
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -35,11 +35,6 @@ static const struct xsm_ops __initconst_
.show_security_evtchn = xsm_show_security_evtchn,
.show_irq_sid = xsm_show_irq_sid,
-
- .do_xsm_op = xsm_do_xsm_op,
-#ifdef CONFIG_COMPAT
- .do_compat_op = xsm_do_compat_op,
-#endif
};
void __init xsm_fixup_ops(struct xsm_ops *ops)
--- a/xen/xsm/flask/flask_op.c
+++ b/xen/xsm/flask/flask_op.c
@@ -23,7 +23,6 @@
#include <conditional.h>
#include "private.h"
-#define ret_t long
#define _copy_to_guest copy_to_guest
#define _copy_from_guest copy_from_guest
@@ -606,7 +605,7 @@ static int flask_relabel_domain(const st
#endif /* !COMPAT */
-ret_t cf_check do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op)
+int cf_check flask_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op)
{
xen_flask_op_t op;
int rv;
@@ -772,9 +771,7 @@ CHECK_flask_transition;
#define flask_devicetree_label compat_devicetree_label
#define xen_flask_op_t compat_flask_op_t
-#undef ret_t
-#define ret_t int
-#define do_flask_op compat_flask_op
+#define flask_do_xsm_op flask_do_compat_op
#include "flask_op.c"
#endif
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1971,12 +1971,6 @@ static const struct xsm_ops __initconst_
.show_security_evtchn = flask_show_security_evtchn,
.show_irq_sid = flask_show_irq_sid,
-
- .do_xsm_op = do_flask_op,
-
-#ifdef CONFIG_COMPAT
- .do_compat_op = compat_flask_op,
-#endif
};
const struct xsm_ops *__init flask_init(
--- a/xen/xsm/flask/private.h
+++ b/xen/xsm/flask/private.h
@@ -3,7 +3,7 @@
#include <public/xen.h>
-long cf_check do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op);
-int cf_check compat_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op);
+int cf_check flask_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op);
+int cf_check flask_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op);
#endif /* XSM_FLASK_PRIVATE */
--- a/xen/xsm/xsm_core.c
+++ b/xen/xsm/xsm_core.c
@@ -216,12 +216,12 @@ bool __init has_xsm_magic(paddr_t start)
long do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
- return xsm_do_xsm_op(op);
+ return xsm_do_xsm_op(XSM_HOOK, op);
}
#ifdef CONFIG_COMPAT
int compat_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op)
{
- return xsm_do_compat_op(op);
+ return xsm_do_compat_op(XSM_HOOK, op);
}
#endif
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 19/24] XSM: convert "allow" (Flask: "access") parameters to bool
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (17 preceding siblings ...)
2026-07-28 13:22 ` [PATCH 18/24] XSM: make XSM " Jan Beulich
@ 2026-07-28 13:23 ` Jan Beulich
2026-07-28 13:23 ` [PATCH 20/24] XSM: fold xsm_{,un}map_domain_pirq() hooks Jan Beulich
` (4 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:23 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné
These are boolean, so they should always have used bool (originally
bool_t), not uint8_t. Leverage recent changes to arrange for this with
(now) fewer places which need changing (within the XSM machinery itself).
Adjust call sites as well, where the conversion wasn't done so far.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Why is it that Arm doesn't use xsm_irq_permission() at all? Same for Arm64
vs xsm_pci_config_permission().
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -235,7 +235,7 @@ long arch_do_domctl(
{
unsigned int fp = domctl->u.ioport_permission.first_port;
unsigned int np = domctl->u.ioport_permission.nr_ports;
- int allow = domctl->u.ioport_permission.allow_access;
+ bool allow = domctl->u.ioport_permission.allow_access;
ret = -EINVAL;
if ( (fp + np) <= fp || (fp + np) > MAX_IOPORTS )
@@ -306,7 +306,8 @@ long arch_do_domctl(
break;
}
- ret = xsm_irq_permission(XSM_PRIV, d, irq, flags);
+ ret = xsm_irq_permission(XSM_PRIV, d, irq,
+ flags & XEN_DOMCTL_GSI_ACTION_MASK);
if ( ret )
break;
@@ -687,7 +688,7 @@ long arch_do_domctl(
unsigned int fgp = domctl->u.ioport_mapping.first_gport;
unsigned int fmp = domctl->u.ioport_mapping.first_mport;
unsigned int np = domctl->u.ioport_mapping.nr_ports;
- unsigned int add = domctl->u.ioport_mapping.add_mapping;
+ bool add = domctl->u.ioport_mapping.add_mapping;
struct hvm_domain *hvm;
struct g2m_ioport *g2m_ioport;
int found = 0;
--- a/xen/arch/x86/pci.c
+++ b/xen/arch/x86/pci.c
@@ -78,7 +78,7 @@ int pci_conf_write_intercept(unsigned in
{
struct pci_dev *pdev;
int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, bdf,
- reg, reg + size - 1, 1);
+ reg, reg + size - 1, true);
if ( rc < 0 )
return rc;
--- a/xen/arch/x86/pv/emul-priv-op.c
+++ b/xen/arch/x86/pv/emul-priv-op.c
@@ -260,7 +260,7 @@ static bool pci_cfg_ok(struct domain *cu
return !write ?
xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
- start, start + size - 1, 0) == 0 :
+ start, start + size - 1, false) == 0 :
pci_conf_write_intercept(0, machine_bdf, start, size, write) >= 0;
}
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -505,21 +505,21 @@ static XSM_INLINE int xsm_unmap_domain_i
}
static XSM_INLINE int xsm_irq_permission(
- XSM_DEFAULT_ARG struct domain *d, int pirq, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, int pirq, bool allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
static XSM_INLINE int xsm_iomem_permission(
- XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, bool allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
static XSM_INLINE int xsm_iomem_mapping(
- XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, bool allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
@@ -527,7 +527,7 @@ static XSM_INLINE int xsm_iomem_mapping(
#ifdef CONFIG_HAS_VPCI
static XSM_INLINE int xsm_iomem_mapping_vpci(
- XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, bool allow)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
@@ -537,7 +537,7 @@ static XSM_INLINE int xsm_iomem_mapping_
#ifdef CONFIG_HAS_PCI
static XSM_INLINE int xsm_pci_config_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start,
- uint16_t end, uint8_t access)
+ uint16_t end, bool access)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
@@ -711,14 +711,14 @@ static XSM_INLINE int xsm_priv_mapping(
#endif
static XSM_INLINE int xsm_ioport_permission(
- XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, bool allow)
{
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, current->domain, d);
}
static XSM_INLINE int xsm_ioport_mapping(
- XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
+ XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, bool allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -77,12 +77,12 @@ XSM_HOOK(int, unmap_domain_irq, struct d
XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
-XSM_HOOK(int, irq_permission, struct domain *, int, uint8_t)
-XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, uint8_t)
+XSM_HOOK(int, irq_permission, struct domain *, int, bool)
+XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, bool)
-XSM_HOOK(int, iomem_mapping, struct domain *, uint64_t, uint64_t, uint8_t)
+XSM_HOOK(int, iomem_mapping, struct domain *, uint64_t, uint64_t, bool)
#ifdef CONFIG_HAS_VPCI
-XSM_HOOK(int, iomem_mapping_vpci, struct domain *, uint64_t, uint64_t, uint8_t)
+XSM_HOOK(int, iomem_mapping_vpci, struct domain *, uint64_t, uint64_t, bool)
#endif
#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
@@ -97,7 +97,7 @@ XSM_HOOK(int, resource_setup_misc)
XSM_HOOK(int, resource_setup_pci, uint32_t)
XSM_HOOK(int, resource_setup_gsi, int)
XSM_HOOK(int, pci_config_permission, struct domain *, uint32_t, uint16_t,
- uint16_t, uint8_t)
+ uint16_t, bool)
#endif
#ifdef CONFIG_HYPFS
@@ -144,8 +144,8 @@ XSM_HOOK(int, update_va_mapping, struct
#if defined(CONFIG_PV) || defined(CONFIG_SHADOW_PAGING)
XSM_HOOK(int, priv_mapping, struct domain *, struct domain *)
#endif
-XSM_HOOK(int, ioport_permission, struct domain *, uint32_t, uint32_t, uint8_t)
-XSM_HOOK(int, ioport_mapping, struct domain *, uint32_t, uint32_t, uint8_t)
+XSM_HOOK(int, ioport_permission, struct domain *, uint32_t, uint32_t, bool)
+XSM_HOOK(int, ioport_mapping, struct domain *, uint32_t, uint32_t, bool)
XSM_HOOK(int, pmu_op, struct domain *, unsigned int)
#endif /* CONFIG_X86 */
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -998,7 +998,7 @@ static int cf_check flask_sysctl(const s
}
#endif /* CONFIG_SYSCTL */
-static inline uint32_t resource_to_perm(uint8_t access)
+static inline uint32_t resource_to_perm(bool access)
{
if ( access )
return RESOURCE__ADD;
@@ -1166,7 +1166,7 @@ static int cf_check flask_unbind_pt_irq(
}
static int cf_check flask_irq_permission(
- struct domain *d, int pirq, uint8_t access)
+ struct domain *d, int pirq, bool access)
{
/* the PIRQ number is not useful; real IRQ is checked during mapping */
return current_has_perm(d, SECCLASS_RESOURCE, resource_to_perm(access));
@@ -1199,7 +1199,7 @@ static int cf_check _iomem_has_perm(
}
static int cf_check flask_iomem_permission(
- struct domain *d, uint64_t start, uint64_t end, uint8_t access)
+ struct domain *d, uint64_t start, uint64_t end, bool access)
{
struct iomem_has_perm_data data;
int rc;
@@ -1221,7 +1221,8 @@ static int cf_check flask_iomem_permissi
return security_iterate_iomem_sids(start, end, _iomem_has_perm, &data);
}
-static int cf_check flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, uint8_t access)
+static int cf_check flask_iomem_mapping(
+ struct domain *d, uint64_t start, uint64_t end, bool access)
{
return flask_iomem_permission(d, start, end, access);
}
@@ -1230,7 +1231,7 @@ static int cf_check flask_iomem_mapping(
#ifdef CONFIG_HAS_PCI
static int cf_check flask_pci_config_permission(
struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end,
- uint8_t access)
+ bool access)
{
uint32_t dsid, rsid;
int rc = -EPERM;
@@ -1709,7 +1710,7 @@ static int cf_check _ioport_has_perm(
}
static int cf_check flask_ioport_permission(
- struct domain *d, uint32_t start, uint32_t end, uint8_t access)
+ struct domain *d, uint32_t start, uint32_t end, bool access)
{
int rc;
struct ioport_has_perm_data data;
@@ -1733,7 +1734,7 @@ static int cf_check flask_ioport_permiss
}
static int cf_check flask_ioport_mapping(
- struct domain *d, uint32_t start, uint32_t end, uint8_t access)
+ struct domain *d, uint32_t start, uint32_t end, bool access)
{
return flask_ioport_permission(d, start, end, access);
}
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 20/24] XSM: fold xsm_{,un}map_domain_pirq() hooks
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (18 preceding siblings ...)
2026-07-28 13:23 ` [PATCH 19/24] XSM: convert "allow" (Flask: "access") parameters to bool Jan Beulich
@ 2026-07-28 13:23 ` Jan Beulich
2026-07-28 13:24 ` [PATCH 21/24] x86: type-correct last parameter of map_domain_pirq() Jan Beulich
` (3 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:23 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné
Like other resource management hooks they are different in just "add
resource" vs "remove resource". Hence like in other cases a single hook
can easily serve both purposes.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -109,7 +109,7 @@ int physdev_map_pirq(struct domain *d, i
return physdev_hvm_map_pirq(d, type, index, pirq_p);
}
- ret = xsm_map_domain_pirq(XSM_DM_PRIV, d);
+ ret = xsm_map_domain_pirq(XSM_DM_PRIV, d, true);
if ( ret )
return ret;
@@ -142,7 +142,7 @@ int physdev_unmap_pirq(struct domain *d,
int ret = 0;
if ( d != current->domain || !is_hvm_domain(d) || !has_pirq(d) )
- ret = xsm_unmap_domain_pirq(XSM_DM_PRIV, d);
+ ret = xsm_map_domain_pirq(XSM_DM_PRIV, d, false);
if ( ret )
return ret;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -461,14 +461,7 @@ static XSM_INLINE char *xsm_show_irq_sid
#ifdef CONFIG_HAS_PIRQ
static XSM_INLINE int xsm_map_domain_pirq(
- XSM_DEFAULT_ARG struct domain *d)
-{
- XSM_ASSERT_ACTION(XSM_DM_PRIV);
- return xsm_default_action(action, current->domain, d);
-}
-
-static XSM_INLINE int xsm_unmap_domain_pirq(
- XSM_DEFAULT_ARG struct domain *d)
+ XSM_DEFAULT_ARG struct domain *d, bool allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -68,8 +68,7 @@ XSM_HOOK(int, kexec)
XSM_HOOK(int, schedop_shutdown, struct domain *, struct domain *)
#ifdef CONFIG_HAS_PIRQ
-XSM_HOOK(int, map_domain_pirq, struct domain *)
-XSM_HOOK(int, unmap_domain_pirq, struct domain *)
+XSM_HOOK(int, map_domain_pirq, struct domain *, bool)
#endif
XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1022,14 +1022,9 @@ static char *cf_check flask_show_irq_sid
#ifdef CONFIG_HAS_PIRQ
-static int cf_check flask_map_domain_pirq(struct domain *d)
+static int cf_check flask_map_domain_pirq(struct domain *d, bool access)
{
- return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__ADD);
-}
-
-static int cf_check flask_unmap_domain_pirq(struct domain *d)
-{
- return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
+ return current_has_perm(d, SECCLASS_RESOURCE, resource_to_perm(access));
}
#endif /* CONFIG_HAS_PIRQ */
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 21/24] x86: type-correct last parameter of map_domain_pirq()
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (19 preceding siblings ...)
2026-07-28 13:23 ` [PATCH 20/24] XSM: fold xsm_{,un}map_domain_pirq() hooks Jan Beulich
@ 2026-07-28 13:24 ` Jan Beulich
2026-07-28 13:25 ` [PATCH 22/24] XSM: pass just SBDF to xsm_{,un}map_domain_irq() Jan Beulich
` (2 subsequent siblings)
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:24 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Andrew Cooper, Teddy Astie, Roger Pau Monné
This was meant to allow for non-MSI data to be passed if necessary, but
the way XSM/Flask uses the (propagated) argument that's not going to work
anyway without further adjustments. As no secondary use has surfaced in
many years, switch to using the correct type.
Leave XSM alone, as that'll be changed subsequently anyway (to then also
no longer use plain void).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/include/asm/irq.h
+++ b/xen/arch/x86/include/asm/irq.h
@@ -27,6 +27,7 @@ typedef struct {
} vmask_t;
struct irq_desc;
+struct msi_info;
/*
* Xen logic for moving interrupts around CPUs allows manipulating interrupts
@@ -161,7 +162,7 @@ struct arch_pirq {
int pirq_shared(struct domain *d , int pirq);
int map_domain_pirq(struct domain *d, int pirq, int irq, int type,
- void *data);
+ struct msi_info *msi);
int unmap_domain_pirq(struct domain *d, int pirq);
int get_free_pirq(struct domain *d, int type);
int get_free_pirqs(struct domain *d, unsigned int nr);
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -2180,7 +2180,7 @@ int get_free_pirqs(struct domain *d, uns
#define MAX_MSI_IRQS 32 /* limited by MSI capability struct properties */
int map_domain_pirq(
- struct domain *d, int pirq, int irq, int type, void *data)
+ struct domain *d, int pirq, int irq, int type, struct msi_info *msi)
{
int ret = 0;
int old_irq, old_pirq;
@@ -2214,7 +2214,7 @@ int map_domain_pirq(
return 0;
}
- ret = xsm_map_domain_irq(XSM_HOOK, d, irq, data);
+ ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi);
if ( ret )
{
dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n",
@@ -2245,7 +2245,6 @@ int map_domain_pirq(
if ( type == MAP_PIRQ_TYPE_MSI || type == MAP_PIRQ_TYPE_MULTI_MSI )
{
- struct msi_info *msi = (struct msi_info *)data;
struct msi_desc *msi_desc;
struct pci_dev *pdev;
unsigned int nr = 0;
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 22/24] XSM: pass just SBDF to xsm_{,un}map_domain_irq()
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (20 preceding siblings ...)
2026-07-28 13:24 ` [PATCH 21/24] x86: type-correct last parameter of map_domain_pirq() Jan Beulich
@ 2026-07-28 13:25 ` Jan Beulich
2026-07-28 13:26 ` [PATCH 23/24] XSM: fold xsm_{,un}map_domain_irq() hooks Jan Beulich
2026-07-28 13:26 ` [PATCH 24/24] XSM: fold xsm_{,un}bind_pt_irq() hooks Jan Beulich
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:25 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné
That's what Flask needs, and by unifying the hooks flask_map_domain_msi()
can then also serve both flask_{,un}map_domain_irq().
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
How come Arm doesn't use xsm_unmap_domain_irq()?
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -2214,7 +2214,7 @@ int map_domain_pirq(
return 0;
}
- ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi);
+ ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi ? &msi->sbdf : NULL);
if ( ret )
{
dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n",
@@ -2442,7 +2442,7 @@ int unmap_domain_pirq(struct domain *d,
*/
if ( !d->is_dying )
ret = xsm_unmap_domain_irq(XSM_HOOK, d, irq,
- msi_desc ? msi_desc->dev : NULL);
+ msi_desc ? &msi_desc->dev->sbdf : NULL);
if ( ret )
goto done;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -470,7 +470,7 @@ static XSM_INLINE int xsm_map_domain_pir
#endif /* CONFIG_HAS_PIRQ */
static XSM_INLINE int xsm_map_domain_irq(
- XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
+ XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
@@ -491,7 +491,7 @@ static XSM_INLINE int xsm_unbind_pt_irq(
}
static XSM_INLINE int xsm_unmap_domain_irq(
- XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
+ XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -71,8 +71,8 @@ XSM_HOOK(int, schedop_shutdown, struct d
XSM_HOOK(int, map_domain_pirq, struct domain *, bool)
#endif
-XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
-XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const void *)
+XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *)
+XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const pci_sbdf_t *)
XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1030,17 +1030,14 @@ static int cf_check flask_map_domain_pir
#endif /* CONFIG_HAS_PIRQ */
static int flask_map_domain_msi (
- struct domain *d, int irq, const void *data, uint32_t *sid,
+ struct domain *d, int irq, pci_sbdf_t sbdf, uint32_t *sid,
struct avc_audit_data *ad)
{
#ifdef CONFIG_HAS_PCI_MSI
- const struct msi_info *msi = data;
- uint32_t machine_bdf = msi->sbdf.sbdf;
-
AVC_AUDIT_DATA_INIT(ad, DEV);
- ad->device = machine_bdf;
+ ad->device = sbdf.sbdf;
- return security_device_sid(machine_bdf, sid);
+ return security_device_sid(sbdf.sbdf, sid);
#else
return -EINVAL;
#endif
@@ -1066,15 +1063,15 @@ static uint32_t flask_iommu_resource_use
}
static int cf_check flask_map_domain_irq(
- struct domain *d, int irq, const void *data)
+ struct domain *d, int irq, const pci_sbdf_t *sbdf)
{
uint32_t sid, dsid;
int rc = -EPERM;
struct avc_audit_data ad;
uint32_t dperm = flask_iommu_resource_use_perm(d);
- if ( irq >= nr_static_irqs && data )
- rc = flask_map_domain_msi(d, irq, data, &sid, &ad);
+ if ( irq >= nr_static_irqs && sbdf )
+ rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
else
rc = get_irq_sid(irq, &sid, &ad);
@@ -1091,32 +1088,15 @@ static int cf_check flask_map_domain_irq
return rc;
}
-static int flask_unmap_domain_msi (
- struct domain *d, int irq, const void *data, uint32_t *sid,
- struct avc_audit_data *ad)
-{
-#ifdef CONFIG_HAS_PCI_MSI
- const struct pci_dev *pdev = data;
- uint32_t machine_bdf = (pdev->seg << 16) | (pdev->bus << 8) | pdev->devfn;
-
- AVC_AUDIT_DATA_INIT(ad, DEV);
- ad->device = machine_bdf;
-
- return security_device_sid(machine_bdf, sid);
-#else
- return -EINVAL;
-#endif
-}
-
static int cf_check flask_unmap_domain_irq(
- struct domain *d, int irq, const void *data)
+ struct domain *d, int irq, const pci_sbdf_t *sbdf)
{
uint32_t sid;
int rc = -EPERM;
struct avc_audit_data ad;
- if ( irq >= nr_static_irqs && data )
- rc = flask_unmap_domain_msi(d, irq, data, &sid, &ad);
+ if ( irq >= nr_static_irqs && sbdf )
+ rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
else
rc = get_irq_sid(irq, &sid, &ad);
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 23/24] XSM: fold xsm_{,un}map_domain_irq() hooks
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (21 preceding siblings ...)
2026-07-28 13:25 ` [PATCH 22/24] XSM: pass just SBDF to xsm_{,un}map_domain_irq() Jan Beulich
@ 2026-07-28 13:26 ` Jan Beulich
2026-07-28 13:26 ` [PATCH 24/24] XSM: fold xsm_{,un}bind_pt_irq() hooks Jan Beulich
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:26 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné,
Julien Grall, Stefano Stabellini, Volodymyr Babchuk,
Bertrand Marquis, Michal Orzel
Like other resource management hooks they are (now) mainly different in
"add resource" vs "remove resource". Hence like in other cases a single
hook can easily serve both purposes, with minor tweaking of
flask_map_domain_irq(). While adjusting that function, also defer the
setting of local variables only needed in the "map" case.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/arm/domctl.c
+++ b/xen/arch/arm/domctl.c
@@ -100,7 +100,7 @@ long arch_do_domctl(struct xen_domctl *d
* done by the 2 hypercalls for consistency with other
* architectures.
*/
- rc = xsm_map_domain_irq(XSM_HOOK, d, irq, NULL);
+ rc = xsm_map_domain_irq(XSM_HOOK, d, irq, NULL, true);
if ( rc )
return rc;
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -2214,7 +2214,7 @@ int map_domain_pirq(
return 0;
}
- ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi ? &msi->sbdf : NULL);
+ ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi ? &msi->sbdf : NULL, true);
if ( ret )
{
dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n",
@@ -2441,8 +2441,8 @@ int unmap_domain_pirq(struct domain *d,
* domain. Skip the XSM check since this is a Xen-initiated action.
*/
if ( !d->is_dying )
- ret = xsm_unmap_domain_irq(XSM_HOOK, d, irq,
- msi_desc ? &msi_desc->dev->sbdf : NULL);
+ ret = xsm_map_domain_irq(XSM_HOOK, d, irq,
+ msi_desc ? &msi_desc->dev->sbdf : NULL, false);
if ( ret )
goto done;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -470,7 +470,8 @@ static XSM_INLINE int xsm_map_domain_pir
#endif /* CONFIG_HAS_PIRQ */
static XSM_INLINE int xsm_map_domain_irq(
- XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
+ XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf,
+ bool allow)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
@@ -490,13 +491,6 @@ static XSM_INLINE int xsm_unbind_pt_irq(
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int xsm_unmap_domain_irq(
- XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
-{
- XSM_ASSERT_ACTION(XSM_HOOK);
- return xsm_default_action(action, current->domain, d);
-}
-
static XSM_INLINE int xsm_irq_permission(
XSM_DEFAULT_ARG struct domain *d, int pirq, bool allow)
{
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -71,8 +71,7 @@ XSM_HOOK(int, schedop_shutdown, struct d
XSM_HOOK(int, map_domain_pirq, struct domain *, bool)
#endif
-XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *)
-XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const pci_sbdf_t *)
+XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *, bool)
XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1063,12 +1063,11 @@ static uint32_t flask_iommu_resource_use
}
static int cf_check flask_map_domain_irq(
- struct domain *d, int irq, const pci_sbdf_t *sbdf)
+ struct domain *d, int irq, const pci_sbdf_t *sbdf, bool access)
{
- uint32_t sid, dsid;
+ uint32_t sid, dsid, dperm;
int rc = -EPERM;
struct avc_audit_data ad;
- uint32_t dperm = flask_iommu_resource_use_perm(d);
if ( irq >= nr_static_irqs && sbdf )
rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
@@ -1078,33 +1077,16 @@ static int cf_check flask_map_domain_irq
if ( rc )
return rc;
- dsid = domain_sid(d);
-
- rc = avc_current_has_perm(sid, SECCLASS_RESOURCE, RESOURCE__ADD_IRQ, &ad);
- if ( rc )
+ rc = avc_current_has_perm(sid, SECCLASS_RESOURCE,
+ access ? RESOURCE__ADD_IRQ : RESOURCE__REMOVE_IRQ,
+ &ad);
+ if ( rc || access )
return rc;
- rc = avc_has_perm(dsid, sid, SECCLASS_RESOURCE, dperm, &ad);
- return rc;
-}
-
-static int cf_check flask_unmap_domain_irq(
- struct domain *d, int irq, const pci_sbdf_t *sbdf)
-{
- uint32_t sid;
- int rc = -EPERM;
- struct avc_audit_data ad;
-
- if ( irq >= nr_static_irqs && sbdf )
- rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
- else
- rc = get_irq_sid(irq, &sid, &ad);
-
- if ( rc )
- return rc;
+ dsid = domain_sid(d);
+ dperm = flask_iommu_resource_use_perm(d);
- rc = avc_current_has_perm(sid, SECCLASS_RESOURCE, RESOURCE__REMOVE_IRQ, &ad);
- return rc;
+ return avc_has_perm(dsid, sid, SECCLASS_RESOURCE, dperm, &ad);
}
static int cf_check flask_bind_pt_irq(
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH 24/24] XSM: fold xsm_{,un}bind_pt_irq() hooks
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
` (22 preceding siblings ...)
2026-07-28 13:26 ` [PATCH 23/24] XSM: fold xsm_{,un}map_domain_irq() hooks Jan Beulich
@ 2026-07-28 13:26 ` Jan Beulich
23 siblings, 0 replies; 25+ messages in thread
From: Jan Beulich @ 2026-07-28 13:26 UTC (permalink / raw)
To: xen-devel@lists.xenproject.org
Cc: Daniel Smith, Andrew Cooper, Teddy Astie, Roger Pau Monné,
Julien Grall, Stefano Stabellini, Volodymyr Babchuk,
Bertrand Marquis, Michal Orzel
Like other resource management hooks they are mainly different in "add
resource" vs "remove resource". Hence like in other cases a single hook
can easily serve both purposes, with minor tweaking of
flask_bind_pt_irq(). While adjusting that function, also defer the setting
of "dperm", which is only needed in the "map" case.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/arm/domctl.c
+++ b/xen/arch/arm/domctl.c
@@ -104,7 +104,7 @@ long arch_do_domctl(struct xen_domctl *d
if ( rc )
return rc;
- rc = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind);
+ rc = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind, true);
if ( rc )
return rc;
@@ -140,7 +140,7 @@ long arch_do_domctl(struct xen_domctl *d
if ( irq != virq )
return -EINVAL;
- rc = xsm_unbind_pt_irq(XSM_DM_PRIV, d, bind);
+ rc = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind, false);
if ( rc )
return rc;
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -622,7 +622,7 @@ long arch_do_domctl(
if ( !is_hvm_domain(d) )
break;
- ret = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind);
+ ret = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind, true);
if ( ret )
break;
@@ -660,7 +660,7 @@ long arch_do_domctl(
if ( !is_hvm_domain(d) )
break;
- ret = xsm_unbind_pt_irq(XSM_DM_PRIV, d, bind);
+ ret = xsm_bind_pt_irq(XSM_DM_PRIV, d, bind, false);
if ( ret )
break;
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -478,14 +478,8 @@ static XSM_INLINE int xsm_map_domain_irq
}
static XSM_INLINE int xsm_bind_pt_irq(
- XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind)
-{
- XSM_ASSERT_ACTION(XSM_DM_PRIV);
- return xsm_default_action(action, current->domain, d);
-}
-
-static XSM_INLINE int xsm_unbind_pt_irq(
- XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind)
+ XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind,
+ bool allow)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
return xsm_default_action(action, current->domain, d);
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -72,8 +72,8 @@ XSM_HOOK(int, map_domain_pirq, struct do
#endif
XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *, bool)
-XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
-XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
+XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *,
+ bool)
XSM_HOOK(int, irq_permission, struct domain *, int, bool)
XSM_HOOK(int, iomem_permission, struct domain *, uint64_t, uint64_t, bool)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1090,16 +1090,15 @@ static int cf_check flask_map_domain_irq
}
static int cf_check flask_bind_pt_irq(
- struct domain *d, struct xen_domctl_bind_pt_irq *bind)
+ struct domain *d, struct xen_domctl_bind_pt_irq *bind, bool access)
{
- uint32_t dsid, rsid;
+ uint32_t dsid, rsid, dperm;
int rc = -EPERM;
int irq;
struct avc_audit_data ad;
- uint32_t dperm = flask_iommu_resource_use_perm(d);
- rc = current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__ADD);
- if ( rc )
+ rc = current_has_perm(d, SECCLASS_RESOURCE, resource_to_perm(access));
+ if ( rc || access )
return rc;
irq = domain_pirq_to_irq(d, bind->machine_irq);
@@ -1113,13 +1112,9 @@ static int cf_check flask_bind_pt_irq(
return rc;
dsid = domain_sid(d);
- return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, dperm, &ad);
-}
+ dperm = flask_iommu_resource_use_perm(d);
-static int cf_check flask_unbind_pt_irq(
- struct domain *d, struct xen_domctl_bind_pt_irq *bind)
-{
- return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
+ return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, dperm, &ad);
}
static int cf_check flask_irq_permission(
^ permalink raw reply [flat|nested] 25+ messages in thread
end of thread, other threads:[~2026-07-28 13:28 UTC | newest]
Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 13:10 [PATCH 00/24] XSM: follow-on to XSAs 492 and 499 Jan Beulich
2026-07-28 13:13 ` [PATCH 01/24] XSM: reduce redundancy in hook machinery Jan Beulich
2026-07-28 13:14 ` [PATCH 02/24] XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y Jan Beulich
2026-07-28 13:14 ` [PATCH 03/24] XSM: make .{,un}map_domain_pirq() hooks dependent upon HAS_PIRQ=y Jan Beulich
2026-07-28 13:14 ` [PATCH 04/24] XSM: make PCI hooks dependent upon HAS_PCI=y Jan Beulich
2026-07-28 13:15 ` [PATCH 05/24] XSM: make .iomem_mapping_vcpi() hook dependent upon HAS_VPCI=y Jan Beulich
2026-07-28 13:15 ` [PATCH 06/24] XSM: make .kexec() hook dependent upon KEXEC=y Jan Beulich
2026-07-28 13:15 ` [PATCH 07/24] XSM: make .hypfs() hook dependent upon HYPFS=y Jan Beulich
2026-07-28 13:16 ` [PATCH 08/24] XSM: make .hvm_altp2mhvm_op() hook dependent upon ALTP2M=y Jan Beulich
2026-07-28 13:17 ` [PATCH 09/24] XSM: make .hvm_param*() hooks dependent upon HVM=y Jan Beulich
2026-07-28 13:17 ` [PATCH 10/24] XSM: make .dm_op() hook dependent upon IOREQ_SERVER=y Jan Beulich
2026-07-28 13:18 ` [PATCH 11/24] XSM: make certain x86-specific hooks dependent upon PV=y Jan Beulich
2026-07-28 13:18 ` [PATCH 12/24] x86/mm: get_page_from_l1e() is PV-or-shadow-only Jan Beulich
2026-07-28 13:19 ` [PATCH 13/24] x86: restrict PHYSDEVOP_* when PV=n Jan Beulich
2026-07-28 13:19 ` [PATCH 14/24] XSM/dummy: fold cf_check into XSM_INLINE Jan Beulich
2026-07-28 13:20 ` [PATCH 15/24] XSM/dummy: drop redundant return statements Jan Beulich
2026-07-28 13:20 ` [PATCH 16/24] XSM: suppress hypercall when XSM=n Jan Beulich
2026-07-28 13:22 ` [PATCH 17/24] XSM: make Argo hooks well-formed ones Jan Beulich
2026-07-28 13:22 ` [PATCH 18/24] XSM: make XSM " Jan Beulich
2026-07-28 13:23 ` [PATCH 19/24] XSM: convert "allow" (Flask: "access") parameters to bool Jan Beulich
2026-07-28 13:23 ` [PATCH 20/24] XSM: fold xsm_{,un}map_domain_pirq() hooks Jan Beulich
2026-07-28 13:24 ` [PATCH 21/24] x86: type-correct last parameter of map_domain_pirq() Jan Beulich
2026-07-28 13:25 ` [PATCH 22/24] XSM: pass just SBDF to xsm_{,un}map_domain_irq() Jan Beulich
2026-07-28 13:26 ` [PATCH 23/24] XSM: fold xsm_{,un}map_domain_irq() hooks Jan Beulich
2026-07-28 13:26 ` [PATCH 24/24] XSM: fold xsm_{,un}bind_pt_irq() hooks Jan Beulich
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.