[PATCH v14 0/4] xen/domain: domain ID allocation

[PATCH v14 0/4] xen/domain: domain ID allocation

[dmkhn]

Patch 1 introduces new domid_{alloc,free} calls.
Patch 2 is a prep change for domain ID allocator test.
Patch 3 introduces some basic testing for domain ID allocator.
Patch 4 adjusts create_dom0() messages (use %pd).

Link to v13: https://lore.kernel.org/xen-devel/20250730174042.1632011-1-dmukhin@ford.com/
Link to CI: https://gitlab.com/xen-project/people/dmukhin/xen/-/pipelines/1973569163

Denis Mukhin (4):
  xen/domain: unify domain ID allocation
  tools/include: move xc_bitops.h to xen-tools/bitops.h
  tools/tests: introduce unit tests for domain ID allocator
  xen/domain: update create_dom0() messages

 .../xen-tools/bitops.h}                       | 16 +++-
 tools/libs/ctrl/xc_misc.c                     | 13 +--
 tools/libs/guest/xg_dom_elfloader.c           |  3 +-
 tools/libs/guest/xg_dom_hvmloader.c           |  3 +-
 tools/libs/guest/xg_private.h                 |  2 +-
 tools/libs/guest/xg_sr_common.h               |  3 +-
 tools/tests/Makefile                          |  2 +-
 tools/tests/domid/.gitignore                  |  2 +
 tools/tests/domid/Makefile                    | 56 +++++++++++
 tools/tests/domid/harness.h                   | 54 +++++++++++
 tools/tests/domid/include/xen/domain.h        |  1 +
 tools/tests/domid/test-domid.c                | 86 +++++++++++++++++
 xen/arch/arm/domain_build.c                   | 13 ++-
 xen/arch/x86/setup.c                          | 11 ++-
 xen/common/Makefile                           |  1 +
 xen/common/device-tree/dom0less-build.c       | 15 +--
 xen/common/domain.c                           |  2 +
 xen/common/domctl.c                           | 43 ++-------
 xen/common/domid.c                            | 95 +++++++++++++++++++
 xen/include/xen/domain.h                      |  3 +
 xen/lib/find-next-bit.c                       |  5 +
 21 files changed, 362 insertions(+), 67 deletions(-)
 rename tools/{libs/ctrl/xc_bitops.h => include/xen-tools/bitops.h} (84%)
 create mode 100644 tools/tests/domid/.gitignore
 create mode 100644 tools/tests/domid/Makefile
 create mode 100644 tools/tests/domid/harness.h
 create mode 120000 tools/tests/domid/include/xen/domain.h
 create mode 100644 tools/tests/domid/test-domid.c
 create mode 100644 xen/common/domid.c

-- 
2.34.1

[PATCH v14 1/4] xen/domain: unify domain ID allocation

[dmkhn]

From: Denis Mukhin <dmukhin@ford.com> 

Currently, there are two different domain ID allocation implementations:

  1) Sequential IDs allocation in dom0less Arm code based on max_init_domid;

  2) Sequential IDs allocation in XEN_DOMCTL_createdomain; does not use
     max_init_domid (both Arm and x86).

The domain ID allocation covers dom0 or late hwdom, predefined domains,
post-boot domains, excluding Xen system domains (domid >=
DOMID_FIRST_RESERVED).

It makes sense to have a common helper code for such task across architectures
(Arm and x86) and between dom0less / toolstack domU allocation.

Note, fixing dependency on max_init_domid is out of scope of this patch.

Wrap the domain ID allocation as an arch-independent function domid_alloc() in
new common/domid.c based on the bitmap.

Allocation algorithm:
- If an explicit domain ID is provided, verify its availability and use it if
  ID is not used;
- If DOMID_INVALID is provided, search the range [1..DOMID_FIRST_RESERVED-1],
  starting from the last used ID.
  Implementation guarantees that two consecutive calls will never return the
  same ID. ID#0 is reserved for the first boot domain (currently, dom0) and
  excluded from the allocation range.

Remove is_free_domid() helper as it is not needed now.

No functional change intended.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
---
Changes since v13:
- fixed panic() formatting in x86's create_dom0()
- fixed login in do_domctl()
- optimizations in domid_alloc()
---
 xen/arch/arm/domain_build.c             |  7 +-
 xen/arch/x86/setup.c                    |  7 +-
 xen/common/Makefile                     |  1 +
 xen/common/device-tree/dom0less-build.c | 15 ++--
 xen/common/domain.c                     |  2 +
 xen/common/domctl.c                     | 43 ++---------
 xen/common/domid.c                      | 95 +++++++++++++++++++++++++
 xen/include/xen/domain.h                |  3 +
 8 files changed, 126 insertions(+), 47 deletions(-)
 create mode 100644 xen/common/domid.c

diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c
index 463ae4474d30..789f2b9d3ce7 100644
--- a/xen/arch/arm/domain_build.c
+++ b/xen/arch/arm/domain_build.c
@@ -2050,6 +2050,7 @@ void __init create_dom0(void)
         .grant_opts = XEN_DOMCTL_GRANT_version(opt_gnttab_max_version),
     };
     unsigned int flags = CDF_privileged | CDF_hardware;
+    domid_t domid;
     int rc;
 
     /* The vGIC for DOM0 is exactly emulating the hardware GIC */
@@ -2074,7 +2075,11 @@ void __init create_dom0(void)
     if ( !llc_coloring_enabled )
         flags |= CDF_directmap;
 
-    dom0 = domain_create(0, &dom0_cfg, flags);
+    domid = domid_alloc(0);
+    if ( domid == DOMID_INVALID )
+        panic("Error allocating domain ID 0\n");
+
+    dom0 = domain_create(domid, &dom0_cfg, flags);
     if ( IS_ERR(dom0) )
         panic("Error creating domain 0 (rc = %ld)\n", PTR_ERR(dom0));
 
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 1543dd251cc6..398da734c0c5 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1047,8 +1047,11 @@ static struct domain *__init create_dom0(struct boot_info *bi)
     if ( iommu_enabled )
         dom0_cfg.flags |= XEN_DOMCTL_CDF_iommu;
 
-    /* Create initial domain.  Not d0 for pvshim. */
-    bd->domid = get_initial_domain_id();
+    /* Allocate initial domain ID.  Not d0 for pvshim. */
+    bd->domid = domid_alloc(get_initial_domain_id());
+    if ( bd->domid == DOMID_INVALID )
+        panic("Error allocating domain ID %u\n", get_initial_domain_id());
+
     d = domain_create(bd->domid, &dom0_cfg,
                       pv_shim ? 0 : CDF_privileged | CDF_hardware);
     if ( IS_ERR(d) )
diff --git a/xen/common/Makefile b/xen/common/Makefile
index c316957fcb36..0c7d0f5d46e1 100644
--- a/xen/common/Makefile
+++ b/xen/common/Makefile
@@ -11,6 +11,7 @@ obj-$(filter-out $(CONFIG_X86),$(CONFIG_ACPI)) += device.o
 obj-$(CONFIG_DEVICE_TREE_PARSE) += device-tree/
 obj-$(CONFIG_IOREQ_SERVER) += dm.o
 obj-y += domain.o
+obj-y += domid.o
 obj-y += event_2l.o
 obj-y += event_channel.o
 obj-$(CONFIG_EVTCHN_FIFO) += event_fifo.o
diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c
index 6bb038111de9..f4b6b515d2d2 100644
--- a/xen/common/device-tree/dom0less-build.c
+++ b/xen/common/device-tree/dom0less-build.c
@@ -833,6 +833,7 @@ void __init create_domUs(void)
     {
         struct kernel_info ki = KERNEL_INFO_INIT;
         int rc = parse_dom0less_node(node, &ki.bd);
+        domid_t domid;
 
         if ( rc == -ENOENT )
             continue;
@@ -842,13 +843,13 @@ void __init create_domUs(void)
         if ( (max_init_domid + 1) >= DOMID_FIRST_RESERVED )
             panic("No more domain IDs available\n");
 
-        /*
-         * The variable max_init_domid is initialized with zero, so here it's
-         * very important to use the pre-increment operator to call
-         * domain_create() with a domid > 0. (domid == 0 is reserved for Dom0)
-         */
-        ki.bd.d = domain_create(++max_init_domid,
-                                &ki.bd.create_cfg, ki.bd.create_flags);
+        domid = domid_alloc(DOMID_INVALID);
+        if ( domid == DOMID_INVALID )
+            panic("Error allocating ID for domain %s\n", dt_node_name(node));
+
+        max_init_domid = max(max_init_domid, domid);
+
+        ki.bd.d = domain_create(domid, &ki.bd.create_cfg, ki.bd.create_flags);
         if ( IS_ERR(ki.bd.d) )
             panic("Error creating domain %s (rc = %ld)\n",
                   dt_node_name(node), PTR_ERR(ki.bd.d));
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 5241a1629eeb..a7e303253d1a 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -692,6 +692,8 @@ static void _domain_destroy(struct domain *d)
 
     lock_profile_deregister_struct(LOCKPROF_TYPE_PERDOM, d);
 
+    domid_free(d->domain_id);
+
     free_domain_struct(d);
 }
 
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index f2a7caaf853c..71e712c1f316 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -51,20 +51,6 @@ static int xenctl_bitmap_to_nodemask(nodemask_t *nodemask,
                                    MAX_NUMNODES);
 }
 
-static inline int is_free_domid(domid_t dom)
-{
-    struct domain *d;
-
-    if ( dom >= DOMID_FIRST_RESERVED )
-        return 0;
-
-    if ( (d = rcu_lock_domain_by_id(dom)) == NULL )
-        return 1;
-
-    rcu_unlock_domain(d);
-    return 0;
-}
-
 void getdomaininfo(struct domain *d, struct xen_domctl_getdomaininfo *info)
 {
     struct vcpu *v;
@@ -423,36 +409,19 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
 
     case XEN_DOMCTL_createdomain:
     {
-        domid_t        dom;
-        static domid_t rover = 0;
+        /* NB: ID#0 is reserved, find the first suitable ID instead. */
+        domid_t domid = domid_alloc(op->domain ?: DOMID_INVALID);
 
-        dom = op->domain;
-        if ( (dom > 0) && (dom < DOMID_FIRST_RESERVED) )
+        if ( domid == DOMID_INVALID )
         {
             ret = -EEXIST;
-            if ( !is_free_domid(dom) )
-                break;
-        }
-        else
-        {
-            for ( dom = rover + 1; dom != rover; dom++ )
-            {
-                if ( dom == DOMID_FIRST_RESERVED )
-                    dom = 1;
-                if ( is_free_domid(dom) )
-                    break;
-            }
-
-            ret = -ENOMEM;
-            if ( dom == rover )
-                break;
-
-            rover = dom;
+            break;
         }
 
-        d = domain_create(dom, &op->u.createdomain, false);
+        d = domain_create(domid, &op->u.createdomain, false);
         if ( IS_ERR(d) )
         {
+            domid_free(domid);
             ret = PTR_ERR(d);
             d = NULL;
             break;
diff --git a/xen/common/domid.c b/xen/common/domid.c
new file mode 100644
index 000000000000..7839a2885810
--- /dev/null
+++ b/xen/common/domid.c
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Domain ID allocator.
+ *
+ * Covers dom0 or late hwdom, predefined domains, post-boot domains.
+ * Excludes system domains (ID >= DOMID_FIRST_RESERVED).
+ *
+ * Copyright 2025 Ford Motor Company
+ */
+
+#include <xen/domain.h>
+
+static DEFINE_SPINLOCK(domid_lock);
+static DECLARE_BITMAP(domid_bitmap, DOMID_FIRST_RESERVED);
+
+/*
+ * Allocate domain ID.
+ *
+ * @param domid Domain ID hint:
+ * - If an explicit domain ID is provided, verify its availability and use it
+ *   if ID is not used;
+ * - If DOMID_INVALID is provided, search [1..DOMID_FIRST_RESERVED-1] range,
+ *   starting from the last used ID. Implementation guarantees that two
+ *   consecutive calls will never return the same ID. ID#0 is reserved for
+ *   the first boot domain (currently, dom0) and excluded from the allocation
+ *   range.
+ * @return Valid domain ID in case of successful allocation,
+ *         DOMID_INVALID - otherwise.
+ */
+domid_t domid_alloc(domid_t domid)
+{
+    static domid_t domid_last;
+
+    spin_lock(&domid_lock);
+
+    /* Exact match. */
+    if ( domid < DOMID_FIRST_RESERVED )
+    {
+        if ( __test_and_set_bit(domid, domid_bitmap) )
+            domid = DOMID_INVALID;
+    }
+    /*
+     * Exhaustive search.
+     *
+     * Domain ID#0 is reserved for the first boot domain (e.g. control domain)
+     * and excluded from allocation.
+     */
+    else
+    {
+        domid_t num = DOMID_FIRST_RESERVED;
+
+        domid = find_next_zero_bit(domid_bitmap, num, domid_last + 1);
+        if ( domid == num && domid_last != 0 )
+        {
+            num = domid_last + 1;
+            domid = find_next_zero_bit(domid_bitmap, num, 1);
+        }
+
+        ASSERT(domid <= DOMID_FIRST_RESERVED);
+        if ( domid < num )
+        {
+            __set_bit(domid, domid_bitmap);
+            domid_last = domid;
+        }
+        else
+            domid = DOMID_INVALID;
+    }
+
+    spin_unlock(&domid_lock);
+
+    return domid;
+}
+
+void domid_free(domid_t domid)
+{
+    int rc;
+
+    ASSERT(domid <= DOMID_FIRST_RESERVED);
+
+    spin_lock(&domid_lock);
+    rc = __test_and_clear_bit(domid, domid_bitmap);
+    spin_unlock(&domid_lock);
+
+    ASSERT(rc);
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h
index e10baf2615fd..8aab05ae93c8 100644
--- a/xen/include/xen/domain.h
+++ b/xen/include/xen/domain.h
@@ -38,6 +38,9 @@ void arch_get_domain_info(const struct domain *d,
 
 domid_t get_initial_domain_id(void);
 
+domid_t domid_alloc(domid_t domid);
+void domid_free(domid_t domid);
+
 /* CDF_* constant. Internal flags for domain creation. */
 /* Is this a privileged domain? */
 #define CDF_privileged           (1U << 0)
-- 
2.34.1

[PATCH v14 2/4] tools/include: move xc_bitops.h to xen-tools/bitops.h

[dmkhn]

From: Denis Mukhin <dmukhin@ford.com> 

Move xc_bitops.h to common tools location to be shared between
the toolstack and unit test code.

Adjust the guard in xen-tools/bitops.h

Correct the #include directives and comments referring to the old
xc_bitops.h in the toolstack code.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
---
Changes since v13:
- new patch
---
 .../ctrl/xc_bitops.h => include/xen-tools/bitops.h} |  6 +++---
 tools/libs/ctrl/xc_misc.c                           | 13 +++++++------
 tools/libs/guest/xg_dom_elfloader.c                 |  3 ++-
 tools/libs/guest/xg_dom_hvmloader.c                 |  3 ++-
 tools/libs/guest/xg_private.h                       |  2 +-
 tools/libs/guest/xg_sr_common.h                     |  3 +--
 6 files changed, 16 insertions(+), 14 deletions(-)
 rename tools/{libs/ctrl/xc_bitops.h => include/xen-tools/bitops.h} (95%)

diff --git a/tools/libs/ctrl/xc_bitops.h b/tools/include/xen-tools/bitops.h
similarity index 95%
rename from tools/libs/ctrl/xc_bitops.h
rename to tools/include/xen-tools/bitops.h
index 4a776dc3a57f..681482f6759f 100644
--- a/tools/libs/ctrl/xc_bitops.h
+++ b/tools/include/xen-tools/bitops.h
@@ -1,5 +1,5 @@
-#ifndef XC_BITOPS_H
-#define XC_BITOPS_H 1
+#ifndef __XEN_TOOLS_BITOPS_H__
+#define __XEN_TOOLS_BITOPS_H__
 
 /* bitmap operations for single threaded access */
 
@@ -81,4 +81,4 @@ static inline void bitmap_or(void *_dst, const void *_other,
         dst[i] |= other[i];
 }
 
-#endif  /* XC_BITOPS_H */
+#endif  /* __XEN_TOOLS_BITOPS_H__ */
diff --git a/tools/libs/ctrl/xc_misc.c b/tools/libs/ctrl/xc_misc.c
index 33e87bac2868..10ddf85667a9 100644
--- a/tools/libs/ctrl/xc_misc.c
+++ b/tools/libs/ctrl/xc_misc.c
@@ -17,8 +17,8 @@
  * License along with this library; If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "xc_bitops.h"
 #include "xc_private.h"
+#include <xen-tools/bitops.h>
 #include <xen/hvm/hvm_op.h>
 
 int xc_get_max_cpus(xc_interface *xch)
@@ -94,11 +94,12 @@ xc_cpumap_t xc_cpumap_alloc(xc_interface *xch)
 }
 
 /*
- * xc_bitops.h has macros that do this as well - however they assume that
- * the bitmask is word aligned but xc_cpumap_t is only guaranteed to be
- * byte aligned and so we need byte versions for architectures which do
- * not support misaligned accesses (which is basically everyone
- * but x86, although even on x86 it can be inefficient).
+ * <xen-tools/bitops.h> has macros that do this as well - however they
+ * assume that the bitmask is word aligned but xc_cpumap_t is only
+ * guaranteed to be byte aligned and so we need byte versions for
+ * architectures which do not support misaligned accesses (which is
+ * basically everyone but x86, although even on x86 it can be
+ * inefficient).
  *
  * NOTE: The xc_bitops macros now use byte alignment.
  * TODO: Clean up the users of this interface.
diff --git a/tools/libs/guest/xg_dom_elfloader.c b/tools/libs/guest/xg_dom_elfloader.c
index f17930d98bf7..8531e90f8e21 100644
--- a/tools/libs/guest/xg_dom_elfloader.c
+++ b/tools/libs/guest/xg_dom_elfloader.c
@@ -25,8 +25,9 @@
 #include <stdarg.h>
 #include <inttypes.h>
 
+#include <xen-tools/bitops.h>
+
 #include "xg_private.h"
-#include "xc_bitops.h"
 
 #define XEN_VER "xen-3.0"
 
diff --git a/tools/libs/guest/xg_dom_hvmloader.c b/tools/libs/guest/xg_dom_hvmloader.c
index 39e1e5f579a7..0f569c20c522 100644
--- a/tools/libs/guest/xg_dom_hvmloader.c
+++ b/tools/libs/guest/xg_dom_hvmloader.c
@@ -24,8 +24,9 @@
 #include <inttypes.h>
 #include <assert.h>
 
+#include <xen-tools/bitops.h>
+
 #include "xg_private.h"
-#include "xc_bitops.h"
 
 /* ------------------------------------------------------------------------ */
 /* parse elf binary                                                         */
diff --git a/tools/libs/guest/xg_private.h b/tools/libs/guest/xg_private.h
index d73947094f2e..285229cf82a3 100644
--- a/tools/libs/guest/xg_private.h
+++ b/tools/libs/guest/xg_private.h
@@ -28,9 +28,9 @@
 #include <sys/stat.h>
 
 #include "xc_private.h"
-#include "xc_bitops.h"
 #include "xenguest.h"
 
+#include <xen-tools/bitops.h>
 #include <xen/memory.h>
 #include <xen/elfnote.h>
 #include <xen/libelf/libelf.h>
diff --git a/tools/libs/guest/xg_sr_common.h b/tools/libs/guest/xg_sr_common.h
index 2f058ee3a6ff..2e583f2eac72 100644
--- a/tools/libs/guest/xg_sr_common.h
+++ b/tools/libs/guest/xg_sr_common.h
@@ -2,11 +2,10 @@
 #define __COMMON__H
 
 #include <stdbool.h>
+#include <xen-tools/bitops.h>
 
 #include "xg_private.h"
 #include "xg_save_restore.h"
-#include "xc_bitops.h"
-
 #include "xg_sr_stream_format.h"
 
 /* String representation of Domain Header types. */
-- 
2.34.1

[PATCH v14 3/4] tools/tests: introduce unit tests for domain ID allocator

[dmkhn]

From: Denis Mukhin <dmukhin@ford.com> 

Introduce some basic infrastructure for doing domain ID allocation unit tests,
and add a few tests that ensure correctness of the domain ID allocator.

Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness code.

Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
---
Changes since v13:
- reworked bitops integration
- hooked xen/lib/find-next-bit.c
- cleaned up harness.h code
- made test to use more IDs
---
 tools/include/xen-tools/bitops.h       | 10 +++
 tools/tests/Makefile                   |  2 +-
 tools/tests/domid/.gitignore           |  2 +
 tools/tests/domid/Makefile             | 56 +++++++++++++++++
 tools/tests/domid/harness.h            | 54 ++++++++++++++++
 tools/tests/domid/include/xen/domain.h |  1 +
 tools/tests/domid/test-domid.c         | 86 ++++++++++++++++++++++++++
 xen/lib/find-next-bit.c                |  5 ++
 8 files changed, 215 insertions(+), 1 deletion(-)
 create mode 100644 tools/tests/domid/.gitignore
 create mode 100644 tools/tests/domid/Makefile
 create mode 100644 tools/tests/domid/harness.h
 create mode 120000 tools/tests/domid/include/xen/domain.h
 create mode 100644 tools/tests/domid/test-domid.c

diff --git a/tools/include/xen-tools/bitops.h b/tools/include/xen-tools/bitops.h
index 681482f6759f..3b98fba6d74c 100644
--- a/tools/include/xen-tools/bitops.h
+++ b/tools/include/xen-tools/bitops.h
@@ -12,6 +12,16 @@
 #define BITS_PER_LONG 32
 #endif
 
+#define ffsl(x)       __builtin_ffsl(x)
+
+#define BIT_WORD(nr)  ((nr) / BITS_PER_LONG)
+
+#define BITS_TO_LONGS(bits) \
+    (((bits) + BITS_PER_LONG - 1) / BITS_PER_LONG)
+
+#define DECLARE_BITMAP(name, bits) \
+    unsigned long name[BITS_TO_LONGS(bits)]
+
 #define BITMAP_ENTRY(_nr,_bmap) ((_bmap))[(_nr) / 8]
 #define BITMAP_SHIFT(_nr) ((_nr) % 8)
 
diff --git a/tools/tests/Makefile b/tools/tests/Makefile
index 36928676a666..ff1666425436 100644
--- a/tools/tests/Makefile
+++ b/tools/tests/Makefile
@@ -1,7 +1,7 @@
 XEN_ROOT = $(CURDIR)/../..
 include $(XEN_ROOT)/tools/Rules.mk
 
-SUBDIRS-y :=
+SUBDIRS-y := domid
 SUBDIRS-y += resource
 SUBDIRS-$(CONFIG_X86) += cpu-policy
 SUBDIRS-$(CONFIG_X86) += tsx
diff --git a/tools/tests/domid/.gitignore b/tools/tests/domid/.gitignore
new file mode 100644
index 000000000000..70e306b3c074
--- /dev/null
+++ b/tools/tests/domid/.gitignore
@@ -0,0 +1,2 @@
+*.o
+test-domid
diff --git a/tools/tests/domid/Makefile b/tools/tests/domid/Makefile
new file mode 100644
index 000000000000..d96ceca6d954
--- /dev/null
+++ b/tools/tests/domid/Makefile
@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Unit tests for domain ID allocator.
+#
+# Copyright 2025 Ford Motor Company
+
+XEN_ROOT=$(CURDIR)/../../..
+include $(XEN_ROOT)/tools/Rules.mk
+
+TESTS := test-domid
+
+vpath domid.c $(XEN_ROOT)/xen/common/
+vpath find-next-bit.c $(XEN_ROOT)/xen/lib/
+
+.PHONY: all
+all: $(TESTS)
+
+.PHONY: run
+run: $(TESTS)
+	$(foreach t,$(TESTS),./$(t);)
+
+.PHONY: clean
+clean:
+	$(RM) -- *.o $(TESTS) $(DEPS_RM)
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -- *~
+
+.PHONY: install
+install: all
+	$(INSTALL_DIR) $(DESTDIR)$(LIBEXEC)/tests
+	$(INSTALL_PROG) test-domid $(DESTDIR)$(LIBEXEC)/tests
+
+.PHONY: uninstall
+uninstall:
+	$(RM) -- $(DESTDIR)$(LIBEXEC)/tests/test-domid
+
+CFLAGS += -D__XEN_TOOLS__
+# find-next-bit.c
+CFLAGS += '-DEXPORT_SYMBOL(x)=' \
+          -Dfind_first_bit \
+          -Dfind_first_zero_bit \
+          -Dfind_next_bit \
+          -Dfind_next_bit_le \
+          -Dfind_next_zero_bit_le
+CFLAGS += $(APPEND_CFLAGS)
+CFLAGS += $(CFLAGS_xeninclude)
+CFLAGS += -I./include/
+
+LDFLAGS += $(APPEND_LDFLAGS)
+
+test-domid: domid.o find-next-bit.o test-domid.o
+	$(CC) $^ -o $@ $(LDFLAGS)
+
+-include $(DEPS_INCLUDE)
diff --git a/tools/tests/domid/harness.h b/tools/tests/domid/harness.h
new file mode 100644
index 000000000000..b043519dcb35
--- /dev/null
+++ b/tools/tests/domid/harness.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Unit test harness for domain ID allocator.
+ *
+ * Copyright 2025 Ford Motor Company
+ */
+
+#ifndef _TEST_HARNESS_
+#define _TEST_HARNESS_
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include <xen-tools/common-macros.h>
+#include <xen-tools/bitops.h>
+
+typedef bool spinlock_t;
+typedef uint16_t domid_t;
+
+extern domid_t domid_alloc(domid_t domid);
+extern void domid_free(domid_t domid);
+
+extern unsigned long find_next_zero_bit(const unsigned long *addr,
+                                        unsigned long size,
+                                        unsigned long offset);
+
+#define __test_and_set_bit(nr, addr)    test_and_set_bit(nr, addr)
+#define __test_and_clear_bit(nr, addr)  test_and_clear_bit(nr, addr)
+#define __set_bit(nr, addr)             set_bit(nr, addr)
+
+#define BUG_ON(x)                       assert(!(x))
+#define ASSERT(x)                       assert(x)
+
+#define DEFINE_SPINLOCK(l)              spinlock_t l
+#define spin_lock(l)                    (*(l) = true)
+#define spin_unlock(l)                  (*(l) = false)
+
+#define printk                          printf
+
+#define DOMID_FIRST_RESERVED            (100)
+#define DOMID_INVALID                   (101)
+
+#endif /* _TEST_HARNESS_ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/tools/tests/domid/include/xen/domain.h b/tools/tests/domid/include/xen/domain.h
new file mode 120000
index 000000000000..2eda9aed088e
--- /dev/null
+++ b/tools/tests/domid/include/xen/domain.h
@@ -0,0 +1 @@
+../../harness.h
\ No newline at end of file
diff --git a/tools/tests/domid/test-domid.c b/tools/tests/domid/test-domid.c
new file mode 100644
index 000000000000..7b6fb5ee2a7b
--- /dev/null
+++ b/tools/tests/domid/test-domid.c
@@ -0,0 +1,86 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Unit tests for domain ID allocator.
+ *
+ * Copyright 2025 Ford Motor Company
+ */
+
+#include "harness.h"
+
+#define verify(exp, fmt, args...) do { \
+    if ( !(exp) ) \
+        printf(fmt, ## args); \
+    assert(exp); \
+} while (0);
+
+/*
+ * Fail on the first error, since tests are dependent on each other.
+ */
+int main(int argc, char **argv)
+{
+    domid_t expected, allocated;
+
+    /* Test ID#0 cannot be allocated twice. */
+    allocated = domid_alloc(0);
+    verify(allocated == 0,
+           "TEST 1: expected %u allocated %u\n", 0, allocated);
+    allocated = domid_alloc(0);
+    verify(allocated == DOMID_INVALID,
+           "TEST 1: expected %u allocated %u\n", DOMID_INVALID, allocated);
+
+    /* Ensure ID is not allocated. */
+    domid_free(0);
+
+    /*
+     * Test that that two consecutive calls of domid_alloc(DOMID_INVALID)
+     * will never return the same ID.
+     * NB: ID#0 is reserved and shall not be allocated by
+     * domid_alloc(DOMID_INVALID).
+     */
+    for ( expected = 1; expected < DOMID_FIRST_RESERVED; expected++ )
+    {
+        allocated = domid_alloc(DOMID_INVALID);
+        verify(allocated == expected,
+               "TEST 2: expected %u allocated %u\n", expected, allocated);
+    }
+    for ( expected = 1; expected < DOMID_FIRST_RESERVED; expected++ )
+    {
+        allocated = domid_alloc(DOMID_INVALID);
+        verify(allocated == DOMID_INVALID,
+               "TEST 3: expected %u allocated %u\n", DOMID_INVALID, allocated);
+    }
+
+    /* Re-allocate first ID from [1..DOMID_FIRST_RESERVED/2]. */
+    for ( expected = 1; expected < DOMID_FIRST_RESERVED / 2; expected++ )
+        domid_free(expected);
+    for ( expected = 1; expected < DOMID_FIRST_RESERVED / 2; expected++ )
+    {
+        allocated = domid_alloc(DOMID_INVALID);
+        verify(allocated == expected,
+               "TEST 4: expected %u allocated %u\n", expected, allocated);
+    }
+
+    /* Re-allocate last ID from [1..DOMID_FIRST_RESERVED - 1]. */
+    expected = DOMID_FIRST_RESERVED - 1;
+    domid_free(DOMID_FIRST_RESERVED - 1);
+    allocated = domid_alloc(DOMID_INVALID);
+    verify(allocated == expected,
+           "TEST 5: expected %u allocated %u\n", expected, allocated);
+
+    /* Allocate an invalid ID. */
+    expected = DOMID_INVALID;
+    allocated = domid_alloc(DOMID_FIRST_RESERVED);
+    verify(allocated == expected,
+           "TEST 6: expected %u allocated %u\n", expected, allocated);
+
+    return 0;
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/xen/lib/find-next-bit.c b/xen/lib/find-next-bit.c
index 9b8d7814f20c..539c7f2022b0 100644
--- a/xen/lib/find-next-bit.c
+++ b/xen/lib/find-next-bit.c
@@ -8,8 +8,13 @@
  * as published by the Free Software Foundation; either version
  * 2 of the License, or (at your option) any later version.
  */
+
+#ifdef __XEN_TOOLS__
+#include <xen-tools/bitops.h>
+#else
 #include <xen/bitops.h>
 #include <xen/byteorder.h>
+#endif
 
 #define __ffs(x) (ffsl(x) - 1)
 #define ffz(x) __ffs(~(x))
-- 
2.34.1

[PATCH v14 4/4] xen/domain: update create_dom0() messages

[dmkhn]

From: Denis Mukhin <dmukhin@ford.com> 

Use %pd for domain identification in error/panic messages in create_dom0().

No functional change.

Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
Changes since v13:
- n/a
---
 xen/arch/arm/domain_build.c | 6 +++---
 xen/arch/x86/setup.c        | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c
index 789f2b9d3ce7..02a15d160962 100644
--- a/xen/arch/arm/domain_build.c
+++ b/xen/arch/arm/domain_build.c
@@ -2084,14 +2084,14 @@ void __init create_dom0(void)
         panic("Error creating domain 0 (rc = %ld)\n", PTR_ERR(dom0));
 
     if ( llc_coloring_enabled && (rc = dom0_set_llc_colors(dom0)) )
-        panic("Error initializing LLC coloring for domain 0 (rc = %d)\n", rc);
+        panic("Error initializing LLC coloring for %pd (rc = %d)\n", dom0, rc);
 
     if ( vcpu_create(dom0, 0) == NULL )
-        panic("Error creating domain 0 vcpu0\n");
+        panic("Error creating %pdv0\n", dom0);
 
     rc = construct_dom0(dom0);
     if ( rc )
-        panic("Could not set up DOM0 guest OS (rc = %d)\n", rc);
+        panic("Could not set up %pd guest OS (rc = %d)\n", dom0, rc);
 
     set_xs_domain(dom0);
 }
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 398da734c0c5..bf21c55f7193 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1084,7 +1084,7 @@ static struct domain *__init create_dom0(struct boot_info *bi)
 
         if ( (strlen(acpi_param) == 0) && acpi_disabled )
         {
-            printk("ACPI is disabled, notifying Domain 0 (acpi=off)\n");
+            printk("ACPI is disabled, notifying %pd (acpi=off)\n", d);
             safe_strcpy(acpi_param, "off");
         }
 
@@ -1099,7 +1099,7 @@ static struct domain *__init create_dom0(struct boot_info *bi)
 
     bd->d = d;
     if ( construct_dom0(bd) != 0 )
-        panic("Could not construct domain 0\n");
+        panic("Could not construct %pd\n", d);
 
     bd->cmdline = NULL;
     xfree(cmdline);
-- 
2.34.1

Re: [PATCH v14 1/4] xen/domain: unify domain ID allocation

[Julien Grall]

Hi Denis,

On 08/08/2025 03:19, dmkhn@proton.me wrote:
> From: Denis Mukhin <dmukhin@ford.com>
> 
> Currently, there are two different domain ID allocation implementations:
> 
>    1) Sequential IDs allocation in dom0less Arm code based on max_init_domid;
> 
>    2) Sequential IDs allocation in XEN_DOMCTL_createdomain; does not use
>       max_init_domid (both Arm and x86).
> 
> The domain ID allocation covers dom0 or late hwdom, predefined domains,
> post-boot domains, excluding Xen system domains (domid >=
> DOMID_FIRST_RESERVED).
> 
> It makes sense to have a common helper code for such task across architectures
> (Arm and x86) and between dom0less / toolstack domU allocation.
> 
> Note, fixing dependency on max_init_domid is out of scope of this patch.
> 
> Wrap the domain ID allocation as an arch-independent function domid_alloc() in
> new common/domid.c based on the bitmap.
> 
> Allocation algorithm:
> - If an explicit domain ID is provided, verify its availability and use it if
>    ID is not used;
> - If DOMID_INVALID is provided, search the range [1..DOMID_FIRST_RESERVED-1],
>    starting from the last used ID.
>    Implementation guarantees that two consecutive calls will never return the
>    same ID. ID#0 is reserved for the first boot domain (currently, dom0) and
>    excluded from the allocation range.
> 
> Remove is_free_domid() helper as it is not needed now.
> 
> No functional change intended.
> 
> Signed-off-by: Denis Mukhin <dmukhin@ford.com>

Reviewed-by: Julien Grall <jgrall@amazon.com>

Cheers,

-- 
Julien Grall

Re: [PATCH v14 3/4] tools/tests: introduce unit tests for domain ID allocator

[Julien Grall]

Hi Denis,

On 08/08/2025 03:20, dmkhn@proton.me wrote:
> From: Denis Mukhin <dmukhin@ford.com>
> 
> Introduce some basic infrastructure for doing domain ID allocation unit tests,
> and add a few tests that ensure correctness of the domain ID allocator.

I am quite happy to see more unit tests for Xen :).

> 
> Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness code.
> 
> Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.
> 
> Signed-off-by: Denis Mukhin <dmukhin@ford.com>

With a couple of remarks below:

Acked-by: Julien Grall <jgrall@amazon.com>

> ---
> Changes since v13:
> - reworked bitops integration
> - hooked xen/lib/find-next-bit.c
> - cleaned up harness.h code
> - made test to use more IDs
> ---
>   tools/include/xen-tools/bitops.h       | 10 +++
>   tools/tests/Makefile                   |  2 +-
>   tools/tests/domid/.gitignore           |  2 +
>   tools/tests/domid/Makefile             | 56 +++++++++++++++++
>   tools/tests/domid/harness.h            | 54 ++++++++++++++++
>   tools/tests/domid/include/xen/domain.h |  1 +
>   tools/tests/domid/test-domid.c         | 86 ++++++++++++++++++++++++++
>   xen/lib/find-next-bit.c                |  5 ++
>   8 files changed, 215 insertions(+), 1 deletion(-)
>   create mode 100644 tools/tests/domid/.gitignore
>   create mode 100644 tools/tests/domid/Makefile
>   create mode 100644 tools/tests/domid/harness.h
>   create mode 120000 tools/tests/domid/include/xen/domain.h
>   create mode 100644 tools/tests/domid/test-domid.c
> 
> diff --git a/tools/include/xen-tools/bitops.h b/tools/include/xen-tools/bitops.h
> index 681482f6759f..3b98fba6d74c 100644
> --- a/tools/include/xen-tools/bitops.h
> +++ b/tools/include/xen-tools/bitops.h
> @@ -12,6 +12,16 @@
>   #define BITS_PER_LONG 32
>   #endif
>   
> +#define ffsl(x)       __builtin_ffsl(x)
> +
> +#define BIT_WORD(nr)  ((nr) / BITS_PER_LONG)
> +
> +#define BITS_TO_LONGS(bits) \
> +    (((bits) + BITS_PER_LONG - 1) / BITS_PER_LONG)
> +
> +#define DECLARE_BITMAP(name, bits) \
> +    unsigned long name[BITS_TO_LONGS(bits)]
> +
>   #define BITMAP_ENTRY(_nr,_bmap) ((_bmap))[(_nr) / 8]
>   #define BITMAP_SHIFT(_nr) ((_nr) % 8)
>   
> diff --git a/tools/tests/Makefile b/tools/tests/Makefile
> index 36928676a666..ff1666425436 100644
> --- a/tools/tests/Makefile
> +++ b/tools/tests/Makefile
> @@ -1,7 +1,7 @@
>   XEN_ROOT = $(CURDIR)/../..
>   include $(XEN_ROOT)/tools/Rules.mk
>   
> -SUBDIRS-y :=
> +SUBDIRS-y := domid

I would prefer if we keep SUBDIRST-y := as it is and add a new line 
SUBDIRS-y +=. This is mostly to reduce the chance that someone will add 
a new directory "abc" and forgot to update the line containing "domid".

>   SUBDIRS-y += resource
>   SUBDIRS-$(CONFIG_X86) += cpu-policy
>   SUBDIRS-$(CONFIG_X86) += tsx
> diff --git a/tools/tests/domid/.gitignore b/tools/tests/domid/.gitignore
> new file mode 100644
> index 000000000000..70e306b3c074
> --- /dev/null
> +++ b/tools/tests/domid/.gitignore
> @@ -0,0 +1,2 @@
> +*.o
> +test-domid
> diff --git a/tools/tests/domid/Makefile b/tools/tests/domid/Makefile
> new file mode 100644
> index 000000000000..d96ceca6d954
> --- /dev/null
> +++ b/tools/tests/domid/Makefile
> @@ -0,0 +1,56 @@
> +# SPDX-License-Identifier: GPL-2.0-only
> +#
> +# Unit tests for domain ID allocator.
> +#
> +# Copyright 2025 Ford Motor Company
> +
> +XEN_ROOT=$(CURDIR)/../../..
> +include $(XEN_ROOT)/tools/Rules.mk
> +
> +TESTS := test-domid
> +
> +vpath domid.c $(XEN_ROOT)/xen/common/
> +vpath find-next-bit.c $(XEN_ROOT)/xen/lib/
> +
> +.PHONY: all
> +all: $(TESTS)
> +
> +.PHONY: run
> +run: $(TESTS)
> +	$(foreach t,$(TESTS),./$(t);)
> +
> +.PHONY: clean
> +clean:
> +	$(RM) -- *.o $(TESTS) $(DEPS_RM)
> +
> +.PHONY: distclean
> +distclean: clean
> +	$(RM) -- *~
> +
> +.PHONY: install
> +install: all
> +	$(INSTALL_DIR) $(DESTDIR)$(LIBEXEC)/tests
> +	$(INSTALL_PROG) test-domid $(DESTDIR)$(LIBEXEC)/tests
> +
> +.PHONY: uninstall
> +uninstall:
> +	$(RM) -- $(DESTDIR)$(LIBEXEC)/tests/test-domid
> +
> +CFLAGS += -D__XEN_TOOLS__
> +# find-next-bit.c
> +CFLAGS += '-DEXPORT_SYMBOL(x)=' \
> +          -Dfind_first_bit \
> +          -Dfind_first_zero_bit \
> +          -Dfind_next_bit \
> +          -Dfind_next_bit_le \
> +          -Dfind_next_zero_bit_le
> +CFLAGS += $(APPEND_CFLAGS)
> +CFLAGS += $(CFLAGS_xeninclude)
> +CFLAGS += -I./include/
> +
> +LDFLAGS += $(APPEND_LDFLAGS)
> +
> +test-domid: domid.o find-next-bit.o test-domid.o
> +	$(CC) $^ -o $@ $(LDFLAGS)
> +
> +-include $(DEPS_INCLUDE)
> diff --git a/tools/tests/domid/harness.h b/tools/tests/domid/harness.h
> new file mode 100644
> index 000000000000..b043519dcb35
> --- /dev/null
> +++ b/tools/tests/domid/harness.h
> @@ -0,0 +1,54 @@
> +/* SPDX-License-Identifier: GPL-2.0-only */
> +/*
> + * Unit test harness for domain ID allocator.
> + *
> + * Copyright 2025 Ford Motor Company
> + */
> +
> +#ifndef _TEST_HARNESS_
> +#define _TEST_HARNESS_
> +
> +#include <assert.h>
> +#include <stdbool.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +
> +#include <xen-tools/common-macros.h>
> +#include <xen-tools/bitops.h>
> +
> +typedef bool spinlock_t;
> +typedef uint16_t domid_t;
> +
> +extern domid_t domid_alloc(domid_t domid);
> +extern void domid_free(domid_t domid);
> +
> +extern unsigned long find_next_zero_bit(const unsigned long *addr,
> +                                        unsigned long size,
> +                                        unsigned long offset);
> +
> +#define __test_and_set_bit(nr, addr)    test_and_set_bit(nr, addr)
> +#define __test_and_clear_bit(nr, addr)  test_and_clear_bit(nr, addr)
> +#define __set_bit(nr, addr)             set_bit(nr, addr)
> +
> +#define BUG_ON(x)                       assert(!(x))
> +#define ASSERT(x)                       assert(x)
> +
> +#define DEFINE_SPINLOCK(l)              spinlock_t l
> +#define spin_lock(l)                    (*(l) = true)
> +#define spin_unlock(l)                  (*(l) = false)

NIT: For hardening purpose, I wonder whether we should also assert that 
"l" is "false" for spin_lock() and "true" for spin_unlock(). This would 
help catching any bug in the locking.

> +
> +#define printk                          printf
> +
> +#define DOMID_FIRST_RESERVED            (100)
> +#define DOMID_INVALID                   (101)
> +
> +#endif /* _TEST_HARNESS_ */
> +
> +/*
> + * Local variables:
> + * mode: C
> + * c-file-style: "BSD"
> + * c-basic-offset: 4
> + * indent-tabs-mode: nil
> + * End:
> + */
> diff --git a/tools/tests/domid/include/xen/domain.h b/tools/tests/domid/include/xen/domain.h
> new file mode 120000
> index 000000000000..2eda9aed088e
> --- /dev/null
> +++ b/tools/tests/domid/include/xen/domain.h
> @@ -0,0 +1 @@
> +../../harness.h
> \ No newline at end of file
> diff --git a/tools/tests/domid/test-domid.c b/tools/tests/domid/test-domid.c
> new file mode 100644
> index 000000000000..7b6fb5ee2a7b
> --- /dev/null
> +++ b/tools/tests/domid/test-domid.c
> @@ -0,0 +1,86 @@
> +/* SPDX-License-Identifier: GPL-2.0-only */
> +/*
> + * Unit tests for domain ID allocator.
> + *
> + * Copyright 2025 Ford Motor Company
> + */
> +
> +#include "harness.h"
> +
> +#define verify(exp, fmt, args...) do { \
> +    if ( !(exp) ) \
> +        printf(fmt, ## args); \
> +    assert(exp); \
> +} while (0);
> +
> +/*
> + * Fail on the first error, since tests are dependent on each other.
> + */
> +int main(int argc, char **argv)
> +{
> +    domid_t expected, allocated;
> +
> +    /* Test ID#0 cannot be allocated twice. */

For future improvement, we could check that for any domid [0; 
DOMID_FIRST_RESERVED[, we can allocate domid_alloc().

This would also confirm that domid_alloc() *only* allocates *one* ID.

Cheers,

-- 
Julien Grall

Re: [PATCH v14 3/4] tools/tests: introduce unit tests for domain ID allocator

[Julien Grall]

On 08/08/2025 18:56, Julien Grall wrote:
> Hi Denis,
> 
> On 08/08/2025 03:20, dmkhn@proton.me wrote:
>> From: Denis Mukhin <dmukhin@ford.com>
>>
>> Introduce some basic infrastructure for doing domain ID allocation 
>> unit tests,
>> and add a few tests that ensure correctness of the domain ID allocator.
> 
> I am quite happy to see more unit tests for Xen :).
> 
>>
>> Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness 
>> code.
>>
>> Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.
>>
>> Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> 
> With a couple of remarks below:
> 
> Acked-by: Julien Grall <jgrall@amazon.com>

Actually, this should have been a Reviewed-by tag. Sorry.

Cheers,

-- 
Julien Grall

Re: [PATCH v14 4/4] xen/domain: update create_dom0() messages

[Julien Grall]

Hi Denis,

On 08/08/2025 03:20, dmkhn@proton.me wrote:
> From: Denis Mukhin <dmukhin@ford.com>
> 
> Use %pd for domain identification in error/panic messages in create_dom0().
> 
> No functional change.
> 
> Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> Reviewed-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
> Acked-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Julien Grall <jgrall@amazon.com>

Cheers,

-- 
Julien Grall

Re: [PATCH v14 1/4] xen/domain: unify domain ID allocation

[dmkhn]

On Fri, Aug 08, 2025 at 06:42:03PM +0100, Julien Grall wrote:
> Hi Denis,
> 
> On 08/08/2025 03:19, dmkhn@proton.me wrote:
> > From: Denis Mukhin <dmukhin@ford.com>
> >
> > Currently, there are two different domain ID allocation implementations:
> >
> >    1) Sequential IDs allocation in dom0less Arm code based on max_init_domid;
> >
> >    2) Sequential IDs allocation in XEN_DOMCTL_createdomain; does not use
> >       max_init_domid (both Arm and x86).
> >
> > The domain ID allocation covers dom0 or late hwdom, predefined domains,
> > post-boot domains, excluding Xen system domains (domid >=
> > DOMID_FIRST_RESERVED).
> >
> > It makes sense to have a common helper code for such task across architectures
> > (Arm and x86) and between dom0less / toolstack domU allocation.
> >
> > Note, fixing dependency on max_init_domid is out of scope of this patch.
> >
> > Wrap the domain ID allocation as an arch-independent function domid_alloc() in
> > new common/domid.c based on the bitmap.
> >
> > Allocation algorithm:
> > - If an explicit domain ID is provided, verify its availability and use it if
> >    ID is not used;
> > - If DOMID_INVALID is provided, search the range [1..DOMID_FIRST_RESERVED-1],
> >    starting from the last used ID.
> >    Implementation guarantees that two consecutive calls will never return the
> >    same ID. ID#0 is reserved for the first boot domain (currently, dom0) and
> >    excluded from the allocation range.
> >
> > Remove is_free_domid() helper as it is not needed now.
> >
> > No functional change intended.
> >
> > Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> 
> Reviewed-by: Julien Grall <jgrall@amazon.com>

Thank you!

> 
> Cheers,
> 
> --
> Julien Grall
> 
> 

Re: [PATCH v14 3/4] tools/tests: introduce unit tests for domain ID allocator

[dmkhn]

On Fri, Aug 08, 2025 at 06:56:16PM +0100, Julien Grall wrote:
> Hi Denis,
> 
> On 08/08/2025 03:20, dmkhn@proton.me wrote:
> > From: Denis Mukhin <dmukhin@ford.com>
> >
> > Introduce some basic infrastructure for doing domain ID allocation unit tests,
> > and add a few tests that ensure correctness of the domain ID allocator.
> 
> I am quite happy to see more unit tests for Xen :).
> 
> >
> > Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness code.
> >
> > Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.
> >
> > Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> 
> With a couple of remarks below:
> 
> Acked-by: Julien Grall <jgrall@amazon.com>
> 
> > ---
> > Changes since v13:
> > - reworked bitops integration
> > - hooked xen/lib/find-next-bit.c
> > - cleaned up harness.h code
> > - made test to use more IDs
> > ---
> >   tools/include/xen-tools/bitops.h       | 10 +++
> >   tools/tests/Makefile                   |  2 +-
> >   tools/tests/domid/.gitignore           |  2 +
> >   tools/tests/domid/Makefile             | 56 +++++++++++++++++
> >   tools/tests/domid/harness.h            | 54 ++++++++++++++++
> >   tools/tests/domid/include/xen/domain.h |  1 +
> >   tools/tests/domid/test-domid.c         | 86 ++++++++++++++++++++++++++
> >   xen/lib/find-next-bit.c                |  5 ++
> >   8 files changed, 215 insertions(+), 1 deletion(-)
> >   create mode 100644 tools/tests/domid/.gitignore
> >   create mode 100644 tools/tests/domid/Makefile
> >   create mode 100644 tools/tests/domid/harness.h
> >   create mode 120000 tools/tests/domid/include/xen/domain.h
> >   create mode 100644 tools/tests/domid/test-domid.c
> >
> > diff --git a/tools/include/xen-tools/bitops.h b/tools/include/xen-tools/bitops.h
> > index 681482f6759f..3b98fba6d74c 100644
> > --- a/tools/include/xen-tools/bitops.h
> > +++ b/tools/include/xen-tools/bitops.h
> > @@ -12,6 +12,16 @@
> >   #define BITS_PER_LONG 32
> >   #endif
> >
> > +#define ffsl(x)       __builtin_ffsl(x)
> > +
> > +#define BIT_WORD(nr)  ((nr) / BITS_PER_LONG)
> > +
> > +#define BITS_TO_LONGS(bits) \
> > +    (((bits) + BITS_PER_LONG - 1) / BITS_PER_LONG)
> > +
> > +#define DECLARE_BITMAP(name, bits) \
> > +    unsigned long name[BITS_TO_LONGS(bits)]
> > +
> >   #define BITMAP_ENTRY(_nr,_bmap) ((_bmap))[(_nr) / 8]
> >   #define BITMAP_SHIFT(_nr) ((_nr) % 8)
> >
> > diff --git a/tools/tests/Makefile b/tools/tests/Makefile
> > index 36928676a666..ff1666425436 100644
> > --- a/tools/tests/Makefile
> > +++ b/tools/tests/Makefile
> > @@ -1,7 +1,7 @@
> >   XEN_ROOT = $(CURDIR)/../..
> >   include $(XEN_ROOT)/tools/Rules.mk
> >
> > -SUBDIRS-y :=
> > +SUBDIRS-y := domid
> 
> I would prefer if we keep SUBDIRST-y := as it is and add a new line
> SUBDIRS-y +=. This is mostly to reduce the chance that someone will add
> a new directory "abc" and forgot to update the line containing "domid".

Ack.

> 
> >   SUBDIRS-y += resource
> >   SUBDIRS-$(CONFIG_X86) += cpu-policy
> >   SUBDIRS-$(CONFIG_X86) += tsx
> > diff --git a/tools/tests/domid/.gitignore b/tools/tests/domid/.gitignore
> > new file mode 100644
> > index 000000000000..70e306b3c074
> > --- /dev/null
> > +++ b/tools/tests/domid/.gitignore
> > @@ -0,0 +1,2 @@
> > +*.o
> > +test-domid
> > diff --git a/tools/tests/domid/Makefile b/tools/tests/domid/Makefile
> > new file mode 100644
> > index 000000000000..d96ceca6d954
> > --- /dev/null
> > +++ b/tools/tests/domid/Makefile
> > @@ -0,0 +1,56 @@
> > +# SPDX-License-Identifier: GPL-2.0-only
> > +#
> > +# Unit tests for domain ID allocator.
> > +#
> > +# Copyright 2025 Ford Motor Company
> > +
> > +XEN_ROOT=$(CURDIR)/../../..
> > +include $(XEN_ROOT)/tools/Rules.mk
> > +
> > +TESTS := test-domid
> > +
> > +vpath domid.c $(XEN_ROOT)/xen/common/
> > +vpath find-next-bit.c $(XEN_ROOT)/xen/lib/
> > +
> > +.PHONY: all
> > +all: $(TESTS)
> > +
> > +.PHONY: run
> > +run: $(TESTS)
> > +	$(foreach t,$(TESTS),./$(t);)
> > +
> > +.PHONY: clean
> > +clean:
> > +	$(RM) -- *.o $(TESTS) $(DEPS_RM)
> > +
> > +.PHONY: distclean
> > +distclean: clean
> > +	$(RM) -- *~
> > +
> > +.PHONY: install
> > +install: all
> > +	$(INSTALL_DIR) $(DESTDIR)$(LIBEXEC)/tests
> > +	$(INSTALL_PROG) test-domid $(DESTDIR)$(LIBEXEC)/tests
> > +
> > +.PHONY: uninstall
> > +uninstall:
> > +	$(RM) -- $(DESTDIR)$(LIBEXEC)/tests/test-domid
> > +
> > +CFLAGS += -D__XEN_TOOLS__
> > +# find-next-bit.c
> > +CFLAGS += '-DEXPORT_SYMBOL(x)=' \
> > +          -Dfind_first_bit \
> > +          -Dfind_first_zero_bit \
> > +          -Dfind_next_bit \
> > +          -Dfind_next_bit_le \
> > +          -Dfind_next_zero_bit_le
> > +CFLAGS += $(APPEND_CFLAGS)
> > +CFLAGS += $(CFLAGS_xeninclude)
> > +CFLAGS += -I./include/
> > +
> > +LDFLAGS += $(APPEND_LDFLAGS)
> > +
> > +test-domid: domid.o find-next-bit.o test-domid.o
> > +	$(CC) $^ -o $@ $(LDFLAGS)
> > +
> > +-include $(DEPS_INCLUDE)
> > diff --git a/tools/tests/domid/harness.h b/tools/tests/domid/harness.h
> > new file mode 100644
> > index 000000000000..b043519dcb35
> > --- /dev/null
> > +++ b/tools/tests/domid/harness.h
> > @@ -0,0 +1,54 @@
> > +/* SPDX-License-Identifier: GPL-2.0-only */
> > +/*
> > + * Unit test harness for domain ID allocator.
> > + *
> > + * Copyright 2025 Ford Motor Company
> > + */
> > +
> > +#ifndef _TEST_HARNESS_
> > +#define _TEST_HARNESS_
> > +
> > +#include <assert.h>
> > +#include <stdbool.h>
> > +#include <stdint.h>
> > +#include <stdio.h>
> > +
> > +#include <xen-tools/common-macros.h>
> > +#include <xen-tools/bitops.h>
> > +
> > +typedef bool spinlock_t;
> > +typedef uint16_t domid_t;
> > +
> > +extern domid_t domid_alloc(domid_t domid);
> > +extern void domid_free(domid_t domid);
> > +
> > +extern unsigned long find_next_zero_bit(const unsigned long *addr,
> > +                                        unsigned long size,
> > +                                        unsigned long offset);
> > +
> > +#define __test_and_set_bit(nr, addr)    test_and_set_bit(nr, addr)
> > +#define __test_and_clear_bit(nr, addr)  test_and_clear_bit(nr, addr)
> > +#define __set_bit(nr, addr)             set_bit(nr, addr)
> > +
> > +#define BUG_ON(x)                       assert(!(x))
> > +#define ASSERT(x)                       assert(x)
> > +
> > +#define DEFINE_SPINLOCK(l)              spinlock_t l
> > +#define spin_lock(l)                    (*(l) = true)
> > +#define spin_unlock(l)                  (*(l) = false)
> 
> NIT: For hardening purpose, I wonder whether we should also assert that
> "l" is "false" for spin_lock() and "true" for spin_unlock(). This would
> help catching any bug in the locking.

Good idea! Will do.

> 
> > +
> > +#define printk                          printf
> > +
> > +#define DOMID_FIRST_RESERVED            (100)
> > +#define DOMID_INVALID                   (101)
> > +
> > +#endif /* _TEST_HARNESS_ */
> > +
> > +/*
> > + * Local variables:
> > + * mode: C
> > + * c-file-style: "BSD"
> > + * c-basic-offset: 4
> > + * indent-tabs-mode: nil
> > + * End:
> > + */
> > diff --git a/tools/tests/domid/include/xen/domain.h b/tools/tests/domid/include/xen/domain.h
> > new file mode 120000
> > index 000000000000..2eda9aed088e
> > --- /dev/null
> > +++ b/tools/tests/domid/include/xen/domain.h
> > @@ -0,0 +1 @@
> > +../../harness.h
> > \ No newline at end of file
> > diff --git a/tools/tests/domid/test-domid.c b/tools/tests/domid/test-domid.c
> > new file mode 100644
> > index 000000000000..7b6fb5ee2a7b
> > --- /dev/null
> > +++ b/tools/tests/domid/test-domid.c
> > @@ -0,0 +1,86 @@
> > +/* SPDX-License-Identifier: GPL-2.0-only */
> > +/*
> > + * Unit tests for domain ID allocator.
> > + *
> > + * Copyright 2025 Ford Motor Company
> > + */
> > +
> > +#include "harness.h"
> > +
> > +#define verify(exp, fmt, args...) do { \
> > +    if ( !(exp) ) \
> > +        printf(fmt, ## args); \
> > +    assert(exp); \
> > +} while (0);
> > +
> > +/*
> > + * Fail on the first error, since tests are dependent on each other.
> > + */
> > +int main(int argc, char **argv)
> > +{
> > +    domid_t expected, allocated;
> > +
> > +    /* Test ID#0 cannot be allocated twice. */
> 
> For future improvement, we could check that for any domid [0;
> DOMID_FIRST_RESERVED[, we can allocate domid_alloc().
> 
> This would also confirm that domid_alloc() *only* allocates *one* ID.

Will update.

> 
> Cheers,
> 
> --
> Julien Grall
> 
> 

Re: [PATCH v14 3/4] tools/tests: introduce unit tests for domain ID allocator

[dmkhn]

On Fri, Aug 08, 2025 at 06:57:07PM +0100, Julien Grall wrote:
> 
> 
> On 08/08/2025 18:56, Julien Grall wrote:
> > Hi Denis,
> >
> > On 08/08/2025 03:20, dmkhn@proton.me wrote:
> >> From: Denis Mukhin <dmukhin@ford.com>
> >>
> >> Introduce some basic infrastructure for doing domain ID allocation
> >> unit tests,
> >> and add a few tests that ensure correctness of the domain ID allocator.
> >
> > I am quite happy to see more unit tests for Xen :).
> >
> >>
> >> Use <xen-tools/bitops.h> and xen/lib/find-next-bit.c in test hardness
> >> code.
> >>
> >> Adjust find-next-bit.c to be compiled with __XEN_TOOLS__.
> >>
> >> Signed-off-by: Denis Mukhin <dmukhin@ford.com>
> >
> > With a couple of remarks below:
> >
> > Acked-by: Julien Grall <jgrall@amazon.com>
> 
> Actually, this should have been a Reviewed-by tag. Sorry.

Thanks for review!

> 
> Cheers,
> 
> --
> Julien Grall
>