* [PATCH v3 01/28] xen/xsm: remove redundant xsm_iomem_mapping()
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 11:18 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING Penny Zheng
` (26 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini, Stewart Hildebrand,
Daniel P. Smith
Function xsm_iomem_mapping() seems redundant, and in flask policy, it just
directly calls xsm_iomem_permission().
Remove it and use xsm_iomem_permission() instead, with the benefit of a
cf_check disappearing too.
Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/common/domctl.c | 2 +-
| 2 +-
xen/include/xsm/dummy.h | 7 -------
xen/include/xsm/xsm.h | 8 --------
xen/xsm/dummy.c | 1 -
xen/xsm/flask/hooks.c | 6 ------
6 files changed, 2 insertions(+), 24 deletions(-)
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 954d790226..71ebeff494 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -701,7 +701,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
!iomem_access_permitted(d, mfn, mfn_end) )
break;
- ret = xsm_iomem_mapping(XSM_HOOK, d, mfn, mfn_end, add);
+ ret = xsm_iomem_permission(XSM_HOOK, d, mfn, mfn_end, add);
if ( ret )
break;
--git a/xen/drivers/vpci/header.c b/xen/drivers/vpci/header.c
index 469f497744..1ff6c63f4d 100644
--- a/xen/drivers/vpci/header.c
+++ b/xen/drivers/vpci/header.c
@@ -67,7 +67,7 @@ static int cf_check map_range(
return -EPERM;
}
- rc = xsm_iomem_mapping(XSM_HOOK, map->d, map_mfn, m_end, map->map);
+ rc = xsm_iomem_permission(XSM_HOOK, map->d, map_mfn, m_end, map->map);
if ( rc )
{
printk(XENLOG_G_WARNING
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 12792c3a43..5e29165763 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -570,13 +570,6 @@ static XSM_INLINE int cf_check xsm_iomem_permission(
return xsm_default_action(action, current->domain, d);
}
-static XSM_INLINE int cf_check xsm_iomem_mapping(
- XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
-{
- XSM_ASSERT_ACTION(XSM_HOOK);
- return xsm_default_action(action, current->domain, d);
-}
-
static XSM_INLINE int cf_check xsm_pci_config_permission(
XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start,
uint16_t end, uint8_t access)
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 9a23d2827c..34caad2f7e 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -116,8 +116,6 @@ struct xsm_ops {
int (*irq_permission)(struct domain *d, int pirq, uint8_t allow);
int (*iomem_permission)(struct domain *d, uint64_t s, uint64_t e,
uint8_t allow);
- int (*iomem_mapping)(struct domain *d, uint64_t s, uint64_t e,
- uint8_t allow);
int (*pci_config_permission)(struct domain *d, uint32_t machine_bdf,
uint16_t start, uint16_t end, uint8_t access);
@@ -517,12 +515,6 @@ static inline int xsm_iomem_permission(
return alternative_call(xsm_ops.iomem_permission, d, s, e, allow);
}
-static inline int xsm_iomem_mapping(
- xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
-{
- return alternative_call(xsm_ops.iomem_mapping, d, s, e, allow);
-}
-
static inline int xsm_pci_config_permission(
xsm_default_t def, struct domain *d, uint32_t machine_bdf, uint16_t start,
uint16_t end, uint8_t access)
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 8b7e01b506..86daca3e89 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -75,7 +75,6 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.unbind_pt_irq = xsm_unbind_pt_irq,
.irq_permission = xsm_irq_permission,
.iomem_permission = xsm_iomem_permission,
- .iomem_mapping = xsm_iomem_mapping,
.pci_config_permission = xsm_pci_config_permission,
.get_vnumainfo = xsm_get_vnumainfo,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index b0308e1b26..e98920dd52 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1167,11 +1167,6 @@ static int cf_check flask_iomem_permission(
return security_iterate_iomem_sids(start, end, _iomem_has_perm, &data);
}
-static int cf_check flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, uint8_t access)
-{
- return flask_iomem_permission(d, start, end, access);
-}
-
static int cf_check flask_pci_config_permission(
struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end,
uint8_t access)
@@ -1945,7 +1940,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.unbind_pt_irq = flask_unbind_pt_irq,
.irq_permission = flask_irq_permission,
.iomem_permission = flask_iomem_permission,
- .iomem_mapping = flask_iomem_mapping,
.pci_config_permission = flask_pci_config_permission,
.resource_plug_core = flask_resource_plug_core,
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 01/28] xen/xsm: remove redundant xsm_iomem_mapping()
2025-10-13 10:15 ` [PATCH v3 01/28] xen/xsm: remove redundant xsm_iomem_mapping() Penny Zheng
@ 2025-10-13 11:18 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-13 11:18 UTC (permalink / raw)
To: Penny Zheng, Daniel P. Smith
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, Stewart Hildebrand, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Function xsm_iomem_mapping() seems redundant, and in flask policy, it just
> directly calls xsm_iomem_permission().
> Remove it and use xsm_iomem_permission() instead, with the benefit of a
> cf_check disappearing too.
>
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
No, this is definitely not what I had suggested. What I did suggest was
to get rid of just ...
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -1167,11 +1167,6 @@ static int cf_check flask_iomem_permission(
> return security_iterate_iomem_sids(start, end, _iomem_has_perm, &data);
> }
>
> -static int cf_check flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, uint8_t access)
> -{
> - return flask_iomem_permission(d, start, end, access);
> -}
... the extra call layer here, by using ...
> @@ -1945,7 +1940,6 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
> .unbind_pt_irq = flask_unbind_pt_irq,
> .irq_permission = flask_irq_permission,
> .iomem_permission = flask_iomem_permission,
> - .iomem_mapping = flask_iomem_mapping,
... flask_iomem_permission() a 2nd time here (and perhaps with a suitable
comment).
That said, if Daniel was okay with the wider folding, so be it.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
2025-10-13 10:15 ` [PATCH v3 01/28] xen/xsm: remove redundant xsm_iomem_mapping() Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-14 14:43 ` Grygorii Strashko
2025-10-28 17:01 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 03/28] xen/altp2m: move p2m_set_suppress_ve_multi() forward Penny Zheng
` (25 subsequent siblings)
27 siblings, 2 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné
The only reference of hvm_copy_context_and_params() is in
arch/x86/mm/mem_sharing.c, so it shall be wrapped with CONFIG_MEM_SHARING.
Otherwise it will become unreachable when MEM_SHARING=n, and hence violating
Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/arch/x86/hvm/hvm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 0c60faa39d..239cd992a4 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -5458,6 +5458,7 @@ void hvm_set_segment_register(struct vcpu *v, enum x86_segment seg,
alternative_vcall(hvm_funcs.set_segment_register, v, seg, reg);
}
+#ifdef CONFIG_MEM_SHARING
int hvm_copy_context_and_params(struct domain *dst, struct domain *src)
{
struct hvm_domain_context c = { .size = hvm_save_size(src) };
@@ -5489,6 +5490,7 @@ int hvm_copy_context_and_params(struct domain *dst, struct domain *src)
return rc;
}
+#endif /* CONFIG_MEM_SHARING */
/*
* Local variables:
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING
2025-10-13 10:15 ` [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING Penny Zheng
@ 2025-10-14 14:43 ` Grygorii Strashko
2025-10-28 17:01 ` Jan Beulich
1 sibling, 0 replies; 68+ messages in thread
From: Grygorii Strashko @ 2025-10-14 14:43 UTC (permalink / raw)
To: xen-devel
On 13.10.25 13:15, Penny Zheng wrote:
> The only reference of hvm_copy_context_and_params() is in
> arch/x86/mm/mem_sharing.c, so it shall be wrapped with CONFIG_MEM_SHARING.
> Otherwise it will become unreachable when MEM_SHARING=n, and hence violating
> Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v2 -> v3:
> - new commit
> ---
> xen/arch/x86/hvm/hvm.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
> index 0c60faa39d..239cd992a4 100644
> --- a/xen/arch/x86/hvm/hvm.c
> +++ b/xen/arch/x86/hvm/hvm.c
> @@ -5458,6 +5458,7 @@ void hvm_set_segment_register(struct vcpu *v, enum x86_segment seg,
> alternative_vcall(hvm_funcs.set_segment_register, v, seg, reg);
> }
>
> +#ifdef CONFIG_MEM_SHARING
> int hvm_copy_context_and_params(struct domain *dst, struct domain *src)
> {
> struct hvm_domain_context c = { .size = hvm_save_size(src) };
> @@ -5489,6 +5490,7 @@ int hvm_copy_context_and_params(struct domain *dst, struct domain *src)
>
> return rc;
> }
> +#endif /* CONFIG_MEM_SHARING */
>
> /*
> * Local variables:
Thank you.
Reviewed-by: Grygorii Strashko <grygorii_strashko@epam.com>
--
Best regards,
-grygorii
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING
2025-10-13 10:15 ` [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING Penny Zheng
2025-10-14 14:43 ` Grygorii Strashko
@ 2025-10-28 17:01 ` Jan Beulich
1 sibling, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-28 17:01 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> The only reference of hvm_copy_context_and_params() is in
> arch/x86/mm/mem_sharing.c, so it shall be wrapped with CONFIG_MEM_SHARING.
> Otherwise it will become unreachable when MEM_SHARING=n, and hence violating
> Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 03/28] xen/altp2m: move p2m_set_suppress_ve_multi() forward
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
2025-10-13 10:15 ` [PATCH v3 01/28] xen/xsm: remove redundant xsm_iomem_mapping() Penny Zheng
2025-10-13 10:15 ` [PATCH v3 02/28] xen/mem_sharing: wrap hvm_copy_context_and_params() with CONFIG_MEM_SHARING Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-28 17:03 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 04/28] xen/sched: remove vcpu_set_soft_affinity() Penny Zheng
` (24 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné
The declaration of p2m_set_suppress_ve_multi() is in <asm/mem_access.h> and
hasn't been included on compiling altp2m.o when VM_EVENT=n, resulting in
undefined error.
To fix it, we could simply move p2m_set_suppress_ve_multi() forward.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/arch/x86/mm/altp2m.c | 34 +++++++++++++++++-----------------
1 file changed, 17 insertions(+), 17 deletions(-)
diff --git a/xen/arch/x86/mm/altp2m.c b/xen/arch/x86/mm/altp2m.c
index 0261360aae..962111fbb0 100644
--- a/xen/arch/x86/mm/altp2m.c
+++ b/xen/arch/x86/mm/altp2m.c
@@ -640,23 +640,6 @@ int p2m_altp2m_propagate_change(struct domain *d, gfn_t gfn,
return ret;
}
-/*
- * Set/clear the #VE suppress bit for a page. Only available on VMX.
- */
-int p2m_set_suppress_ve(struct domain *d, gfn_t gfn, bool suppress_ve,
- unsigned int altp2m_idx)
-{
- int rc;
- struct xen_hvm_altp2m_suppress_ve_multi sve = {
- altp2m_idx, suppress_ve, 0, 0, gfn_x(gfn), gfn_x(gfn), 0
- };
-
- if ( !(rc = p2m_set_suppress_ve_multi(d, &sve)) )
- rc = sve.first_error;
-
- return rc;
-}
-
/*
* Set/clear the #VE suppress bit for multiple pages. Only available on VMX.
*/
@@ -725,6 +708,23 @@ int p2m_set_suppress_ve_multi(struct domain *d,
return rc;
}
+/*
+ * Set/clear the #VE suppress bit for a page. Only available on VMX.
+ */
+int p2m_set_suppress_ve(struct domain *d, gfn_t gfn, bool suppress_ve,
+ unsigned int altp2m_idx)
+{
+ int rc;
+ struct xen_hvm_altp2m_suppress_ve_multi sve = {
+ altp2m_idx, suppress_ve, 0, 0, gfn_x(gfn), gfn_x(gfn), 0
+ };
+
+ if ( !(rc = p2m_set_suppress_ve_multi(d, &sve)) )
+ rc = sve.first_error;
+
+ return rc;
+}
+
int p2m_get_suppress_ve(struct domain *d, gfn_t gfn, bool *suppress_ve,
unsigned int altp2m_idx)
{
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 03/28] xen/altp2m: move p2m_set_suppress_ve_multi() forward
2025-10-13 10:15 ` [PATCH v3 03/28] xen/altp2m: move p2m_set_suppress_ve_multi() forward Penny Zheng
@ 2025-10-28 17:03 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-28 17:03 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> The declaration of p2m_set_suppress_ve_multi() is in <asm/mem_access.h> and
> hasn't been included on compiling altp2m.o when VM_EVENT=n, resulting in
> undefined error.
> To fix it, we could simply move p2m_set_suppress_ve_multi() forward.
I don't mind the move, but a definition appearing without a prior declaration
is a Misra violation as well, iirc. So the missing #include will need adding
anyway, afaict.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 04/28] xen/sched: remove vcpu_set_soft_affinity()
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (2 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 03/28] xen/altp2m: move p2m_set_suppress_ve_multi() forward Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:24 ` Jürgen Groß
2025-10-13 10:15 ` [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL Penny Zheng
` (23 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Dario Faggioli,
Juergen Gross, George Dunlap, Jan Beulich
Helper vcpu_set_soft_affinity() only has a single caller, so it is of little
value to keep it as a helper and could easily be expanded at the sole call
site.
Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/common/sched/core.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
index 2ab4313517..ec2448cfa1 100644
--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -1402,11 +1402,6 @@ int vcpu_set_hard_affinity(struct vcpu *v, const cpumask_t *affinity)
return vcpu_set_affinity(v, affinity, v->sched_unit->cpu_hard_affinity);
}
-static int vcpu_set_soft_affinity(struct vcpu *v, const cpumask_t *affinity)
-{
- return vcpu_set_affinity(v, affinity, v->sched_unit->cpu_soft_affinity);
-}
-
/* Block the currently-executing domain until a pertinent event occurs. */
void vcpu_block(void)
{
@@ -1762,8 +1757,9 @@ int vcpu_affinity_domctl(struct domain *d, uint32_t cmd,
{
ret = xenctl_bitmap_to_bitmap(cpumask_bits(new_affinity),
&vcpuaff->cpumap_soft, nr_cpu_ids);
- if ( !ret)
- ret = vcpu_set_soft_affinity(v, new_affinity);
+ if ( !ret )
+ ret = vcpu_set_affinity(v, new_affinity,
+ v->sched_unit->cpu_soft_affinity);
if ( ret )
{
/*
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 04/28] xen/sched: remove vcpu_set_soft_affinity()
2025-10-13 10:15 ` [PATCH v3 04/28] xen/sched: remove vcpu_set_soft_affinity() Penny Zheng
@ 2025-10-13 10:24 ` Jürgen Groß
0 siblings, 0 replies; 68+ messages in thread
From: Jürgen Groß @ 2025-10-13 10:24 UTC (permalink / raw)
To: Penny Zheng, xen-devel
Cc: ray.huang, oleksii.kurochko, Dario Faggioli, George Dunlap,
Jan Beulich
[-- Attachment #1.1.1: Type: text/plain, Size: 372 bytes --]
On 13.10.25 12:15, Penny Zheng wrote:
> Helper vcpu_set_soft_affinity() only has a single caller, so it is of little
> value to keep it as a helper and could easily be expanded at the sole call
> site.
>
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (3 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 04/28] xen/sched: remove vcpu_set_soft_affinity() Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:41 ` Jürgen Groß
` (2 more replies)
2025-10-13 10:15 ` [PATCH v3 06/28] xen/x86: move domctl.o out of PV_SHIM_EXCLUSIVE Penny Zheng
` (22 subsequent siblings)
27 siblings, 3 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel, xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini, Bertrand Marquis,
Volodymyr Babchuk, Alistair Francis, Bob Eshleman, Connor Davis,
Nathan Studer, Stewart Hildebrand, Dario Faggioli, Juergen Gross,
George Dunlap, Daniel P. Smith
Rename all the CONFIG_SYSCTL into CONFIG_MGMT_HYPERCALLS to help provide a
single option to manage all unnecessary hypercalls, including
sysctl, domctl, etc, in dom0less system and PV shim mode, which could also
make it easier to support randconfigs.
While doing the replacement, we fix some bugs on xsm system:
- wrap the whole xsm function to avoid bringing unreachable codes when
MGMT_DOMCTL=n
- add missing wrapping in include/xsm/dummy.h
Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v2 -> v3:
- wrap the whole xsm function
- add missing wrapping in include/xsm/dummy.h
- refine kconfig description
---
xen/Kconfig.debug | 2 +-
xen/arch/arm/Makefile | 2 +-
xen/arch/riscv/stubs.c | 4 ++--
xen/arch/x86/Makefile | 2 +-
xen/arch/x86/configs/pvshim_defconfig | 2 +-
xen/arch/x86/psr.c | 26 +++++++++++++-------------
xen/common/Kconfig | 20 ++++++++------------
xen/common/Makefile | 2 +-
xen/common/page_alloc.c | 8 ++++----
xen/common/perfc.c | 4 ++--
xen/common/sched/arinc653.c | 10 +++++-----
xen/common/sched/core.c | 6 +++---
xen/common/sched/cpupool.c | 16 ++++++++--------
xen/common/sched/credit.c | 6 +++---
xen/common/sched/credit2.c | 6 +++---
xen/common/sched/private.h | 4 ++--
xen/common/spinlock.c | 4 ++--
xen/drivers/char/console.c | 4 ++--
xen/include/hypercall-defs.c | 4 ++--
xen/include/xsm/dummy.h | 6 ++++++
xen/include/xsm/xsm.h | 24 +++++++++---------------
xen/xsm/dummy.c | 6 +++---
xen/xsm/flask/hooks.c | 22 +++++++++++-----------
23 files changed, 93 insertions(+), 97 deletions(-)
diff --git a/xen/Kconfig.debug b/xen/Kconfig.debug
index d900d926c5..a69615cd63 100644
--- a/xen/Kconfig.debug
+++ b/xen/Kconfig.debug
@@ -37,7 +37,7 @@ config SELF_TESTS
config COVERAGE
bool "Code coverage support"
- depends on SYSCTL && !LIVEPATCH
+ depends on MGMT_HYPERCALLS && !LIVEPATCH
select SUPPRESS_DUPLICATE_SYMBOL_WARNINGS if !ENFORCE_UNIQUE_SYMBOLS
help
Enable code coverage support.
diff --git a/xen/arch/arm/Makefile b/xen/arch/arm/Makefile
index 7e88ddd3d7..2aff1a1630 100644
--- a/xen/arch/arm/Makefile
+++ b/xen/arch/arm/Makefile
@@ -51,7 +51,7 @@ obj-y += setup.o
obj-y += shutdown.o
obj-y += smp.o
obj-y += smpboot.o
-obj-$(CONFIG_SYSCTL) += sysctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += sysctl.o
obj-y += time.o
obj-y += traps.o
obj-y += vcpreg.o
diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c
index 1a8c86cd8d..a74e56843c 100644
--- a/xen/arch/riscv/stubs.c
+++ b/xen/arch/riscv/stubs.c
@@ -282,7 +282,7 @@ unsigned long raw_copy_from_guest(void *to, const void __user *from,
BUG_ON("unimplemented");
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/* sysctl.c */
long arch_do_sysctl(struct xen_sysctl *sysctl,
@@ -295,7 +295,7 @@ void arch_do_physinfo(struct xen_sysctl_physinfo *pi)
{
BUG_ON("unimplemented");
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* p2m.c */
diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index 407571c510..d252154b05 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -66,7 +66,7 @@ obj-y += smpboot.o
obj-y += spec_ctrl.o
obj-y += srat.o
obj-y += string.o
-obj-$(CONFIG_SYSCTL) += sysctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += sysctl.o
obj-y += time.o
obj-y += traps-setup.o
obj-y += traps.o
diff --git a/xen/arch/x86/configs/pvshim_defconfig b/xen/arch/x86/configs/pvshim_defconfig
index 24f4e4857d..d1db94df78 100644
--- a/xen/arch/x86/configs/pvshim_defconfig
+++ b/xen/arch/x86/configs/pvshim_defconfig
@@ -25,4 +25,4 @@ CONFIG_PDX_NONE=y
# CONFIG_INTEL_IOMMU is not set
# CONFIG_DEBUG is not set
# CONFIG_GDBSX is not set
-# CONFIG_SYSCTL is not set
+# CONFIG_MGMT_HYPERCALLS is not set
diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c
index cce7020868..80ce5804b4 100644
--- a/xen/arch/x86/psr.c
+++ b/xen/arch/x86/psr.c
@@ -135,7 +135,7 @@ static const struct feat_props {
*/
enum psr_type alt_type;
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/* get_feat_info is used to return feature HW info through sysctl. */
bool (*get_feat_info)(const struct feat_node *feat,
uint32_t data[], unsigned int array_len);
@@ -422,7 +422,7 @@ static bool mba_init_feature(const struct cpuid_leaf *regs,
return true;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static bool cf_check cat_get_feat_info(
const struct feat_node *feat, uint32_t data[], unsigned int array_len)
{
@@ -435,7 +435,7 @@ static bool cf_check cat_get_feat_info(
return true;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* L3 CAT props */
static void cf_check l3_cat_write_msr(
@@ -448,14 +448,14 @@ static const struct feat_props l3_cat_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_L3_CBM,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = cat_get_feat_info,
#endif
.write_msr = l3_cat_write_msr,
.sanitize = cat_check_cbm,
};
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/* L3 CDP props */
static bool cf_check l3_cdp_get_feat_info(
const struct feat_node *feat, uint32_t data[], uint32_t array_len)
@@ -467,7 +467,7 @@ static bool cf_check l3_cdp_get_feat_info(
return true;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check l3_cdp_write_msr(
unsigned int cos, uint32_t val, enum psr_type type)
@@ -483,7 +483,7 @@ static const struct feat_props l3_cdp_props = {
.type[0] = PSR_TYPE_L3_DATA,
.type[1] = PSR_TYPE_L3_CODE,
.alt_type = PSR_TYPE_L3_CBM,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = l3_cdp_get_feat_info,
#endif
.write_msr = l3_cdp_write_msr,
@@ -501,14 +501,14 @@ static const struct feat_props l2_cat_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_L2_CBM,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = cat_get_feat_info,
#endif
.write_msr = l2_cat_write_msr,
.sanitize = cat_check_cbm,
};
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/* MBA props */
static bool cf_check mba_get_feat_info(
const struct feat_node *feat, uint32_t data[], unsigned int array_len)
@@ -523,7 +523,7 @@ static bool cf_check mba_get_feat_info(
return true;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check mba_write_msr(
unsigned int cos, uint32_t val, enum psr_type type)
@@ -561,7 +561,7 @@ static const struct feat_props mba_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_MBA_THRTL,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = mba_get_feat_info,
#endif
.write_msr = mba_write_msr,
@@ -826,7 +826,7 @@ static struct psr_socket_info *get_socket_info(unsigned int socket)
return socket_info + socket;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
int psr_get_info(unsigned int socket, enum psr_type type,
uint32_t data[], unsigned int array_len)
{
@@ -858,7 +858,7 @@ int psr_get_info(unsigned int socket, enum psr_type type,
return -EINVAL;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
int psr_get_val(struct domain *d, unsigned int socket,
uint32_t *val, enum psr_type type)
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 76f9ce705f..7bd8a04730 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -508,7 +508,7 @@ config CRYPTO
config LIVEPATCH
bool "Live patching support"
default X86
- depends on "$(XEN_HAS_BUILD_ID)" = "y" && SYSCTL && HAS_VMAP
+ depends on "$(XEN_HAS_BUILD_ID)" = "y" && MGMT_HYPERCALLS && HAS_VMAP
select CC_SPLIT_SECTIONS
help
Allows a running Xen hypervisor to be dynamically patched using
@@ -600,7 +600,7 @@ config DTB_FILE
config TRACEBUFFER
bool "Enable tracing infrastructure" if EXPERT
default y
- depends on SYSCTL
+ depends on MGMT_HYPERCALLS
help
Enable tracing infrastructure and pre-defined tracepoints within Xen.
This will allow live information about Xen's execution and performance
@@ -648,21 +648,17 @@ config SYSTEM_SUSPEND
If unsure, say N.
-menu "Supported hypercall interfaces"
- visible if EXPERT
-
-config SYSCTL
- bool "Enable sysctl hypercall"
+config MGMT_HYPERCALLS
+ bool "Enable privileged hypercalls for system management"
default y
help
This option shall only be disabled on some dom0less systems, or
- PV shim on x86, to reduce Xen footprint.
-
-endmenu
+ PV shim on x86, to reduce Xen footprint via managing unnessary
+ hypercalls, like sysctl, etc.
config PM_OP
bool "Enable Performance Management Operation"
- depends on ACPI && HAS_CPUFREQ && SYSCTL
+ depends on ACPI && HAS_CPUFREQ && MGMT_HYPERCALLS
default y
help
This option shall enable userspace performance management control
@@ -670,7 +666,7 @@ config PM_OP
config PM_STATS
bool "Enable Performance Management Statistics"
- depends on ACPI && HAS_CPUFREQ && SYSCTL
+ depends on ACPI && HAS_CPUFREQ && MGMT_HYPERCALLS
default y
help
Enable collection of performance management statistics to aid in
diff --git a/xen/common/Makefile b/xen/common/Makefile
index 0c7d0f5d46..7c32fbd9f1 100644
--- a/xen/common/Makefile
+++ b/xen/common/Makefile
@@ -51,7 +51,7 @@ obj-y += spinlock.o
obj-$(CONFIG_STACK_PROTECTOR) += stack-protector.o
obj-y += stop_machine.o
obj-y += symbols.o
-obj-$(CONFIG_SYSCTL) += sysctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += sysctl.o
obj-y += tasklet.o
obj-y += time.o
obj-y += timer.o
diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 1f67b88a89..26615d1e97 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -602,7 +602,7 @@ out:
return ret;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
void get_outstanding_claims(uint64_t *free_pages, uint64_t *outstanding_pages)
{
spin_lock(&heap_lock);
@@ -610,7 +610,7 @@ void get_outstanding_claims(uint64_t *free_pages, uint64_t *outstanding_pages)
*free_pages = avail_heap_pages(MEMZONE_XEN + 1, NR_ZONES - 1, -1);
spin_unlock(&heap_lock);
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static bool __read_mostly first_node_initialised;
#ifndef CONFIG_SEPARATE_XENHEAP
@@ -1788,7 +1788,7 @@ int offline_page(mfn_t mfn, int broken, uint32_t *status)
return 0;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* Online the memory.
* The caller should make sure end_pfn <= max_page,
@@ -1873,7 +1873,7 @@ int query_page_offline(mfn_t mfn, uint32_t *status)
return 0;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* This function should only be called with valid pages from the same NUMA
diff --git a/xen/common/perfc.c b/xen/common/perfc.c
index 0f3b89af2c..97a94ef1fc 100644
--- a/xen/common/perfc.c
+++ b/xen/common/perfc.c
@@ -149,7 +149,7 @@ void cf_check perfc_reset(unsigned char key)
}
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static struct xen_sysctl_perfc_desc perfc_d[NR_PERFCTRS];
static xen_sysctl_perfc_val_t *perfc_vals;
static unsigned int perfc_nbr_vals;
@@ -266,7 +266,7 @@ int perfc_control(struct xen_sysctl_perfc_op *pc)
return rc;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Local variables:
diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c
index 8a4f4259d8..7d6c40d800 100644
--- a/xen/common/sched/arinc653.c
+++ b/xen/common/sched/arinc653.c
@@ -220,7 +220,7 @@ static void update_schedule_units(const struct scheduler *ops)
SCHED_PRIV(ops)->schedule[i].unit_id);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/**
* This function is called by the adjust_global scheduler hook to put
* in place a new ARINC653 schedule.
@@ -335,7 +335,7 @@ arinc653_sched_get(
return 0;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/**************************************************************************
* Scheduler callback functions *
@@ -661,7 +661,7 @@ a653_switch_sched(struct scheduler *new_ops, unsigned int cpu,
return &sr->_lock;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/**
* Xen scheduler callback function to perform a global (not domain-specific)
* adjustment. It is used by the ARINC 653 scheduler to put in place a new
@@ -701,7 +701,7 @@ a653sched_adjust_global(const struct scheduler *ops,
return rc;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/**
* This structure defines our scheduler for Xen.
@@ -736,7 +736,7 @@ static const struct scheduler sched_arinc653_def = {
.switch_sched = a653_switch_sched,
.adjust = NULL,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.adjust_global = a653sched_adjust_global,
#endif
diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
index ec2448cfa1..88150432c3 100644
--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -2064,7 +2064,7 @@ long do_set_timer_op(s_time_t timeout)
return 0;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/* scheduler_id - fetch ID of current scheduler */
int scheduler_id(void)
{
@@ -2107,7 +2107,7 @@ long sched_adjust(struct domain *d, struct xen_domctl_scheduler_op *op)
return ret;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
long sched_adjust_global(struct xen_sysctl_scheduler_op *op)
{
struct cpupool *pool;
@@ -2136,7 +2136,7 @@ long sched_adjust_global(struct xen_sysctl_scheduler_op *op)
return rc;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void vcpu_periodic_timer_work_locked(struct vcpu *v)
{
diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c
index f5459c2779..51ba3cb43d 100644
--- a/xen/common/sched/cpupool.c
+++ b/xen/common/sched/cpupool.c
@@ -241,12 +241,12 @@ struct cpupool *cpupool_get_by_id(unsigned int poolid)
return __cpupool_get_by_id(poolid, true);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static struct cpupool *cpupool_get_next_by_id(unsigned int poolid)
{
return __cpupool_get_by_id(poolid, false);
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
void cpupool_put(struct cpupool *pool)
{
@@ -354,7 +354,7 @@ static struct cpupool *cpupool_create(unsigned int poolid,
return ERR_PTR(ret);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* destroys the given cpupool
* returns 0 on success, 1 else
@@ -382,7 +382,7 @@ static int cpupool_destroy(struct cpupool *c)
debugtrace_printk("cpupool_destroy(pool=%u)\n", c->cpupool_id);
return 0;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Move domain to another cpupool
@@ -572,7 +572,7 @@ static int cpupool_unassign_cpu_start(struct cpupool *c, unsigned int cpu)
return ret;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static long cf_check cpupool_unassign_cpu_helper(void *info)
{
struct cpupool *c = info;
@@ -638,7 +638,7 @@ static int cpupool_unassign_cpu(struct cpupool *c, unsigned int cpu)
}
return continue_hypercall_on_cpu(work_cpu, cpupool_unassign_cpu_helper, c);
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* add a new domain to a cpupool
@@ -816,7 +816,7 @@ static void cpupool_cpu_remove_forced(unsigned int cpu)
rcu_read_unlock(&sched_res_rculock);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* do cpupool related sysctl operations
*/
@@ -982,7 +982,7 @@ int cpupool_do_sysctl(struct xen_sysctl_cpupool_op *op)
return ret;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
unsigned int cpupool_get_id(const struct domain *d)
{
diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c
index 6dcf6b2c8b..0cbec2a9c0 100644
--- a/xen/common/sched/credit.c
+++ b/xen/common/sched/credit.c
@@ -1256,7 +1256,7 @@ __csched_set_tslice(struct csched_private *prv, unsigned int timeslice_ms)
prv->credit = prv->credits_per_tslice * prv->ncpus;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check
csched_sys_cntl(const struct scheduler *ops,
struct xen_sysctl_scheduler_op *sc)
@@ -1299,7 +1299,7 @@ csched_sys_cntl(const struct scheduler *ops,
out:
return rc;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void *cf_check
csched_alloc_domdata(const struct scheduler *ops, struct domain *dom)
@@ -2290,7 +2290,7 @@ static const struct scheduler sched_credit_def = {
.adjust = csched_dom_cntl,
.adjust_affinity= csched_aff_cntl,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.adjust_global = csched_sys_cntl,
#endif
diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c
index 75316d42b7..307e63ebd8 100644
--- a/xen/common/sched/credit2.c
+++ b/xen/common/sched/credit2.c
@@ -3131,7 +3131,7 @@ csched2_aff_cntl(const struct scheduler *ops, struct sched_unit *unit,
__clear_bit(__CSFLAG_pinned, &svc->flags);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check csched2_sys_cntl(
const struct scheduler *ops, struct xen_sysctl_scheduler_op *sc)
{
@@ -3163,7 +3163,7 @@ static int cf_check csched2_sys_cntl(
return 0;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void *cf_check
csched2_alloc_domdata(const struct scheduler *ops, struct domain *dom)
@@ -4248,7 +4248,7 @@ static const struct scheduler sched_credit2_def = {
.adjust = csched2_dom_cntl,
.adjust_affinity= csched2_aff_cntl,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.adjust_global = csched2_sys_cntl,
#endif
diff --git a/xen/common/sched/private.h b/xen/common/sched/private.h
index d6884550cd..b7ff67200b 100644
--- a/xen/common/sched/private.h
+++ b/xen/common/sched/private.h
@@ -356,7 +356,7 @@ struct scheduler {
struct sched_unit *unit,
const struct cpumask *hard,
const struct cpumask *soft);
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*adjust_global) (const struct scheduler *ops,
struct xen_sysctl_scheduler_op *sc);
#endif
@@ -512,7 +512,7 @@ static inline int sched_adjust_dom(const struct scheduler *s, struct domain *d,
return s->adjust ? s->adjust(s, d, op) : 0;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int sched_adjust_cpupool(const struct scheduler *s,
struct xen_sysctl_scheduler_op *op)
{
diff --git a/xen/common/spinlock.c b/xen/common/spinlock.c
index 0389293b09..9d08159615 100644
--- a/xen/common/spinlock.c
+++ b/xen/common/spinlock.c
@@ -690,7 +690,7 @@ void cf_check spinlock_profile_reset(unsigned char key)
spinlock_profile_iterate(spinlock_profile_reset_elem, NULL);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
typedef struct {
struct xen_sysctl_lockprof_op *pc;
int rc;
@@ -750,7 +750,7 @@ int spinlock_profile_control(struct xen_sysctl_lockprof_op *pc)
return rc;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
void _lock_profile_register_struct(
int32_t type, struct lock_profile_qhead *qhead, int32_t idx)
diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index 9bd5b4825d..c38b58d5fc 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -371,7 +371,7 @@ static void conring_puts(const char *str, size_t len)
conringc = conringp - conring_size;
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
long read_console_ring(struct xen_sysctl_readconsole *op)
{
XEN_GUEST_HANDLE_PARAM(char) str;
@@ -414,7 +414,7 @@ long read_console_ring(struct xen_sysctl_readconsole *op)
return 0;
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c
index 8370b4b289..ab9fc6dcb8 100644
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -194,7 +194,7 @@ kexec_op(unsigned long op, void *uarg)
#ifdef CONFIG_IOREQ_SERVER
dm_op(domid_t domid, unsigned int nr_bufs, xen_dm_op_buf_t *bufs)
#endif
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
sysctl(xen_sysctl_t *u_sysctl)
#endif
#if defined(CONFIG_X86) && defined(CONFIG_PAGING)
@@ -277,7 +277,7 @@ physdev_op compat do hvm hvm do_arm
#ifdef CONFIG_HVM
hvm_op do do do do do
#endif
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
sysctl do do do do do
#endif
#ifndef CONFIG_PV_SHIM_EXCLUSIVE
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 5e29165763..5206836582 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -148,11 +148,13 @@ static XSM_INLINE int cf_check xsm_domctl_scheduler_op(
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static XSM_INLINE int cf_check xsm_set_target(
XSM_DEFAULT_ARG struct domain *d, struct domain *e)
@@ -180,6 +182,7 @@ static XSM_INLINE int cf_check xsm_domctl(
}
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd)
{
XSM_ASSERT_ACTION(XSM_PRIV);
@@ -191,6 +194,7 @@ static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear)
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d)
{
@@ -485,11 +489,13 @@ static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID)
return xsm_default_action(action, current->domain, NULL);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID)
{
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 34caad2f7e..0231a208ff 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -57,13 +57,15 @@ struct xsm_ops {
int (*domain_create)(struct domain *d, uint32_t ssidref);
int (*getdomaininfo)(struct domain *d);
int (*domctl_scheduler_op)(struct domain *d, int op);
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*sysctl_scheduler_op)(int op);
#endif
int (*set_target)(struct domain *d, struct domain *e);
int (*domctl)(struct domain *d, unsigned int cmd, uint32_t ssidref);
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*sysctl)(int cmd);
int (*readconsole)(uint32_t clear);
+#endif
int (*evtchn_unbound)(struct domain *d, struct evtchn *chn, domid_t id2);
int (*evtchn_interdomain)(struct domain *d1, struct evtchn *chn1,
@@ -138,7 +140,7 @@ struct xsm_ops {
int (*resource_setup_gsi)(int gsi);
int (*resource_setup_misc)(void);
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*page_offline)(uint32_t cmd);
#endif
int (*hypfs_op)(void);
@@ -244,7 +246,7 @@ static inline int xsm_domctl_scheduler_op(
return alternative_call(xsm_ops.domctl_scheduler_op, d, cmd);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd)
{
return alternative_call(xsm_ops.sysctl_scheduler_op, cmd);
@@ -263,23 +265,17 @@ static inline int xsm_domctl(xsm_default_t def, struct domain *d,
return alternative_call(xsm_ops.domctl, d, cmd, ssidref);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_sysctl(xsm_default_t def, int cmd)
{
-#ifdef CONFIG_SYSCTL
return alternative_call(xsm_ops.sysctl, cmd);
-#else
- return -EOPNOTSUPP;
-#endif
}
static inline int xsm_readconsole(xsm_default_t def, uint32_t clear)
{
-#ifdef CONFIG_SYSCTL
return alternative_call(xsm_ops.readconsole, clear);
-#else
- return -EOPNOTSUPP;
-#endif
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline int xsm_evtchn_unbound(
xsm_default_t def, struct domain *d1, struct evtchn *chn, domid_t id2)
@@ -593,14 +589,12 @@ static inline int xsm_resource_setup_misc(xsm_default_t def)
return alternative_call(xsm_ops.resource_setup_misc);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_page_offline(xsm_default_t def, uint32_t cmd)
{
-#ifdef CONFIG_SYSCTL
return alternative_call(xsm_ops.page_offline, cmd);
-#else
- return -EOPNOTSUPP;
-#endif
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline int xsm_hypfs_op(xsm_default_t def)
{
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 86daca3e89..7892d36cc2 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -19,12 +19,12 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.domain_create = xsm_domain_create,
.getdomaininfo = xsm_getdomaininfo,
.domctl_scheduler_op = xsm_domctl_scheduler_op,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl_scheduler_op = xsm_sysctl_scheduler_op,
#endif
.set_target = xsm_set_target,
.domctl = xsm_domctl,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl = xsm_sysctl,
.readconsole = xsm_readconsole,
#endif
@@ -97,7 +97,7 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.resource_setup_gsi = xsm_resource_setup_gsi,
.resource_setup_misc = xsm_resource_setup_misc,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.page_offline = xsm_page_offline,
#endif
.hypfs_op = xsm_hypfs_op,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index e98920dd52..2eabf62e8c 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -626,7 +626,7 @@ static int cf_check flask_domctl_scheduler_op(struct domain *d, int op)
}
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check flask_sysctl_scheduler_op(int op)
{
switch ( op )
@@ -641,7 +641,7 @@ static int cf_check flask_sysctl_scheduler_op(int op)
return avc_unknown_permission("sysctl_scheduler_op", op);
}
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int cf_check flask_set_target(struct domain *d, struct domain *t)
{
@@ -858,7 +858,7 @@ static int cf_check flask_domctl(struct domain *d, unsigned int cmd,
}
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check flask_sysctl(int cmd)
{
switch ( cmd )
@@ -946,7 +946,7 @@ static int cf_check flask_readconsole(uint32_t clear)
return domain_has_xen(current->domain, perms);
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline uint32_t resource_to_perm(uint8_t access)
{
@@ -1203,12 +1203,12 @@ static int cf_check flask_resource_unplug_core(void)
return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static int flask_resource_use_core(void)
{
return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__USE, NULL);
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int cf_check flask_resource_plug_pci(uint32_t machine_bdf)
{
@@ -1273,7 +1273,7 @@ static int cf_check flask_resource_setup_misc(void)
return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL);
}
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int cf_check flask_page_offline(uint32_t cmd)
{
switch ( cmd )
@@ -1288,7 +1288,7 @@ static inline int cf_check flask_page_offline(uint32_t cmd)
return avc_unknown_permission("page_offline", cmd);
}
}
-#endif /* CONFIG_SYSCTL */
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline int cf_check flask_hypfs_op(void)
{
@@ -1884,12 +1884,12 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.domain_create = flask_domain_create,
.getdomaininfo = flask_getdomaininfo,
.domctl_scheduler_op = flask_domctl_scheduler_op,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl_scheduler_op = flask_sysctl_scheduler_op,
#endif
.set_target = flask_set_target,
.domctl = flask_domctl,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl = flask_sysctl,
.readconsole = flask_readconsole,
#endif
@@ -1950,7 +1950,7 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.resource_setup_gsi = flask_resource_setup_gsi,
.resource_setup_misc = flask_resource_setup_misc,
-#ifdef CONFIG_SYSCTL
+#ifdef CONFIG_MGMT_HYPERCALLS
.page_offline = flask_page_offline,
#endif
.hypfs_op = flask_hypfs_op,
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL
2025-10-13 10:15 ` [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL Penny Zheng
@ 2025-10-13 10:41 ` Jürgen Groß
2025-10-29 14:30 ` Jan Beulich
2025-10-29 21:26 ` Stewart Hildebrand
2 siblings, 0 replies; 68+ messages in thread
From: Jürgen Groß @ 2025-10-13 10:41 UTC (permalink / raw)
To: Penny Zheng, xen-devel, xen-devel
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Jan Beulich, Julien Grall, Roger Pau Monné,
Stefano Stabellini, Bertrand Marquis, Volodymyr Babchuk,
Alistair Francis, Bob Eshleman, Connor Davis, Nathan Studer,
Stewart Hildebrand, Dario Faggioli, George Dunlap,
Daniel P. Smith
[-- Attachment #1.1.1: Type: text/plain, Size: 744 bytes --]
On 13.10.25 12:15, Penny Zheng wrote:
> Rename all the CONFIG_SYSCTL into CONFIG_MGMT_HYPERCALLS to help provide a
> single option to manage all unnecessary hypercalls, including
> sysctl, domctl, etc, in dom0less system and PV shim mode, which could also
> make it easier to support randconfigs.
> While doing the replacement, we fix some bugs on xsm system:
> - wrap the whole xsm function to avoid bringing unreachable codes when
> MGMT_DOMCTL=n
> - add missing wrapping in include/xsm/dummy.h
>
> Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL
2025-10-13 10:15 ` [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL Penny Zheng
2025-10-13 10:41 ` Jürgen Groß
@ 2025-10-29 14:30 ` Jan Beulich
2025-10-29 21:26 ` Stewart Hildebrand
2 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-29 14:30 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, Bertrand Marquis, Volodymyr Babchuk,
Alistair Francis, Bob Eshleman, Connor Davis, Nathan Studer,
Stewart Hildebrand, Dario Faggioli, Juergen Gross, George Dunlap,
Daniel P. Smith, xen-devel, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Rename all the CONFIG_SYSCTL into CONFIG_MGMT_HYPERCALLS to help provide a
> single option to manage all unnecessary hypercalls, including
> sysctl, domctl, etc, in dom0less system and PV shim mode, which could also
> make it easier to support randconfigs.
> While doing the replacement, we fix some bugs on xsm system:
> - wrap the whole xsm function to avoid bringing unreachable codes when
> MGMT_DOMCTL=n
> - add missing wrapping in include/xsm/dummy.h
>
> Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
Quite a few more acks are going to be needed; please recall that it's on you to
collect them all.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL
2025-10-13 10:15 ` [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL Penny Zheng
2025-10-13 10:41 ` Jürgen Groß
2025-10-29 14:30 ` Jan Beulich
@ 2025-10-29 21:26 ` Stewart Hildebrand
2025-11-19 6:33 ` Penny, Zheng
2 siblings, 1 reply; 68+ messages in thread
From: Stewart Hildebrand @ 2025-10-29 21:26 UTC (permalink / raw)
To: Penny Zheng, xen-devel, xen-devel
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Jan Beulich, Julien Grall, Roger Pau Monné,
Stefano Stabellini, Bertrand Marquis, Volodymyr Babchuk,
Alistair Francis, Bob Eshleman, Connor Davis, Nathan Studer,
Stewart Hildebrand, Dario Faggioli, Juergen Gross, George Dunlap,
Daniel P. Smith
On 10/13/25 06:15, Penny Zheng wrote:
> Rename all the CONFIG_SYSCTL into CONFIG_MGMT_HYPERCALLS to help provide a
> single option to manage all unnecessary hypercalls, including
> sysctl, domctl, etc, in dom0less system and PV shim mode, which could also
> make it easier to support randconfigs.
> While doing the replacement, we fix some bugs on xsm system:
> - wrap the whole xsm function to avoid bringing unreachable codes when
> MGMT_DOMCTL=n
> - add missing wrapping in include/xsm/dummy.h
>
> Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Shouldn't the title of the patch use CONFIG_MGMT_HYPERCALLS, not CONFIG_MGMT_DOMCTL?
Regardless, for ARINC 653:
Acked-by: Stewart Hildebrand <stewart@stew.dk>
^ permalink raw reply [flat|nested] 68+ messages in thread
* RE: [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL
2025-10-29 21:26 ` Stewart Hildebrand
@ 2025-11-19 6:33 ` Penny, Zheng
0 siblings, 0 replies; 68+ messages in thread
From: Penny, Zheng @ 2025-11-19 6:33 UTC (permalink / raw)
To: Hildebrand, Stewart, xen-devel@lists.xenproject.org,
xen-devel@dornerworks.com
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini, Bertrand Marquis,
Volodymyr Babchuk, Alistair Francis, Bob Eshleman, Connor Davis,
Nathan Studer, Stewart Hildebrand, Dario Faggioli, Juergen Gross,
George Dunlap, Daniel P. Smith
[Public]
> -----Original Message-----
> From: Stewart Hildebrand <stewart.hildebrand@amd.com>
> Sent: Thursday, October 30, 2025 5:26 AM
> To: Penny, Zheng <penny.zheng@amd.com>; xen-devel@lists.xenproject.org; xen-
> devel@dornerworks.com
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Jan
> Beulich <jbeulich@suse.com>; Julien Grall <julien@xen.org>; Roger Pau Monné
> <roger.pau@citrix.com>; Stefano Stabellini <sstabellini@kernel.org>; Bertrand
> Marquis <bertrand.marquis@arm.com>; Volodymyr Babchuk
> <Volodymyr_Babchuk@epam.com>; Alistair Francis <alistair.francis@wdc.com>;
> Bob Eshleman <bobbyeshleman@gmail.com>; Connor Davis
> <connojdavis@gmail.com>; Nathan Studer <nathan.studer@dornerworks.com>;
> Stewart Hildebrand <stewart@stew.dk>; Dario Faggioli <dfaggioli@suse.com>;
> Juergen Gross <jgross@suse.com>; George Dunlap <gwd@xenproject.org>; Daniel
> P. Smith <dpsmith@apertussolutions.com>
> Subject: Re: [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with
> CONFIG_MGMT_DOMCTL
>
> On 10/13/25 06:15, Penny Zheng wrote:
> > Rename all the CONFIG_SYSCTL into CONFIG_MGMT_HYPERCALLS to help
> > provide a single option to manage all unnecessary hypercalls,
> > including sysctl, domctl, etc, in dom0less system and PV shim mode,
> > which could also make it easier to support randconfigs.
> > While doing the replacement, we fix some bugs on xsm system:
> > - wrap the whole xsm function to avoid bringing unreachable codes when
> > MGMT_DOMCTL=n
> > - add missing wrapping in include/xsm/dummy.h
> >
> > Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
> > Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> > Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
> Shouldn't the title of the patch use CONFIG_MGMT_HYPERCALLS, not
> CONFIG_MGMT_DOMCTL?
>
Oh, typo, so sorry
> Regardless, for ARINC 653:
>
> Acked-by: Stewart Hildebrand <stewart@stew.dk>
thx
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 06/28] xen/x86: move domctl.o out of PV_SHIM_EXCLUSIVE
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (4 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 05/28] xen/sysctl: replace CONFIG_SYSCTL with CONFIG_MGMT_DOMCTL Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-29 14:33 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 07/28] xen/domctl: make MGMT_HYPERCALLS transiently def_bool Penny Zheng
` (21 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné, Anthony PERARD, Michal Orzel,
Julien Grall, Stefano Stabellini
In order to fix CI error of a randconfig picking both PV_SHIM_EXCLUSIVE=y and
HVM=y results in hvm.c being built, but domctl.c not being built, which leaves
a few functions, like domctl_lock_acquire/release() undefined, causing linking
to fail.
To fix that, we intend to move domctl.o out of the PV_SHIM_EXCLUSIVE Makefile
/hypercall-defs section, with this adjustment, we also need to release
redundant vnuma_destroy() stub definition from PV_SHIM_EXCLUSIVE guardian,
to not break compilation
Above change will leave dead code in the shim binary temporarily and will be
fixed once domctl.o's building becomes dependent upon CONFIG_MGMT_HYPERCALLS.
Fixes: 568f806cba4c ("xen/x86: remove "depends on !PV_SHIM_EXCLUSIVE"")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- remove paging_domctl hypercall-defs
---
xen/arch/x86/Makefile | 2 +-
xen/common/Makefile | 5 +----
xen/include/hypercall-defs.c | 4 +---
xen/include/xen/domain.h | 4 ----
4 files changed, 3 insertions(+), 12 deletions(-)
diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index d252154b05..0f91ffcb9d 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -28,6 +28,7 @@ obj-y += delay.o
obj-y += desc.o
obj-bin-y += dmi_scan.init.o
obj-y += domain.o
+obj-y += domctl.o
obj-bin-y += dom0_build.init.o
obj-y += domain_page.o
obj-y += e820.o
@@ -79,7 +80,6 @@ obj-y += vm_event.o
obj-y += xstate.o
ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
-obj-y += domctl.o
obj-y += platform_hypercall.o
obj-$(CONFIG_COMPAT) += x86_64/platform_hypercall.o
endif
diff --git a/xen/common/Makefile b/xen/common/Makefile
index 7c32fbd9f1..fdf826f218 100644
--- a/xen/common/Makefile
+++ b/xen/common/Makefile
@@ -11,6 +11,7 @@ obj-$(filter-out $(CONFIG_X86),$(CONFIG_ACPI)) += device.o
obj-$(CONFIG_DEVICE_TREE_PARSE) += device-tree/
obj-$(CONFIG_IOREQ_SERVER) += dm.o
obj-y += domain.o
+obj-y += domctl.o
obj-y += domid.o
obj-y += event_2l.o
obj-y += event_channel.o
@@ -70,10 +71,6 @@ obj-bin-$(CONFIG_X86) += $(foreach n,decompress bunzip2 unxz unlzma lzo unlzo un
obj-$(CONFIG_COMPAT) += $(addprefix compat/,domain.o memory.o multicall.o xlat.o)
-ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
-obj-y += domctl.o
-endif
-
extra-y := symbols-dummy.o
obj-$(CONFIG_COVERAGE) += coverage/
diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c
index ab9fc6dcb8..cd2c801af6 100644
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -200,8 +200,8 @@ sysctl(xen_sysctl_t *u_sysctl)
#if defined(CONFIG_X86) && defined(CONFIG_PAGING)
paging_domctl_cont(xen_domctl_t *u_domctl)
#endif
-#ifndef CONFIG_PV_SHIM_EXCLUSIVE
domctl(xen_domctl_t *u_domctl)
+#ifndef CONFIG_PV_SHIM_EXCLUSIVE
platform_op(xen_platform_op_t *u_xenpf_op)
#endif
#ifdef CONFIG_HVM
@@ -280,9 +280,7 @@ hvm_op do do do do do
#ifdef CONFIG_MGMT_HYPERCALLS
sysctl do do do do do
#endif
-#ifndef CONFIG_PV_SHIM_EXCLUSIVE
domctl do do do do do
-#endif
#ifdef CONFIG_KEXEC
kexec_op compat do - - -
#endif
diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h
index 8aab05ae93..11d2505420 100644
--- a/xen/include/xen/domain.h
+++ b/xen/include/xen/domain.h
@@ -185,11 +185,7 @@ struct vnuma_info {
struct xen_vmemrange *vmemrange;
};
-#ifndef CONFIG_PV_SHIM_EXCLUSIVE
void vnuma_destroy(struct vnuma_info *vnuma);
-#else
-static inline void vnuma_destroy(struct vnuma_info *vnuma) { ASSERT(!vnuma); }
-#endif
extern bool vmtrace_available;
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 06/28] xen/x86: move domctl.o out of PV_SHIM_EXCLUSIVE
2025-10-13 10:15 ` [PATCH v3 06/28] xen/x86: move domctl.o out of PV_SHIM_EXCLUSIVE Penny Zheng
@ 2025-10-29 14:33 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-29 14:33 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
Anthony PERARD, Michal Orzel, Julien Grall, Stefano Stabellini,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> In order to fix CI error of a randconfig picking both PV_SHIM_EXCLUSIVE=y and
> HVM=y results in hvm.c being built, but domctl.c not being built, which leaves
> a few functions, like domctl_lock_acquire/release() undefined, causing linking
> to fail.
> To fix that, we intend to move domctl.o out of the PV_SHIM_EXCLUSIVE Makefile
> /hypercall-defs section, with this adjustment, we also need to release
> redundant vnuma_destroy() stub definition from PV_SHIM_EXCLUSIVE guardian,
> to not break compilation
> Above change will leave dead code in the shim binary temporarily and will be
> fixed once domctl.o's building becomes dependent upon CONFIG_MGMT_HYPERCALLS.
>
> Fixes: 568f806cba4c ("xen/x86: remove "depends on !PV_SHIM_EXCLUSIVE"")
Is this still applicable with what has gone in recently? (Overall I'm trying to
figure out whether actually reviewing this patch makes sense, before it's re-
based onto current staging.)
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 07/28] xen/domctl: make MGMT_HYPERCALLS transiently def_bool
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (5 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 06/28] xen/x86: move domctl.o out of PV_SHIM_EXCLUSIVE Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-29 14:37 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT Penny Zheng
` (20 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
In order to asist in reviewing/developing disabling domctl-op patch serie,
we will transiently make MGMT_HYPERCALLS def_bool. And it will become
optional at the last of domctl-op patch serie, where common/domctl.o's
building as a whole becomes dependent upon that setting.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/common/Kconfig | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 7bd8a04730..807b213e8b 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -649,8 +649,7 @@ config SYSTEM_SUSPEND
If unsure, say N.
config MGMT_HYPERCALLS
- bool "Enable privileged hypercalls for system management"
- default y
+ def_bool y
help
This option shall only be disabled on some dom0less systems, or
PV shim on x86, to reduce Xen footprint via managing unnessary
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 07/28] xen/domctl: make MGMT_HYPERCALLS transiently def_bool
2025-10-13 10:15 ` [PATCH v3 07/28] xen/domctl: make MGMT_HYPERCALLS transiently def_bool Penny Zheng
@ 2025-10-29 14:37 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-29 14:37 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> In order to asist in reviewing/developing disabling domctl-op patch serie,
> we will transiently make MGMT_HYPERCALLS def_bool. And it will become
> optional at the last of domctl-op patch serie, where common/domctl.o's
> building as a whole becomes dependent upon that setting.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
While in principle this is what I have been asking for, I don't think it can
sensibly be ack-ed before being re-based onto current staging, where ...
> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -649,8 +649,7 @@ config SYSTEM_SUSPEND
> If unsure, say N.
>
> config MGMT_HYPERCALLS
> - bool "Enable privileged hypercalls for system management"
> - default y
> + def_bool y
> help
> This option shall only be disabled on some dom0less systems, or
> PV shim on x86, to reduce Xen footprint via managing unnessary
... a "depends on" has (re)appeared.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (6 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 07/28] xen/domctl: make MGMT_HYPERCALLS transiently def_bool Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-21 13:24 ` Grygorii Strashko
2025-10-29 15:57 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 10/28] xen/vm_event: make VM_EVENT depend on CONFIG_MGMT_HYPERCALLS Penny Zheng
` (19 subsequent siblings)
27 siblings, 2 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné, Anthony PERARD, Michal Orzel,
Julien Grall, Stefano Stabellini, Tamas K Lengyel,
Alexandru Isaila, Petre Pircalabu, Daniel P. Smith
File hvm/vm_event.c and x86/vm_event.c are the extend to vm_event handling
routines, and its compilation shall be guarded by CONFIG_VM_EVENT too.
Futhermore, features about monitor_op and memory access are both based on
vm event subsystem, so monitor.o/mem_access.o shall be wrapped under
CONFIG_VM_EVENT.
Although CONFIG_VM_EVENT is right now forcibly enabled on x86 via
MEM_ACCESS_ALWAYS_ON, we could disable it through disabling
CONFIG_MGMT_HYPERCALLS later. So we remove MEM_ACCESS_ALWAYS_ON and
make VM_EVENT=y on default only on x86 to retain the same.
In consequence, a few switch-blocks need in-place stubs in do_altp2m_op()
to pass compilation when ALTP2M=y and VM_EVENT=n(, hence MEM_ACCESS=n), like
HVMOP_altp2m_set_mem_access, etc.
And the following functions still require stubs to pass compilation:
- vm_event_check_ring()
- p2m_mem_access_check()
- xenmem_access_to_p2m_access()
The following functions are developed on the basis of vm event framework, or
only invoked by vm_event.c/monitor.c/mem_access.c, so they all shall be
wrapped with CONFIG_VM_EVENT (otherwise they will become unreachable and
violate Misra rule 2.1 when VM_EVENT=n):
- hvm_toggle_singlestep
- hvm_fast_singlestep
- hvm_enable_msr_interception
- hvm_function_table.enable_msr_interception
- hvm_has_set_descriptor_access_existing
- hvm_function_table.set_descriptor_access_existing
- arch_monitor_domctl_op
- arch_monitor_allow_userspace
- arch_monitor_get_capabilities
- hvm_emulate_one_vm_event
- hvmemul_write{,cmpxchg,rep_ins,rep_outs,rep_movs,rep_stos,read_io,write_io}_discard
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- split out XSM changes
- remove unnecessary stubs
- move "struct p2m_domain" declaration ahead of the #ifdef
---
v2 -> v3:
- move .enable_msr_interception and .set_descriptor_access_exiting together
- with the introduction of "vm_event_is_enabled()", all hvm_monitor_xxx()
stubs are no longer needed
- change to use in-place stubs in do_altp2m_op()
- no need to add stub for monitor_traps(), __vm_event_claim_slot(),
vm_event_put_request() and vm_event_vcpu_pause()
- remove MEM_ACCESS_ALWAYS_ON
- return default p2m_access_rwx for xenmem_access_to_p2m_access() when
VM_EVENT=n
- add wrapping for hvm_emulate_one_vm_event/
hvmemul_write{,cmpxchg,rep_ins,rep_outs,rep_movs,rep_stos,read_io,write_io}_discard
---
xen/arch/x86/Makefile | 2 +-
xen/arch/x86/hvm/Kconfig | 1 -
xen/arch/x86/hvm/Makefile | 4 +-
xen/arch/x86/hvm/emulate.c | 58 ++++++++++++++-------------
xen/arch/x86/hvm/hvm.c | 21 ++++++++++
xen/arch/x86/hvm/svm/svm.c | 8 +++-
xen/arch/x86/hvm/vmx/vmx.c | 10 +++++
xen/arch/x86/include/asm/hvm/hvm.h | 9 ++++-
xen/arch/x86/include/asm/mem_access.h | 9 +++++
xen/arch/x86/include/asm/monitor.h | 9 +++++
xen/common/Kconfig | 7 +---
xen/include/xen/mem_access.h | 10 +++++
xen/include/xen/vm_event.h | 7 ++++
13 files changed, 116 insertions(+), 39 deletions(-)
diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index 0f91ffcb9d..615cd101b8 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -76,7 +76,7 @@ obj-y += usercopy.o
obj-y += x86_emulate.o
obj-$(CONFIG_TBOOT) += tboot.o
obj-y += hpet.o
-obj-y += vm_event.o
+obj-$(CONFIG_VM_EVENT) += vm_event.o
obj-y += xstate.o
ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
diff --git a/xen/arch/x86/hvm/Kconfig b/xen/arch/x86/hvm/Kconfig
index 5cb9f29042..e6b388dd0e 100644
--- a/xen/arch/x86/hvm/Kconfig
+++ b/xen/arch/x86/hvm/Kconfig
@@ -3,7 +3,6 @@ menuconfig HVM
default !PV_SHIM
select COMPAT
select IOREQ_SERVER
- select MEM_ACCESS_ALWAYS_ON
help
Interfaces to support HVM domains. HVM domains require hardware
virtualisation extensions (e.g. Intel VT-x, AMD SVM), but can boot
diff --git a/xen/arch/x86/hvm/Makefile b/xen/arch/x86/hvm/Makefile
index 6ec2c8f2db..952db00dd7 100644
--- a/xen/arch/x86/hvm/Makefile
+++ b/xen/arch/x86/hvm/Makefile
@@ -16,7 +16,7 @@ obj-y += io.o
obj-y += ioreq.o
obj-y += irq.o
obj-y += mmio.o
-obj-y += monitor.o
+obj-$(CONFIG_VM_EVENT) += monitor.o
obj-y += mtrr.o
obj-y += nestedhvm.o
obj-y += pmtimer.o
@@ -26,7 +26,7 @@ obj-y += save.o
obj-y += stdvga.o
obj-y += vioapic.o
obj-y += vlapic.o
-obj-y += vm_event.o
+obj-$(CONFIG_VM_EVENT) += vm_event.o
obj-y += vmsi.o
obj-y += vpic.o
obj-y += vpt.o
diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index fe75b0516d..d56ef02baf 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -1615,6 +1615,7 @@ static int cf_check hvmemul_blk(
return rc;
}
+#ifdef CONFIG_VM_EVENT
static int cf_check hvmemul_write_discard(
enum x86_segment seg,
unsigned long offset,
@@ -1717,6 +1718,7 @@ static int cf_check hvmemul_cache_op_discard(
{
return X86EMUL_OKAY;
}
+#endif /* CONFIG_VM_EVENT */
static int cf_check hvmemul_cmpxchg(
enum x86_segment seg,
@@ -2750,33 +2752,6 @@ static const struct x86_emulate_ops hvm_emulate_ops = {
.vmfunc = hvmemul_vmfunc,
};
-static const struct x86_emulate_ops hvm_emulate_ops_no_write = {
- .read = hvmemul_read,
- .insn_fetch = hvmemul_insn_fetch,
- .write = hvmemul_write_discard,
- .cmpxchg = hvmemul_cmpxchg_discard,
- .rep_ins = hvmemul_rep_ins_discard,
- .rep_outs = hvmemul_rep_outs_discard,
- .rep_movs = hvmemul_rep_movs_discard,
- .rep_stos = hvmemul_rep_stos_discard,
- .read_segment = hvmemul_read_segment,
- .write_segment = hvmemul_write_segment,
- .read_io = hvmemul_read_io_discard,
- .write_io = hvmemul_write_io_discard,
- .read_cr = hvmemul_read_cr,
- .write_cr = hvmemul_write_cr,
- .read_xcr = hvmemul_read_xcr,
- .write_xcr = hvmemul_write_xcr,
- .read_msr = hvmemul_read_msr,
- .write_msr = hvmemul_write_msr_discard,
- .cache_op = hvmemul_cache_op_discard,
- .tlb_op = hvmemul_tlb_op,
- .cpuid = x86emul_cpuid,
- .get_fpu = hvmemul_get_fpu,
- .put_fpu = hvmemul_put_fpu,
- .vmfunc = hvmemul_vmfunc,
-};
-
/*
* Note that passing VIO_no_completion into this function serves as kind
* of (but not fully) an "auto select completion" indicator. When there's
@@ -2887,6 +2862,34 @@ int hvm_emulate_one(
return _hvm_emulate_one(hvmemul_ctxt, &hvm_emulate_ops, completion);
}
+#ifdef CONFIG_VM_EVENT
+static const struct x86_emulate_ops hvm_emulate_ops_no_write = {
+ .read = hvmemul_read,
+ .insn_fetch = hvmemul_insn_fetch,
+ .write = hvmemul_write_discard,
+ .cmpxchg = hvmemul_cmpxchg_discard,
+ .rep_ins = hvmemul_rep_ins_discard,
+ .rep_outs = hvmemul_rep_outs_discard,
+ .rep_movs = hvmemul_rep_movs_discard,
+ .rep_stos = hvmemul_rep_stos_discard,
+ .read_segment = hvmemul_read_segment,
+ .write_segment = hvmemul_write_segment,
+ .read_io = hvmemul_read_io_discard,
+ .write_io = hvmemul_write_io_discard,
+ .read_cr = hvmemul_read_cr,
+ .write_cr = hvmemul_write_cr,
+ .read_xcr = hvmemul_read_xcr,
+ .write_xcr = hvmemul_write_xcr,
+ .read_msr = hvmemul_read_msr,
+ .write_msr = hvmemul_write_msr_discard,
+ .cache_op = hvmemul_cache_op_discard,
+ .tlb_op = hvmemul_tlb_op,
+ .cpuid = x86emul_cpuid,
+ .get_fpu = hvmemul_get_fpu,
+ .put_fpu = hvmemul_put_fpu,
+ .vmfunc = hvmemul_vmfunc,
+};
+
void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
unsigned int errcode)
{
@@ -2949,6 +2952,7 @@ void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
hvm_emulate_writeback(&ctx);
}
+#endif /* CONFIG_VM_EVENT */
void hvm_emulate_init_once(
struct hvm_emulate_ctxt *hvmemul_ctxt,
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 48a293069b..e3dacc909b 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -50,6 +50,7 @@
#include <asm/hvm/vm_event.h>
#include <asm/hvm/vpt.h>
#include <asm/i387.h>
+#include <asm/mem_access.h>
#include <asm/mc146818rtc.h>
#include <asm/mce.h>
#include <asm/monitor.h>
@@ -4861,15 +4862,20 @@ static int do_altp2m_op(
break;
case HVMOP_altp2m_set_mem_access:
+#ifdef CONFIG_VM_EVENT
if ( a.u.mem_access.pad )
rc = -EINVAL;
else
rc = p2m_set_mem_access(d, _gfn(a.u.mem_access.gfn), 1, 0, 0,
a.u.mem_access.access,
a.u.mem_access.view);
+#else
+ rc = -EOPNOTSUPP;
+#endif
break;
case HVMOP_altp2m_set_mem_access_multi:
+#ifdef CONFIG_VM_EVENT
if ( a.u.set_mem_access_multi.pad ||
a.u.set_mem_access_multi.opaque > a.u.set_mem_access_multi.nr )
{
@@ -4898,9 +4904,13 @@ static int do_altp2m_op(
&a, u.set_mem_access_multi.opaque) )
rc = -EFAULT;
}
+#else
+ rc = -EOPNOTSUPP;
+#endif
break;
case HVMOP_altp2m_get_mem_access:
+#ifdef CONFIG_VM_EVENT
if ( a.u.mem_access.pad )
rc = -EINVAL;
else
@@ -4915,6 +4925,9 @@ static int do_altp2m_op(
rc = __copy_to_guest(arg, &a, 1) ? -EFAULT : 0;
}
}
+#else
+ rc = -EOPNOTSUPP;
+#endif
break;
case HVMOP_altp2m_change_gfn:
@@ -5030,6 +5043,7 @@ static int compat_altp2m_op(
switch ( a.cmd )
{
case HVMOP_altp2m_set_mem_access_multi:
+#ifdef CONFIG_VM_EVENT
#define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list(_d_, _s_); \
guest_from_compat_handle((_d_)->pfn_list, (_s_)->pfn_list)
#define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list(_d_, _s_); \
@@ -5038,6 +5052,7 @@ static int compat_altp2m_op(
&a.u.set_mem_access_multi);
#undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list
#undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list
+#endif
break;
default:
@@ -5056,6 +5071,7 @@ static int compat_altp2m_op(
switch ( a.cmd )
{
case HVMOP_altp2m_set_mem_access_multi:
+#ifdef CONFIG_VM_EVENT
if ( rc == -ERESTART )
{
a.u.set_mem_access_multi.opaque =
@@ -5065,6 +5081,9 @@ static int compat_altp2m_op(
&a, u.set_mem_access_multi.opaque) )
rc = -EFAULT;
}
+#else
+ rc = -EOPNOTSUPP;
+#endif
break;
default:
@@ -5283,6 +5302,7 @@ int hvm_debug_op(struct vcpu *v, int32_t op)
return rc;
}
+#ifdef CONFIG_VM_EVENT
void hvm_toggle_singlestep(struct vcpu *v)
{
ASSERT(atomic_read(&v->pause_count));
@@ -5292,6 +5312,7 @@ void hvm_toggle_singlestep(struct vcpu *v)
v->arch.hvm.single_step = !v->arch.hvm.single_step;
}
+#endif /* CONFIG_VM_EVENT */
#ifdef CONFIG_ALTP2M
void hvm_fast_singlestep(struct vcpu *v, uint16_t p2midx)
diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index 679ca3dacd..c8506c25c4 100644
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -299,6 +299,7 @@ void svm_intercept_msr(struct vcpu *v, uint32_t msr, int flags)
__clear_bit(msr * 2 + 1, msr_bit);
}
+#ifdef CONFIG_VM_EVENT
static void cf_check svm_enable_msr_interception(struct domain *d, uint32_t msr)
{
struct vcpu *v;
@@ -306,6 +307,7 @@ static void cf_check svm_enable_msr_interception(struct domain *d, uint32_t msr)
for_each_vcpu ( d, v )
svm_intercept_msr(v, msr, MSR_INTERCEPT_WRITE);
}
+#endif /* CONFIG_VM_EVENT */
static void svm_save_dr(struct vcpu *v)
{
@@ -826,6 +828,7 @@ static void cf_check svm_set_rdtsc_exiting(struct vcpu *v, bool enable)
vmcb_set_general2_intercepts(vmcb, general2_intercepts);
}
+#ifdef CONFIG_VM_EVENT
static void cf_check svm_set_descriptor_access_exiting(
struct vcpu *v, bool enable)
{
@@ -843,6 +846,7 @@ static void cf_check svm_set_descriptor_access_exiting(
vmcb_set_general1_intercepts(vmcb, general1_intercepts);
}
+#endif /* CONFIG_VM_EVENT */
static unsigned int cf_check svm_get_insn_bytes(struct vcpu *v, uint8_t *buf)
{
@@ -2457,9 +2461,11 @@ static struct hvm_function_table __initdata_cf_clobber svm_function_table = {
.fpu_dirty_intercept = svm_fpu_dirty_intercept,
.msr_read_intercept = svm_msr_read_intercept,
.msr_write_intercept = svm_msr_write_intercept,
+#ifdef CONFIG_VM_EVENT
.enable_msr_interception = svm_enable_msr_interception,
- .set_rdtsc_exiting = svm_set_rdtsc_exiting,
.set_descriptor_access_exiting = svm_set_descriptor_access_exiting,
+#endif
+ .set_rdtsc_exiting = svm_set_rdtsc_exiting,
.get_insn_bytes = svm_get_insn_bytes,
.nhvm_vcpu_initialise = nsvm_vcpu_initialise,
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index a40af1db66..1996e139a0 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -1520,6 +1520,7 @@ static void cf_check vmx_set_rdtsc_exiting(struct vcpu *v, bool enable)
vmx_vmcs_exit(v);
}
+#ifdef CONFIG_VM_EVENT
static void cf_check vmx_set_descriptor_access_exiting(
struct vcpu *v, bool enable)
{
@@ -1534,6 +1535,7 @@ static void cf_check vmx_set_descriptor_access_exiting(
vmx_update_secondary_exec_control(v);
vmx_vmcs_exit(v);
}
+#endif /* CONFIG_VM_EVENT */
static void cf_check vmx_init_hypercall_page(void *p)
{
@@ -2413,6 +2415,7 @@ static void cf_check vmx_handle_eoi(uint8_t vector, int isr)
printk_once(XENLOG_WARNING "EOI for %02x but SVI=%02x\n", vector, old_svi);
}
+#ifdef CONFIG_VM_EVENT
static void cf_check vmx_enable_msr_interception(struct domain *d, uint32_t msr)
{
struct vcpu *v;
@@ -2420,6 +2423,7 @@ static void cf_check vmx_enable_msr_interception(struct domain *d, uint32_t msr)
for_each_vcpu ( d, v )
vmx_set_msr_intercept(v, msr, VMX_MSR_W);
}
+#endif /* CONFIG_VM_EVENT */
#ifdef CONFIG_ALTP2M
@@ -2871,7 +2875,9 @@ static struct hvm_function_table __initdata_cf_clobber vmx_function_table = {
.nhvm_domain_relinquish_resources = nvmx_domain_relinquish_resources,
.update_vlapic_mode = vmx_vlapic_msr_changed,
.nhvm_hap_walk_L1_p2m = nvmx_hap_walk_L1_p2m,
+#ifdef CONFIG_VM_EVENT
.enable_msr_interception = vmx_enable_msr_interception,
+#endif
#ifdef CONFIG_ALTP2M
.altp2m_vcpu_update_p2m = vmx_vcpu_update_eptp,
.altp2m_vcpu_update_vmfunc_ve = vmx_vcpu_update_vmfunc_ve,
@@ -3079,9 +3085,11 @@ const struct hvm_function_table * __init start_vmx(void)
vmx_function_table.caps.singlestep = cpu_has_monitor_trap_flag;
+#ifdef CONFIG_VM_EVENT
if ( cpu_has_vmx_dt_exiting )
vmx_function_table.set_descriptor_access_exiting =
vmx_set_descriptor_access_exiting;
+#endif
/*
* Do not enable EPT when (!cpu_has_vmx_pat), to prevent security hole
@@ -3152,8 +3160,10 @@ void __init vmx_fill_funcs(void)
if ( !cpu_has_xen_ibt )
return;
+#ifdef CONFIG_VM_EVENT
vmx_function_table.set_descriptor_access_exiting =
vmx_set_descriptor_access_exiting;
+#endif
vmx_function_table.update_eoi_exit_bitmap = vmx_update_eoi_exit_bitmap;
vmx_function_table.process_isr = vmx_process_isr;
diff --git a/xen/arch/x86/include/asm/hvm/hvm.h b/xen/arch/x86/include/asm/hvm/hvm.h
index f02183691e..473cf24b83 100644
--- a/xen/arch/x86/include/asm/hvm/hvm.h
+++ b/xen/arch/x86/include/asm/hvm/hvm.h
@@ -192,7 +192,10 @@ struct hvm_function_table {
void (*handle_cd)(struct vcpu *v, unsigned long value);
void (*set_info_guest)(struct vcpu *v);
void (*set_rdtsc_exiting)(struct vcpu *v, bool enable);
+#ifdef CONFIG_VM_EVENT
void (*set_descriptor_access_exiting)(struct vcpu *v, bool enable);
+ void (*enable_msr_interception)(struct domain *d, uint32_t msr);
+#endif
/* Nested HVM */
int (*nhvm_vcpu_initialise)(struct vcpu *v);
@@ -224,8 +227,6 @@ struct hvm_function_table {
paddr_t *L1_gpa, unsigned int *page_order,
uint8_t *p2m_acc, struct npfec npfec);
- void (*enable_msr_interception)(struct domain *d, uint32_t msr);
-
#ifdef CONFIG_ALTP2M
/* Alternate p2m */
void (*altp2m_vcpu_update_p2m)(struct vcpu *v);
@@ -433,10 +434,12 @@ static inline bool using_svm(void)
#define hvm_long_mode_active(v) (!!((v)->arch.hvm.guest_efer & EFER_LMA))
+#ifdef CONFIG_VM_EVENT
static inline bool hvm_has_set_descriptor_access_exiting(void)
{
return hvm_funcs.set_descriptor_access_exiting;
}
+#endif
static inline void hvm_domain_creation_finished(struct domain *d)
{
@@ -679,10 +682,12 @@ static inline int nhvm_hap_walk_L1_p2m(
v, L2_gpa, L1_gpa, page_order, p2m_acc, npfec);
}
+#ifdef CONFIG_VM_EVENT
static inline void hvm_enable_msr_interception(struct domain *d, uint32_t msr)
{
alternative_vcall(hvm_funcs.enable_msr_interception, d, msr);
}
+#endif
static inline bool hvm_is_singlestep_supported(void)
{
diff --git a/xen/arch/x86/include/asm/mem_access.h b/xen/arch/x86/include/asm/mem_access.h
index 1a52a10322..c786116310 100644
--- a/xen/arch/x86/include/asm/mem_access.h
+++ b/xen/arch/x86/include/asm/mem_access.h
@@ -14,6 +14,7 @@
#ifndef __ASM_X86_MEM_ACCESS_H__
#define __ASM_X86_MEM_ACCESS_H__
+#ifdef CONFIG_VM_EVENT
/*
* Setup vm_event request based on the access (gla is -1ull if not available).
* Handles the rw2rx conversion. Boolean return value indicates if event type
@@ -25,6 +26,14 @@
bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
struct npfec npfec,
struct vm_event_st **req_ptr);
+#else
+static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
+ struct npfec npfec,
+ struct vm_event_st **req_ptr)
+{
+ return false;
+}
+#endif /* CONFIG_VM_EVENT */
/* Check for emulation and mark vcpu for skipping one instruction
* upon rescheduling if required. */
diff --git a/xen/arch/x86/include/asm/monitor.h b/xen/arch/x86/include/asm/monitor.h
index 3c64d8258f..1cd169f8f0 100644
--- a/xen/arch/x86/include/asm/monitor.h
+++ b/xen/arch/x86/include/asm/monitor.h
@@ -32,6 +32,7 @@ struct monitor_msr_bitmap {
DECLARE_BITMAP(high, 8192);
};
+#ifdef COMFIG_VM_EVENT
static inline
void arch_monitor_allow_userspace(struct domain *d, bool allow_userspace)
{
@@ -102,6 +103,7 @@ static inline uint32_t arch_monitor_get_capabilities(struct domain *d)
return capabilities;
}
+#endif /* CONFIG_VM_EVENT */
int arch_monitor_domctl_event(struct domain *d,
struct xen_domctl_monitor_op *mop);
@@ -123,7 +125,14 @@ static inline void arch_monitor_cleanup_domain(struct domain *d) {}
#endif
+#ifdef CONFIG_VM_EVENT
bool monitored_msr(const struct domain *d, u32 msr);
+#else
+static inline bool monitored_msr(const struct domain *d, u32 msr)
+{
+ return false;
+}
+#endif
bool monitored_msr_onchangeonly(const struct domain *d, u32 msr);
#endif /* __ASM_X86_MONITOR_H__ */
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 807b213e8b..95cbb451bf 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -170,13 +170,10 @@ config HAS_VMAP
config LIBFDT
bool
-config MEM_ACCESS_ALWAYS_ON
- bool
-
config VM_EVENT
- def_bool MEM_ACCESS_ALWAYS_ON
- prompt "Memory Access and VM events" if !MEM_ACCESS_ALWAYS_ON
+ bool "Memory Access and VM events"
depends on HVM
+ default X86
help
Framework to configure memory access types for guests and receive
diff --git a/xen/include/xen/mem_access.h b/xen/include/xen/mem_access.h
index 4de651038d..7f2400ceed 100644
--- a/xen/include/xen/mem_access.h
+++ b/xen/include/xen/mem_access.h
@@ -74,9 +74,19 @@ typedef enum {
} p2m_access_t;
struct p2m_domain;
+#ifdef CONFIG_VM_EVENT
bool xenmem_access_to_p2m_access(const struct p2m_domain *p2m,
xenmem_access_t xaccess,
p2m_access_t *paccess);
+#else
+static inline bool xenmem_access_to_p2m_access(const struct p2m_domain *p2m,
+ xenmem_access_t xaccess,
+ p2m_access_t *paccess)
+{
+ *paccess = p2m_access_rwx;
+ return true;
+}
+#endif
/*
* Set access type for a region of gfns.
diff --git a/xen/include/xen/vm_event.h b/xen/include/xen/vm_event.h
index 27d0c74216..1b76ce632e 100644
--- a/xen/include/xen/vm_event.h
+++ b/xen/include/xen/vm_event.h
@@ -51,7 +51,14 @@ struct vm_event_domain
};
/* Returns whether a ring has been set up */
+#ifdef CONFIG_VM_EVENT
bool vm_event_check_ring(struct vm_event_domain *ved);
+#else
+static inline bool vm_event_check_ring(struct vm_event_domain *ved)
+{
+ return false;
+}
+#endif /* CONFIG_VM_EVENT */
/* Returns 0 on success, -ENOSYS if there is no ring, -EBUSY if there is no
* available space and the caller is a foreign domain. If the guest itself
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-10-13 10:15 ` [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT Penny Zheng
@ 2025-10-21 13:24 ` Grygorii Strashko
2025-10-29 15:57 ` Jan Beulich
1 sibling, 0 replies; 68+ messages in thread
From: Grygorii Strashko @ 2025-10-21 13:24 UTC (permalink / raw)
To: Penny Zheng, xen-devel
Cc: ray.huang, oleksii.kurochko, Jan Beulich, Andrew Cooper,
Roger Pau Monné, Anthony PERARD, Michal Orzel, Julien Grall,
Stefano Stabellini, Tamas K Lengyel, Alexandru Isaila,
Petre Pircalabu, Daniel P. Smith
Hi
On 13.10.25 13:15, Penny Zheng wrote:
> File hvm/vm_event.c and x86/vm_event.c are the extend to vm_event handling
> routines, and its compilation shall be guarded by CONFIG_VM_EVENT too.
> Futhermore, features about monitor_op and memory access are both based on
> vm event subsystem, so monitor.o/mem_access.o shall be wrapped under
> CONFIG_VM_EVENT.
>
> Although CONFIG_VM_EVENT is right now forcibly enabled on x86 via
> MEM_ACCESS_ALWAYS_ON, we could disable it through disabling
> CONFIG_MGMT_HYPERCALLS later. So we remove MEM_ACCESS_ALWAYS_ON and
> make VM_EVENT=y on default only on x86 to retain the same.
>
> In consequence, a few switch-blocks need in-place stubs in do_altp2m_op()
> to pass compilation when ALTP2M=y and VM_EVENT=n(, hence MEM_ACCESS=n), like
> HVMOP_altp2m_set_mem_access, etc.
> And the following functions still require stubs to pass compilation:
> - vm_event_check_ring()
> - p2m_mem_access_check()
> - xenmem_access_to_p2m_access()
>
> The following functions are developed on the basis of vm event framework, or
> only invoked by vm_event.c/monitor.c/mem_access.c, so they all shall be
> wrapped with CONFIG_VM_EVENT (otherwise they will become unreachable and
> violate Misra rule 2.1 when VM_EVENT=n):
> - hvm_toggle_singlestep
> - hvm_fast_singlestep
> - hvm_enable_msr_interception
> - hvm_function_table.enable_msr_interception
> - hvm_has_set_descriptor_access_existing
> - hvm_function_table.set_descriptor_access_existing
> - arch_monitor_domctl_op
> - arch_monitor_allow_userspace
> - arch_monitor_get_capabilities
> - hvm_emulate_one_vm_event
> - hvmemul_write{,cmpxchg,rep_ins,rep_outs,rep_movs,rep_stos,read_io,write_io}_discard
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v1 -> v2:
> - split out XSM changes
> - remove unnecessary stubs
> - move "struct p2m_domain" declaration ahead of the #ifdef
> ---
> v2 -> v3:
> - move .enable_msr_interception and .set_descriptor_access_exiting together
> - with the introduction of "vm_event_is_enabled()", all hvm_monitor_xxx()
> stubs are no longer needed
> - change to use in-place stubs in do_altp2m_op()
> - no need to add stub for monitor_traps(), __vm_event_claim_slot(),
> vm_event_put_request() and vm_event_vcpu_pause()
> - remove MEM_ACCESS_ALWAYS_ON
> - return default p2m_access_rwx for xenmem_access_to_p2m_access() when
> VM_EVENT=n
> - add wrapping for hvm_emulate_one_vm_event/
> hvmemul_write{,cmpxchg,rep_ins,rep_outs,rep_movs,rep_stos,read_io,write_io}_discard
> ---
> xen/arch/x86/Makefile | 2 +-
> xen/arch/x86/hvm/Kconfig | 1 -
> xen/arch/x86/hvm/Makefile | 4 +-
> xen/arch/x86/hvm/emulate.c | 58 ++++++++++++++-------------
> xen/arch/x86/hvm/hvm.c | 21 ++++++++++
> xen/arch/x86/hvm/svm/svm.c | 8 +++-
> xen/arch/x86/hvm/vmx/vmx.c | 10 +++++
> xen/arch/x86/include/asm/hvm/hvm.h | 9 ++++-
> xen/arch/x86/include/asm/mem_access.h | 9 +++++
> xen/arch/x86/include/asm/monitor.h | 9 +++++
> xen/common/Kconfig | 7 +---
> xen/include/xen/mem_access.h | 10 +++++
> xen/include/xen/vm_event.h | 7 ++++
> 13 files changed, 116 insertions(+), 39 deletions(-)
>
> diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
> index 0f91ffcb9d..615cd101b8 100644
> --- a/xen/arch/x86/Makefile
> +++ b/xen/arch/x86/Makefile
> @@ -76,7 +76,7 @@ obj-y += usercopy.o
> obj-y += x86_emulate.o
> obj-$(CONFIG_TBOOT) += tboot.o
> obj-y += hpet.o
> -obj-y += vm_event.o
> +obj-$(CONFIG_VM_EVENT) += vm_event.o
> obj-y += xstate.o
>
> ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
> diff --git a/xen/arch/x86/hvm/Kconfig b/xen/arch/x86/hvm/Kconfig
> index 5cb9f29042..e6b388dd0e 100644
> --- a/xen/arch/x86/hvm/Kconfig
> +++ b/xen/arch/x86/hvm/Kconfig
> @@ -3,7 +3,6 @@ menuconfig HVM
> default !PV_SHIM
> select COMPAT
> select IOREQ_SERVER
> - select MEM_ACCESS_ALWAYS_ON
> help
> Interfaces to support HVM domains. HVM domains require hardware
> virtualisation extensions (e.g. Intel VT-x, AMD SVM), but can boot
> diff --git a/xen/arch/x86/hvm/Makefile b/xen/arch/x86/hvm/Makefile
> index 6ec2c8f2db..952db00dd7 100644
> --- a/xen/arch/x86/hvm/Makefile
> +++ b/xen/arch/x86/hvm/Makefile
> @@ -16,7 +16,7 @@ obj-y += io.o
> obj-y += ioreq.o
> obj-y += irq.o
> obj-y += mmio.o
> -obj-y += monitor.o
> +obj-$(CONFIG_VM_EVENT) += monitor.o
> obj-y += mtrr.o
> obj-y += nestedhvm.o
> obj-y += pmtimer.o
> @@ -26,7 +26,7 @@ obj-y += save.o
> obj-y += stdvga.o
> obj-y += vioapic.o
> obj-y += vlapic.o
> -obj-y += vm_event.o
> +obj-$(CONFIG_VM_EVENT) += vm_event.o
> obj-y += vmsi.o
> obj-y += vpic.o
> obj-y += vpt.o
> diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
> index fe75b0516d..d56ef02baf 100644
> --- a/xen/arch/x86/hvm/emulate.c
> +++ b/xen/arch/x86/hvm/emulate.c
> @@ -1615,6 +1615,7 @@ static int cf_check hvmemul_blk(
> return rc;
> }
>
> +#ifdef CONFIG_VM_EVENT
> static int cf_check hvmemul_write_discard(
> enum x86_segment seg,
> unsigned long offset,
> @@ -1717,6 +1718,7 @@ static int cf_check hvmemul_cache_op_discard(
> {
> return X86EMUL_OKAY;
> }
> +#endif /* CONFIG_VM_EVENT */
>
> static int cf_check hvmemul_cmpxchg(
> enum x86_segment seg,
> @@ -2750,33 +2752,6 @@ static const struct x86_emulate_ops hvm_emulate_ops = {
> .vmfunc = hvmemul_vmfunc,
> };
>
> -static const struct x86_emulate_ops hvm_emulate_ops_no_write = {
> - .read = hvmemul_read,
> - .insn_fetch = hvmemul_insn_fetch,
> - .write = hvmemul_write_discard,
> - .cmpxchg = hvmemul_cmpxchg_discard,
> - .rep_ins = hvmemul_rep_ins_discard,
> - .rep_outs = hvmemul_rep_outs_discard,
> - .rep_movs = hvmemul_rep_movs_discard,
> - .rep_stos = hvmemul_rep_stos_discard,
> - .read_segment = hvmemul_read_segment,
> - .write_segment = hvmemul_write_segment,
> - .read_io = hvmemul_read_io_discard,
> - .write_io = hvmemul_write_io_discard,
> - .read_cr = hvmemul_read_cr,
> - .write_cr = hvmemul_write_cr,
> - .read_xcr = hvmemul_read_xcr,
> - .write_xcr = hvmemul_write_xcr,
> - .read_msr = hvmemul_read_msr,
> - .write_msr = hvmemul_write_msr_discard,
> - .cache_op = hvmemul_cache_op_discard,
> - .tlb_op = hvmemul_tlb_op,
> - .cpuid = x86emul_cpuid,
> - .get_fpu = hvmemul_get_fpu,
> - .put_fpu = hvmemul_put_fpu,
> - .vmfunc = hvmemul_vmfunc,
> -};
> -
> /*
> * Note that passing VIO_no_completion into this function serves as kind
> * of (but not fully) an "auto select completion" indicator. When there's
> @@ -2887,6 +2862,34 @@ int hvm_emulate_one(
> return _hvm_emulate_one(hvmemul_ctxt, &hvm_emulate_ops, completion);
> }
>
> +#ifdef CONFIG_VM_EVENT
> +static const struct x86_emulate_ops hvm_emulate_ops_no_write = {
> + .read = hvmemul_read,
> + .insn_fetch = hvmemul_insn_fetch,
> + .write = hvmemul_write_discard,
> + .cmpxchg = hvmemul_cmpxchg_discard,
> + .rep_ins = hvmemul_rep_ins_discard,
> + .rep_outs = hvmemul_rep_outs_discard,
> + .rep_movs = hvmemul_rep_movs_discard,
> + .rep_stos = hvmemul_rep_stos_discard,
> + .read_segment = hvmemul_read_segment,
> + .write_segment = hvmemul_write_segment,
> + .read_io = hvmemul_read_io_discard,
> + .write_io = hvmemul_write_io_discard,
> + .read_cr = hvmemul_read_cr,
> + .write_cr = hvmemul_write_cr,
> + .read_xcr = hvmemul_read_xcr,
> + .write_xcr = hvmemul_write_xcr,
> + .read_msr = hvmemul_read_msr,
> + .write_msr = hvmemul_write_msr_discard,
> + .cache_op = hvmemul_cache_op_discard,
> + .tlb_op = hvmemul_tlb_op,
> + .cpuid = x86emul_cpuid,
> + .get_fpu = hvmemul_get_fpu,
> + .put_fpu = hvmemul_put_fpu,
> + .vmfunc = hvmemul_vmfunc,
> +};
> +
> void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
> unsigned int errcode)
> {
> @@ -2949,6 +2952,7 @@ void hvm_emulate_one_vm_event(enum emul_kind kind, unsigned int trapnr,
>
> hvm_emulate_writeback(&ctx);
> }
> +#endif /* CONFIG_VM_EVENT */
>
> void hvm_emulate_init_once(
> struct hvm_emulate_ctxt *hvmemul_ctxt,
> diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
> index 48a293069b..e3dacc909b 100644
> --- a/xen/arch/x86/hvm/hvm.c
> +++ b/xen/arch/x86/hvm/hvm.c
> @@ -50,6 +50,7 @@
> #include <asm/hvm/vm_event.h>
> #include <asm/hvm/vpt.h>
> #include <asm/i387.h>
> +#include <asm/mem_access.h>
> #include <asm/mc146818rtc.h>
> #include <asm/mce.h>
> #include <asm/monitor.h>
> @@ -4861,15 +4862,20 @@ static int do_altp2m_op(
> break;
>
> case HVMOP_altp2m_set_mem_access:
> +#ifdef CONFIG_VM_EVENT
> if ( a.u.mem_access.pad )
> rc = -EINVAL;
> else
> rc = p2m_set_mem_access(d, _gfn(a.u.mem_access.gfn), 1, 0, 0,
> a.u.mem_access.access,
> a.u.mem_access.view);
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
>
> case HVMOP_altp2m_set_mem_access_multi:
> +#ifdef CONFIG_VM_EVENT
> if ( a.u.set_mem_access_multi.pad ||
> a.u.set_mem_access_multi.opaque > a.u.set_mem_access_multi.nr )
> {
> @@ -4898,9 +4904,13 @@ static int do_altp2m_op(
> &a, u.set_mem_access_multi.opaque) )
> rc = -EFAULT;
> }
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
>
> case HVMOP_altp2m_get_mem_access:
> +#ifdef CONFIG_VM_EVENT
> if ( a.u.mem_access.pad )
> rc = -EINVAL;
> else
> @@ -4915,6 +4925,9 @@ static int do_altp2m_op(
> rc = __copy_to_guest(arg, &a, 1) ? -EFAULT : 0;
> }
> }
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
>
> case HVMOP_altp2m_change_gfn:
> @@ -5030,6 +5043,7 @@ static int compat_altp2m_op(
> switch ( a.cmd )
> {
> case HVMOP_altp2m_set_mem_access_multi:
> +#ifdef CONFIG_VM_EVENT
> #define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list(_d_, _s_); \
> guest_from_compat_handle((_d_)->pfn_list, (_s_)->pfn_list)
> #define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list(_d_, _s_); \
> @@ -5038,6 +5052,7 @@ static int compat_altp2m_op(
> &a.u.set_mem_access_multi);
> #undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list
> #undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list
> +#endif
> break;
>
> default:
> @@ -5056,6 +5071,7 @@ static int compat_altp2m_op(
> switch ( a.cmd )
> {
> case HVMOP_altp2m_set_mem_access_multi:
> +#ifdef CONFIG_VM_EVENT
> if ( rc == -ERESTART )
> {
> a.u.set_mem_access_multi.opaque =
> @@ -5065,6 +5081,9 @@ static int compat_altp2m_op(
> &a, u.set_mem_access_multi.opaque) )
> rc = -EFAULT;
> }
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
>
> default:
> @@ -5283,6 +5302,7 @@ int hvm_debug_op(struct vcpu *v, int32_t op)
> return rc;
> }
>
> +#ifdef CONFIG_VM_EVENT
> void hvm_toggle_singlestep(struct vcpu *v)
> {
> ASSERT(atomic_read(&v->pause_count));
> @@ -5292,6 +5312,7 @@ void hvm_toggle_singlestep(struct vcpu *v)
>
> v->arch.hvm.single_step = !v->arch.hvm.single_step;
> }
> +#endif /* CONFIG_VM_EVENT */
>
> #ifdef CONFIG_ALTP2M
> void hvm_fast_singlestep(struct vcpu *v, uint16_t p2midx)
> diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
> index 679ca3dacd..c8506c25c4 100644
> --- a/xen/arch/x86/hvm/svm/svm.c
> +++ b/xen/arch/x86/hvm/svm/svm.c
> @@ -299,6 +299,7 @@ void svm_intercept_msr(struct vcpu *v, uint32_t msr, int flags)
> __clear_bit(msr * 2 + 1, msr_bit);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static void cf_check svm_enable_msr_interception(struct domain *d, uint32_t msr)
> {
> struct vcpu *v;
> @@ -306,6 +307,7 @@ static void cf_check svm_enable_msr_interception(struct domain *d, uint32_t msr)
> for_each_vcpu ( d, v )
> svm_intercept_msr(v, msr, MSR_INTERCEPT_WRITE);
> }
> +#endif /* CONFIG_VM_EVENT */
>
> static void svm_save_dr(struct vcpu *v)
> {
> @@ -826,6 +828,7 @@ static void cf_check svm_set_rdtsc_exiting(struct vcpu *v, bool enable)
> vmcb_set_general2_intercepts(vmcb, general2_intercepts);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static void cf_check svm_set_descriptor_access_exiting(
> struct vcpu *v, bool enable)
> {
> @@ -843,6 +846,7 @@ static void cf_check svm_set_descriptor_access_exiting(
>
> vmcb_set_general1_intercepts(vmcb, general1_intercepts);
> }
> +#endif /* CONFIG_VM_EVENT */
>
> static unsigned int cf_check svm_get_insn_bytes(struct vcpu *v, uint8_t *buf)
> {
> @@ -2457,9 +2461,11 @@ static struct hvm_function_table __initdata_cf_clobber svm_function_table = {
> .fpu_dirty_intercept = svm_fpu_dirty_intercept,
> .msr_read_intercept = svm_msr_read_intercept,
> .msr_write_intercept = svm_msr_write_intercept,
> +#ifdef CONFIG_VM_EVENT
> .enable_msr_interception = svm_enable_msr_interception,
> - .set_rdtsc_exiting = svm_set_rdtsc_exiting,
> .set_descriptor_access_exiting = svm_set_descriptor_access_exiting,
> +#endif
> + .set_rdtsc_exiting = svm_set_rdtsc_exiting,
> .get_insn_bytes = svm_get_insn_bytes,
>
> .nhvm_vcpu_initialise = nsvm_vcpu_initialise,
> diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
> index a40af1db66..1996e139a0 100644
> --- a/xen/arch/x86/hvm/vmx/vmx.c
> +++ b/xen/arch/x86/hvm/vmx/vmx.c
> @@ -1520,6 +1520,7 @@ static void cf_check vmx_set_rdtsc_exiting(struct vcpu *v, bool enable)
> vmx_vmcs_exit(v);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static void cf_check vmx_set_descriptor_access_exiting(
> struct vcpu *v, bool enable)
> {
> @@ -1534,6 +1535,7 @@ static void cf_check vmx_set_descriptor_access_exiting(
> vmx_update_secondary_exec_control(v);
> vmx_vmcs_exit(v);
> }
> +#endif /* CONFIG_VM_EVENT */
>
> static void cf_check vmx_init_hypercall_page(void *p)
> {
> @@ -2413,6 +2415,7 @@ static void cf_check vmx_handle_eoi(uint8_t vector, int isr)
> printk_once(XENLOG_WARNING "EOI for %02x but SVI=%02x\n", vector, old_svi);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static void cf_check vmx_enable_msr_interception(struct domain *d, uint32_t msr)
> {
> struct vcpu *v;
> @@ -2420,6 +2423,7 @@ static void cf_check vmx_enable_msr_interception(struct domain *d, uint32_t msr)
> for_each_vcpu ( d, v )
> vmx_set_msr_intercept(v, msr, VMX_MSR_W);
> }
> +#endif /* CONFIG_VM_EVENT */
>
> #ifdef CONFIG_ALTP2M
>
> @@ -2871,7 +2875,9 @@ static struct hvm_function_table __initdata_cf_clobber vmx_function_table = {
> .nhvm_domain_relinquish_resources = nvmx_domain_relinquish_resources,
> .update_vlapic_mode = vmx_vlapic_msr_changed,
> .nhvm_hap_walk_L1_p2m = nvmx_hap_walk_L1_p2m,
> +#ifdef CONFIG_VM_EVENT
> .enable_msr_interception = vmx_enable_msr_interception,
> +#endif
> #ifdef CONFIG_ALTP2M
> .altp2m_vcpu_update_p2m = vmx_vcpu_update_eptp,
> .altp2m_vcpu_update_vmfunc_ve = vmx_vcpu_update_vmfunc_ve,
> @@ -3079,9 +3085,11 @@ const struct hvm_function_table * __init start_vmx(void)
>
> vmx_function_table.caps.singlestep = cpu_has_monitor_trap_flag;
>
> +#ifdef CONFIG_VM_EVENT
> if ( cpu_has_vmx_dt_exiting )
> vmx_function_table.set_descriptor_access_exiting =
> vmx_set_descriptor_access_exiting;
> +#endif
>
> /*
> * Do not enable EPT when (!cpu_has_vmx_pat), to prevent security hole
> @@ -3152,8 +3160,10 @@ void __init vmx_fill_funcs(void)
> if ( !cpu_has_xen_ibt )
> return;
>
> +#ifdef CONFIG_VM_EVENT
> vmx_function_table.set_descriptor_access_exiting =
> vmx_set_descriptor_access_exiting;
> +#endif
>
> vmx_function_table.update_eoi_exit_bitmap = vmx_update_eoi_exit_bitmap;
> vmx_function_table.process_isr = vmx_process_isr;
> diff --git a/xen/arch/x86/include/asm/hvm/hvm.h b/xen/arch/x86/include/asm/hvm/hvm.h
> index f02183691e..473cf24b83 100644
> --- a/xen/arch/x86/include/asm/hvm/hvm.h
> +++ b/xen/arch/x86/include/asm/hvm/hvm.h
> @@ -192,7 +192,10 @@ struct hvm_function_table {
> void (*handle_cd)(struct vcpu *v, unsigned long value);
> void (*set_info_guest)(struct vcpu *v);
> void (*set_rdtsc_exiting)(struct vcpu *v, bool enable);
> +#ifdef CONFIG_VM_EVENT
> void (*set_descriptor_access_exiting)(struct vcpu *v, bool enable);
> + void (*enable_msr_interception)(struct domain *d, uint32_t msr);
> +#endif
>
> /* Nested HVM */
> int (*nhvm_vcpu_initialise)(struct vcpu *v);
> @@ -224,8 +227,6 @@ struct hvm_function_table {
> paddr_t *L1_gpa, unsigned int *page_order,
> uint8_t *p2m_acc, struct npfec npfec);
>
> - void (*enable_msr_interception)(struct domain *d, uint32_t msr);
> -
> #ifdef CONFIG_ALTP2M
> /* Alternate p2m */
> void (*altp2m_vcpu_update_p2m)(struct vcpu *v);
> @@ -433,10 +434,12 @@ static inline bool using_svm(void)
>
> #define hvm_long_mode_active(v) (!!((v)->arch.hvm.guest_efer & EFER_LMA))
>
> +#ifdef CONFIG_VM_EVENT
> static inline bool hvm_has_set_descriptor_access_exiting(void)
> {
> return hvm_funcs.set_descriptor_access_exiting;
> }
> +#endif
>
> static inline void hvm_domain_creation_finished(struct domain *d)
> {
> @@ -679,10 +682,12 @@ static inline int nhvm_hap_walk_L1_p2m(
> v, L2_gpa, L1_gpa, page_order, p2m_acc, npfec);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static inline void hvm_enable_msr_interception(struct domain *d, uint32_t msr)
> {
> alternative_vcall(hvm_funcs.enable_msr_interception, d, msr);
> }
> +#endif
>
> static inline bool hvm_is_singlestep_supported(void)
> {
> diff --git a/xen/arch/x86/include/asm/mem_access.h b/xen/arch/x86/include/asm/mem_access.h
> index 1a52a10322..c786116310 100644
> --- a/xen/arch/x86/include/asm/mem_access.h
> +++ b/xen/arch/x86/include/asm/mem_access.h
> @@ -14,6 +14,7 @@
> #ifndef __ASM_X86_MEM_ACCESS_H__
> #define __ASM_X86_MEM_ACCESS_H__
>
> +#ifdef CONFIG_VM_EVENT
> /*
> * Setup vm_event request based on the access (gla is -1ull if not available).
> * Handles the rw2rx conversion. Boolean return value indicates if event type
> @@ -25,6 +26,14 @@
> bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> struct npfec npfec,
> struct vm_event_st **req_ptr);
> +#else
> +static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> + struct npfec npfec,
> + struct vm_event_st **req_ptr)
> +{
> + return false;
> +}
> +#endif /* CONFIG_VM_EVENT */
>
> /* Check for emulation and mark vcpu for skipping one instruction
> * upon rescheduling if required. */
> diff --git a/xen/arch/x86/include/asm/monitor.h b/xen/arch/x86/include/asm/monitor.h
> index 3c64d8258f..1cd169f8f0 100644
> --- a/xen/arch/x86/include/asm/monitor.h
> +++ b/xen/arch/x86/include/asm/monitor.h
> @@ -32,6 +32,7 @@ struct monitor_msr_bitmap {
> DECLARE_BITMAP(high, 8192);
> };
>
> +#ifdef COMFIG_VM_EVENT
Typo here causes build to fail.
With ^ fixed and patches 3 and 9 applied, and VM_EVENT=n there are still
build failures, like:
xen/arch/x86/hvm/svm/svm.c:2757: undefined reference to `hvm_monitor_debug'
In my opinion, It might be reasonable to proceed with this patch (and related patches [3,?]) first,
as standalone series, to make VM_EVENT=n work and do MGMT_HYPERCALLS on top of it.
This patch, by itself, is big and included in even bigger series - which makes hard to
review and track changes.
[..]
--
Best regards,
-grygorii
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-10-13 10:15 ` [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT Penny Zheng
2025-10-21 13:24 ` Grygorii Strashko
@ 2025-10-29 15:57 ` Jan Beulich
2025-11-11 7:08 ` Penny, Zheng
1 sibling, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-10-29 15:57 UTC (permalink / raw)
To: Penny Zheng, Tamas K Lengyel
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
Anthony PERARD, Michal Orzel, Julien Grall, Stefano Stabellini,
Alexandru Isaila, Petre Pircalabu, Daniel P. Smith, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> File hvm/vm_event.c and x86/vm_event.c are the extend to vm_event handling
> routines, and its compilation shall be guarded by CONFIG_VM_EVENT too.
> Futhermore, features about monitor_op and memory access are both based on
> vm event subsystem, so monitor.o/mem_access.o shall be wrapped under
> CONFIG_VM_EVENT.
>
> Although CONFIG_VM_EVENT is right now forcibly enabled on x86 via
> MEM_ACCESS_ALWAYS_ON, we could disable it through disabling
> CONFIG_MGMT_HYPERCALLS later. So we remove MEM_ACCESS_ALWAYS_ON and
> make VM_EVENT=y on default only on x86 to retain the same.
>
> In consequence, a few switch-blocks need in-place stubs in do_altp2m_op()
> to pass compilation when ALTP2M=y and VM_EVENT=n(, hence MEM_ACCESS=n), like
> HVMOP_altp2m_set_mem_access, etc.
> And the following functions still require stubs to pass compilation:
> - vm_event_check_ring()
> - p2m_mem_access_check()
> - xenmem_access_to_p2m_access()
>
> The following functions are developed on the basis of vm event framework, or
> only invoked by vm_event.c/monitor.c/mem_access.c, so they all shall be
> wrapped with CONFIG_VM_EVENT (otherwise they will become unreachable and
> violate Misra rule 2.1 when VM_EVENT=n):
> - hvm_toggle_singlestep
> - hvm_fast_singlestep
> - hvm_enable_msr_interception
> - hvm_function_table.enable_msr_interception
> - hvm_has_set_descriptor_access_existing
> - hvm_function_table.set_descriptor_access_existing
> - arch_monitor_domctl_op
> - arch_monitor_allow_userspace
> - arch_monitor_get_capabilities
> - hvm_emulate_one_vm_event
> - hvmemul_write{,cmpxchg,rep_ins,rep_outs,rep_movs,rep_stos,read_io,write_io}_discard
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Overall I agree with Grygorii's remark towards this preferably wanting (a) splitting
off and perhaps (b) also splitting up some. If at all possible, of course.
> --- a/xen/arch/x86/hvm/hvm.c
> +++ b/xen/arch/x86/hvm/hvm.c
> @@ -50,6 +50,7 @@
> #include <asm/hvm/vm_event.h>
> #include <asm/hvm/vpt.h>
> #include <asm/i387.h>
> +#include <asm/mem_access.h>
> #include <asm/mc146818rtc.h>
> #include <asm/mce.h>
> #include <asm/monitor.h>
> @@ -4861,15 +4862,20 @@ static int do_altp2m_op(
> break;
>
> case HVMOP_altp2m_set_mem_access:
> +#ifdef CONFIG_VM_EVENT
> if ( a.u.mem_access.pad )
> rc = -EINVAL;
> else
> rc = p2m_set_mem_access(d, _gfn(a.u.mem_access.gfn), 1, 0, 0,
> a.u.mem_access.access,
> a.u.mem_access.view);
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
I think this (and if possible the others below here) would better use
IS_ENABLED(). (Would also shrink the diff.)
> @@ -5030,6 +5043,7 @@ static int compat_altp2m_op(
> switch ( a.cmd )
> {
> case HVMOP_altp2m_set_mem_access_multi:
> +#ifdef CONFIG_VM_EVENT
> #define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list(_d_, _s_); \
> guest_from_compat_handle((_d_)->pfn_list, (_s_)->pfn_list)
> #define XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list(_d_, _s_); \
> @@ -5038,6 +5052,7 @@ static int compat_altp2m_op(
> &a.u.set_mem_access_multi);
> #undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_pfn_list
> #undef XLAT_hvm_altp2m_set_mem_access_multi_HNDL_access_list
> +#endif
> break;
>
> default:
> @@ -5056,6 +5071,7 @@ static int compat_altp2m_op(
> switch ( a.cmd )
> {
> case HVMOP_altp2m_set_mem_access_multi:
> +#ifdef CONFIG_VM_EVENT
> if ( rc == -ERESTART )
> {
> a.u.set_mem_access_multi.opaque =
> @@ -5065,6 +5081,9 @@ static int compat_altp2m_op(
> &a, u.set_mem_access_multi.opaque) )
> rc = -EFAULT;
> }
> +#else
> + rc = -EOPNOTSUPP;
> +#endif
> break;
>
> default:
Are these changes really needed?
> --- a/xen/arch/x86/include/asm/hvm/hvm.h
> +++ b/xen/arch/x86/include/asm/hvm/hvm.h
> @@ -192,7 +192,10 @@ struct hvm_function_table {
> void (*handle_cd)(struct vcpu *v, unsigned long value);
> void (*set_info_guest)(struct vcpu *v);
> void (*set_rdtsc_exiting)(struct vcpu *v, bool enable);
> +#ifdef CONFIG_VM_EVENT
> void (*set_descriptor_access_exiting)(struct vcpu *v, bool enable);
> + void (*enable_msr_interception)(struct domain *d, uint32_t msr);
> +#endif
>
> /* Nested HVM */
> int (*nhvm_vcpu_initialise)(struct vcpu *v);
Another blank line ahead of the #ifdef?
> @@ -433,10 +434,12 @@ static inline bool using_svm(void)
>
> #define hvm_long_mode_active(v) (!!((v)->arch.hvm.guest_efer & EFER_LMA))
>
> +#ifdef CONFIG_VM_EVENT
> static inline bool hvm_has_set_descriptor_access_exiting(void)
> {
> return hvm_funcs.set_descriptor_access_exiting;
> }
> +#endif
>
> static inline void hvm_domain_creation_finished(struct domain *d)
> {
> @@ -679,10 +682,12 @@ static inline int nhvm_hap_walk_L1_p2m(
> v, L2_gpa, L1_gpa, page_order, p2m_acc, npfec);
> }
>
> +#ifdef CONFIG_VM_EVENT
> static inline void hvm_enable_msr_interception(struct domain *d, uint32_t msr)
> {
> alternative_vcall(hvm_funcs.enable_msr_interception, d, msr);
> }
> +#endif
Move this up into the earlier #ifdef?
> --- a/xen/arch/x86/include/asm/mem_access.h
> +++ b/xen/arch/x86/include/asm/mem_access.h
> @@ -14,6 +14,7 @@
> #ifndef __ASM_X86_MEM_ACCESS_H__
> #define __ASM_X86_MEM_ACCESS_H__
>
> +#ifdef CONFIG_VM_EVENT
> /*
> * Setup vm_event request based on the access (gla is -1ull if not available).
> * Handles the rw2rx conversion. Boolean return value indicates if event type
> @@ -25,6 +26,14 @@
> bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> struct npfec npfec,
> struct vm_event_st **req_ptr);
> +#else
> +static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> + struct npfec npfec,
> + struct vm_event_st **req_ptr)
> +{
> + return false;
Leaving *req_ptr untouched feels dangerous; the fact that the sole caller has
what it uses set to NULL up front is secondary.
From looking at the function it's also not quite clear to me whether "false" is
the correct return value here. Tamas?
> --- a/xen/arch/x86/include/asm/monitor.h
> +++ b/xen/arch/x86/include/asm/monitor.h
> @@ -32,6 +32,7 @@ struct monitor_msr_bitmap {
> DECLARE_BITMAP(high, 8192);
> };
>
> +#ifdef COMFIG_VM_EVENT
Typo aside, isn't the entire file (perhaps minus some stubs) useful only when
VM_EVENT=y?
> --- a/xen/include/xen/mem_access.h
> +++ b/xen/include/xen/mem_access.h
> @@ -74,9 +74,19 @@ typedef enum {
> } p2m_access_t;
>
> struct p2m_domain;
> +#ifdef CONFIG_VM_EVENT
> bool xenmem_access_to_p2m_access(const struct p2m_domain *p2m,
> xenmem_access_t xaccess,
> p2m_access_t *paccess);
> +#else
> +static inline bool xenmem_access_to_p2m_access(const struct p2m_domain *p2m,
> + xenmem_access_t xaccess,
> + p2m_access_t *paccess)
> +{
> + *paccess = p2m_access_rwx;
Why not p2m->default_access, as the full function has it? And should xaccess
other than XENMEM_access_default be rejected, by returning false? (In turn I
wonder whether the real function may not want to move elsewhere, so that a
stub open-coding part of it wouldn't be necessary.)
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* RE: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-10-29 15:57 ` Jan Beulich
@ 2025-11-11 7:08 ` Penny, Zheng
2025-11-11 8:13 ` Jan Beulich
0 siblings, 1 reply; 68+ messages in thread
From: Penny, Zheng @ 2025-11-11 7:08 UTC (permalink / raw)
To: Jan Beulich, Tamas K Lengyel
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Roger Pau Monné, Anthony PERARD, Orzel, Michal, Julien Grall,
Stefano Stabellini, Alexandru Isaila, Petre Pircalabu,
Daniel P. Smith, xen-devel@lists.xenproject.org
[Public]
Hi,
Sorry for the late response. Just got back from long annual leaves
> -----Original Message-----
> > --- a/xen/arch/x86/include/asm/mem_access.h
> > +++ b/xen/arch/x86/include/asm/mem_access.h
> > @@ -14,6 +14,7 @@
> > #ifndef __ASM_X86_MEM_ACCESS_H__
> > #define __ASM_X86_MEM_ACCESS_H__
> >
> > +#ifdef CONFIG_VM_EVENT
> > /*
> > * Setup vm_event request based on the access (gla is -1ull if not available).
> > * Handles the rw2rx conversion. Boolean return value indicates if event type
> > @@ -25,6 +26,14 @@
> > bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> > struct npfec npfec,
> > struct vm_event_st **req_ptr);
> > +#else
> > +static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> > + struct npfec npfec,
> > + struct vm_event_st **req_ptr)
> > +{
> > + return false;
>
> Leaving *req_ptr untouched feels dangerous; the fact that the sole caller has
> what it uses set to NULL up front is secondary.
>
If we *req_ptr = NULL; compiler will not DCE the following code block when VM_EVENT=n:
```
if ( req_ptr )
{
if ( monitor_traps(curr, sync, req_ptr) < 0 )
rc = 0;
xfree(req_ptr);
}
return rc;
```
Or am I misunderstanding what you suggest?
> From looking at the function it's also not quite clear to me whether "false" is
> the correct return value here. Tamas?
>
> > --- a/xen/arch/x86/include/asm/monitor.h
> > +++ b/xen/arch/x86/include/asm/monitor.h
> > @@ -32,6 +32,7 @@ struct monitor_msr_bitmap {
> > DECLARE_BITMAP(high, 8192);
> > };
> >
> > +#ifdef COMFIG_VM_EVENT
>
> Typo aside, isn't the entire file (perhaps minus some stubs) useful only when
> VM_EVENT=y?
>
Yes, maybe only arch_monitor_get_capabilities() needs the wrapping. As it invokes hvm_has_set_descriptor_access_exiting(), which is declared only when VM_EVENT=y
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-11-11 7:08 ` Penny, Zheng
@ 2025-11-11 8:13 ` Jan Beulich
2025-11-11 9:46 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-11-11 8:13 UTC (permalink / raw)
To: Penny, Zheng
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Roger Pau Monné, Anthony PERARD, Orzel, Michal, Julien Grall,
Stefano Stabellini, Alexandru Isaila, Petre Pircalabu,
Daniel P. Smith, xen-devel@lists.xenproject.org, Tamas K Lengyel
On 11.11.2025 08:08, Penny, Zheng wrote:
> [Public]
>
> Hi,
>
> Sorry for the late response. Just got back from long annual leaves
>
>> -----Original Message-----
>>> --- a/xen/arch/x86/include/asm/mem_access.h
>>> +++ b/xen/arch/x86/include/asm/mem_access.h
>>> @@ -14,6 +14,7 @@
>>> #ifndef __ASM_X86_MEM_ACCESS_H__
>>> #define __ASM_X86_MEM_ACCESS_H__
>>>
>>> +#ifdef CONFIG_VM_EVENT
>>> /*
>>> * Setup vm_event request based on the access (gla is -1ull if not available).
>>> * Handles the rw2rx conversion. Boolean return value indicates if event type
>>> @@ -25,6 +26,14 @@
>>> bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
>>> struct npfec npfec,
>>> struct vm_event_st **req_ptr);
>>> +#else
>>> +static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
>>> + struct npfec npfec,
>>> + struct vm_event_st **req_ptr)
>>> +{
>>> + return false;
>>
>> Leaving *req_ptr untouched feels dangerous; the fact that the sole caller has
>> what it uses set to NULL up front is secondary.
>>
>
> If we *req_ptr = NULL; compiler will not DCE the following code block when VM_EVENT=n:
> ```
> if ( req_ptr )
> {
> if ( monitor_traps(curr, sync, req_ptr) < 0 )
> rc = 0;
>
> xfree(req_ptr);
> }
> return rc;
> ```
> Or am I misunderstanding what you suggest?
First: It would have helped if you had also said where that code fragment actually
was taken from.
Seeing it's in hvm_hap_nested_page_fault(), I'm having trouble following why the
compiler wouldn't be able to see that the local variable "req_ptr" there would
never change value, i.e. remain NULL throughout its lifetime. If indeed there's a
compiler shortcoming, that either wants working around or properly writing down.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* RE: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
2025-11-11 8:13 ` Jan Beulich
@ 2025-11-11 9:46 ` Penny, Zheng
0 siblings, 0 replies; 68+ messages in thread
From: Penny, Zheng @ 2025-11-11 9:46 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Roger Pau Monné, Anthony PERARD, Orzel, Michal, Julien Grall,
Stefano Stabellini, Alexandru Isaila, Petre Pircalabu,
Daniel P. Smith, xen-devel@lists.xenproject.org, Tamas K Lengyel
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Tuesday, November 11, 2025 4:14 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Roger Pau Monné <roger.pau@citrix.com>;
> Anthony PERARD <anthony.perard@vates.tech>; Orzel, Michal
> <Michal.Orzel@amd.com>; Julien Grall <julien@xen.org>; Stefano Stabellini
> <sstabellini@kernel.org>; Alexandru Isaila <aisaila@bitdefender.com>; Petre
> Pircalabu <ppircalabu@bitdefender.com>; Daniel P. Smith
> <dpsmith@apertussolutions.com>; xen-devel@lists.xenproject.org; Tamas K
> Lengyel <tamas@tklengyel.com>
> Subject: Re: [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT
>
> On 11.11.2025 08:08, Penny, Zheng wrote:
> > [Public]
> >
> > Hi,
> >
> > Sorry for the late response. Just got back from long annual leaves
> >
> >> -----Original Message-----
> >>> --- a/xen/arch/x86/include/asm/mem_access.h
> >>> +++ b/xen/arch/x86/include/asm/mem_access.h
> >>> @@ -14,6 +14,7 @@
> >>> #ifndef __ASM_X86_MEM_ACCESS_H__
> >>> #define __ASM_X86_MEM_ACCESS_H__
> >>>
> >>> +#ifdef CONFIG_VM_EVENT
> >>> /*
> >>> * Setup vm_event request based on the access (gla is -1ull if not available).
> >>> * Handles the rw2rx conversion. Boolean return value indicates if
> >>> event type @@ -25,6 +26,14 @@ bool p2m_mem_access_check(paddr_t
> >>> gpa, unsigned long gla,
> >>> struct npfec npfec,
> >>> struct vm_event_st **req_ptr);
> >>> +#else
> >>> +static inline bool p2m_mem_access_check(paddr_t gpa, unsigned long gla,
> >>> + struct npfec npfec,
> >>> + struct vm_event_st
> >>> +**req_ptr) {
> >>> + return false;
> >>
> >> Leaving *req_ptr untouched feels dangerous; the fact that the sole
> >> caller has what it uses set to NULL up front is secondary.
> >>
> >
> > If we *req_ptr = NULL; compiler will not DCE the following code block when
> VM_EVENT=n:
> > ```
> > if ( req_ptr )
> > {
> > if ( monitor_traps(curr, sync, req_ptr) < 0 )
> > rc = 0;
> >
> > xfree(req_ptr);
> > }
> > return rc;
> > ```
> > Or am I misunderstanding what you suggest?
>
> First: It would have helped if you had also said where that code fragment actually
> was taken from.
>
> Seeing it's in hvm_hap_nested_page_fault(), I'm having trouble following why the
> compiler wouldn't be able to see that the local variable "req_ptr" there would never
> change value, i.e. remain NULL throughout its lifetime. If indeed there's a compiler
> shortcoming, that either wants working around or properly writing down.
>
This runtime undefined error will only occur when we turn on CONFIG_UBSAN(, then -fsanitize=undefined in CFLAG). Idk why....
But if we strengthen the condition check with vm_event_is_enabled(), we will pass even when UBSAN=y.
```
if ( req_ptr && vm_event_is_enabled(curr) )
```
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 10/28] xen/vm_event: make VM_EVENT depend on CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (7 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 09/28] xen/vm_event: consolidate CONFIG_VM_EVENT Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 11/28] xen/xsm: wrap xsm_vm_event_control() with CONFIG_VM_EVENT Penny Zheng
` (18 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
VM event could only be enabled/disabled via vm_event domctl-op, so
CONFIG_VM_EVENT shall depend on CONFIG_MGMT_HYPERCALLS
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
---
xen/common/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 95cbb451bf..309d262386 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -172,7 +172,7 @@ config LIBFDT
config VM_EVENT
bool "Memory Access and VM events"
- depends on HVM
+ depends on HVM && MGMT_HYPERCALLS
default X86
help
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 11/28] xen/xsm: wrap xsm_vm_event_control() with CONFIG_VM_EVENT
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (8 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 10/28] xen/vm_event: make VM_EVENT depend on CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 12/28] xen/domctl: wrap domain_pause_by_systemcontroller() with MGMT_HYPERCALLS Penny Zheng
` (17 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Daniel P. Smith,
Stefano Stabellini
Function xsm_vm_event_control() is only invoked under CONFIG_VM_EVENT, so
it shall be wrapped with it, otherwiae it will become unreachable when
VM_EVENT=n and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- new commit
---
v2 -> v3:
- address "violating Misra rule 2.1" in commit message
- add missing wrapping in include/xsm/dummy.h
---
xen/include/xsm/dummy.h | 2 +-
xen/include/xsm/xsm.h | 4 ++--
xen/xsm/dummy.c | 2 +-
xen/xsm/flask/hooks.c | 4 ++--
4 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 5206836582..9b1d31b6ec 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -639,6 +639,7 @@ static XSM_INLINE int cf_check xsm_hvm_altp2mhvm_op(
}
}
+#ifdef CONFIG_VM_EVENT
static XSM_INLINE int cf_check xsm_vm_event_control(
XSM_DEFAULT_ARG struct domain *d, int mode, int op)
{
@@ -646,7 +647,6 @@ static XSM_INLINE int cf_check xsm_vm_event_control(
return xsm_default_action(action, current->domain, d);
}
-#ifdef CONFIG_VM_EVENT
static XSM_INLINE int cf_check xsm_mem_access(XSM_DEFAULT_ARG struct domain *d)
{
XSM_ASSERT_ACTION(XSM_DM_PRIV);
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 0231a208ff..4c6e0dc0f9 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -155,9 +155,9 @@ struct xsm_ops {
int (*hvm_altp2mhvm_op)(struct domain *d, uint64_t mode, uint32_t op);
int (*get_vnumainfo)(struct domain *d);
+#ifdef CONFIG_VM_EVENT
int (*vm_event_control)(struct domain *d, int mode, int op);
-#ifdef CONFIG_VM_EVENT
int (*mem_access)(struct domain *d);
#endif
@@ -635,13 +635,13 @@ static inline int xsm_get_vnumainfo(xsm_default_t def, struct domain *d)
return alternative_call(xsm_ops.get_vnumainfo, d);
}
+#ifdef CONFIG_VM_EVENT
static inline int xsm_vm_event_control(
xsm_default_t def, struct domain *d, int mode, int op)
{
return alternative_call(xsm_ops.vm_event_control, d, mode, op);
}
-#ifdef CONFIG_VM_EVENT
static inline int xsm_mem_access(xsm_default_t def, struct domain *d)
{
return alternative_call(xsm_ops.mem_access, d);
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 7892d36cc2..dbe363f0de 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -114,9 +114,9 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.remove_from_physmap = xsm_remove_from_physmap,
.map_gmfn_foreign = xsm_map_gmfn_foreign,
+#ifdef CONFIG_VM_EVENT
.vm_event_control = xsm_vm_event_control,
-#ifdef CONFIG_VM_EVENT
.mem_access = xsm_mem_access,
#endif
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 2eabf62e8c..d0fd057db5 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1360,12 +1360,12 @@ static int cf_check flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint
return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP);
}
+#ifdef CONFIG_VM_EVENT
static int cf_check flask_vm_event_control(struct domain *d, int mode, int op)
{
return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__VM_EVENT);
}
-#ifdef CONFIG_VM_EVENT
static int cf_check flask_mem_access(struct domain *d)
{
return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__MEM_ACCESS);
@@ -1961,9 +1961,9 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.do_xsm_op = do_flask_op,
.get_vnumainfo = flask_get_vnumainfo,
+#ifdef CONFIG_VM_EVENT
.vm_event_control = flask_vm_event_control,
-#ifdef CONFIG_VM_EVENT
.mem_access = flask_mem_access,
#endif
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 12/28] xen/domctl: wrap domain_pause_by_systemcontroller() with MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (9 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 11/28] xen/xsm: wrap xsm_vm_event_control() with CONFIG_VM_EVENT Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 11:28 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 13/28] xen/domctl: wrap domain_soft_reset() with CONFIG_MGMT_HYPERCALLS Penny Zheng
` (16 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
Function domain_pause_by_systemcontroller() is responsible for
XEN_DOMCTL_pausedomain domctl-op, and shall be wrapped around with
CONFIG_MGMT_HYPERCALLS. Otherwiae it will become unreachable when
MGMT_HYPERCALLS=n and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- provide transient wrapping around XEN_DOMCTL_pausedomain-case
---
v2 -> v3:
- remove transient wrapping around XEN_DOMCTL_pausedomain-case
- address "violating Misra rule 2.1" in commit message
---
xen/common/domain.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 775c339285..976172c7d3 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1606,10 +1606,12 @@ static int _domain_pause_by_systemcontroller(struct domain *d, bool sync)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_pause_by_systemcontroller(struct domain *d)
{
return _domain_pause_by_systemcontroller(d, true /* sync */);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int domain_pause_by_systemcontroller_nosync(struct domain *d)
{
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 12/28] xen/domctl: wrap domain_pause_by_systemcontroller() with MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 12/28] xen/domctl: wrap domain_pause_by_systemcontroller() with MGMT_HYPERCALLS Penny Zheng
@ 2025-10-30 11:28 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 11:28 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Function domain_pause_by_systemcontroller() is responsible for
> XEN_DOMCTL_pausedomain domctl-op, and shall be wrapped around with
> CONFIG_MGMT_HYPERCALLS. Otherwiae it will become unreachable when
> MGMT_HYPERCALLS=n and hence violating Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v1 -> v2:
> - adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
> - provide transient wrapping around XEN_DOMCTL_pausedomain-case
> ---
> v2 -> v3:
> - remove transient wrapping around XEN_DOMCTL_pausedomain-case
> - address "violating Misra rule 2.1" in commit message
Fine with me, but imo this purely mechanical change wants combining with the
similar ones in patches 14 and 16, both touching the same file.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 13/28] xen/domctl: wrap domain_soft_reset() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (10 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 12/28] xen/domctl: wrap domain_pause_by_systemcontroller() with MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 12:14 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 14/28] xen/domctl: wrap domain_resume() " Penny Zheng
` (15 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Michal Orzel, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Jan Beulich, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Christopher Clark, Daniel P. Smith
Function domain_soft_reset() is responsible for domain soft reset domctl-op,
and shall be wrapped with CONFIG_MGMT_HYPERCALLS
Tracking its calling chain, and the following functions shall also be wrapped
with CONFIG_MGMT_HYPERCALLS:
- grant_table_warn_active_grants()
- argo_soft_reset()
- arch_domain_soft_reset()
Otherwise they will become unreachable when MGMT_HYPERCALLS=n and hence
violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- remove unnessary wrapping in stub.c
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_soft_reset-case transiently
---
v2 -> v3:
- add back stub wrapping for ppc/riscv
- remove transient wrapping around XEN_DOMCTL_soft_reset-case
- address "violating Misra rule 2.1" in commit message
---
xen/arch/arm/domain.c | 2 ++
xen/arch/ppc/stubs.c | 2 ++
xen/arch/riscv/stubs.c | 2 ++
xen/arch/x86/domain.c | 2 ++
xen/common/argo.c | 2 ++
xen/common/domain.c | 2 ++
xen/common/grant_table.c | 2 ++
7 files changed, 14 insertions(+)
diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index e36719bce4..948ca35e19 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -875,10 +875,12 @@ void arch_domain_unpause(struct domain *d)
{
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_domain_soft_reset(struct domain *d)
{
return -ENOSYS;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_domain_creation_finished(struct domain *d)
{
diff --git a/xen/arch/ppc/stubs.c b/xen/arch/ppc/stubs.c
index bdaf474c5c..ecaffe0d2e 100644
--- a/xen/arch/ppc/stubs.c
+++ b/xen/arch/ppc/stubs.c
@@ -214,10 +214,12 @@ void arch_domain_unpause(struct domain *d)
BUG_ON("unimplemented");
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_domain_soft_reset(struct domain *d)
{
BUG_ON("unimplemented");
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_domain_creation_finished(struct domain *d)
{
diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c
index a74e56843c..291c8a23e8 100644
--- a/xen/arch/riscv/stubs.c
+++ b/xen/arch/riscv/stubs.c
@@ -188,10 +188,12 @@ void arch_domain_unpause(struct domain *d)
BUG_ON("unimplemented");
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_domain_soft_reset(struct domain *d)
{
BUG_ON("unimplemented");
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_domain_creation_finished(struct domain *d)
{
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 19fd86ce88..5b3c5e8caf 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -1030,6 +1030,7 @@ void arch_domain_unpause(struct domain *d)
viridian_time_domain_thaw(d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_domain_soft_reset(struct domain *d)
{
struct page_info *page = virt_to_page(d->shared_info), *new_page;
@@ -1131,6 +1132,7 @@ int arch_domain_soft_reset(struct domain *d)
return ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_domain_creation_finished(struct domain *d)
{
diff --git a/xen/common/argo.c b/xen/common/argo.c
index cbe8911a43..a451546d57 100644
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -2351,6 +2351,7 @@ argo_destroy(struct domain *d)
write_unlock(&L1_global_argo_rwlock);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void
argo_soft_reset(struct domain *d)
{
@@ -2374,3 +2375,4 @@ argo_soft_reset(struct domain *d)
write_unlock(&L1_global_argo_rwlock);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 976172c7d3..678e81b400 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1689,6 +1689,7 @@ void domain_unpause_except_self(struct domain *d)
domain_unpause(d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_soft_reset(struct domain *d, bool resuming)
{
struct vcpu *v;
@@ -1726,6 +1727,7 @@ int domain_soft_reset(struct domain *d, bool resuming)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int vcpu_reset(struct vcpu *v)
{
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index cf131c43a1..24ef1205c9 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3962,6 +3962,7 @@ int gnttab_release_mappings(struct domain *d)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void grant_table_warn_active_grants(struct domain *d)
{
struct grant_table *gt = d->grant_table;
@@ -4006,6 +4007,7 @@ void grant_table_warn_active_grants(struct domain *d)
#undef WARN_GRANT_MAX
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void
grant_table_destroy(
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 13/28] xen/domctl: wrap domain_soft_reset() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 13/28] xen/domctl: wrap domain_soft_reset() with CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-30 12:14 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 12:14 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Stefano Stabellini, Julien Grall,
Bertrand Marquis, Michal Orzel, Volodymyr Babchuk, Andrew Cooper,
Anthony PERARD, Roger Pau Monné, Shawn Anastasio,
Alistair Francis, Bob Eshleman, Connor Davis, Christopher Clark,
Daniel P. Smith, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Function domain_soft_reset() is responsible for domain soft reset domctl-op,
> and shall be wrapped with CONFIG_MGMT_HYPERCALLS
> Tracking its calling chain, and the following functions shall also be wrapped
> with CONFIG_MGMT_HYPERCALLS:
> - grant_table_warn_active_grants()
> - argo_soft_reset()
> - arch_domain_soft_reset()
> Otherwise they will become unreachable when MGMT_HYPERCALLS=n and hence
> violating Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
This imo wants doing differently, with all the per-arch stubs going away. I've sent
a patch (with you Cc-ed), on top of which all that should remain for this series
would be to add a dependency to the new HAS_SOFT_RESET. Possibly that could then
even be folded into some other patch (doing something similar).
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 14/28] xen/domctl: wrap domain_resume() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (11 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 13/28] xen/domctl: wrap domain_soft_reset() with CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 15/28] xen/domctl: wrap domain_kill() " Penny Zheng
` (14 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
One usage of function domain_resume() is in domain resume domctl-op, and
the other is in domain_soft_reset(), which is already guarded with
CONFIG_MGMT_HYPERCALLS.
So we could wrap domain_resume() with CONFIG_MGMT_HYPERCALLS. Otherwise
it will become unreachable codes when MGMT_HYPERCALLS=n and hence violating
Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- new commit
---
v2 -> v3:
- remove transient wrapping around XEN_DOMCTL_resumedomain-case
- address "violating Misra rule 2.1" in commit message
---
xen/common/domain.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 678e81b400..34e2e501dc 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1351,6 +1351,7 @@ int domain_shutdown(struct domain *d, u8 reason)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void domain_resume(struct domain *d)
{
struct vcpu *v;
@@ -1377,6 +1378,7 @@ void domain_resume(struct domain *d)
domain_unpause(d);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int vcpu_start_shutdown_deferral(struct vcpu *v)
{
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (12 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 14/28] xen/domctl: wrap domain_resume() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 12:43 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 16/28] xen/domctl: wrap domain_set_node_affinity() " Penny Zheng
` (13 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Michal Orzel, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Jan Beulich, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Tamas K Lengyel
Function domain_kill() is responsible for killing domain and relinquish
domain-held resources. and it is only invoked under
XEN_DOMCTL_destroydomain-case. So it shall be wrapped with
CONFIG_MGMT_HYPERCALLS.
Tracking its calling chain, the following functions could also be wrapped with
CONFIG_MGMT_HYPERCALLS:
- domain_relinquish_resource
- pci_release_device
- relinquish_shared_pages
- paging_teardown
- p2m_pod_empty_cache
- relinquish_memory
- pit_deinit
- iommu_release_dt_devices
- tee_relinquish_resources
- ffa_relinquish_resources/optee_relinquish_resources
- relinquish_p2m_mapping
- p2m_clear_root_pages
Otherwise all these functions will become unreachable codes when
MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_destroydomain-case transiently
---
v2 -> v3:
- add back stub wrapping in ppc/riscv
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_destroydomain-case
---
xen/arch/arm/domain.c | 3 +++
xen/arch/arm/include/asm/tee/tee.h | 2 ++
xen/arch/arm/mmu/p2m.c | 4 ++++
xen/arch/arm/mpu/p2m.c | 2 ++
xen/arch/arm/tee/ffa.c | 4 ++++
xen/arch/arm/tee/optee.c | 4 ++++
xen/arch/arm/tee/tee.c | 2 ++
xen/arch/ppc/stubs.c | 2 ++
xen/arch/riscv/stubs.c | 2 ++
xen/arch/x86/domain.c | 2 ++
xen/arch/x86/emul-i8254.c | 2 ++
xen/arch/x86/mm/mem_sharing.c | 2 ++
xen/arch/x86/mm/p2m-pod.c | 2 ++
xen/arch/x86/mm/p2m.c | 2 ++
xen/arch/x86/mm/paging.c | 2 ++
xen/common/domain.c | 2 ++
xen/drivers/passthrough/device_tree.c | 2 ++
xen/drivers/passthrough/pci.c | 2 ++
18 files changed, 43 insertions(+)
diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index 948ca35e19..3070a5fc8f 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -995,6 +995,7 @@ int arch_vcpu_reset(struct vcpu *v)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int relinquish_memory(struct domain *d, struct page_list_head *list)
{
struct page_info *page, *tmp;
@@ -1146,6 +1147,8 @@ int domain_relinquish_resources(struct domain *d)
#undef PROGRESS
+#endif /* CONFIG_MGMT_HYPERCALLS */
+
void arch_dump_domain_info(struct domain *d)
{
p2m_dump_info(d);
diff --git a/xen/arch/arm/include/asm/tee/tee.h b/xen/arch/arm/include/asm/tee/tee.h
index 15d664e28d..f4187c5dc3 100644
--- a/xen/arch/arm/include/asm/tee/tee.h
+++ b/xen/arch/arm/include/asm/tee/tee.h
@@ -40,12 +40,14 @@ struct tee_mediator_ops {
int (*domain_teardown)(struct domain *d);
void (*free_domain_ctx)(struct domain *d);
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* Called during domain destruction to relinquish resources used
* by mediator itself. This function can return -ERESTART to indicate
* that it does not finished work and should be called again.
*/
int (*relinquish_resources)(struct domain *d);
+#endif
/* Handle SMCCC call for current domain. */
bool (*handle_call)(struct cpu_user_regs *regs);
diff --git a/xen/arch/arm/mmu/p2m.c b/xen/arch/arm/mmu/p2m.c
index 51abf3504f..30d6071e91 100644
--- a/xen/arch/arm/mmu/p2m.c
+++ b/xen/arch/arm/mmu/p2m.c
@@ -1243,6 +1243,7 @@ static void p2m_invalidate_table(struct p2m_domain *p2m, mfn_t mfn)
p2m->need_flush = true;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* The domain will not be scheduled anymore, so in theory we should
* not need to flush the TLBs. Do it for safety purpose.
@@ -1262,6 +1263,7 @@ void p2m_clear_root_pages(struct p2m_domain *p2m)
p2m_write_unlock(p2m);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Invalidate all entries in the root page-tables. This is
@@ -1556,6 +1558,7 @@ int p2m_init(struct domain *d)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* The function will go through the p2m and remove page reference when it
* is required. The mapping will be removed from the p2m.
@@ -1626,6 +1629,7 @@ int relinquish_p2m_mapping(struct domain *d)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Clean & invalidate RAM associated to the guest vCPU.
diff --git a/xen/arch/arm/mpu/p2m.c b/xen/arch/arm/mpu/p2m.c
index f7fb58ab6a..c44297a9e3 100644
--- a/xen/arch/arm/mpu/p2m.c
+++ b/xen/arch/arm/mpu/p2m.c
@@ -57,10 +57,12 @@ bool p2m_resolve_translation_fault(struct domain *d, gfn_t gfn)
void p2m_flush_vm(struct vcpu *v) {}
+#ifdef CONFIG_MGMT_HYPERCALLS
int relinquish_p2m_mapping(struct domain *d)
{
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void p2m_domain_creation_finished(struct domain *d) {}
diff --git a/xen/arch/arm/tee/ffa.c b/xen/arch/arm/tee/ffa.c
index 1d0239cf69..f9ba9b60bf 100644
--- a/xen/arch/arm/tee/ffa.c
+++ b/xen/arch/arm/tee/ffa.c
@@ -469,10 +469,12 @@ static void ffa_free_domain_ctx(struct domain *d)
XFREE(d->arch.tee);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int ffa_relinquish_resources(struct domain *d)
{
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void ffa_init_secondary(void)
{
@@ -623,7 +625,9 @@ static const struct tee_mediator_ops ffa_ops =
.domain_init = ffa_domain_init,
.domain_teardown = ffa_domain_teardown,
.free_domain_ctx = ffa_free_domain_ctx,
+#ifdef CONFIG_MGMT_HYPERCALLS
.relinquish_resources = ffa_relinquish_resources,
+#endif
.handle_call = ffa_handle_call,
};
diff --git a/xen/arch/arm/tee/optee.c b/xen/arch/arm/tee/optee.c
index 5151bd90ed..1ed0fd231d 100644
--- a/xen/arch/arm/tee/optee.c
+++ b/xen/arch/arm/tee/optee.c
@@ -632,6 +632,7 @@ static void free_optee_shm_buf_pg_list(struct optee_domain *ctx,
cookie);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int optee_relinquish_resources(struct domain *d)
{
struct arm_smccc_res resp;
@@ -693,6 +694,7 @@ static int optee_relinquish_resources(struct domain *d)
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#define PAGELIST_ENTRIES_PER_PAGE \
((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1)
@@ -1727,7 +1729,9 @@ static const struct tee_mediator_ops optee_ops =
.probe = optee_probe,
.domain_init = optee_domain_init,
.domain_teardown = optee_domain_teardown,
+#ifdef CONFIG_MGMT_HYPERCALLS
.relinquish_resources = optee_relinquish_resources,
+#endif
.handle_call = optee_handle_call,
};
diff --git a/xen/arch/arm/tee/tee.c b/xen/arch/arm/tee/tee.c
index 8501443c8e..a8e160700f 100644
--- a/xen/arch/arm/tee/tee.c
+++ b/xen/arch/arm/tee/tee.c
@@ -65,6 +65,7 @@ int tee_domain_teardown(struct domain *d)
return cur_mediator->ops->domain_teardown(d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int tee_relinquish_resources(struct domain *d)
{
if ( !cur_mediator )
@@ -72,6 +73,7 @@ int tee_relinquish_resources(struct domain *d)
return cur_mediator->ops->relinquish_resources(d);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
uint16_t tee_get_type(void)
{
diff --git a/xen/arch/ppc/stubs.c b/xen/arch/ppc/stubs.c
index ecaffe0d2e..a57cc8595d 100644
--- a/xen/arch/ppc/stubs.c
+++ b/xen/arch/ppc/stubs.c
@@ -241,10 +241,12 @@ int arch_vcpu_reset(struct vcpu *v)
BUG_ON("unimplemented");
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_relinquish_resources(struct domain *d)
{
BUG_ON("unimplemented");
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_dump_domain_info(struct domain *d)
{
diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c
index 291c8a23e8..3e4280dee1 100644
--- a/xen/arch/riscv/stubs.c
+++ b/xen/arch/riscv/stubs.c
@@ -215,10 +215,12 @@ int arch_vcpu_reset(struct vcpu *v)
BUG_ON("unimplemented");
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_relinquish_resources(struct domain *d)
{
BUG_ON("unimplemented");
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_dump_domain_info(struct domain *d)
{
diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 5b3c5e8caf..314de75d8e 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -2298,6 +2298,7 @@ void sync_vcpu_execstate(struct vcpu *v)
read_atomic(&v->dirty_cpu) != dirty_cpu);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int relinquish_memory(
struct domain *d, struct page_list_head *list, unsigned long type)
{
@@ -2622,6 +2623,7 @@ int domain_relinquish_resources(struct domain *d)
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_dump_domain_info(struct domain *d)
{
diff --git a/xen/arch/x86/emul-i8254.c b/xen/arch/x86/emul-i8254.c
index 144aa168a3..f106ab794c 100644
--- a/xen/arch/x86/emul-i8254.c
+++ b/xen/arch/x86/emul-i8254.c
@@ -651,6 +651,7 @@ void pit_init(struct domain *d)
pit_reset(d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void pit_deinit(struct domain *d)
{
PITState *pit = domain_vpit(d);
@@ -664,6 +665,7 @@ void pit_deinit(struct domain *d)
destroy_periodic_time(&pit->pt0);
}
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Local variables:
diff --git a/xen/arch/x86/mm/mem_sharing.c b/xen/arch/x86/mm/mem_sharing.c
index b5a259af1d..af7b7f2538 100644
--- a/xen/arch/x86/mm/mem_sharing.c
+++ b/xen/arch/x86/mm/mem_sharing.c
@@ -1396,6 +1396,7 @@ int __mem_sharing_unshare_page(struct domain *d,
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int relinquish_shared_pages(struct domain *d)
{
int rc = 0;
@@ -1452,6 +1453,7 @@ int relinquish_shared_pages(struct domain *d)
p2m_unlock(p2m);
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int range_share(struct domain *d, struct domain *cd,
struct mem_sharing_op_range *range)
diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c
index 05633fe2ac..4e915808f4 100644
--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -366,6 +366,7 @@ void p2m_pod_get_mem_target(const struct domain *d, xen_pod_target_t *target)
pod_unlock(p2m);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int p2m_pod_empty_cache(struct domain *d)
{
struct p2m_domain *p2m = p2m_get_hostp2m(d);
@@ -409,6 +410,7 @@ int p2m_pod_empty_cache(struct domain *d)
unlock_page_alloc(p2m);
return p2m->pod.count ? -ERESTART : 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int
p2m_pod_offline_or_broken_hit(struct page_info *p)
diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
index e2a00a0efd..c1a87cde27 100644
--- a/xen/arch/x86/mm/p2m.c
+++ b/xen/arch/x86/mm/p2m.c
@@ -2097,6 +2097,7 @@ int xenmem_add_to_physmap_one(
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* Remove foreign mappings from the p2m, as that drops the page reference taken
* when mapped.
@@ -2160,6 +2161,7 @@ int relinquish_p2m_mapping(struct domain *d)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void p2m_log_dirty_range(struct domain *d, unsigned long begin_pfn,
unsigned long nr, uint8_t *dirty_bitmap)
diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index 65455a6867..116389d4e9 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -768,6 +768,7 @@ void paging_vcpu_teardown(struct vcpu *v)
shadow_vcpu_teardown(v);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/* Call when destroying a domain */
int paging_teardown(struct domain *d)
{
@@ -794,6 +795,7 @@ int paging_teardown(struct domain *d)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* Call once all of the references to the domain have gone away */
void paging_final_teardown(struct domain *d)
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 34e2e501dc..5d81ab3045 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1230,6 +1230,7 @@ int rcu_lock_live_remote_domain_by_id(domid_t dom, struct domain **d)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_kill(struct domain *d)
{
int rc = 0;
@@ -1280,6 +1281,7 @@ int domain_kill(struct domain *d)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void __domain_crash(struct domain *d)
diff --git a/xen/drivers/passthrough/device_tree.c b/xen/drivers/passthrough/device_tree.c
index f5850a2607..015ffa15d4 100644
--- a/xen/drivers/passthrough/device_tree.c
+++ b/xen/drivers/passthrough/device_tree.c
@@ -108,6 +108,7 @@ int iommu_dt_domain_init(struct domain *d)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_release_dt_devices(struct domain *d)
{
const struct domain_iommu *hd = dom_iommu(d);
@@ -136,6 +137,7 @@ int iommu_release_dt_devices(struct domain *d)
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int iommu_dt_xlate(struct device *dev,
const struct dt_phandle_args *iommu_spec,
diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c
index 3edcfa8a04..cd855108c2 100644
--- a/xen/drivers/passthrough/pci.c
+++ b/xen/drivers/passthrough/pci.c
@@ -945,6 +945,7 @@ static int deassign_device(struct domain *d, uint16_t seg, uint8_t bus,
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int pci_release_devices(struct domain *d)
{
int combined_ret;
@@ -1003,6 +1004,7 @@ int pci_release_devices(struct domain *d)
return combined_ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#define PCI_CLASS_BRIDGE_HOST 0x0600
#define PCI_CLASS_BRIDGE_PCI 0x0604
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 15/28] xen/domctl: wrap domain_kill() " Penny Zheng
@ 2025-10-30 12:43 ` Jan Beulich
2025-11-12 8:58 ` Penny, Zheng
2025-11-13 4:40 ` Penny, Zheng
0 siblings, 2 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 12:43 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Stefano Stabellini, Julien Grall,
Bertrand Marquis, Michal Orzel, Volodymyr Babchuk, Andrew Cooper,
Anthony PERARD, Roger Pau Monné, Shawn Anastasio,
Alistair Francis, Bob Eshleman, Connor Davis, Tamas K Lengyel,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> --- a/xen/arch/x86/mm/mem_sharing.c
> +++ b/xen/arch/x86/mm/mem_sharing.c
> @@ -1396,6 +1396,7 @@ int __mem_sharing_unshare_page(struct domain *d,
> return rc;
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> int relinquish_shared_pages(struct domain *d)
> {
> int rc = 0;
> @@ -1452,6 +1453,7 @@ int relinquish_shared_pages(struct domain *d)
> p2m_unlock(p2m);
> return rc;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
>
> static int range_share(struct domain *d, struct domain *cd,
> struct mem_sharing_op_range *range)
Is this necessary? Shouldn't MEM_SHARING as a whole become dependent upon
MGMT_HYPERCALLS, then also covering XENMEM_sharing_op? (The same will already
implicitly happen for MEM_PAGING, due to its VM_EVENT dependency.)
> --- a/xen/arch/x86/mm/paging.c
> +++ b/xen/arch/x86/mm/paging.c
> @@ -768,6 +768,7 @@ void paging_vcpu_teardown(struct vcpu *v)
> shadow_vcpu_teardown(v);
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> /* Call when destroying a domain */
> int paging_teardown(struct domain *d)
> {
> @@ -794,6 +795,7 @@ int paging_teardown(struct domain *d)
>
> return rc;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
>
> /* Call once all of the references to the domain have gone away */
> void paging_final_teardown(struct domain *d)
This is irritating, and could hence have done with some clarification in the
description (to aid review, if nothing else): On the surface, why would
paging_teardown() need excluding, but paging_vcpu_teardown() and
paging_final_teardown() would (need to) stay? Yes, the latter two are used
on failure paths of certain functions. (Same e.g. for domain_teardown() and
hence arch_domain_teardown().)
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* RE: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-10-30 12:43 ` Jan Beulich
@ 2025-11-12 8:58 ` Penny, Zheng
2025-11-12 10:02 ` Jan Beulich
2025-11-13 4:40 ` Penny, Zheng
1 sibling, 1 reply; 68+ messages in thread
From: Penny, Zheng @ 2025-11-12 8:58 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Orzel, Michal, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Tamas K Lengyel, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Thursday, October 30, 2025 8:44 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Stefano
> Stabellini <sstabellini@kernel.org>; Julien Grall <julien@xen.org>; Bertrand
> Marquis <bertrand.marquis@arm.com>; Orzel, Michal <Michal.Orzel@amd.com>;
> Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>; Andrew Cooper
> <andrew.cooper3@citrix.com>; Anthony PERARD <anthony.perard@vates.tech>;
> Roger Pau Monné <roger.pau@citrix.com>; Shawn Anastasio
> <sanastasio@raptorengineering.com>; Alistair Francis <alistair.francis@wdc.com>;
> Bob Eshleman <bobbyeshleman@gmail.com>; Connor Davis
> <connojdavis@gmail.com>; Tamas K Lengyel <tamas@tklengyel.com>; xen-
> devel@lists.xenproject.org
> Subject: Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with
> CONFIG_MGMT_HYPERCALLS
>
> On 13.10.2025 12:15, Penny Zheng wrote:
> > --- a/xen/arch/x86/mm/mem_sharing.c
> > +++ b/xen/arch/x86/mm/mem_sharing.c
> > @@ -1396,6 +1396,7 @@ int __mem_sharing_unshare_page(struct domain *d,
> > return rc;
> > }
> >
> > +#ifdef CONFIG_MGMT_HYPERCALLS
> > int relinquish_shared_pages(struct domain *d) {
> > int rc = 0;
> > @@ -1452,6 +1453,7 @@ int relinquish_shared_pages(struct domain *d)
> > p2m_unlock(p2m);
> > return rc;
> > }
> > +#endif /* CONFIG_MGMT_HYPERCALLS */
> >
> > static int range_share(struct domain *d, struct domain *cd,
> > struct mem_sharing_op_range *range)
>
> Is this necessary? Shouldn't MEM_SHARING as a whole become dependent upon
> MGMT_HYPERCALLS, then also covering XENMEM_sharing_op? (The same will
> already implicitly happen for MEM_PAGING, due to its VM_EVENT dependency.)
>
Yes, Since I didn't see VM_EVENT dependency for MEM_SHARING. I'm not 100% sure that whether memory sharing feature is dependent on VM_EVENT. Also as I roughly look through the codes in mm/mem_sharing.c, maybe only mem_sharing_notify_enomem() utilizes vm event subsystem.
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-11-12 8:58 ` Penny, Zheng
@ 2025-11-12 10:02 ` Jan Beulich
2025-11-13 4:11 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-11-12 10:02 UTC (permalink / raw)
To: Penny, Zheng
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Orzel, Michal, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Tamas K Lengyel, xen-devel@lists.xenproject.org
On 12.11.2025 09:58, Penny, Zheng wrote:
> [Public]
>
>> -----Original Message-----
>> From: Jan Beulich <jbeulich@suse.com>
>> Sent: Thursday, October 30, 2025 8:44 PM
>> To: Penny, Zheng <penny.zheng@amd.com>
>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Stefano
>> Stabellini <sstabellini@kernel.org>; Julien Grall <julien@xen.org>; Bertrand
>> Marquis <bertrand.marquis@arm.com>; Orzel, Michal <Michal.Orzel@amd.com>;
>> Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>; Andrew Cooper
>> <andrew.cooper3@citrix.com>; Anthony PERARD <anthony.perard@vates.tech>;
>> Roger Pau Monné <roger.pau@citrix.com>; Shawn Anastasio
>> <sanastasio@raptorengineering.com>; Alistair Francis <alistair.francis@wdc.com>;
>> Bob Eshleman <bobbyeshleman@gmail.com>; Connor Davis
>> <connojdavis@gmail.com>; Tamas K Lengyel <tamas@tklengyel.com>; xen-
>> devel@lists.xenproject.org
>> Subject: Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with
>> CONFIG_MGMT_HYPERCALLS
>>
>> On 13.10.2025 12:15, Penny Zheng wrote:
>>> --- a/xen/arch/x86/mm/mem_sharing.c
>>> +++ b/xen/arch/x86/mm/mem_sharing.c
>>> @@ -1396,6 +1396,7 @@ int __mem_sharing_unshare_page(struct domain *d,
>>> return rc;
>>> }
>>>
>>> +#ifdef CONFIG_MGMT_HYPERCALLS
>>> int relinquish_shared_pages(struct domain *d) {
>>> int rc = 0;
>>> @@ -1452,6 +1453,7 @@ int relinquish_shared_pages(struct domain *d)
>>> p2m_unlock(p2m);
>>> return rc;
>>> }
>>> +#endif /* CONFIG_MGMT_HYPERCALLS */
>>>
>>> static int range_share(struct domain *d, struct domain *cd,
>>> struct mem_sharing_op_range *range)
>>
>> Is this necessary? Shouldn't MEM_SHARING as a whole become dependent upon
>> MGMT_HYPERCALLS, then also covering XENMEM_sharing_op? (The same will
>> already implicitly happen for MEM_PAGING, due to its VM_EVENT dependency.)
>>
>
> Yes, Since I didn't see VM_EVENT dependency for MEM_SHARING. I'm not 100% sure that whether memory sharing feature is dependent on VM_EVENT. Also as I roughly look through the codes in mm/mem_sharing.c, maybe only mem_sharing_notify_enomem() utilizes vm event subsystem.
Right, a little while ago (iirc in the context of your work) Tamas said the same.
But I didn't ask about VM_EVENT; I asked about MGMT_HYPERCALLS.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* RE: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-11-12 10:02 ` Jan Beulich
@ 2025-11-13 4:11 ` Penny, Zheng
0 siblings, 0 replies; 68+ messages in thread
From: Penny, Zheng @ 2025-11-13 4:11 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Orzel, Michal, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Tamas K Lengyel, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Wednesday, November 12, 2025 6:02 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Stefano
> Stabellini <sstabellini@kernel.org>; Julien Grall <julien@xen.org>; Bertrand
> Marquis <bertrand.marquis@arm.com>; Orzel, Michal <Michal.Orzel@amd.com>;
> Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>; Andrew Cooper
> <andrew.cooper3@citrix.com>; Anthony PERARD <anthony.perard@vates.tech>;
> Roger Pau Monné <roger.pau@citrix.com>; Shawn Anastasio
> <sanastasio@raptorengineering.com>; Alistair Francis <alistair.francis@wdc.com>;
> Bob Eshleman <bobbyeshleman@gmail.com>; Connor Davis
> <connojdavis@gmail.com>; Tamas K Lengyel <tamas@tklengyel.com>; xen-
> devel@lists.xenproject.org
> Subject: Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with
> CONFIG_MGMT_HYPERCALLS
>
> On 12.11.2025 09:58, Penny, Zheng wrote:
> > [Public]
> >
> >> -----Original Message-----
> >> From: Jan Beulich <jbeulich@suse.com>
> >> Sent: Thursday, October 30, 2025 8:44 PM
> >> To: Penny, Zheng <penny.zheng@amd.com>
> >> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com;
> >> Stefano Stabellini <sstabellini@kernel.org>; Julien Grall
> >> <julien@xen.org>; Bertrand Marquis <bertrand.marquis@arm.com>; Orzel,
> >> Michal <Michal.Orzel@amd.com>; Volodymyr Babchuk
> >> <Volodymyr_Babchuk@epam.com>; Andrew Cooper
> >> <andrew.cooper3@citrix.com>; Anthony PERARD
> >> <anthony.perard@vates.tech>; Roger Pau Monné <roger.pau@citrix.com>;
> >> Shawn Anastasio <sanastasio@raptorengineering.com>; Alistair Francis
> >> <alistair.francis@wdc.com>; Bob Eshleman <bobbyeshleman@gmail.com>;
> >> Connor Davis <connojdavis@gmail.com>; Tamas K Lengyel
> >> <tamas@tklengyel.com>; xen- devel@lists.xenproject.org
> >> Subject: Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with
> >> CONFIG_MGMT_HYPERCALLS
> >>
> >> On 13.10.2025 12:15, Penny Zheng wrote:
> >>> --- a/xen/arch/x86/mm/mem_sharing.c
> >>> +++ b/xen/arch/x86/mm/mem_sharing.c
> >>> @@ -1396,6 +1396,7 @@ int __mem_sharing_unshare_page(struct domain
> *d,
> >>> return rc;
> >>> }
> >>>
> >>> +#ifdef CONFIG_MGMT_HYPERCALLS
> >>> int relinquish_shared_pages(struct domain *d) {
> >>> int rc = 0;
> >>> @@ -1452,6 +1453,7 @@ int relinquish_shared_pages(struct domain *d)
> >>> p2m_unlock(p2m);
> >>> return rc;
> >>> }
> >>> +#endif /* CONFIG_MGMT_HYPERCALLS */
> >>>
> >>> static int range_share(struct domain *d, struct domain *cd,
> >>> struct mem_sharing_op_range *range)
> >>
> >> Is this necessary? Shouldn't MEM_SHARING as a whole become dependent
> >> upon MGMT_HYPERCALLS, then also covering XENMEM_sharing_op? (The
> same
> >> will already implicitly happen for MEM_PAGING, due to its VM_EVENT
> >> dependency.)
> >>
> >
> > Yes, Since I didn't see VM_EVENT dependency for MEM_SHARING. I'm not
> 100% sure that whether memory sharing feature is dependent on VM_EVENT. Also
> as I roughly look through the codes in mm/mem_sharing.c, maybe only
> mem_sharing_notify_enomem() utilizes vm event subsystem.
>
> Right, a little while ago (iirc in the context of your work) Tamas said the same.
> But I didn't ask about VM_EVENT; I asked about MGMT_HYPERCALLS.
>
Oh, sorry....
Yes, The enabling bit (d->arch.hvm.mem_sharing.enabled) could only be enabled via domctl-op. I will make it depend on MGMT_HYPERCALLS.
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* RE: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with CONFIG_MGMT_HYPERCALLS
2025-10-30 12:43 ` Jan Beulich
2025-11-12 8:58 ` Penny, Zheng
@ 2025-11-13 4:40 ` Penny, Zheng
1 sibling, 0 replies; 68+ messages in thread
From: Penny, Zheng @ 2025-11-13 4:40 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Orzel, Michal, Volodymyr Babchuk,
Andrew Cooper, Anthony PERARD, Roger Pau Monné,
Shawn Anastasio, Alistair Francis, Bob Eshleman, Connor Davis,
Tamas K Lengyel, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Thursday, October 30, 2025 8:44 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Stefano
> Stabellini <sstabellini@kernel.org>; Julien Grall <julien@xen.org>; Bertrand
> Marquis <bertrand.marquis@arm.com>; Orzel, Michal <Michal.Orzel@amd.com>;
> Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>; Andrew Cooper
> <andrew.cooper3@citrix.com>; Anthony PERARD <anthony.perard@vates.tech>;
> Roger Pau Monné <roger.pau@citrix.com>; Shawn Anastasio
> <sanastasio@raptorengineering.com>; Alistair Francis <alistair.francis@wdc.com>;
> Bob Eshleman <bobbyeshleman@gmail.com>; Connor Davis
> <connojdavis@gmail.com>; Tamas K Lengyel <tamas@tklengyel.com>; xen-
> devel@lists.xenproject.org
> Subject: Re: [PATCH v3 15/28] xen/domctl: wrap domain_kill() with
> CONFIG_MGMT_HYPERCALLS
>
> > --- a/xen/arch/x86/mm/paging.c
> > +++ b/xen/arch/x86/mm/paging.c
> > @@ -768,6 +768,7 @@ void paging_vcpu_teardown(struct vcpu *v)
> > shadow_vcpu_teardown(v);
> > }
> >
> > +#ifdef CONFIG_MGMT_HYPERCALLS
> > /* Call when destroying a domain */
> > int paging_teardown(struct domain *d) { @@ -794,6 +795,7 @@ int
> > paging_teardown(struct domain *d)
> >
> > return rc;
> > }
> > +#endif /* CONFIG_MGMT_HYPERCALLS */
> >
> > /* Call once all of the references to the domain have gone away */
> > void paging_final_teardown(struct domain *d)
>
> This is irritating, and could hence have done with some clarification in the
> description (to aid review, if nothing else): On the surface, why would
> paging_teardown() need excluding, but paging_vcpu_teardown() and
> paging_final_teardown() would (need to) stay? Yes, the latter two are used on failure
> paths of certain functions. (Same e.g. for domain_teardown() and hence
> arch_domain_teardown().)
>
The reason for domain_teardown() is that its another usage is in the failure path of domain_create()
The exclusion of paging_final_teardown() is blocked by domain_destroy(), which will be triggered when refcnt equals zero.
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 16/28] xen/domctl: wrap domain_set_node_affinity() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (13 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 15/28] xen/domctl: wrap domain_kill() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 17/28] xen/domctl: wrap vcpu_affinity_domctl() " Penny Zheng
` (12 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
Function domain_set_node_affinity() is responsible for
XEN_DOMCTL_setnodeaffinity domctl-op, and shall be wrapped with
CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreachable codes when
MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_setnodeaffinity-case and xenctl_bitmap_to_nodemask()
transiently
---
v2 -> v3:
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_setnodeaffinity-case
---
xen/common/domain.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xen/common/domain.c b/xen/common/domain.c
index 5d81ab3045..6778dc388c 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -1105,6 +1105,7 @@ void __init setup_system_domains(void)
#endif
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int domain_set_node_affinity(struct domain *d, const nodemask_t *affinity)
{
/* Being disjoint with the system is just wrong. */
@@ -1133,6 +1134,7 @@ out:
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* rcu_read_lock(&domlist_read_lock) must be held. */
static struct domain *domid_to_domain(domid_t dom)
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 17/28] xen/domctl: wrap vcpu_affinity_domctl() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (14 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 16/28] xen/domctl: wrap domain_set_node_affinity() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:44 ` Jürgen Groß
2025-10-13 10:15 ` [PATCH v3 18/28] xen/domctl: wrap sched_adjust() " Penny Zheng
` (11 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Dario Faggioli,
Juergen Gross, George Dunlap
Function vcpu_affinity_domctl() is responsible for
XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity} domctl-op, and shall be
wrapped with CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreachable
codes when MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity}-case transiently
---
v2 -> v3:
- adapt to changes of "remove vcpu_set_soft_affinity()"
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity}-case
---
xen/common/sched/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
index 88150432c3..180de784fa 100644
--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -1688,6 +1688,7 @@ int vcpuaffinity_params_invalid(const struct xen_domctl_vcpuaffinity *vcpuaff)
guest_handle_is_null(vcpuaff->cpumap_soft.bitmap));
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int vcpu_affinity_domctl(struct domain *d, uint32_t cmd,
struct xen_domctl_vcpuaffinity *vcpuaff)
{
@@ -1798,6 +1799,7 @@ int vcpu_affinity_domctl(struct domain *d, uint32_t cmd,
return ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
bool alloc_affinity_masks(struct affinity_masks *affinity)
{
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 17/28] xen/domctl: wrap vcpu_affinity_domctl() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 17/28] xen/domctl: wrap vcpu_affinity_domctl() " Penny Zheng
@ 2025-10-13 10:44 ` Jürgen Groß
0 siblings, 0 replies; 68+ messages in thread
From: Jürgen Groß @ 2025-10-13 10:44 UTC (permalink / raw)
To: Penny Zheng, xen-devel
Cc: ray.huang, oleksii.kurochko, Dario Faggioli, George Dunlap
[-- Attachment #1.1.1: Type: text/plain, Size: 1723 bytes --]
On 13.10.25 12:15, Penny Zheng wrote:
> Function vcpu_affinity_domctl() is responsible for
> XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity} domctl-op, and shall be
> wrapped with CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreachable
> codes when MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v1 -> v2:
> - adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
> - wrap XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity}-case transiently
> ---
> v2 -> v3:
> - adapt to changes of "remove vcpu_set_soft_affinity()"
> - address "violating Misra rule 2.1" in commit message
> - remove transient wrapping around XEN_DOMCTL_{getvcpuaffinity,setvcpuaffinity}-case
> ---
> xen/common/sched/core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
> index 88150432c3..180de784fa 100644
> --- a/xen/common/sched/core.c
> +++ b/xen/common/sched/core.c
> @@ -1688,6 +1688,7 @@ int vcpuaffinity_params_invalid(const struct xen_domctl_vcpuaffinity *vcpuaff)
> guest_handle_is_null(vcpuaff->cpumap_soft.bitmap));
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
I suggest to move this #ifdef above vcpuaffinity_params_invalid(), which is
used by vcpu_affinity_domctl() only.
> int vcpu_affinity_domctl(struct domain *d, uint32_t cmd,
> struct xen_domctl_vcpuaffinity *vcpuaff)
> {
> @@ -1798,6 +1799,7 @@ int vcpu_affinity_domctl(struct domain *d, uint32_t cmd,
>
> return ret;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
>
> bool alloc_affinity_masks(struct affinity_masks *affinity)
> {
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 18/28] xen/domctl: wrap sched_adjust() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (15 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 17/28] xen/domctl: wrap vcpu_affinity_domctl() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 11:03 ` Jürgen Groß
2025-10-13 10:15 ` [PATCH v3 19/28] xen/domctl: wrap xsm_irq_permission " Penny Zheng
` (10 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel, xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Nathan Studer,
Stewart Hildebrand, Dario Faggioli, Juergen Gross, George Dunlap,
Meng Xu, Daniel P. Smith, Stefano Stabellini
Function sched_adjust() is responsible for XEN_DOMCTL_scheduler_op domctl-op,
so it could be wrapped with CONFIG_MGMT_HYPERCALLS.
Tracing its calling chain, the following functions shall be wrapped with
CONFIG_MGMT_HYPERCALLS too:
- sched_adjust_dom()
- scheduler-specific .adjust() callback
- xsm_sysctl_scheduler_op()
Otherwise all these functions will become unreachable when MGMT_HYPERCALLS=n,
and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_scheduler_op-case transiently
---
v2 -> v3
- add missing wrapping in xsm/dummy.h
- move and get away with just a single #ifdef
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_scheduler_op-case
---
xen/common/sched/arinc653.c | 1 -
xen/common/sched/core.c | 2 --
xen/common/sched/credit.c | 4 +++-
xen/common/sched/credit2.c | 4 +++-
xen/common/sched/private.h | 8 ++++----
xen/common/sched/rt.c | 4 ++++
xen/include/xsm/dummy.h | 2 ++
xen/include/xsm/xsm.h | 4 ++--
xen/xsm/dummy.c | 2 +-
xen/xsm/flask/hooks.c | 4 ++--
10 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c
index 7d6c40d800..5a6f8c8642 100644
--- a/xen/common/sched/arinc653.c
+++ b/xen/common/sched/arinc653.c
@@ -735,7 +735,6 @@ static const struct scheduler sched_arinc653_def = {
.switch_sched = a653_switch_sched,
- .adjust = NULL,
#ifdef CONFIG_MGMT_HYPERCALLS
.adjust_global = a653sched_adjust_global,
#endif
diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c
index 180de784fa..6cee0858ec 100644
--- a/xen/common/sched/core.c
+++ b/xen/common/sched/core.c
@@ -2072,7 +2072,6 @@ int scheduler_id(void)
{
return operations.sched_id;
}
-#endif
/* Adjust scheduling parameter for a given domain. */
long sched_adjust(struct domain *d, struct xen_domctl_scheduler_op *op)
@@ -2109,7 +2108,6 @@ long sched_adjust(struct domain *d, struct xen_domctl_scheduler_op *op)
return ret;
}
-#ifdef CONFIG_MGMT_HYPERCALLS
long sched_adjust_global(struct xen_sysctl_scheduler_op *op)
{
struct cpupool *pool;
diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c
index 0cbec2a9c0..ed3241bec8 100644
--- a/xen/common/sched/credit.c
+++ b/xen/common/sched/credit.c
@@ -1183,6 +1183,7 @@ csched_unit_yield(const struct scheduler *ops, struct sched_unit *unit)
set_bit(CSCHED_FLAG_UNIT_YIELD, &svc->flags);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check
csched_dom_cntl(
const struct scheduler *ops,
@@ -1227,6 +1228,7 @@ csched_dom_cntl(
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check
csched_aff_cntl(const struct scheduler *ops, struct sched_unit *unit,
@@ -2288,9 +2290,9 @@ static const struct scheduler sched_credit_def = {
.wake = csched_unit_wake,
.yield = csched_unit_yield,
- .adjust = csched_dom_cntl,
.adjust_affinity= csched_aff_cntl,
#ifdef CONFIG_MGMT_HYPERCALLS
+ .adjust = csched_dom_cntl,
.adjust_global = csched_sys_cntl,
#endif
diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c
index 307e63ebd8..b73dd3c548 100644
--- a/xen/common/sched/credit2.c
+++ b/xen/common/sched/credit2.c
@@ -2909,6 +2909,7 @@ static void cf_check csched2_unit_migrate(
sched_set_res(unit, get_sched_res(new_cpu));
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check
csched2_dom_cntl(
const struct scheduler *ops,
@@ -3114,6 +3115,7 @@ csched2_dom_cntl(
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check
csched2_aff_cntl(const struct scheduler *ops, struct sched_unit *unit,
@@ -4246,9 +4248,9 @@ static const struct scheduler sched_credit2_def = {
.wake = csched2_unit_wake,
.yield = csched2_unit_yield,
- .adjust = csched2_dom_cntl,
.adjust_affinity= csched2_aff_cntl,
#ifdef CONFIG_MGMT_HYPERCALLS
+ .adjust = csched2_dom_cntl,
.adjust_global = csched2_sys_cntl,
#endif
diff --git a/xen/common/sched/private.h b/xen/common/sched/private.h
index b7ff67200b..3b35002c5d 100644
--- a/xen/common/sched/private.h
+++ b/xen/common/sched/private.h
@@ -349,14 +349,14 @@ struct scheduler {
void (*migrate) (const struct scheduler *ops,
struct sched_unit *unit,
unsigned int new_cpu);
- int (*adjust) (const struct scheduler *ops,
- struct domain *d,
- struct xen_domctl_scheduler_op *op);
void (*adjust_affinity)(const struct scheduler *ops,
struct sched_unit *unit,
const struct cpumask *hard,
const struct cpumask *soft);
#ifdef CONFIG_MGMT_HYPERCALLS
+ int (*adjust) (const struct scheduler *ops,
+ struct domain *d,
+ struct xen_domctl_scheduler_op *op);
int (*adjust_global) (const struct scheduler *ops,
struct xen_sysctl_scheduler_op *sc);
#endif
@@ -506,13 +506,13 @@ static inline void sched_adjust_affinity(const struct scheduler *s,
s->adjust_affinity(s, unit, hard, soft);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int sched_adjust_dom(const struct scheduler *s, struct domain *d,
struct xen_domctl_scheduler_op *op)
{
return s->adjust ? s->adjust(s, d, op) : 0;
}
-#ifdef CONFIG_MGMT_HYPERCALLS
static inline int sched_adjust_cpupool(const struct scheduler *s,
struct xen_sysctl_scheduler_op *op)
{
diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c
index 7b1f64a779..a42040b259 100644
--- a/xen/common/sched/rt.c
+++ b/xen/common/sched/rt.c
@@ -1362,6 +1362,7 @@ out:
unit_schedule_unlock_irq(lock, unit);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* set/get each unit info of each domain
*/
@@ -1471,6 +1472,7 @@ rt_dom_cntl(
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* The replenishment timer handler picks units
@@ -1572,7 +1574,9 @@ static const struct scheduler sched_rtds_def = {
.insert_unit = rt_unit_insert,
.remove_unit = rt_unit_remove,
+#ifdef CONFIG_MGMT_HYPERCALLS
.adjust = rt_dom_cntl,
+#endif
.pick_resource = rt_res_pick,
.do_schedule = rt_schedule,
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 9b1d31b6ec..5810a18087 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -141,12 +141,14 @@ static XSM_INLINE int cf_check xsm_getdomaininfo(
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_domctl_scheduler_op(
XSM_DEFAULT_ARG struct domain *d, int cmd)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd)
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 4c6e0dc0f9..9dd485646a 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -56,8 +56,8 @@ struct xsm_ops {
struct xen_domctl_getdomaininfo *info);
int (*domain_create)(struct domain *d, uint32_t ssidref);
int (*getdomaininfo)(struct domain *d);
- int (*domctl_scheduler_op)(struct domain *d, int op);
#ifdef CONFIG_MGMT_HYPERCALLS
+ int (*domctl_scheduler_op)(struct domain *d, int op);
int (*sysctl_scheduler_op)(int op);
#endif
int (*set_target)(struct domain *d, struct domain *e);
@@ -240,13 +240,13 @@ static inline int xsm_get_domain_state(xsm_default_t def, struct domain *d)
return alternative_call(xsm_ops.get_domain_state, d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_domctl_scheduler_op(
xsm_default_t def, struct domain *d, int cmd)
{
return alternative_call(xsm_ops.domctl_scheduler_op, d, cmd);
}
-#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd)
{
return alternative_call(xsm_ops.sysctl_scheduler_op, cmd);
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index dbe363f0de..724b2a2653 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -18,8 +18,8 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.security_domaininfo = xsm_security_domaininfo,
.domain_create = xsm_domain_create,
.getdomaininfo = xsm_getdomaininfo,
- .domctl_scheduler_op = xsm_domctl_scheduler_op,
#ifdef CONFIG_MGMT_HYPERCALLS
+ .domctl_scheduler_op = xsm_domctl_scheduler_op,
.sysctl_scheduler_op = xsm_sysctl_scheduler_op,
#endif
.set_target = xsm_set_target,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index d0fd057db5..839a4cf9e6 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -609,6 +609,7 @@ static int cf_check flask_getdomaininfo(struct domain *d)
return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETDOMAININFO);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check flask_domctl_scheduler_op(struct domain *d, int op)
{
switch ( op )
@@ -626,7 +627,6 @@ static int cf_check flask_domctl_scheduler_op(struct domain *d, int op)
}
}
-#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check flask_sysctl_scheduler_op(int op)
{
switch ( op )
@@ -1883,8 +1883,8 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.security_domaininfo = flask_security_domaininfo,
.domain_create = flask_domain_create,
.getdomaininfo = flask_getdomaininfo,
- .domctl_scheduler_op = flask_domctl_scheduler_op,
#ifdef CONFIG_MGMT_HYPERCALLS
+ .domctl_scheduler_op = flask_domctl_scheduler_op,
.sysctl_scheduler_op = flask_sysctl_scheduler_op,
#endif
.set_target = flask_set_target,
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 18/28] xen/domctl: wrap sched_adjust() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 18/28] xen/domctl: wrap sched_adjust() " Penny Zheng
@ 2025-10-13 11:03 ` Jürgen Groß
2025-10-13 11:13 ` Jan Beulich
0 siblings, 1 reply; 68+ messages in thread
From: Jürgen Groß @ 2025-10-13 11:03 UTC (permalink / raw)
To: Penny Zheng, xen-devel, xen-devel
Cc: ray.huang, oleksii.kurochko, Nathan Studer, Stewart Hildebrand,
Dario Faggioli, George Dunlap, Meng Xu, Daniel P. Smith,
Stefano Stabellini
[-- Attachment #1.1.1: Type: text/plain, Size: 1339 bytes --]
On 13.10.25 12:15, Penny Zheng wrote:
> Function sched_adjust() is responsible for XEN_DOMCTL_scheduler_op domctl-op,
> so it could be wrapped with CONFIG_MGMT_HYPERCALLS.
> Tracing its calling chain, the following functions shall be wrapped with
> CONFIG_MGMT_HYPERCALLS too:
> - sched_adjust_dom()
> - scheduler-specific .adjust() callback
> - xsm_sysctl_scheduler_op()
> Otherwise all these functions will become unreachable when MGMT_HYPERCALLS=n,
> and hence violating Misra rule 2.1.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Just one further remark below (not for this patch).
> diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
> index 4c6e0dc0f9..9dd485646a 100644
> --- a/xen/include/xsm/xsm.h
> +++ b/xen/include/xsm/xsm.h
> @@ -56,8 +56,8 @@ struct xsm_ops {
> struct xen_domctl_getdomaininfo *info);
> int (*domain_create)(struct domain *d, uint32_t ssidref);
> int (*getdomaininfo)(struct domain *d);
As visible in this context .getdomaininfo() is not hidden yet, which
I think is still true at the end of the series, while I believe it
should be used by systl/domctl code only.
Or did I miss something?
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 18/28] xen/domctl: wrap sched_adjust() with CONFIG_MGMT_HYPERCALLS
2025-10-13 11:03 ` Jürgen Groß
@ 2025-10-13 11:13 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-13 11:13 UTC (permalink / raw)
To: Jürgen Groß
Cc: ray.huang, oleksii.kurochko, Nathan Studer, Stewart Hildebrand,
Dario Faggioli, George Dunlap, Meng Xu, Daniel P. Smith,
Stefano Stabellini, Penny Zheng, xen-devel, xen-devel
On 13.10.2025 13:03, Jürgen Groß wrote:
> On 13.10.25 12:15, Penny Zheng wrote:
>> Function sched_adjust() is responsible for XEN_DOMCTL_scheduler_op domctl-op,
>> so it could be wrapped with CONFIG_MGMT_HYPERCALLS.
>> Tracing its calling chain, the following functions shall be wrapped with
>> CONFIG_MGMT_HYPERCALLS too:
>> - sched_adjust_dom()
>> - scheduler-specific .adjust() callback
>> - xsm_sysctl_scheduler_op()
>> Otherwise all these functions will become unreachable when MGMT_HYPERCALLS=n,
>> and hence violating Misra rule 2.1.
>>
>> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
>> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
>
> Reviewed-by: Juergen Gross <jgross@suse.com>
>
> Just one further remark below (not for this patch).
>
>> diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
>> index 4c6e0dc0f9..9dd485646a 100644
>> --- a/xen/include/xsm/xsm.h
>> +++ b/xen/include/xsm/xsm.h
>> @@ -56,8 +56,8 @@ struct xsm_ops {
>> struct xen_domctl_getdomaininfo *info);
>> int (*domain_create)(struct domain *d, uint32_t ssidref);
>> int (*getdomaininfo)(struct domain *d);
>
> As visible in this context .getdomaininfo() is not hidden yet, which
> I think is still true at the end of the series, while I believe it
> should be used by systl/domctl code only.
>
> Or did I miss something?
As was discussed, getdomaininfo and a few others may need to remain
accessible even with MGMT_HYPERCALLS=n, to be able to at least obtain
and report system state.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 19/28] xen/domctl: wrap xsm_irq_permission with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (16 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 18/28] xen/domctl: wrap sched_adjust() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 20/28] xen/domctl: wrap arch-specific domain_set_time_offset() " Penny Zheng
` (9 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel; +Cc: ray.huang, oleksii.kurochko, Penny Zheng, Daniel P. Smith
Function xsm_irq_permission() is invoked only under
XEN_DOMCTL_irq_permission domctl-op, and shall be wrapped with
CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreanchable when
MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
---
v2 -> v3
- add missing wrapping in xsm/dummy.h
- adapt to the commit of "remove redundant xsm_iomem_mapping()"
- address "violating Misra rule 2.1" in commit message
---
xen/include/xsm/dummy.h | 2 ++
xen/include/xsm/xsm.h | 4 ++++
xen/xsm/dummy.c | 2 ++
xen/xsm/flask/hooks.c | 4 ++++
4 files changed, 12 insertions(+)
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 5810a18087..a5deb8a975 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -564,12 +564,14 @@ static XSM_INLINE int cf_check xsm_unmap_domain_irq(
return xsm_default_action(action, current->domain, d);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_irq_permission(
XSM_DEFAULT_ARG struct domain *d, int pirq, uint8_t allow)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
+#endif
static XSM_INLINE int cf_check xsm_iomem_permission(
XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 9dd485646a..ee43002fdb 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -115,7 +115,9 @@ struct xsm_ops {
int (*unmap_domain_irq)(struct domain *d, int irq, const void *data);
int (*bind_pt_irq)(struct domain *d, struct xen_domctl_bind_pt_irq *bind);
int (*unbind_pt_irq)(struct domain *d, struct xen_domctl_bind_pt_irq *bind);
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*irq_permission)(struct domain *d, int pirq, uint8_t allow);
+#endif
int (*iomem_permission)(struct domain *d, uint64_t s, uint64_t e,
uint8_t allow);
int (*pci_config_permission)(struct domain *d, uint32_t machine_bdf,
@@ -499,11 +501,13 @@ static inline int xsm_unbind_pt_irq(
return alternative_call(xsm_ops.unbind_pt_irq, d, bind);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_irq_permission(
xsm_default_t def, struct domain *d, int pirq, uint8_t allow)
{
return alternative_call(xsm_ops.irq_permission, d, pirq, allow);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline int xsm_iomem_permission(
xsm_default_t def, struct domain *d, uint64_t s, uint64_t e, uint8_t allow)
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 724b2a2653..7cf00ce37e 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -73,7 +73,9 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.unmap_domain_irq = xsm_unmap_domain_irq,
.bind_pt_irq = xsm_bind_pt_irq,
.unbind_pt_irq = xsm_unbind_pt_irq,
+#ifdef CONFIG_MGMT_HYPERCALLS
.irq_permission = xsm_irq_permission,
+#endif
.iomem_permission = xsm_iomem_permission,
.pci_config_permission = xsm_pci_config_permission,
.get_vnumainfo = xsm_get_vnumainfo,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 839a4cf9e6..ca07585450 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1111,12 +1111,14 @@ static int cf_check flask_unbind_pt_irq(
return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check flask_irq_permission(
struct domain *d, int pirq, uint8_t access)
{
/* the PIRQ number is not useful; real IRQ is checked during mapping */
return current_has_perm(d, SECCLASS_RESOURCE, resource_to_perm(access));
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
struct iomem_has_perm_data {
uint32_t ssid;
@@ -1938,7 +1940,9 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.unmap_domain_irq = flask_unmap_domain_irq,
.bind_pt_irq = flask_bind_pt_irq,
.unbind_pt_irq = flask_unbind_pt_irq,
+#ifdef CONFIG_MGMT_HYPERCALLS
.irq_permission = flask_irq_permission,
+#endif
.iomem_permission = flask_iomem_permission,
.pci_config_permission = flask_pci_config_permission,
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 20/28] xen/domctl: wrap arch-specific domain_set_time_offset() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (17 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 19/28] xen/domctl: wrap xsm_irq_permission " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 21/28] xen/domctl: wrap xsm_set_target() " Penny Zheng
` (8 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Michal Orzel, Volodymyr Babchuk,
Alistair Francis, Bob Eshleman, Connor Davis, Jan Beulich,
Andrew Cooper, Roger Pau Monné
Arch-specific domain_set_time_offset() is responisble for
XEN_DOMCTL_settimeoffset domctl-op, and shall be wrapped with
CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreachable when
MGMT_HYPERCALLS=n, and hence violating Misra rule 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com> # x86
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_settimeoffset-case transiently
---
v2 -> v3:
- add back stub wrapping for riscv
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_settimeoffset-case
---
xen/arch/arm/time.c | 2 ++
xen/arch/riscv/stubs.c | 2 ++
xen/arch/x86/time.c | 2 ++
3 files changed, 6 insertions(+)
diff --git a/xen/arch/arm/time.c b/xen/arch/arm/time.c
index e74d30d258..dfed0b0ab8 100644
--- a/xen/arch/arm/time.c
+++ b/xen/arch/arm/time.c
@@ -365,12 +365,14 @@ void force_update_vcpu_system_time(struct vcpu *v)
update_vcpu_system_time(v);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void domain_set_time_offset(struct domain *d, int64_t time_offset_seconds)
{
d->time_offset.seconds = time_offset_seconds;
d->time_offset.set = true;
/* XXX update guest visible wallclock time */
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int cpu_time_callback(struct notifier_block *nfb,
unsigned long action,
diff --git a/xen/arch/riscv/stubs.c b/xen/arch/riscv/stubs.c
index 3e4280dee1..be1cadc362 100644
--- a/xen/arch/riscv/stubs.c
+++ b/xen/arch/riscv/stubs.c
@@ -31,10 +31,12 @@ void send_timer_event(struct vcpu *v)
BUG_ON("unimplemented");
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void domain_set_time_offset(struct domain *d, int64_t time_offset_seconds)
{
BUG_ON("unimplemented");
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* domctl.c */
diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c
index 59129f419d..e7394ce8cf 100644
--- a/xen/arch/x86/time.c
+++ b/xen/arch/x86/time.c
@@ -1841,6 +1841,7 @@ static void update_domain_rtc(void)
rcu_read_unlock(&domlist_read_lock);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void domain_set_time_offset(struct domain *d, int64_t time_offset_seconds)
{
d->time_offset.seconds = time_offset_seconds;
@@ -1849,6 +1850,7 @@ void domain_set_time_offset(struct domain *d, int64_t time_offset_seconds)
rtc_update_clock(d);
update_domain_wallclock_time(d);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int cpu_frequency_change(u64 freq)
{
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 21/28] xen/domctl: wrap xsm_set_target() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (18 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 20/28] xen/domctl: wrap arch-specific domain_set_time_offset() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 22/28] xen/domctl: wrap iommu-related domctl op " Penny Zheng
` (7 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel; +Cc: ray.huang, oleksii.kurochko, Penny Zheng, Daniel P. Smith
Function xsm_set_target() is only invoked under XEN_DOMCTL_set_target
domctl-op, and shall be wrapped with CONFIG_MGMT_HYPERCALLS. Otherwise
it will become unreachable codes when MGMT_HYPERCALLS=n, and hence violating
Misra 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
---
v2 -> v3
- wrap the whole inline function xsm_set_target()
- add missing wrapping in xsm/dummy.h
- address "violating Misra rule 2.1" in commit message
---
xen/include/xsm/dummy.h | 2 ++
xen/include/xsm/xsm.h | 4 +++-
xen/xsm/dummy.c | 2 +-
xen/xsm/flask/hooks.c | 4 ++--
4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index a5deb8a975..a598d74f1f 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -158,12 +158,14 @@ static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd)
}
#endif /* CONFIG_MGMT_HYPERCALLS */
+#ifdef CONFIG_MGMT_HYPERCALLS
static XSM_INLINE int cf_check xsm_set_target(
XSM_DEFAULT_ARG struct domain *d, struct domain *e)
{
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, NULL);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static XSM_INLINE int cf_check xsm_domctl(
XSM_DEFAULT_ARG struct domain *d, unsigned int cmd, uint32_t ssidref)
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index ee43002fdb..154a4b8a92 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -59,8 +59,8 @@ struct xsm_ops {
#ifdef CONFIG_MGMT_HYPERCALLS
int (*domctl_scheduler_op)(struct domain *d, int op);
int (*sysctl_scheduler_op)(int op);
-#endif
int (*set_target)(struct domain *d, struct domain *e);
+#endif
int (*domctl)(struct domain *d, unsigned int cmd, uint32_t ssidref);
#ifdef CONFIG_MGMT_HYPERCALLS
int (*sysctl)(int cmd);
@@ -255,11 +255,13 @@ static inline int xsm_sysctl_scheduler_op(xsm_default_t def, int cmd)
}
#endif
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int xsm_set_target(
xsm_default_t def, struct domain *d, struct domain *e)
{
return alternative_call(xsm_ops.set_target, d, e);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static inline int xsm_domctl(xsm_default_t def, struct domain *d,
unsigned int cmd, uint32_t ssidref)
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 7cf00ce37e..9774bb3bdb 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -21,8 +21,8 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
#ifdef CONFIG_MGMT_HYPERCALLS
.domctl_scheduler_op = xsm_domctl_scheduler_op,
.sysctl_scheduler_op = xsm_sysctl_scheduler_op,
-#endif
.set_target = xsm_set_target,
+#endif
.domctl = xsm_domctl,
#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl = xsm_sysctl,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ca07585450..9b63c516e6 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -641,7 +641,6 @@ static int cf_check flask_sysctl_scheduler_op(int op)
return avc_unknown_permission("sysctl_scheduler_op", op);
}
}
-#endif /* CONFIG_MGMT_HYPERCALLS */
static int cf_check flask_set_target(struct domain *d, struct domain *t)
{
@@ -666,6 +665,7 @@ static int cf_check flask_set_target(struct domain *d, struct domain *t)
&dsec->target_sid);
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int cf_check flask_domctl(struct domain *d, unsigned int cmd,
uint32_t ssidref)
@@ -1888,8 +1888,8 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
#ifdef CONFIG_MGMT_HYPERCALLS
.domctl_scheduler_op = flask_domctl_scheduler_op,
.sysctl_scheduler_op = flask_sysctl_scheduler_op,
-#endif
.set_target = flask_set_target,
+#endif
.domctl = flask_domctl,
#ifdef CONFIG_MGMT_HYPERCALLS
.sysctl = flask_sysctl,
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 22/28] xen/domctl: wrap iommu-related domctl op with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (19 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 21/28] xen/domctl: wrap xsm_set_target() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 13:09 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 23/28] xen/domctl: wrap arch_{get,set}_paging_mempool_size() " Penny Zheng
` (6 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Michal Orzel, Volodymyr Babchuk,
Jan Beulich, Andrew Cooper, Roger Pau Monné, Rahul Singh,
Daniel P. Smith
Function iommu_do_domctl() is the main entry for all iommu-related domctl-op,
and shall be wrapped with CONFIG_MGMT_HYPERCALLS.
Tracking its calling chain, the following functions shall all be wrapped
with CONFIG_MGMT_HYPERCALLS:
- iommu_do_pci_domctl
- iommu_get_device_group
- amd_iommu_group_id/intel_iommu_group_id
- device_assigned
- assign_device
- intel_iommu_assign_device/amd_iommu_assign_device
- deassign_device
- reassign_device_ownership/reassign_device
- make PCI_PASSTHROUGH depend on MGMT_HYPERCALLS
- iommu_do_dt_domctl
- iommu_deassign_dt_device
- arm_smmu_reassign_dev
- arm_smmu_deassign_dev
- arm_smmu_detach_dev
- arm_smmu_domain_remove_master
- ipmmu_reassign_device
- ipmmu_deassign_device
- ipmmu_detach_device
- iommu_remove_dt_device
- iommu_dt_device_is_assigned_locked
- dt_find_node_by_gpath
- xsm_get_device_group
- xsm_assign_device
- xsm_deassign_device
- xsm_assign_dtdevice
- xsm_deassign_dtdevice
Otherwise all the functions will become unreachable when MGMT_HYPERCALLS=n,
and hence violating Misra rule 2.1
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_assign_device{test_assign_device,deassign_device,
get_device_group}-case transiently
---
v2 -> v3:
- make PCI_PASSTHROUGH(, then HAS_VPCI_GUEST_SUPPORT) depend on MGMT_HYPERCALLS
- add wrapping for iommu_remove_dt_device/iommu_dt_device_is_assigned_locked/
arm_smmu_detach_dev/arm_smmu_domain_remove_master
- fold commit
"xen/xsm: wrap xsm-iommu-related functions with CONFIG_MGMT_HYPERCALLS" in
- fix overly long #ifdef
- add missing wrapping in xsm/dummy.h
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping of
XEN_DOMCTL_assign_device{test_assign_device,deassign_device,get_device_group}-case
---
xen/arch/arm/Kconfig | 2 +-
xen/common/device-tree/device-tree.c | 2 ++
xen/drivers/passthrough/amd/pci_amd_iommu.c | 8 ++++++++
xen/drivers/passthrough/arm/ipmmu-vmsa.c | 8 ++++++++
xen/drivers/passthrough/arm/smmu-v3.c | 4 ++++
xen/drivers/passthrough/arm/smmu.c | 10 ++++++++++
xen/drivers/passthrough/device_tree.c | 6 ++++++
xen/drivers/passthrough/iommu.c | 2 ++
xen/drivers/passthrough/pci.c | 6 +++++-
xen/drivers/passthrough/vtd/iommu.c | 6 ++++++
xen/include/xsm/dummy.h | 12 ++++++------
xen/include/xsm/xsm.h | 21 ++++++++++++---------
xen/xsm/dummy.c | 10 ++++++----
xen/xsm/flask/hooks.c | 20 ++++++++++++--------
14 files changed, 88 insertions(+), 29 deletions(-)
diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig
index cf6af68299..5a5d7810c8 100644
--- a/xen/arch/arm/Kconfig
+++ b/xen/arch/arm/Kconfig
@@ -270,7 +270,7 @@ source "arch/arm/firmware/Kconfig"
config PCI_PASSTHROUGH
bool "PCI passthrough" if EXPERT
- depends on ARM_64 && HAS_PASSTHROUGH
+ depends on ARM_64 && HAS_PASSTHROUGH && MGMT_HYPERCALLS
help
This option enables PCI device passthrough
diff --git a/xen/common/device-tree/device-tree.c b/xen/common/device-tree/device-tree.c
index 0b5375f151..70bd8e7da5 100644
--- a/xen/common/device-tree/device-tree.c
+++ b/xen/common/device-tree/device-tree.c
@@ -371,6 +371,7 @@ struct dt_device_node *dt_find_node_by_path_from(struct dt_device_node *from,
return np;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int dt_find_node_by_gpath(XEN_GUEST_HANDLE(char) u_path, uint32_t u_plen,
struct dt_device_node **node)
{
@@ -386,6 +387,7 @@ int dt_find_node_by_gpath(XEN_GUEST_HANDLE(char) u_path, uint32_t u_plen,
return (*node == NULL) ? -ESRCH : 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
struct dt_device_node *dt_find_node_by_alias(const char *alias)
{
diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c
index 3a14770855..5786bf0c59 100644
--- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
+++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
@@ -461,6 +461,7 @@ static void amd_iommu_disable_domain_device(const struct domain *domain,
spin_unlock_irqrestore(&iommu->lock, flags);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check reassign_device(
struct domain *source, struct domain *target, u8 devfn,
struct pci_dev *pdev)
@@ -550,6 +551,7 @@ static int cf_check amd_iommu_assign_device(
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check amd_iommu_clear_root_pgtable(struct domain *d)
{
@@ -698,12 +700,14 @@ static int cf_check amd_iommu_remove_device(u8 devfn, struct pci_dev *pdev)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check amd_iommu_group_id(u16 seg, u8 bus, u8 devfn)
{
unsigned int bdf = PCI_BDF(bus, devfn);
return (bdf < ivrs_bdf_entries) ? get_dma_requestor_id(seg, bdf) : bdf;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#include <asm/io_apic.h>
@@ -772,14 +776,18 @@ static const struct iommu_ops __initconst_cf_clobber _iommu_ops = {
.quarantine_init = amd_iommu_quarantine_init,
.add_device = amd_iommu_add_device,
.remove_device = amd_iommu_remove_device,
+#ifdef CONFIG_MGMT_HYPERCALLS
.assign_device = amd_iommu_assign_device,
+#endif
.teardown = amd_iommu_domain_destroy,
.clear_root_pgtable = amd_iommu_clear_root_pgtable,
.map_page = amd_iommu_map_page,
.unmap_page = amd_iommu_unmap_page,
.iotlb_flush = amd_iommu_flush_iotlb_pages,
+#ifdef CONFIG_MGMT_HYPERCALLS
.reassign_device = reassign_device,
.get_device_group_id = amd_iommu_group_id,
+#endif
.enable_x2apic = iov_enable_xt,
.update_ire_from_apic = amd_iommu_ioapic_update_ire,
.update_ire_from_msi = amd_iommu_msi_msg_update_ire,
diff --git a/xen/drivers/passthrough/arm/ipmmu-vmsa.c b/xen/drivers/passthrough/arm/ipmmu-vmsa.c
index ea9fa9ddf3..023febc424 100644
--- a/xen/drivers/passthrough/arm/ipmmu-vmsa.c
+++ b/xen/drivers/passthrough/arm/ipmmu-vmsa.c
@@ -739,6 +739,7 @@ static int ipmmu_attach_device(struct ipmmu_vmsa_domain *domain,
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static void ipmmu_detach_device(struct ipmmu_vmsa_domain *domain,
struct device *dev)
{
@@ -748,6 +749,7 @@ static void ipmmu_detach_device(struct ipmmu_vmsa_domain *domain,
for ( i = 0; i < fwspec->num_ids; ++i )
ipmmu_utlb_disable(domain, fwspec->ids[i]);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int ipmmu_init_platform_device(struct device *dev,
const struct dt_phandle_args *args)
@@ -1138,7 +1140,9 @@ static void ipmmu_free_root_domain(struct ipmmu_vmsa_domain *domain)
xfree(domain);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int ipmmu_deassign_device(struct domain *d, struct device *dev);
+#endif
static int ipmmu_assign_device(struct domain *d, u8 devfn, struct device *dev,
uint32_t flag)
@@ -1254,6 +1258,7 @@ out:
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int ipmmu_deassign_device(struct domain *d, struct device *dev)
{
struct ipmmu_vmsa_xen_domain *xen_domain = dom_iommu(d)->arch.priv;
@@ -1309,6 +1314,7 @@ static int ipmmu_reassign_device(struct domain *s, struct domain *t,
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int ipmmu_dt_xlate(struct device *dev,
const struct dt_phandle_args *spec)
@@ -1487,7 +1493,9 @@ static const struct iommu_ops ipmmu_iommu_ops =
.teardown = ipmmu_iommu_domain_teardown,
.iotlb_flush = ipmmu_iotlb_flush,
.assign_device = ipmmu_assign_device,
+#ifdef CONFIG_MGMT_HYPERCALLS
.reassign_device = ipmmu_reassign_device,
+#endif
.map_page = arm_iommu_map_page,
.unmap_page = arm_iommu_unmap_page,
.dt_xlate = ipmmu_dt_xlate,
diff --git a/xen/drivers/passthrough/arm/smmu-v3.c b/xen/drivers/passthrough/arm/smmu-v3.c
index bf153227db..22def57b03 100644
--- a/xen/drivers/passthrough/arm/smmu-v3.c
+++ b/xen/drivers/passthrough/arm/smmu-v3.c
@@ -2759,6 +2759,7 @@ out:
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int arm_smmu_deassign_dev(struct domain *d, uint8_t devfn, struct device *dev)
{
struct iommu_domain *io_domain = arm_smmu_get_domain(d, dev);
@@ -2826,6 +2827,7 @@ static int arm_smmu_reassign_dev(struct domain *s, struct domain *t,
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int arm_smmu_iommu_xen_domain_init(struct domain *d)
{
@@ -2862,7 +2864,9 @@ static const struct iommu_ops arm_smmu_iommu_ops = {
.teardown = arm_smmu_iommu_xen_domain_teardown,
.iotlb_flush = arm_smmu_iotlb_flush,
.assign_device = arm_smmu_assign_dev,
+#ifdef CONFIG_MGMT_HYPERCALLS
.reassign_device = arm_smmu_reassign_dev,
+#endif
.map_page = arm_iommu_map_page,
.unmap_page = arm_iommu_unmap_page,
.dt_xlate = arm_smmu_dt_xlate,
diff --git a/xen/drivers/passthrough/arm/smmu.c b/xen/drivers/passthrough/arm/smmu.c
index 22d306d0cb..51c1bf4f08 100644
--- a/xen/drivers/passthrough/arm/smmu.c
+++ b/xen/drivers/passthrough/arm/smmu.c
@@ -894,8 +894,10 @@ static int register_smmu_master(struct arm_smmu_device *smmu,
/* Forward declaration */
static int arm_smmu_assign_dev(struct domain *d, u8 devfn,
struct device *dev, u32 flag);
+#ifdef CONFIG_MGMT_HYPERCALLS
static int arm_smmu_deassign_dev(struct domain *d, uint8_t devfn,
struct device *dev);
+#endif
/*
* The driver which supports generic IOMMU DT bindings must have this
@@ -1699,6 +1701,7 @@ static int arm_smmu_domain_add_master(struct arm_smmu_domain *smmu_domain,
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static void arm_smmu_domain_remove_master(
const struct arm_smmu_domain *smmu_domain,
struct arm_smmu_master_cfg *cfg)
@@ -1713,6 +1716,7 @@ static void arm_smmu_domain_remove_master(
arm_smmu_write_s2cr(smmu, idx);
}
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
{
@@ -1761,6 +1765,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
return arm_smmu_domain_add_master(smmu_domain, cfg);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static void arm_smmu_detach_dev(struct iommu_domain *domain, struct device *dev)
{
struct arm_smmu_domain *smmu_domain = domain->priv;
@@ -1770,6 +1775,7 @@ static void arm_smmu_detach_dev(struct iommu_domain *domain, struct device *dev)
arm_smmu_domain_remove_master(smmu_domain, cfg);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#if 0 /*
* Xen: The page table is shared with the processor, therefore
@@ -2849,6 +2855,7 @@ out:
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int arm_smmu_deassign_dev(struct domain *d, uint8_t devfn,
struct device *dev)
{
@@ -2918,6 +2925,7 @@ static int arm_smmu_reassign_dev(struct domain *s, struct domain *t,
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int arm_smmu_iommu_domain_init(struct domain *d)
{
@@ -2956,7 +2964,9 @@ static const struct iommu_ops arm_smmu_iommu_ops = {
.teardown = arm_smmu_iommu_domain_teardown,
.iotlb_flush = arm_smmu_iotlb_flush,
.assign_device = arm_smmu_assign_dev,
+#ifdef CONFIG_MGMT_HYPERCALLS
.reassign_device = arm_smmu_reassign_dev,
+#endif
.map_page = arm_iommu_map_page,
.unmap_page = arm_iommu_unmap_page,
.dt_xlate = arm_smmu_dt_xlate_generic,
diff --git a/xen/drivers/passthrough/device_tree.c b/xen/drivers/passthrough/device_tree.c
index 015ffa15d4..09ac740fb2 100644
--- a/xen/drivers/passthrough/device_tree.c
+++ b/xen/drivers/passthrough/device_tree.c
@@ -59,6 +59,7 @@ fail:
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_deassign_dt_device(struct domain *d, struct dt_device_node *dev)
{
const struct domain_iommu *hd = dom_iommu(d);
@@ -100,6 +101,7 @@ static bool iommu_dt_device_is_assigned_locked(const struct dt_device_node *dev)
return assigned;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int iommu_dt_domain_init(struct domain *d)
{
@@ -212,6 +214,7 @@ int iommu_add_dt_pci_sideband_ids(struct pci_dev *pdev)
}
#endif /* CONFIG_HAS_PCI */
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_remove_dt_device(struct dt_device_node *np)
{
const struct iommu_ops *ops = iommu_get_ops();
@@ -256,6 +259,7 @@ int iommu_remove_dt_device(struct dt_device_node *np)
spin_unlock(&dtdevs_lock);
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int iommu_add_dt_device(struct dt_device_node *np)
{
@@ -320,6 +324,7 @@ int iommu_add_dt_device(struct dt_device_node *np)
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_do_dt_domctl(struct xen_domctl *domctl, struct domain *d,
XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
{
@@ -431,3 +436,4 @@ int iommu_do_dt_domctl(struct xen_domctl *domctl, struct domain *d,
return ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
index c9425d6971..8812e38174 100644
--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -625,6 +625,7 @@ void iommu_resume(void)
iommu_vcall(iommu_get_ops(), resume);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_do_domctl(
struct xen_domctl *domctl, struct domain *d,
XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
@@ -645,6 +646,7 @@ int iommu_do_domctl(
return ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void iommu_crash_shutdown(void)
{
diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c
index cd855108c2..aa07a7e748 100644
--- a/xen/drivers/passthrough/pci.c
+++ b/xen/drivers/passthrough/pci.c
@@ -877,6 +877,7 @@ int pci_remove_device(u16 seg, u8 bus, u8 devfn)
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/* Caller should hold the pcidevs_lock */
static int deassign_device(struct domain *d, uint16_t seg, uint8_t bus,
uint8_t devfn)
@@ -945,7 +946,6 @@ static int deassign_device(struct domain *d, uint16_t seg, uint8_t bus,
return ret;
}
-#ifdef CONFIG_MGMT_HYPERCALLS
int pci_release_devices(struct domain *d)
{
int combined_ret;
@@ -1483,6 +1483,7 @@ static int iommu_remove_device(struct pci_dev *pdev)
return iommu_call(hd->platform_ops, remove_device, devfn, pci_to_dev(pdev));
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int device_assigned(u16 seg, u8 bus, u8 devfn)
{
struct pci_dev *pdev;
@@ -1646,6 +1647,7 @@ static int iommu_get_device_group(
return i;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void iommu_dev_iotlb_flush_timeout(struct domain *d, struct pci_dev *pdev)
{
@@ -1671,6 +1673,7 @@ void iommu_dev_iotlb_flush_timeout(struct domain *d, struct pci_dev *pdev)
pcidevs_unlock();
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int iommu_do_pci_domctl(
struct xen_domctl *domctl, struct domain *d,
XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
@@ -1804,6 +1807,7 @@ int iommu_do_pci_domctl(
return ret;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
struct segment_iter {
int (*handler)(struct pci_dev *pdev, void *arg);
diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
index b4105163cc..8913dd4d5f 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2731,6 +2731,7 @@ static int __init cf_check vtd_setup(void)
return ret;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
static int cf_check reassign_device_ownership(
struct domain *source,
struct domain *target,
@@ -2926,6 +2927,7 @@ static int cf_check intel_iommu_group_id(u16 seg, u8 bus, u8 devfn)
return PCI_BDF(bus, devfn);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
static int __must_check cf_check vtd_suspend(void)
{
@@ -3234,14 +3236,18 @@ static const struct iommu_ops __initconst_cf_clobber vtd_ops = {
.add_device = intel_iommu_add_device,
.enable_device = intel_iommu_enable_device,
.remove_device = intel_iommu_remove_device,
+#ifdef CONFIG_MGMT_HYPERCALLS
.assign_device = intel_iommu_assign_device,
+#endif
.teardown = iommu_domain_teardown,
.clear_root_pgtable = iommu_clear_root_pgtable,
.map_page = intel_iommu_map_page,
.unmap_page = intel_iommu_unmap_page,
.lookup_page = intel_iommu_lookup_page,
+#ifdef CONFIG_MGMT_HYPERCALLS
.reassign_device = reassign_device_ownership,
.get_device_group_id = intel_iommu_group_id,
+#endif
.enable_x2apic = intel_iommu_enable_eim,
.disable_x2apic = intel_iommu_disable_eim,
.update_ire_from_apic = io_apic_write_remap_rte,
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index a598d74f1f..f53492bedc 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -407,7 +407,8 @@ static XSM_INLINE int cf_check xsm_get_vnumainfo(
return xsm_default_action(action, current->domain, d);
}
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
static XSM_INLINE int cf_check xsm_get_device_group(
XSM_DEFAULT_ARG uint32_t machine_bdf)
{
@@ -428,10 +429,9 @@ static XSM_INLINE int cf_check xsm_deassign_device(
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
+#endif /* CONFIG_HAS_PCI */
-#endif /* HAS_PASSTHROUGH && HAS_PCI */
-
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
static XSM_INLINE int cf_check xsm_assign_dtdevice(
XSM_DEFAULT_ARG struct domain *d, const char *dtpath)
{
@@ -445,8 +445,8 @@ static XSM_INLINE int cf_check xsm_deassign_dtdevice(
XSM_ASSERT_ACTION(XSM_HOOK);
return xsm_default_action(action, current->domain, d);
}
-
-#endif /* HAS_PASSTHROUGH && HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID)
{
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 154a4b8a92..c9a2b895b1 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -123,16 +123,18 @@ struct xsm_ops {
int (*pci_config_permission)(struct domain *d, uint32_t machine_bdf,
uint16_t start, uint16_t end, uint8_t access);
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
int (*get_device_group)(uint32_t machine_bdf);
int (*assign_device)(struct domain *d, uint32_t machine_bdf);
int (*deassign_device)(struct domain *d, uint32_t machine_bdf);
-#endif
+#endif /* CONFIG_HAS_PCI */
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
int (*assign_dtdevice)(struct domain *d, const char *dtpath);
int (*deassign_dtdevice)(struct domain *d, const char *dtpath);
-#endif
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
int (*resource_plug_core)(void);
int (*resource_unplug_core)(void);
@@ -524,7 +526,8 @@ static inline int xsm_pci_config_permission(
return alternative_call(xsm_ops.pci_config_permission, d, machine_bdf, start, end, access);
}
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
static inline int xsm_get_device_group(xsm_default_t def, uint32_t machine_bdf)
{
return alternative_call(xsm_ops.get_device_group, machine_bdf);
@@ -541,9 +544,9 @@ static inline int xsm_deassign_device(
{
return alternative_call(xsm_ops.deassign_device, d, machine_bdf);
}
-#endif /* HAS_PASSTHROUGH && HAS_PCI) */
+#endif /* CONFIG_HAS_PCI */
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
static inline int xsm_assign_dtdevice(
xsm_default_t def, struct domain *d, const char *dtpath)
{
@@ -555,8 +558,8 @@ static inline int xsm_deassign_dtdevice(
{
return alternative_call(xsm_ops.deassign_dtdevice, d, dtpath);
}
-
-#endif /* HAS_PASSTHROUGH && HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
static inline int xsm_resource_plug_pci(xsm_default_t def, uint32_t machine_bdf)
{
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 9774bb3bdb..f2a22fed92 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -80,16 +80,18 @@ static const struct xsm_ops __initconst_cf_clobber dummy_ops = {
.pci_config_permission = xsm_pci_config_permission,
.get_vnumainfo = xsm_get_vnumainfo,
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
.get_device_group = xsm_get_device_group,
.assign_device = xsm_assign_device,
.deassign_device = xsm_deassign_device,
-#endif
+#endif /* CONFIG_HAS_PCI */
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
.assign_dtdevice = xsm_assign_dtdevice,
.deassign_dtdevice = xsm_deassign_dtdevice,
-#endif
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
.resource_plug_core = xsm_resource_plug_core,
.resource_unplug_core = xsm_resource_unplug_core,
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 9b63c516e6..f761f8b384 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1388,7 +1388,8 @@ static int cf_check flask_mem_sharing(struct domain *d)
}
#endif
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
static int cf_check flask_get_device_group(uint32_t machine_bdf)
{
uint32_t rsid;
@@ -1459,9 +1460,9 @@ static int cf_check flask_deassign_device(
return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__REMOVE_DEVICE, NULL);
}
-#endif /* HAS_PASSTHROUGH && HAS_PCI */
+#endif /* CONFIG_HAS_PCI */
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
static int flask_test_assign_dtdevice(const char *dtpath)
{
uint32_t rsid;
@@ -1522,7 +1523,8 @@ static int cf_check flask_deassign_dtdevice(
return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__REMOVE_DEVICE,
NULL);
}
-#endif /* HAS_PASSTHROUGH && HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
static int cf_check flask_platform_op(uint32_t op)
{
@@ -1987,16 +1989,18 @@ static const struct xsm_ops __initconst_cf_clobber flask_ops = {
.remove_from_physmap = flask_remove_from_physmap,
.map_gmfn_foreign = flask_map_gmfn_foreign,
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI)
+#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_MGMT_HYPERCALLS)
+#ifdef CONFIG_HAS_PCI
.get_device_group = flask_get_device_group,
.assign_device = flask_assign_device,
.deassign_device = flask_deassign_device,
-#endif
+#endif /* CONFIG_HAS_PCI */
-#if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE_DISCOVERY)
+#ifdef CONFIG_HAS_DEVICE_TREE_DISCOVERY
.assign_dtdevice = flask_assign_dtdevice,
.deassign_dtdevice = flask_deassign_dtdevice,
-#endif
+#endif /* CONFIG_HAS_DEVICE_TREE_DISCOVERY */
+#endif /* CONFIG_HAS_PASSTHROUGH && CONFIG_MGMT_HYPERCALLS */
.platform_op = flask_platform_op,
#ifdef CONFIG_X86
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 22/28] xen/domctl: wrap iommu-related domctl op with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 22/28] xen/domctl: wrap iommu-related domctl op " Penny Zheng
@ 2025-10-30 13:09 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 13:09 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Stefano Stabellini, Julien Grall,
Bertrand Marquis, Michal Orzel, Volodymyr Babchuk, Andrew Cooper,
Roger Pau Monné, Rahul Singh, Daniel P. Smith, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Function iommu_do_domctl() is the main entry for all iommu-related domctl-op,
> and shall be wrapped with CONFIG_MGMT_HYPERCALLS.
> Tracking its calling chain, the following functions shall all be wrapped
> with CONFIG_MGMT_HYPERCALLS:
> - iommu_do_pci_domctl
> - iommu_get_device_group
> - amd_iommu_group_id/intel_iommu_group_id
> - device_assigned
> - assign_device
> - intel_iommu_assign_device/amd_iommu_assign_device
> - deassign_device
> - reassign_device_ownership/reassign_device
Could this PCI related subset and ...
> - make PCI_PASSTHROUGH depend on MGMT_HYPERCALLS
> - iommu_do_dt_domctl
> - iommu_deassign_dt_device
> - arm_smmu_reassign_dev
> - arm_smmu_deassign_dev
> - arm_smmu_detach_dev
> - arm_smmu_domain_remove_master
> - ipmmu_reassign_device
> - ipmmu_deassign_device
> - ipmmu_detach_device
> - iommu_remove_dt_device
> - iommu_dt_device_is_assigned_locked
> - dt_find_node_by_gpath
... this DT related subset become separate (prereq) patches? Doing so may also reduce
the number of acks you need to collect on individual patches.
The bullet point in between looks unrelated in this list; it's not about any function,
after all. In fact I was about to complain that the aspect isn't mentioned in the
description, until I spotted the misplaced line.
> - xsm_get_device_group
> - xsm_assign_device
> - xsm_deassign_device
> - xsm_assign_dtdevice
> - xsm_deassign_dtdevice
> Otherwise all the functions will become unreachable when MGMT_HYPERCALLS=n,
> and hence violating Misra rule 2.1
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v1 -> v2:
> - adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
> - wrap XEN_DOMCTL_assign_device{test_assign_device,deassign_device,
> get_device_group}-case transiently
> ---
> v2 -> v3:
> - make PCI_PASSTHROUGH(, then HAS_VPCI_GUEST_SUPPORT) depend on MGMT_HYPERCALLS
Is this correct, though? Isn't PCI pass-through and vPCI guest support also
possible in dom0less / hyperlaunch?
> --- a/xen/drivers/passthrough/amd/pci_amd_iommu.c
> +++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c
> @@ -461,6 +461,7 @@ static void amd_iommu_disable_domain_device(const struct domain *domain,
> spin_unlock_irqrestore(&iommu->lock, flags);
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> static int cf_check reassign_device(
> struct domain *source, struct domain *target, u8 devfn,
> struct pci_dev *pdev)
> @@ -550,6 +551,7 @@ static int cf_check amd_iommu_assign_device(
>
> return rc;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
>
> static void cf_check amd_iommu_clear_root_pgtable(struct domain *d)
> {
> @@ -698,12 +700,14 @@ static int cf_check amd_iommu_remove_device(u8 devfn, struct pci_dev *pdev)
> return 0;
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> static int cf_check amd_iommu_group_id(u16 seg, u8 bus, u8 devfn)
> {
> unsigned int bdf = PCI_BDF(bus, devfn);
>
> return (bdf < ivrs_bdf_entries) ? get_dma_requestor_id(seg, bdf) : bdf;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
Might be worth moving some code and ...
> @@ -772,14 +776,18 @@ static const struct iommu_ops __initconst_cf_clobber _iommu_ops = {
> .quarantine_init = amd_iommu_quarantine_init,
> .add_device = amd_iommu_add_device,
> .remove_device = amd_iommu_remove_device,
> +#ifdef CONFIG_MGMT_HYPERCALLS
> .assign_device = amd_iommu_assign_device,
> +#endif
> .teardown = amd_iommu_domain_destroy,
> .clear_root_pgtable = amd_iommu_clear_root_pgtable,
> .map_page = amd_iommu_map_page,
> .unmap_page = amd_iommu_unmap_page,
> .iotlb_flush = amd_iommu_flush_iotlb_pages,
> +#ifdef CONFIG_MGMT_HYPERCALLS
> .reassign_device = reassign_device,
> .get_device_group_id = amd_iommu_group_id,
> +#endif
> .enable_x2apic = iov_enable_xt,
> .update_ire_from_apic = amd_iommu_ioapic_update_ire,
> .update_ire_from_msi = amd_iommu_msi_msg_update_ire,
... some fields / initializers, such that we get away with a single #ifdef each.
> --- a/xen/drivers/passthrough/pci.c
> +++ b/xen/drivers/passthrough/pci.c
> @@ -877,6 +877,7 @@ int pci_remove_device(u16 seg, u8 bus, u8 devfn)
> return ret;
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> /* Caller should hold the pcidevs_lock */
> static int deassign_device(struct domain *d, uint16_t seg, uint8_t bus,
> uint8_t devfn)
> @@ -945,7 +946,6 @@ static int deassign_device(struct domain *d, uint16_t seg, uint8_t bus,
> return ret;
> }
>
> -#ifdef CONFIG_MGMT_HYPERCALLS
> int pci_release_devices(struct domain *d)
> {
> int combined_ret;
> @@ -1483,6 +1483,7 @@ static int iommu_remove_device(struct pci_dev *pdev)
> return iommu_call(hd->platform_ops, remove_device, devfn, pci_to_dev(pdev));
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> static int device_assigned(u16 seg, u8 bus, u8 devfn)
> {
> struct pci_dev *pdev;
> @@ -1646,6 +1647,7 @@ static int iommu_get_device_group(
>
> return i;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
>
> void iommu_dev_iotlb_flush_timeout(struct domain *d, struct pci_dev *pdev)
> {
> @@ -1671,6 +1673,7 @@ void iommu_dev_iotlb_flush_timeout(struct domain *d, struct pci_dev *pdev)
> pcidevs_unlock();
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> int iommu_do_pci_domctl(
> struct xen_domctl *domctl, struct domain *d,
> XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
> @@ -1804,6 +1807,7 @@ int iommu_do_pci_domctl(
>
> return ret;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
Same here - the helpers of iommu_do_pci_domctl() would likely best move immediately
ahead of it, so that all can be covered with a single #ifdef.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 23/28] xen/domctl: wrap arch_{get,set}_paging_mempool_size() with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (20 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 22/28] xen/domctl: wrap iommu-related domctl op " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 24/28] xen/domctl: make CONFIG_X86_PSR depend on CONFIG_MGMT_HYPERCALLS Penny Zheng
` (5 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Stefano Stabellini,
Julien Grall, Bertrand Marquis, Michal Orzel, Volodymyr Babchuk,
Jan Beulich, Andrew Cooper, Roger Pau Monné
Arch-specific arch_{get,set}_paging_mempool_size() is responsible for
XEN_DOMCTL_{get,set}_paging_mempool_size domctl-op, and shall be wrapped
with CONFIG_MGMT_HYPERCALLS. Otherwise it will become unreachable codes when
MGMT_HYPERCALLS=n, and hence violating Misra 2.1.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com> # x86
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap XEN_DOMCTL_{get,set}_paging_mempool_size-case transiently
---
v2 -> v3
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around XEN_DOMCTL_{get,set}_paging_mempool_size-case
---
xen/arch/arm/mmu/p2m.c | 4 ++++
xen/arch/x86/mm/paging.c | 2 ++
2 files changed, 6 insertions(+)
diff --git a/xen/arch/arm/mmu/p2m.c b/xen/arch/arm/mmu/p2m.c
index 30d6071e91..4caa5844e4 100644
--- a/xen/arch/arm/mmu/p2m.c
+++ b/xen/arch/arm/mmu/p2m.c
@@ -58,12 +58,14 @@ static void p2m_free_page(struct domain *d, struct page_info *pg)
}
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/* Return the size of the pool, in bytes. */
int arch_get_paging_mempool_size(struct domain *d, uint64_t *size)
{
*size = (uint64_t)ACCESS_ONCE(d->arch.paging.p2m_total_pages) << PAGE_SHIFT;
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Set the pool of pages to the required number of pages.
@@ -122,6 +124,7 @@ int p2m_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
return 0;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
{
unsigned long pages = size >> PAGE_SHIFT;
@@ -140,6 +143,7 @@ int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
int p2m_teardown_allocation(struct domain *d)
{
diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index 116389d4e9..c6e3996093 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -949,6 +949,7 @@ int __init paging_set_allocation(struct domain *d, unsigned int pages,
}
#endif
+#ifdef CONFIG_MGMT_HYPERCALLS
int arch_get_paging_mempool_size(struct domain *d, uint64_t *size)
{
unsigned long pages;
@@ -991,6 +992,7 @@ int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
return preempted ? -ERESTART : rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/*
* Local variables:
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 24/28] xen/domctl: make CONFIG_X86_PSR depend on CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (21 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 23/28] xen/domctl: wrap arch_{get,set}_paging_mempool_size() " Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-13 10:15 ` [PATCH v3 25/28] xen/domctl: avoid unreachable codes when both MGMT_HYPERCALLS and MEM_SHARING unset Penny Zheng
` (4 subsequent siblings)
27 siblings, 0 replies; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné, Stefano Stabellini
Users control/monitor Intel Platform Shared Resource (PSR) through
related domctl-op or sysctl-op, so CONFIG_X86_PSR can be put under
MGMT_HYPERCALLS. With this change, we could remove MGMT_HYPERCALLS-wrapping
in psr.c.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
v1 -> v2:
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
---
xen/arch/x86/Kconfig | 1 +
xen/arch/x86/psr.c | 18 ------------------
2 files changed, 1 insertion(+), 18 deletions(-)
diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig
index 3f0f3a0f3a..21da8c1a69 100644
--- a/xen/arch/x86/Kconfig
+++ b/xen/arch/x86/Kconfig
@@ -190,6 +190,7 @@ config TBOOT
config X86_PSR
bool "Platform Shared Resource support" if EXPERT
default INTEL
+ depends on MGMT_HYPERCALLS
help
Support of Platform Shared Resource technology, which is basis for
monitoring and control of resources like cache and memory bandwidth.
diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c
index 80ce5804b4..4f2c2d0042 100644
--- a/xen/arch/x86/psr.c
+++ b/xen/arch/x86/psr.c
@@ -135,11 +135,9 @@ static const struct feat_props {
*/
enum psr_type alt_type;
-#ifdef CONFIG_MGMT_HYPERCALLS
/* get_feat_info is used to return feature HW info through sysctl. */
bool (*get_feat_info)(const struct feat_node *feat,
uint32_t data[], unsigned int array_len);
-#endif
/* write_msr is used to write out feature MSR register. */
void (*write_msr)(unsigned int cos, uint32_t val, enum psr_type type);
@@ -422,7 +420,6 @@ static bool mba_init_feature(const struct cpuid_leaf *regs,
return true;
}
-#ifdef CONFIG_MGMT_HYPERCALLS
static bool cf_check cat_get_feat_info(
const struct feat_node *feat, uint32_t data[], unsigned int array_len)
{
@@ -435,7 +432,6 @@ static bool cf_check cat_get_feat_info(
return true;
}
-#endif /* CONFIG_MGMT_HYPERCALLS */
/* L3 CAT props */
static void cf_check l3_cat_write_msr(
@@ -448,14 +444,11 @@ static const struct feat_props l3_cat_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_L3_CBM,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = cat_get_feat_info,
-#endif
.write_msr = l3_cat_write_msr,
.sanitize = cat_check_cbm,
};
-#ifdef CONFIG_MGMT_HYPERCALLS
/* L3 CDP props */
static bool cf_check l3_cdp_get_feat_info(
const struct feat_node *feat, uint32_t data[], uint32_t array_len)
@@ -467,7 +460,6 @@ static bool cf_check l3_cdp_get_feat_info(
return true;
}
-#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check l3_cdp_write_msr(
unsigned int cos, uint32_t val, enum psr_type type)
@@ -483,9 +475,7 @@ static const struct feat_props l3_cdp_props = {
.type[0] = PSR_TYPE_L3_DATA,
.type[1] = PSR_TYPE_L3_CODE,
.alt_type = PSR_TYPE_L3_CBM,
-#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = l3_cdp_get_feat_info,
-#endif
.write_msr = l3_cdp_write_msr,
.sanitize = cat_check_cbm,
};
@@ -501,14 +491,11 @@ static const struct feat_props l2_cat_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_L2_CBM,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = cat_get_feat_info,
-#endif
.write_msr = l2_cat_write_msr,
.sanitize = cat_check_cbm,
};
-#ifdef CONFIG_MGMT_HYPERCALLS
/* MBA props */
static bool cf_check mba_get_feat_info(
const struct feat_node *feat, uint32_t data[], unsigned int array_len)
@@ -523,7 +510,6 @@ static bool cf_check mba_get_feat_info(
return true;
}
-#endif /* CONFIG_MGMT_HYPERCALLS */
static void cf_check mba_write_msr(
unsigned int cos, uint32_t val, enum psr_type type)
@@ -561,9 +547,7 @@ static const struct feat_props mba_props = {
.cos_num = 1,
.type[0] = PSR_TYPE_MBA_THRTL,
.alt_type = PSR_TYPE_UNKNOWN,
-#ifdef CONFIG_MGMT_HYPERCALLS
.get_feat_info = mba_get_feat_info,
-#endif
.write_msr = mba_write_msr,
.sanitize = mba_sanitize_thrtl,
};
@@ -826,7 +810,6 @@ static struct psr_socket_info *get_socket_info(unsigned int socket)
return socket_info + socket;
}
-#ifdef CONFIG_MGMT_HYPERCALLS
int psr_get_info(unsigned int socket, enum psr_type type,
uint32_t data[], unsigned int array_len)
{
@@ -858,7 +841,6 @@ int psr_get_info(unsigned int socket, enum psr_type type,
return -EINVAL;
}
-#endif /* CONFIG_MGMT_HYPERCALLS */
int psr_get_val(struct domain *d, unsigned int socket,
uint32_t *val, enum psr_type type)
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* [PATCH v3 25/28] xen/domctl: avoid unreachable codes when both MGMT_HYPERCALLS and MEM_SHARING unset
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (22 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 24/28] xen/domctl: make CONFIG_X86_PSR depend on CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 13:13 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 26/28] xen/domctl: wrap arch-specific domctl-op with CONFIG_MGMT_HYPERCALLS Penny Zheng
` (3 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné
The following functions have been referenced in places which is either guarded
with CONFIG_MGMT_HYPERCALLS or CONFIG_MEM_SHARING:
- arch_hvm_save
- arch_hvm_check
- arch_hvm_load
- hvm_save_size
- hvm_save
- hvm_load
- hvm_vmtrace_reset
So they shall be wrapped under OR relationship, otherwise they will become
unreachable codes when MGMT_HYPERCALLS=n && MEM_SHARING=n, and hence violating
Misra rule 2.1.
We move arch_hvm_save(), arch_hvm_check(), arch_hvm_load() and hvm_save_size()
nearer to the left functions, to avoid scattered #ifdef-wrapping.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3
- new commit
---
xen/arch/x86/hvm/save.c | 154 +++++++++++++++--------------
xen/arch/x86/hvm/vmx/vmx.c | 4 +
xen/arch/x86/include/asm/hvm/hvm.h | 4 +
3 files changed, 86 insertions(+), 76 deletions(-)
diff --git a/xen/arch/x86/hvm/save.c b/xen/arch/x86/hvm/save.c
index 8ab6405706..47050e13b6 100644
--- a/xen/arch/x86/hvm/save.c
+++ b/xen/arch/x86/hvm/save.c
@@ -15,62 +15,6 @@
#include <public/hvm/save.h>
-static void arch_hvm_save(struct domain *d, struct hvm_save_header *hdr)
-{
- uint32_t eax, ebx, ecx, edx;
-
- /* Save some CPUID bits */
- cpuid(1, &eax, &ebx, &ecx, &edx);
- hdr->cpuid = eax;
-
- /* Save guest's preferred TSC. */
- hdr->gtsc_khz = d->arch.tsc_khz;
-
- /* Time when saving started */
- d->arch.hvm.sync_tsc = rdtsc();
-}
-
-static int arch_hvm_check(const struct domain *d,
- const struct hvm_save_header *hdr)
-{
- uint32_t eax, ebx, ecx, edx;
-
- if ( hdr->magic != HVM_FILE_MAGIC )
- {
- printk(XENLOG_G_ERR "HVM%d restore: bad magic number %#"PRIx32"\n",
- d->domain_id, hdr->magic);
- return -EINVAL;
- }
-
- if ( hdr->version != HVM_FILE_VERSION )
- {
- printk(XENLOG_G_ERR "HVM%d restore: unsupported version %u\n",
- d->domain_id, hdr->version);
- return -EINVAL;
- }
-
- cpuid(1, &eax, &ebx, &ecx, &edx);
- /* CPUs ought to match but with feature-masking they might not */
- if ( (hdr->cpuid & ~0x0fUL) != (eax & ~0x0fUL) )
- printk(XENLOG_G_INFO "HVM%d restore: VM saved on one CPU "
- "(%#"PRIx32") and restored on another (%#"PRIx32").\n",
- d->domain_id, hdr->cpuid, eax);
-
- return 0;
-}
-
-static void arch_hvm_load(struct domain *d, const struct hvm_save_header *hdr)
-{
- /* Restore guest's preferred TSC frequency. */
- if ( hdr->gtsc_khz )
- d->arch.tsc_khz = hdr->gtsc_khz;
- if ( d->arch.vtsc )
- hvm_set_rdtsc_exiting(d, 1);
-
- /* Time when restore started */
- d->arch.hvm.sync_tsc = rdtsc();
-}
-
/* List of handlers for various HVM save and restore types */
static struct {
hvm_save_handler save;
@@ -101,26 +45,6 @@ void __init hvm_register_savevm(uint16_t typecode,
hvm_sr_handlers[typecode].kind = kind;
}
-size_t hvm_save_size(struct domain *d)
-{
- struct vcpu *v;
- size_t sz;
- int i;
-
- /* Basic overhead for header and footer */
- sz = (2 * sizeof (struct hvm_save_descriptor)) + HVM_SAVE_LENGTH(HEADER);
-
- /* Plus space for each thing we will be saving */
- for ( i = 0; i <= HVM_SAVE_CODE_MAX; i++ )
- if ( hvm_sr_handlers[i].kind == HVMSR_PER_VCPU )
- for_each_vcpu(d, v)
- sz += hvm_sr_handlers[i].size;
- else
- sz += hvm_sr_handlers[i].size;
-
- return sz;
-}
-
/*
* Extract a single instance of a save record, by marshalling all records of
* that type and copying out the one we need.
@@ -196,6 +120,83 @@ int hvm_save_one(struct domain *d, unsigned int typecode, unsigned int instance,
return rv;
}
+#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
+static void arch_hvm_save(struct domain *d, struct hvm_save_header *hdr)
+{
+ uint32_t eax, ebx, ecx, edx;
+
+ /* Save some CPUID bits */
+ cpuid(1, &eax, &ebx, &ecx, &edx);
+ hdr->cpuid = eax;
+
+ /* Save guest's preferred TSC. */
+ hdr->gtsc_khz = d->arch.tsc_khz;
+
+ /* Time when saving started */
+ d->arch.hvm.sync_tsc = rdtsc();
+}
+
+static int arch_hvm_check(const struct domain *d,
+ const struct hvm_save_header *hdr)
+{
+ uint32_t eax, ebx, ecx, edx;
+
+ if ( hdr->magic != HVM_FILE_MAGIC )
+ {
+ printk(XENLOG_G_ERR "HVM%d restore: bad magic number %#"PRIx32"\n",
+ d->domain_id, hdr->magic);
+ return -EINVAL;
+ }
+
+ if ( hdr->version != HVM_FILE_VERSION )
+ {
+ printk(XENLOG_G_ERR "HVM%d restore: unsupported version %u\n",
+ d->domain_id, hdr->version);
+ return -EINVAL;
+ }
+
+ cpuid(1, &eax, &ebx, &ecx, &edx);
+ /* CPUs ought to match but with feature-masking they might not */
+ if ( (hdr->cpuid & ~0x0fUL) != (eax & ~0x0fUL) )
+ printk(XENLOG_G_INFO "HVM%d restore: VM saved on one CPU "
+ "(%#"PRIx32") and restored on another (%#"PRIx32").\n",
+ d->domain_id, hdr->cpuid, eax);
+
+ return 0;
+}
+
+static void arch_hvm_load(struct domain *d, const struct hvm_save_header *hdr)
+{
+ /* Restore guest's preferred TSC frequency. */
+ if ( hdr->gtsc_khz )
+ d->arch.tsc_khz = hdr->gtsc_khz;
+ if ( d->arch.vtsc )
+ hvm_set_rdtsc_exiting(d, 1);
+
+ /* Time when restore started */
+ d->arch.hvm.sync_tsc = rdtsc();
+}
+
+size_t hvm_save_size(struct domain *d)
+{
+ struct vcpu *v;
+ size_t sz;
+ unsigned int i;
+
+ /* Basic overhead for header and footer */
+ sz = (2 * sizeof (struct hvm_save_descriptor)) + HVM_SAVE_LENGTH(HEADER);
+
+ /* Plus space for each thing we will be saving */
+ for ( i = 0; i <= HVM_SAVE_CODE_MAX; i++ )
+ if ( hvm_sr_handlers[i].kind == HVMSR_PER_VCPU )
+ for_each_vcpu(d, v)
+ sz += hvm_sr_handlers[i].size;
+ else
+ sz += hvm_sr_handlers[i].size;
+
+ return sz;
+}
+
int hvm_save(struct domain *d, hvm_domain_context_t *h)
{
char *c;
@@ -390,6 +391,7 @@ int hvm_load(struct domain *d, bool real, hvm_domain_context_t *h)
/* Not reached */
}
+#endif /* CONFIG_MGMT_HYPERCALLS || CONFIG_MEM_SHARING */
int _hvm_init_entry(struct hvm_domain_context *h, uint16_t tc, uint16_t inst,
uint32_t len)
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 1996e139a0..4394990131 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2701,6 +2701,7 @@ static int cf_check vmtrace_output_position(struct vcpu *v, uint64_t *pos)
return v->arch.hvm.vmx.ipt_active;
}
+#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
static int cf_check vmtrace_reset(struct vcpu *v)
{
if ( !v->arch.hvm.vmx.ipt_active )
@@ -2710,6 +2711,7 @@ static int cf_check vmtrace_reset(struct vcpu *v)
v->arch.msrs->rtit.status = 0;
return 0;
}
+#endif /* CONFIG_MGMT_HYPERCALLS || CONFIG_MEM_SHARING */
static uint64_t cf_check vmx_get_reg(struct vcpu *v, unsigned int reg)
{
@@ -2888,7 +2890,9 @@ static struct hvm_function_table __initdata_cf_clobber vmx_function_table = {
.vmtrace_output_position = vmtrace_output_position,
.vmtrace_set_option = vmtrace_set_option,
.vmtrace_get_option = vmtrace_get_option,
+#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
.vmtrace_reset = vmtrace_reset,
+#endif
.get_reg = vmx_get_reg,
.set_reg = vmx_set_reg,
diff --git a/xen/arch/x86/include/asm/hvm/hvm.h b/xen/arch/x86/include/asm/hvm/hvm.h
index 473cf24b83..9d6cb42d48 100644
--- a/xen/arch/x86/include/asm/hvm/hvm.h
+++ b/xen/arch/x86/include/asm/hvm/hvm.h
@@ -240,7 +240,9 @@ struct hvm_function_table {
int (*vmtrace_output_position)(struct vcpu *v, uint64_t *pos);
int (*vmtrace_set_option)(struct vcpu *v, uint64_t key, uint64_t value);
int (*vmtrace_get_option)(struct vcpu *v, uint64_t key, uint64_t *value);
+#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
int (*vmtrace_reset)(struct vcpu *v);
+#endif
uint64_t (*get_reg)(struct vcpu *v, unsigned int reg);
void (*set_reg)(struct vcpu *v, unsigned int reg, uint64_t val);
@@ -775,6 +777,7 @@ static inline int hvm_vmtrace_get_option(
return -EOPNOTSUPP;
}
+#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
static inline int hvm_vmtrace_reset(struct vcpu *v)
{
if ( hvm_funcs.vmtrace_reset )
@@ -782,6 +785,7 @@ static inline int hvm_vmtrace_reset(struct vcpu *v)
return -EOPNOTSUPP;
}
+#endif /* CONFIG_MGMT_HYPERCALLS || CONFIG_MEM_SHARING */
/*
* Accessors for registers which have per-guest-type or per-vendor locations
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 25/28] xen/domctl: avoid unreachable codes when both MGMT_HYPERCALLS and MEM_SHARING unset
2025-10-13 10:15 ` [PATCH v3 25/28] xen/domctl: avoid unreachable codes when both MGMT_HYPERCALLS and MEM_SHARING unset Penny Zheng
@ 2025-10-30 13:13 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 13:13 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> The following functions have been referenced in places which is either guarded
> with CONFIG_MGMT_HYPERCALLS or CONFIG_MEM_SHARING:
> - arch_hvm_save
> - arch_hvm_check
> - arch_hvm_load
> - hvm_save_size
> - hvm_save
> - hvm_load
> - hvm_vmtrace_reset
> So they shall be wrapped under OR relationship, otherwise they will become
> unreachable codes when MGMT_HYPERCALLS=n && MEM_SHARING=n, and hence violating
> Misra rule 2.1.
> We move arch_hvm_save(), arch_hvm_check(), arch_hvm_load() and hvm_save_size()
> nearer to the left functions, to avoid scattered #ifdef-wrapping.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
See my earlier remarks towards MEM_SHARING possibly becoming dependent upon
MGMT_HYPERCALLS, at which point things may want doing and/or describing a little
differently.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 26/28] xen/domctl: wrap arch-specific domctl-op with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (23 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 25/28] xen/domctl: avoid unreachable codes when both MGMT_HYPERCALLS and MEM_SHARING unset Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 13:24 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS Penny Zheng
` (2 subsequent siblings)
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini, Bertrand Marquis,
Volodymyr Babchuk, Tamas K Lengyel, Daniel P. Smith
Function arch_do_domctl() is responsible for arch-specific domctl-op,
and shall be wrapped with CONFIG_MGMT_HYPERCALLS
Tracking its calling chain and the following functions shall be wrapped with
CONFIG_MGMT_HYPERCALLS too. Otherwise they will all become unreachable when
MGMT_HYPERCALLS=n, and hence violating Misra Rule 2.1.
For x86:
- hvm_save_one
- hvm_acpi_power_button
- hvm_acpi_sleep_button
- hvm_debug_op
- mem_sharing_domctl
- make P2M_AUDIT depend on CONFIG_MGMT_HYPERCALLS
- make PG_log_dirty depend on CONFIG_MGMT_HYPERCALLS
- do_vmtrace_op
- hvm_vmtrace_control
- hvm_funcs.vmtrace_control
- hvm_vmtrace_get_option
- hvm_funcs.vmtrace_get_option
- hvm_vmtrace_set_option
- hvm_funcs.vmtrace_set_option
- hvm_vmtrace_output_position
- hvm_funcs.vmtrace_output_position
- paging_domctl_cont
- make policy.o/msr.o depend on CONFIG_MGMT_HYPERCALLS
For ARM:
- subarch_do_domctl
We put the guardian in Makefile for the arch-specific domctl.o compilation.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- split out xsm parts
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
- wrap default-case and arch_get_domain_info() transiently
---
v2 -> v3:
- add missing guardian in arm/Makefile
- cover RTIT_CTL{,STATUS}_MASK #define-s
- add missing guardian for .vmtrace_output_position
- guard the whole static inline function
- address "violating Misra rule 2.1" in commit message
- remove transient wrapping around default-case and arch_get_domain_info()
---
xen/Kconfig.debug | 2 +-
xen/arch/arm/Makefile | 2 +-
xen/arch/arm/arm32/Makefile | 2 +-
xen/arch/arm/arm64/Makefile | 2 +-
xen/arch/x86/Makefile | 2 +-
xen/arch/x86/hvm/hvm.c | 2 ++
xen/arch/x86/hvm/pmtimer.c | 2 ++
xen/arch/x86/hvm/vmx/vmx.c | 4 ++++
xen/arch/x86/include/asm/hvm/hvm.h | 4 ++++
xen/arch/x86/include/asm/p2m.h | 2 +-
xen/arch/x86/include/asm/paging.h | 2 +-
xen/arch/x86/mm/mem_sharing.c | 2 ++
xen/include/hypercall-defs.c | 4 ++--
xen/lib/x86/Makefile | 4 ++--
14 files changed, 25 insertions(+), 11 deletions(-)
diff --git a/xen/Kconfig.debug b/xen/Kconfig.debug
index a69615cd63..0dd44d2b10 100644
--- a/xen/Kconfig.debug
+++ b/xen/Kconfig.debug
@@ -15,7 +15,7 @@ if DEBUG || EXPERT
config GDBSX
bool "Guest debugging with gdbsx"
- depends on X86
+ depends on X86 && MGMT_HYPERCALLS
default y
help
If you want to enable support for debugging guests from dom0 via
diff --git a/xen/arch/arm/Makefile b/xen/arch/arm/Makefile
index 2aff1a1630..2f4593f5eb 100644
--- a/xen/arch/arm/Makefile
+++ b/xen/arch/arm/Makefile
@@ -20,7 +20,7 @@ obj-$(CONFIG_IOREQ_SERVER) += dm.o
obj-$(CONFIG_DOM0LESS_BOOT) += dom0less-build.init.o
obj-y += domain.o
obj-y += domain_build.init.o
-obj-y += domctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += domctl.o
obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
obj-y += efi/
obj-y += gic.o
diff --git a/xen/arch/arm/arm32/Makefile b/xen/arch/arm/arm32/Makefile
index 531168f58a..f8cbf14211 100644
--- a/xen/arch/arm/arm32/Makefile
+++ b/xen/arch/arm/arm32/Makefile
@@ -4,7 +4,7 @@ obj-$(CONFIG_MPU) += mpu/
obj-y += cache.o
obj-$(CONFIG_EARLY_PRINTK) += debug.o
-obj-y += domctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += domctl.o
obj-y += domain.o
obj-y += entry.o
obj-y += head.o
diff --git a/xen/arch/arm/arm64/Makefile b/xen/arch/arm/arm64/Makefile
index 6491c5350b..6b77a15abe 100644
--- a/xen/arch/arm/arm64/Makefile
+++ b/xen/arch/arm/arm64/Makefile
@@ -6,7 +6,7 @@ obj-y += cache.o
obj-y += cpufeature.o
obj-$(CONFIG_HARDEN_BRANCH_PREDICTOR) += bpi.o
obj-$(CONFIG_EARLY_PRINTK) += debug.o
-obj-y += domctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += domctl.o
obj-y += domain.o
obj-y += entry.o
obj-y += head.o
diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile
index 615cd101b8..7253ca32af 100644
--- a/xen/arch/x86/Makefile
+++ b/xen/arch/x86/Makefile
@@ -28,7 +28,7 @@ obj-y += delay.o
obj-y += desc.o
obj-bin-y += dmi_scan.init.o
obj-y += domain.o
-obj-y += domctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += domctl.o
obj-bin-y += dom0_build.init.o
obj-y += domain_page.o
obj-y += e820.o
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index e3dacc909b..e77b0c03ed 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -5259,6 +5259,7 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg)
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int hvm_debug_op(struct vcpu *v, int32_t op)
{
int rc = 0;
@@ -5301,6 +5302,7 @@ int hvm_debug_op(struct vcpu *v, int32_t op)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#ifdef CONFIG_VM_EVENT
void hvm_toggle_singlestep(struct vcpu *v)
diff --git a/xen/arch/x86/hvm/pmtimer.c b/xen/arch/x86/hvm/pmtimer.c
index 87a7a01c9f..f080f7561d 100644
--- a/xen/arch/x86/hvm/pmtimer.c
+++ b/xen/arch/x86/hvm/pmtimer.c
@@ -56,6 +56,7 @@ static void pmt_update_sci(PMTState *s)
hvm_isa_irq_deassert(s->vcpu->domain, SCI_IRQ);
}
+#ifdef CONFIG_MGMT_HYPERCALLS
void hvm_acpi_power_button(struct domain *d)
{
PMTState *s = &d->arch.hvm.pl_time->vpmt;
@@ -81,6 +82,7 @@ void hvm_acpi_sleep_button(struct domain *d)
pmt_update_sci(s);
spin_unlock(&s->lock);
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
/* Set the correct value in the timer, accounting for time elapsed
* since the last time we did that. */
diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 4394990131..5c2e8a8d92 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2568,6 +2568,7 @@ static bool cf_check vmx_get_pending_event(
return true;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
/*
* We only let vmtrace agents see and modify a subset of bits in MSR_RTIT_CTL.
* These all pertain to data-emitted into the trace buffer(s). Must not
@@ -2700,6 +2701,7 @@ static int cf_check vmtrace_output_position(struct vcpu *v, uint64_t *pos)
*pos = v->arch.msrs->rtit.output_offset;
return v->arch.hvm.vmx.ipt_active;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
static int cf_check vmtrace_reset(struct vcpu *v)
@@ -2886,10 +2888,12 @@ static struct hvm_function_table __initdata_cf_clobber vmx_function_table = {
.altp2m_vcpu_emulate_ve = vmx_vcpu_emulate_ve,
.altp2m_vcpu_emulate_vmfunc = vmx_vcpu_emulate_vmfunc,
#endif
+#ifdef CONFIG_MGMT_HYPERCALLS
.vmtrace_control = vmtrace_control,
.vmtrace_output_position = vmtrace_output_position,
.vmtrace_set_option = vmtrace_set_option,
.vmtrace_get_option = vmtrace_get_option,
+#endif
#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
.vmtrace_reset = vmtrace_reset,
#endif
diff --git a/xen/arch/x86/include/asm/hvm/hvm.h b/xen/arch/x86/include/asm/hvm/hvm.h
index 9d6cb42d48..a88c69e3ff 100644
--- a/xen/arch/x86/include/asm/hvm/hvm.h
+++ b/xen/arch/x86/include/asm/hvm/hvm.h
@@ -236,10 +236,12 @@ struct hvm_function_table {
#endif
/* vmtrace */
+#ifdef CONFIG_MGMT_HYPERCALLS
int (*vmtrace_control)(struct vcpu *v, bool enable, bool reset);
int (*vmtrace_output_position)(struct vcpu *v, uint64_t *pos);
int (*vmtrace_set_option)(struct vcpu *v, uint64_t key, uint64_t value);
int (*vmtrace_get_option)(struct vcpu *v, uint64_t key, uint64_t *value);
+#endif
#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
int (*vmtrace_reset)(struct vcpu *v);
#endif
@@ -742,6 +744,7 @@ static inline bool altp2m_vcpu_emulate_ve(struct vcpu *v)
bool altp2m_vcpu_emulate_ve(struct vcpu *v);
#endif /* CONFIG_ALTP2M */
+#ifdef CONFIG_MGMT_HYPERCALLS
static inline int hvm_vmtrace_control(struct vcpu *v, bool enable, bool reset)
{
if ( hvm_funcs.vmtrace_control )
@@ -776,6 +779,7 @@ static inline int hvm_vmtrace_get_option(
return -EOPNOTSUPP;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
#if defined(CONFIG_MGMT_HYPERCALLS) || defined(CONFIG_MEM_SHARING)
static inline int hvm_vmtrace_reset(struct vcpu *v)
diff --git a/xen/arch/x86/include/asm/p2m.h b/xen/arch/x86/include/asm/p2m.h
index 9016e88411..3574e2eecd 100644
--- a/xen/arch/x86/include/asm/p2m.h
+++ b/xen/arch/x86/include/asm/p2m.h
@@ -20,7 +20,7 @@
#include <asm/page.h> /* for pagetable_t */
/* Debugging and auditing of the P2M code? */
-#if !defined(NDEBUG) && defined(CONFIG_HVM)
+#if !defined(NDEBUG) && defined(CONFIG_HVM) && defined(CONFIG_MGMT_HYPERCALLS)
#define P2M_AUDIT 1
#else
#define P2M_AUDIT 0
diff --git a/xen/arch/x86/include/asm/paging.h b/xen/arch/x86/include/asm/paging.h
index 1b0694bb36..db3e5b8f31 100644
--- a/xen/arch/x86/include/asm/paging.h
+++ b/xen/arch/x86/include/asm/paging.h
@@ -55,7 +55,7 @@
#define PG_translate 0
#define PG_external 0
#endif
-#ifdef CONFIG_PAGING
+#if defined(CONFIG_PAGING) && defined(CONFIG_MGMT_HYPERCALLS)
/* Enable log dirty mode */
#define PG_log_dirty (XEN_DOMCTL_SHADOW_ENABLE_LOG_DIRTY << PG_mode_shift)
#else
diff --git a/xen/arch/x86/mm/mem_sharing.c b/xen/arch/x86/mm/mem_sharing.c
index af7b7f2538..6113a271dc 100644
--- a/xen/arch/x86/mm/mem_sharing.c
+++ b/xen/arch/x86/mm/mem_sharing.c
@@ -2322,6 +2322,7 @@ out:
return rc;
}
+#ifdef CONFIG_MGMT_HYPERCALLS
int mem_sharing_domctl(struct domain *d, struct xen_domctl_mem_sharing_op *mec)
{
int rc;
@@ -2339,6 +2340,7 @@ int mem_sharing_domctl(struct domain *d, struct xen_domctl_mem_sharing_op *mec)
return rc;
}
+#endif /* CONFIG_MGMT_HYPERCALLS */
void arch_dump_shared_mem_info(void)
{
diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c
index cd2c801af6..02d7b93e80 100644
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -197,7 +197,7 @@ dm_op(domid_t domid, unsigned int nr_bufs, xen_dm_op_buf_t *bufs)
#ifdef CONFIG_MGMT_HYPERCALLS
sysctl(xen_sysctl_t *u_sysctl)
#endif
-#if defined(CONFIG_X86) && defined(CONFIG_PAGING)
+#if defined(CONFIG_X86) && defined(CONFIG_PAGING) && defined(CONFIG_MGMT_HYPERCALLS)
paging_domctl_cont(xen_domctl_t *u_domctl)
#endif
domctl(xen_domctl_t *u_domctl)
@@ -296,7 +296,7 @@ dm_op compat do compat do do
hypfs_op do do do do do
#endif
mca do do - - -
-#if defined(CONFIG_X86) && defined(CONFIG_PAGING)
+#if defined(CONFIG_X86) && defined(CONFIG_PAGING) && defined(CONFIG_MGMT_HYPERCALLS)
paging_domctl_cont do do do do -
#endif
diff --git a/xen/lib/x86/Makefile b/xen/lib/x86/Makefile
index 780ea05db1..89fb4bba27 100644
--- a/xen/lib/x86/Makefile
+++ b/xen/lib/x86/Makefile
@@ -1,3 +1,3 @@
obj-y += cpuid.o
-obj-y += msr.o
-obj-y += policy.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += msr.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += policy.o
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 26/28] xen/domctl: wrap arch-specific domctl-op with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 26/28] xen/domctl: wrap arch-specific domctl-op with CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-30 13:24 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 13:24 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, Bertrand Marquis, Volodymyr Babchuk,
Tamas K Lengyel, Daniel P. Smith, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Function arch_do_domctl() is responsible for arch-specific domctl-op,
> and shall be wrapped with CONFIG_MGMT_HYPERCALLS
> Tracking its calling chain and the following functions shall be wrapped with
> CONFIG_MGMT_HYPERCALLS too. Otherwise they will all become unreachable when
> MGMT_HYPERCALLS=n, and hence violating Misra Rule 2.1.
> For x86:
> - hvm_save_one
> - hvm_acpi_power_button
> - hvm_acpi_sleep_button
> - hvm_debug_op
> - mem_sharing_domctl
> - make P2M_AUDIT depend on CONFIG_MGMT_HYPERCALLS
> - make PG_log_dirty depend on CONFIG_MGMT_HYPERCALLS
> - do_vmtrace_op
> - hvm_vmtrace_control
> - hvm_funcs.vmtrace_control
> - hvm_vmtrace_get_option
> - hvm_funcs.vmtrace_get_option
> - hvm_vmtrace_set_option
> - hvm_funcs.vmtrace_set_option
> - hvm_vmtrace_output_position
> - hvm_funcs.vmtrace_output_position
> - paging_domctl_cont
> - make policy.o/msr.o depend on CONFIG_MGMT_HYPERCALLS
> For ARM:
> - subarch_do_domctl
> We put the guardian in Makefile for the arch-specific domctl.o compilation.
>
> Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
> ---
> v1 -> v2:
> - split out xsm parts
> - adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
> - wrap default-case and arch_get_domain_info() transiently
> ---
> v2 -> v3:
> - add missing guardian in arm/Makefile
> - cover RTIT_CTL{,STATUS}_MASK #define-s
> - add missing guardian for .vmtrace_output_position
> - guard the whole static inline function
> - address "violating Misra rule 2.1" in commit message
> - remove transient wrapping around default-case and arch_get_domain_info()
> ---
> xen/Kconfig.debug | 2 +-
> xen/arch/arm/Makefile | 2 +-
> xen/arch/arm/arm32/Makefile | 2 +-
> xen/arch/arm/arm64/Makefile | 2 +-
> xen/arch/x86/Makefile | 2 +-
> xen/arch/x86/hvm/hvm.c | 2 ++
> xen/arch/x86/hvm/pmtimer.c | 2 ++
> xen/arch/x86/hvm/vmx/vmx.c | 4 ++++
> xen/arch/x86/include/asm/hvm/hvm.h | 4 ++++
> xen/arch/x86/include/asm/p2m.h | 2 +-
> xen/arch/x86/include/asm/paging.h | 2 +-
> xen/arch/x86/mm/mem_sharing.c | 2 ++
> xen/include/hypercall-defs.c | 4 ++--
> xen/lib/x86/Makefile | 4 ++--
> 14 files changed, 25 insertions(+), 11 deletions(-)
This again might better be split, perhaps (at least) into an Arm and an x86 patch.
Possibly the do_vmtrace_op() set of changes could also be a separate patch.
> --- a/xen/Kconfig.debug
> +++ b/xen/Kconfig.debug
> @@ -15,7 +15,7 @@ if DEBUG || EXPERT
>
> config GDBSX
> bool "Guest debugging with gdbsx"
> - depends on X86
> + depends on X86 && MGMT_HYPERCALLS
Likely better
depends on MGMT_HYPERCALLS
depends on X86
such that when (if ever) another arch is to be added, a simpler modification will
do.
> --- a/xen/arch/x86/mm/mem_sharing.c
> +++ b/xen/arch/x86/mm/mem_sharing.c
> @@ -2322,6 +2322,7 @@ out:
> return rc;
> }
>
> +#ifdef CONFIG_MGMT_HYPERCALLS
> int mem_sharing_domctl(struct domain *d, struct xen_domctl_mem_sharing_op *mec)
> {
> int rc;
> @@ -2339,6 +2340,7 @@ int mem_sharing_domctl(struct domain *d, struct xen_domctl_mem_sharing_op *mec)
>
> return rc;
> }
> +#endif /* CONFIG_MGMT_HYPERCALLS */
See again my MEM_SHARING related remark.
> --- a/xen/lib/x86/Makefile
> +++ b/xen/lib/x86/Makefile
> @@ -1,3 +1,3 @@
> obj-y += cpuid.o
> -obj-y += msr.o
> -obj-y += policy.o
> +obj-$(CONFIG_MGMT_HYPERCALLS) += msr.o
> +obj-$(CONFIG_MGMT_HYPERCALLS) += policy.o
What about e.g. x86_cpuid_copy_{to,from}_buffer(), living in cpuid.o?
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (24 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 26/28] xen/domctl: wrap arch-specific domctl-op with CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 13:34 ` Jan Beulich
2025-10-13 10:15 ` [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS Penny Zheng
[not found] ` <20251013101540.3502842-9-Penny.Zheng@amd.com>
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Jan Beulich,
Andrew Cooper, Roger Pau Monné
Helper domctl_lock_{acquire,release} is domctl_lock, which HVM_PARAM_IDENT_PT
uses to ensure synchronization and hence being a toolstack-only operation.
So we shall make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS,
returning -EOPNOTSUPP when MGMT_HYPERCALLS=n.
Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v2 -> v3:
- new commit
---
xen/arch/x86/hvm/hvm.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index e77b0c03ed..e7d630af95 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -4281,7 +4281,6 @@ static int hvm_allow_set_param(struct domain *d,
static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
{
struct domain *curr_d = current->domain;
- struct vcpu *v;
int rc;
rc = hvm_allow_set_param(d, index, value);
@@ -4307,6 +4306,10 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
rc = -EINVAL;
break;
case HVM_PARAM_IDENT_PT:
+ {
+#ifdef CONFIG_MGMT_HYPERCALLS
+ struct vcpu *v;
+
/*
* Only actually required for VT-x lacking unrestricted_guest
* capabilities. Short circuit the pause if possible.
@@ -4334,7 +4337,11 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
domain_unpause(d);
domctl_lock_release();
+#else
+ rc = -EOPNOTSUPP;
+#endif /* CONFIG_MGMT_HYPERCALLS */
break;
+ }
case HVM_PARAM_DM_DOMAIN:
/* The only value this should ever be set to is DOMID_SELF */
if ( value != DOMID_SELF )
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-30 13:34 ` Jan Beulich
2025-11-18 6:45 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 13:34 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> Helper domctl_lock_{acquire,release} is domctl_lock, which HVM_PARAM_IDENT_PT
> uses to ensure synchronization and hence being a toolstack-only operation.
> So we shall make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS,
> returning -EOPNOTSUPP when MGMT_HYPERCALLS=n.
>
> Suggested-by: Jan Beulich <jbeulich@suse.com>
I fear this isn't quite what I suggested. The param get/set are XSM_TARGET, i.e.
can be used by DM as well. The particular one here shouldn't be used by a DM, but
that's a different question. Similarly in principle the PVH Dom0 building code
should be able to use this path; it doesn't right now in favor of some open-
coding.
What iirc I did suggest was that the serialization isn't needed when no domctl can
be used to otherwise alter (relevant) guest state.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* RE: [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS
2025-10-30 13:34 ` Jan Beulich
@ 2025-11-18 6:45 ` Penny, Zheng
2025-11-18 7:12 ` Jan Beulich
0 siblings, 1 reply; 68+ messages in thread
From: Penny, Zheng @ 2025-11-18 6:45 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Roger Pau Monné, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Thursday, October 30, 2025 9:35 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Roger Pau Monné <roger.pau@citrix.com>;
> xen-devel@lists.xenproject.org
> Subject: Re: [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT
> conditional upon CONFIG_MGMT_HYPERCALLS
>
> On 13.10.2025 12:15, Penny Zheng wrote:
> > Helper domctl_lock_{acquire,release} is domctl_lock, which
> > HVM_PARAM_IDENT_PT uses to ensure synchronization and hence being a
> toolstack-only operation.
> > So we shall make HVM_PARAM_IDENT_PT conditional upon
> > CONFIG_MGMT_HYPERCALLS, returning -EOPNOTSUPP when
> MGMT_HYPERCALLS=n.
> >
> > Suggested-by: Jan Beulich <jbeulich@suse.com>
>
> I fear this isn't quite what I suggested. The param get/set are XSM_TARGET, i.e.
> can be used by DM as well. The particular one here shouldn't be used by a DM, but
> that's a different question. Similarly in principle the PVH Dom0 building code should
> be able to use this path; it doesn't right now in favor of some open- coding.
>
> What iirc I did suggest was that the serialization isn't needed when no domctl can
> be used to otherwise alter (relevant) guest state.
Ah, true, serialization isn't needed when MGMT_HYPERCALLS=n, as no domctl-op could alter the guest state at the same time.
Then maybe adding IS_ENABLED() checking is enough:
```
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 5a50721bd0..4e1b3ee5f4 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -4324,7 +4324,7 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
* the domctl_lock.
*/
rc = -ERESTART;
- if ( !domctl_lock_acquire() )
+ if ( IS_ENABLED(CONFIG_MGMT_HYPERCALLS) && !domctl_lock_acquire() )
break;
rc = 0;
@@ -4334,7 +4334,8 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
paging_update_cr3(v, false);
domain_unpause(d);
- domctl_lock_release();
+ if ( IS_ENABLED(CONFIG_MGMT_HYPERCALLS) )
+ domctl_lock_release();
break;
case HVM_PARAM_DM_DOMAIN:
/* The only value this should ever be set to is DOMID_SELF */
```
>
> Jan
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS
2025-11-18 6:45 ` Penny, Zheng
@ 2025-11-18 7:12 ` Jan Beulich
0 siblings, 0 replies; 68+ messages in thread
From: Jan Beulich @ 2025-11-18 7:12 UTC (permalink / raw)
To: Penny, Zheng
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Roger Pau Monné, xen-devel@lists.xenproject.org
On 18.11.2025 07:45, Penny, Zheng wrote:
> [Public]
>
>> -----Original Message-----
>> From: Jan Beulich <jbeulich@suse.com>
>> Sent: Thursday, October 30, 2025 9:35 PM
>> To: Penny, Zheng <penny.zheng@amd.com>
>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
>> Cooper <andrew.cooper3@citrix.com>; Roger Pau Monné <roger.pau@citrix.com>;
>> xen-devel@lists.xenproject.org
>> Subject: Re: [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT
>> conditional upon CONFIG_MGMT_HYPERCALLS
>>
>> On 13.10.2025 12:15, Penny Zheng wrote:
>>> Helper domctl_lock_{acquire,release} is domctl_lock, which
>>> HVM_PARAM_IDENT_PT uses to ensure synchronization and hence being a
>> toolstack-only operation.
>>> So we shall make HVM_PARAM_IDENT_PT conditional upon
>>> CONFIG_MGMT_HYPERCALLS, returning -EOPNOTSUPP when
>> MGMT_HYPERCALLS=n.
>>>
>>> Suggested-by: Jan Beulich <jbeulich@suse.com>
>>
>> I fear this isn't quite what I suggested. The param get/set are XSM_TARGET, i.e.
>> can be used by DM as well. The particular one here shouldn't be used by a DM, but
>> that's a different question. Similarly in principle the PVH Dom0 building code should
>> be able to use this path; it doesn't right now in favor of some open- coding.
>>
>> What iirc I did suggest was that the serialization isn't needed when no domctl can
>> be used to otherwise alter (relevant) guest state.
>
> Ah, true, serialization isn't needed when MGMT_HYPERCALLS=n, as no domctl-op could alter the guest state at the same time.
> Then maybe adding IS_ENABLED() checking is enough:
Yes, that or indeed introducing stubs. Which one is the lesser evil I'm having
a hard time determining. Hence I'd suggest that you go with the below, unless
someone else chimes in.
Jan
> ```
> diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
> index 5a50721bd0..4e1b3ee5f4 100644
> --- a/xen/arch/x86/hvm/hvm.c
> +++ b/xen/arch/x86/hvm/hvm.c
> @@ -4324,7 +4324,7 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
> * the domctl_lock.
> */
> rc = -ERESTART;
> - if ( !domctl_lock_acquire() )
> + if ( IS_ENABLED(CONFIG_MGMT_HYPERCALLS) && !domctl_lock_acquire() )
> break;
>
> rc = 0;
> @@ -4334,7 +4334,8 @@ static int hvm_set_param(struct domain *d, uint32_t index, uint64_t value)
> paging_update_cr3(v, false);
> domain_unpause(d);
>
> - domctl_lock_release();
> + if ( IS_ENABLED(CONFIG_MGMT_HYPERCALLS) )
> + domctl_lock_release();
> break;
> case HVM_PARAM_DM_DOMAIN:
> /* The only value this should ever be set to is DOMID_SELF */
> ```
>
>>
>> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 [PATCH v3 00/28] Disable domctl-op via CONFIG_MGMT_HYPERCALLS Penny Zheng
` (25 preceding siblings ...)
2025-10-13 10:15 ` [PATCH v3 27/28] xen/domctl: make HVM_PARAM_IDENT_PT conditional upon CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-13 10:15 ` Penny Zheng
2025-10-30 13:40 ` Jan Beulich
[not found] ` <20251013101540.3502842-9-Penny.Zheng@amd.com>
27 siblings, 1 reply; 68+ messages in thread
From: Penny Zheng @ 2025-10-13 10:15 UTC (permalink / raw)
To: xen-devel
Cc: ray.huang, oleksii.kurochko, Penny Zheng, Andrew Cooper,
Anthony PERARD, Michal Orzel, Jan Beulich, Julien Grall,
Roger Pau Monné, Stefano Stabellini
Wrap domctl hypercall def and domctl.o with CONFIG_MGMT_HYPERCALLS.
Signed-off-by: Penny Zheng <Penny.Zheng@amd.com>
---
v1 -> v2:
- remove stub in common/domctl.c
- combine the original commit of "xen/domctl: provide stub for
domctl_lock_{acquire,release}"
- adapt to changes of "unify DOMCTL to MGMT_HYPERCALLS"
---
v2 -> v3:
- add pitfall warnning in Kconfig help
---
xen/common/Kconfig | 6 ++++--
xen/common/Makefile | 2 +-
xen/include/hypercall-defs.c | 4 ++--
3 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 309d262386..efbe97c54a 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
If unsure, say N.
config MGMT_HYPERCALLS
- def_bool y
+ bool "Enable privileged hypercalls for system management"
help
This option shall only be disabled on some dom0less systems, or
PV shim on x86, to reduce Xen footprint via managing unnessary
- hypercalls, like sysctl, etc.
+ hypercalls, like sysctl, domctl, etc.
+ Be cautious to disable it, as users will face missing a few basic
+ hypercalls like listdomains, getdomaininfo, etc.
config PM_OP
bool "Enable Performance Management Operation"
diff --git a/xen/common/Makefile b/xen/common/Makefile
index fdf826f218..45c0bda000 100644
--- a/xen/common/Makefile
+++ b/xen/common/Makefile
@@ -11,7 +11,7 @@ obj-$(filter-out $(CONFIG_X86),$(CONFIG_ACPI)) += device.o
obj-$(CONFIG_DEVICE_TREE_PARSE) += device-tree/
obj-$(CONFIG_IOREQ_SERVER) += dm.o
obj-y += domain.o
-obj-y += domctl.o
+obj-$(CONFIG_MGMT_HYPERCALLS) += domctl.o
obj-y += domid.o
obj-y += event_2l.o
obj-y += event_channel.o
diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c
index 02d7b93e80..c243edc460 100644
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -196,11 +196,11 @@ dm_op(domid_t domid, unsigned int nr_bufs, xen_dm_op_buf_t *bufs)
#endif
#ifdef CONFIG_MGMT_HYPERCALLS
sysctl(xen_sysctl_t *u_sysctl)
+domctl(xen_domctl_t *u_domctl)
#endif
#if defined(CONFIG_X86) && defined(CONFIG_PAGING) && defined(CONFIG_MGMT_HYPERCALLS)
paging_domctl_cont(xen_domctl_t *u_domctl)
#endif
-domctl(xen_domctl_t *u_domctl)
#ifndef CONFIG_PV_SHIM_EXCLUSIVE
platform_op(xen_platform_op_t *u_xenpf_op)
#endif
@@ -279,8 +279,8 @@ hvm_op do do do do do
#endif
#ifdef CONFIG_MGMT_HYPERCALLS
sysctl do do do do do
-#endif
domctl do do do do do
+#endif
#ifdef CONFIG_KEXEC
kexec_op compat do - - -
#endif
--
2.34.1
^ permalink raw reply related [flat|nested] 68+ messages in thread* Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-10-13 10:15 ` [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS Penny Zheng
@ 2025-10-30 13:40 ` Jan Beulich
2025-11-18 6:43 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-10-30 13:40 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Anthony PERARD,
Michal Orzel, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
> If unsure, say N.
>
> config MGMT_HYPERCALLS
> - def_bool y
> + bool "Enable privileged hypercalls for system management"
> help
> This option shall only be disabled on some dom0less systems, or
> PV shim on x86, to reduce Xen footprint via managing unnessary
> - hypercalls, like sysctl, etc.
> + hypercalls, like sysctl, domctl, etc.
> + Be cautious to disable it, as users will face missing a few basic
> + hypercalls like listdomains, getdomaininfo, etc.
This is still too little, imo. For one I'm not sure "users" is quite the right
term. I'd say it's more "admins". And then, as mentioned, there are a few
domctl-s which are usable by DMs. Aiui device pass-through may also be impacted,
which imo will want mentioning here as well. Or else, if there is an implication
that DMs aren't to be used when MGMT_HYPERCALLS=n, that is what would want
calling out.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* RE: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-10-30 13:40 ` Jan Beulich
@ 2025-11-18 6:43 ` Penny, Zheng
2025-11-18 7:14 ` Jan Beulich
0 siblings, 1 reply; 68+ messages in thread
From: Penny, Zheng @ 2025-11-18 6:43 UTC (permalink / raw)
To: Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Thursday, October 30, 2025 9:40 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Julien
> Grall <julien@xen.org>; Roger Pau Monné <roger.pau@citrix.com>; Stefano
> Stabellini <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> CONFIG_MGMT_HYPERCALLS
>
> On 13.10.2025 12:15, Penny Zheng wrote:
> > --- a/xen/common/Kconfig
> > +++ b/xen/common/Kconfig
> > @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
> > If unsure, say N.
> >
> > config MGMT_HYPERCALLS
> > - def_bool y
> > + bool "Enable privileged hypercalls for system management"
> > help
> > This option shall only be disabled on some dom0less systems, or
> > PV shim on x86, to reduce Xen footprint via managing unnessary
> > - hypercalls, like sysctl, etc.
> > + hypercalls, like sysctl, domctl, etc.
> > + Be cautious to disable it, as users will face missing a few basic
> > + hypercalls like listdomains, getdomaininfo, etc.
>
> This is still too little, imo. For one I'm not sure "users" is quite the right term. I'd say
> it's more "admins". And then, as mentioned, there are a few domctl-s which are
> usable by DMs. Aiui device pass-through may also be impacted, which imo will
> want mentioning here as well. Or else, if there is an implication that DMs aren't to
> be used when MGMT_HYPERCALLS=n, that is what would want calling out.
>
How about
"
Be cautious to disable it, as admins will face missing a few basic
hypercalls like listdomains, getdomaininfo, etc, hence leading to
have an impact on xl-device-passthrough and restricted DM.
"
Another question on PV_SHIM_EXCLUSIVE:
After Stefano's " 6c80f0dd1bb xen: fix randconfig build problems after introducing SYSCTL " reversion patch, and to avoid incurring randconfig failures till the last, maybe I shall combine all PV_SHIM_EXCLUSIVE-related changes into a new commit and put it in the last, after making MGMT_HYPERCALLS optional again?
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-11-18 6:43 ` Penny, Zheng
@ 2025-11-18 7:14 ` Jan Beulich
2025-11-18 7:51 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-11-18 7:14 UTC (permalink / raw)
To: Penny, Zheng
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel@lists.xenproject.org
On 18.11.2025 07:43, Penny, Zheng wrote:
> [Public]
>
>> -----Original Message-----
>> From: Jan Beulich <jbeulich@suse.com>
>> Sent: Thursday, October 30, 2025 9:40 PM
>> To: Penny, Zheng <penny.zheng@amd.com>
>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
>> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
>> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Julien
>> Grall <julien@xen.org>; Roger Pau Monné <roger.pau@citrix.com>; Stefano
>> Stabellini <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
>> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
>> CONFIG_MGMT_HYPERCALLS
>>
>> On 13.10.2025 12:15, Penny Zheng wrote:
>>> --- a/xen/common/Kconfig
>>> +++ b/xen/common/Kconfig
>>> @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
>>> If unsure, say N.
>>>
>>> config MGMT_HYPERCALLS
>>> - def_bool y
>>> + bool "Enable privileged hypercalls for system management"
>>> help
>>> This option shall only be disabled on some dom0less systems, or
>>> PV shim on x86, to reduce Xen footprint via managing unnessary
>>> - hypercalls, like sysctl, etc.
>>> + hypercalls, like sysctl, domctl, etc.
>>> + Be cautious to disable it, as users will face missing a few basic
>>> + hypercalls like listdomains, getdomaininfo, etc.
>>
>> This is still too little, imo. For one I'm not sure "users" is quite the right term. I'd say
>> it's more "admins". And then, as mentioned, there are a few domctl-s which are
>> usable by DMs. Aiui device pass-through may also be impacted, which imo will
>> want mentioning here as well. Or else, if there is an implication that DMs aren't to
>> be used when MGMT_HYPERCALLS=n, that is what would want calling out.
>
> How about
> "
> Be cautious to disable it, as admins will face missing a few basic
> hypercalls like listdomains, getdomaininfo, etc, hence leading to
> have an impact on xl-device-passthrough and restricted DM.
> "
Much better. However, why "xl-" and why "restricted"? Neither aspect matters
here, unless I overlook something.
> Another question on PV_SHIM_EXCLUSIVE:
> After Stefano's " 6c80f0dd1bb xen: fix randconfig build problems after introducing SYSCTL " reversion patch, and to avoid incurring randconfig failures till the last, maybe I shall combine all PV_SHIM_EXCLUSIVE-related changes into a new commit and put it in the last, after making MGMT_HYPERCALLS optional again?
Whatever works best.
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* RE: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-11-18 7:14 ` Jan Beulich
@ 2025-11-18 7:51 ` Penny, Zheng
2025-11-18 19:29 ` Jason Andryuk
0 siblings, 1 reply; 68+ messages in thread
From: Penny, Zheng @ 2025-11-18 7:51 UTC (permalink / raw)
To: Jan Beulich, Andryuk, Jason
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jan Beulich <jbeulich@suse.com>
> Sent: Tuesday, November 18, 2025 3:14 PM
> To: Penny, Zheng <penny.zheng@amd.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Julien
> Grall <julien@xen.org>; Roger Pau Monné <roger.pau@citrix.com>; Stefano
> Stabellini <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> CONFIG_MGMT_HYPERCALLS
>
> On 18.11.2025 07:43, Penny, Zheng wrote:
> > [Public]
> >
> >> -----Original Message-----
> >> From: Jan Beulich <jbeulich@suse.com>
> >> Sent: Thursday, October 30, 2025 9:40 PM
> >> To: Penny, Zheng <penny.zheng@amd.com>
> >> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com;
> >> Andrew Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> >> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>;
> >> Julien Grall <julien@xen.org>; Roger Pau Monné
> >> <roger.pau@citrix.com>; Stefano Stabellini <sstabellini@kernel.org>;
> >> xen-devel@lists.xenproject.org
> >> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> >> CONFIG_MGMT_HYPERCALLS
> >>
> >> On 13.10.2025 12:15, Penny Zheng wrote:
> >>> --- a/xen/common/Kconfig
> >>> +++ b/xen/common/Kconfig
> >>> @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
> >>> If unsure, say N.
> >>>
> >>> config MGMT_HYPERCALLS
> >>> - def_bool y
> >>> + bool "Enable privileged hypercalls for system management"
> >>> help
> >>> This option shall only be disabled on some dom0less systems, or
> >>> PV shim on x86, to reduce Xen footprint via managing unnessary
> >>> - hypercalls, like sysctl, etc.
> >>> + hypercalls, like sysctl, domctl, etc.
> >>> + Be cautious to disable it, as users will face missing a few basic
> >>> + hypercalls like listdomains, getdomaininfo, etc.
> >>
> >> This is still too little, imo. For one I'm not sure "users" is quite
> >> the right term. I'd say it's more "admins". And then, as mentioned,
> >> there are a few domctl-s which are usable by DMs. Aiui device
> >> pass-through may also be impacted, which imo will want mentioning
> >> here as well. Or else, if there is an implication that DMs aren't to be used when
> MGMT_HYPERCALLS=n, that is what would want calling out.
> >
> > How about
> > "
> > Be cautious to disable it, as admins will face missing a few basic
> > hypercalls like listdomains, getdomaininfo, etc, hence leading to
> > have an impact on xl-device-passthrough and restricted DM.
> > "
>
> Much better. However, why "xl-" and why "restricted"? Neither aspect matters here,
> unless I overlook something.
>
Later, in hyperlaunch scenario, device passthrough is still needed, but it's not current device passthrough mode, which depends on xl-tool-stack to de-assign it from hardware domain and re-assign it to guest. It will be limited in boot-up stage, and configured via device tree only. FWIU, we may reuse VPCI framework, but commands like "xl assign/deassign xxx" will not be needed anymore. PLZ correct me if understand wrongly, @Andryuk, Jason
And DM, like QEMU, is still applicable, but only supports a new machine type, "pvh".
If it is too much details and only brings confusion, I'll delete and refine it to " have an impact on device-passthrough and DM "
> > Another question on PV_SHIM_EXCLUSIVE:
> > After Stefano's " 6c80f0dd1bb xen: fix randconfig build problems after introducing
> SYSCTL " reversion patch, and to avoid incurring randconfig failures till the last,
> maybe I shall combine all PV_SHIM_EXCLUSIVE-related changes into a new
> commit and put it in the last, after making MGMT_HYPERCALLS optional again?
>
> Whatever works best.
>
> Jan
^ permalink raw reply [flat|nested] 68+ messages in thread
* Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-11-18 7:51 ` Penny, Zheng
@ 2025-11-18 19:29 ` Jason Andryuk
2025-11-20 4:09 ` Penny, Zheng
0 siblings, 1 reply; 68+ messages in thread
From: Jason Andryuk @ 2025-11-18 19:29 UTC (permalink / raw)
To: Penny, Zheng, Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel@lists.xenproject.org
On 2025-11-18 02:51, Penny, Zheng wrote:
> [Public]
>
>> -----Original Message-----
>> From: Jan Beulich <jbeulich@suse.com>
>> Sent: Tuesday, November 18, 2025 3:14 PM
>> To: Penny, Zheng <penny.zheng@amd.com>
>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
>> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
>> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Julien
>> Grall <julien@xen.org>; Roger Pau Monné <roger.pau@citrix.com>; Stefano
>> Stabellini <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
>> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
>> CONFIG_MGMT_HYPERCALLS
>>
>> On 18.11.2025 07:43, Penny, Zheng wrote:
>>> [Public]
>>>
>>>> -----Original Message-----
>>>> From: Jan Beulich <jbeulich@suse.com>
>>>> Sent: Thursday, October 30, 2025 9:40 PM
>>>> To: Penny, Zheng <penny.zheng@amd.com>
>>>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com;
>>>> Andrew Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
>>>> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>;
>>>> Julien Grall <julien@xen.org>; Roger Pau Monné
>>>> <roger.pau@citrix.com>; Stefano Stabellini <sstabellini@kernel.org>;
>>>> xen-devel@lists.xenproject.org
>>>> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
>>>> CONFIG_MGMT_HYPERCALLS
>>>>
>>>> On 13.10.2025 12:15, Penny Zheng wrote:
>>>>> --- a/xen/common/Kconfig
>>>>> +++ b/xen/common/Kconfig
>>>>> @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
>>>>> If unsure, say N.
>>>>>
>>>>> config MGMT_HYPERCALLS
>>>>> - def_bool y
>>>>> + bool "Enable privileged hypercalls for system management"
>>>>> help
>>>>> This option shall only be disabled on some dom0less systems, or
>>>>> PV shim on x86, to reduce Xen footprint via managing unnessary
"unnecessary"
>>>>> - hypercalls, like sysctl, etc.
>>>>> + hypercalls, like sysctl, domctl, etc.
>>>>> + Be cautious to disable it, as users will face missing a few basic
>>>>> + hypercalls like listdomains, getdomaininfo, etc.
>>>>
>>>> This is still too little, imo. For one I'm not sure "users" is quite
>>>> the right term. I'd say it's more "admins". And then, as mentioned,
>>>> there are a few domctl-s which are usable by DMs. Aiui device
>>>> pass-through may also be impacted, which imo will want mentioning
>>>> here as well. Or else, if there is an implication that DMs aren't to be used when
>> MGMT_HYPERCALLS=n, that is what would want calling out.
>>>
>>> How about
>>> "
>>> Be cautious to disable it, as admins will face missing a few basic
>>> hypercalls like listdomains, getdomaininfo, etc, hence leading to
>>> have an impact on xl-device-passthrough and restricted DM.
>>> "
>>
>> Much better. However, why "xl-" and why "restricted"? Neither aspect matters here,
>> unless I overlook something.
>>
>
> Later, in hyperlaunch scenario, device passthrough is still needed, but it's not current device passthrough mode, which depends on xl-tool-stack to de-assign it from hardware domain and re-assign it to guest. It will be limited in boot-up stage, and configured via device tree only. FWIU, we may reuse VPCI framework, but commands like "xl assign/deassign xxx" will not be needed anymore. PLZ correct me if understand wrongly, @Andryuk, Jason
Yes, this is correct.
>
> And DM, like QEMU, is still applicable, but only supports a new machine type, "pvh".
vPCI is used to assign the PCI devices to a PVH domain during boot.
QEMU is present and provides virtio devices, but it does not play a role
in PCI passthrough. So far we've used independent PCI segments for vPCI
and QEMU/virtio.
Anyway, maybe something like this for the help text:
"""
Management hypercalls provide the means for dom0 to manage the overall
Xen system and other domains. This includes the hypercalls needed to
construct new domains. In a dom0less or pv-shim build, they can be
omitted to cut down on the Xen binary's size. However, this comes at
the loss of significant runtime functionality.
Unless you know what you are doing, you should enable this.
"""
Regards,
Jason
^ permalink raw reply [flat|nested] 68+ messages in thread
* RE: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with CONFIG_MGMT_HYPERCALLS
2025-11-18 19:29 ` Jason Andryuk
@ 2025-11-20 4:09 ` Penny, Zheng
0 siblings, 0 replies; 68+ messages in thread
From: Penny, Zheng @ 2025-11-20 4:09 UTC (permalink / raw)
To: Andryuk, Jason, Jan Beulich
Cc: Huang, Ray, oleksii.kurochko@gmail.com, Andrew Cooper,
Anthony PERARD, Orzel, Michal, Julien Grall, Roger Pau Monné,
Stefano Stabellini, xen-devel@lists.xenproject.org
[Public]
> -----Original Message-----
> From: Jason Andryuk <jason.andryuk@amd.com>
> Sent: Wednesday, November 19, 2025 3:30 AM
> To: Penny, Zheng <penny.zheng@amd.com>; Jan Beulich <jbeulich@suse.com>
> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com; Andrew
> Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>; Julien
> Grall <julien@xen.org>; Roger Pau Monné <roger.pau@citrix.com>; Stefano
> Stabellini <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> CONFIG_MGMT_HYPERCALLS
>
> On 2025-11-18 02:51, Penny, Zheng wrote:
> > [Public]
> >
> >> -----Original Message-----
> >> From: Jan Beulich <jbeulich@suse.com>
> >> Sent: Tuesday, November 18, 2025 3:14 PM
> >> To: Penny, Zheng <penny.zheng@amd.com>
> >> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com;
> >> Andrew Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> >> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>;
> >> Julien Grall <julien@xen.org>; Roger Pau Monné
> >> <roger.pau@citrix.com>; Stefano Stabellini <sstabellini@kernel.org>;
> >> xen-devel@lists.xenproject.org
> >> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> >> CONFIG_MGMT_HYPERCALLS
> >>
> >> On 18.11.2025 07:43, Penny, Zheng wrote:
> >>> [Public]
> >>>
> >>>> -----Original Message-----
> >>>> From: Jan Beulich <jbeulich@suse.com>
> >>>> Sent: Thursday, October 30, 2025 9:40 PM
> >>>> To: Penny, Zheng <penny.zheng@amd.com>
> >>>> Cc: Huang, Ray <Ray.Huang@amd.com>; oleksii.kurochko@gmail.com;
> >>>> Andrew Cooper <andrew.cooper3@citrix.com>; Anthony PERARD
> >>>> <anthony.perard@vates.tech>; Orzel, Michal <Michal.Orzel@amd.com>;
> >>>> Julien Grall <julien@xen.org>; Roger Pau Monné
> >>>> <roger.pau@citrix.com>; Stefano Stabellini
> >>>> <sstabellini@kernel.org>; xen-devel@lists.xenproject.org
> >>>> Subject: Re: [PATCH v3 28/28] xen/domctl: wrap common/domctl.c with
> >>>> CONFIG_MGMT_HYPERCALLS
> >>>>
> >>>> On 13.10.2025 12:15, Penny Zheng wrote:
> >>>>> --- a/xen/common/Kconfig
> >>>>> +++ b/xen/common/Kconfig
> >>>>> @@ -646,11 +646,13 @@ config SYSTEM_SUSPEND
> >>>>> If unsure, say N.
> >>>>>
> >>>>> config MGMT_HYPERCALLS
> >>>>> - def_bool y
> >>>>> + bool "Enable privileged hypercalls for system management"
> >>>>> help
> >>>>> This option shall only be disabled on some dom0less systems, or
> >>>>> PV shim on x86, to reduce Xen footprint via managing
> >>>>> unnessary
>
> "unnecessary"
>
> >>>>> - hypercalls, like sysctl, etc.
> >>>>> + hypercalls, like sysctl, domctl, etc.
> >>>>> + Be cautious to disable it, as users will face missing a few basic
> >>>>> + hypercalls like listdomains, getdomaininfo, etc.
> >>>>
> >>>> This is still too little, imo. For one I'm not sure "users" is
> >>>> quite the right term. I'd say it's more "admins". And then, as
> >>>> mentioned, there are a few domctl-s which are usable by DMs. Aiui
> >>>> device pass-through may also be impacted, which imo will want
> >>>> mentioning here as well. Or else, if there is an implication that
> >>>> DMs aren't to be used when
> >> MGMT_HYPERCALLS=n, that is what would want calling out.
> >>>
> >>> How about
> >>> "
> >>> Be cautious to disable it, as admins will face missing a few basic
> >>> hypercalls like listdomains, getdomaininfo, etc, hence leading to
> >>> have an impact on xl-device-passthrough and restricted DM.
> >>> "
> >>
> >> Much better. However, why "xl-" and why "restricted"? Neither aspect
> >> matters here, unless I overlook something.
> >>
> >
> > Later, in hyperlaunch scenario, device passthrough is still needed,
> > but it's not current device passthrough mode, which depends on
> > xl-tool-stack to de-assign it from hardware domain and re-assign it to
> > guest. It will be limited in boot-up stage, and configured via device
> > tree only. FWIU, we may reuse VPCI framework, but commands like "xl
> > assign/deassign xxx" will not be needed anymore. PLZ correct me if
> > understand wrongly, @Andryuk, Jason
>
> Yes, this is correct.
>
> >
> > And DM, like QEMU, is still applicable, but only supports a new machine type,
> "pvh".
>
> vPCI is used to assign the PCI devices to a PVH domain during boot.
> QEMU is present and provides virtio devices, but it does not play a role in PCI
> passthrough. So far we've used independent PCI segments for vPCI and
> QEMU/virtio.
>
> Anyway, maybe something like this for the help text:
> """
> Management hypercalls provide the means for dom0 to manage the overall Xen
> system and other domains. This includes the hypercalls needed to construct new
> domains. In a dom0less or pv-shim build, they can be omitted to cut down on the
> Xen binary's size. However, this comes at the loss of significant runtime
> functionality.
>
> Unless you know what you are doing, you should enable this.
> """
>
Thx!!! I'll combine them all
> Regards,
> Jason
^ permalink raw reply [flat|nested] 68+ messages in thread
[parent not found: <20251013101540.3502842-9-Penny.Zheng@amd.com>]
* Re: [PATCH v3 08/28] xen/vm_event: introduce vm_event_is_enabled()
[not found] ` <20251013101540.3502842-9-Penny.Zheng@amd.com>
@ 2025-10-29 15:02 ` Jan Beulich
2025-10-30 11:10 ` Grygorii Strashko
0 siblings, 1 reply; 68+ messages in thread
From: Jan Beulich @ 2025-10-29 15:02 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
Tamas K Lengyel, Alexandru Isaila, Petre Pircalabu, xen-devel
On 13.10.2025 12:15, Penny Zheng wrote:
> @@ -2340,6 +2341,7 @@ int hvm_set_cr0(unsigned long value, bool may_defer)
> (value & (X86_CR0_PE | X86_CR0_PG)) == X86_CR0_PG )
> return X86EMUL_EXCEPTION;
>
> + may_defer &= vm_event_is_enabled(v);
I think this wants to move to the very top of the function, so that it's clear
that all uses (current and future) in the function are covered. Same for the
sibling functions, of course.
> @@ -3544,6 +3548,7 @@ int hvm_vmexit_cpuid(struct cpu_user_regs *regs, unsigned int inst_len)
> struct vcpu *curr = current;
> unsigned int leaf = regs->eax, subleaf = regs->ecx;
> struct cpuid_leaf res;
> + int ret = 0;
>
> if ( curr->arch.msrs->misc_features_enables.cpuid_faulting &&
> hvm_get_cpl(curr) > 0 )
> @@ -3560,7 +3565,10 @@ int hvm_vmexit_cpuid(struct cpu_user_regs *regs, unsigned int inst_len)
> regs->rcx = res.c;
> regs->rdx = res.d;
>
> - return hvm_monitor_cpuid(inst_len, leaf, subleaf);
> + if ( vm_event_is_enabled(curr) )
> + ret = hvm_monitor_cpuid(inst_len, leaf, subleaf);
> +
> + return ret;
Just to mention, could also do without a new local variable:
return vm_event_is_enabled(curr)
? hvm_monitor_cpuid(inst_len, leaf, subleaf)
: 0;
> @@ -3860,9 +3869,11 @@ int hvm_descriptor_access_intercept(uint64_t exit_info,
> struct vcpu *curr = current;
> struct domain *currd = curr->domain;
>
> - if ( currd->arch.monitor.descriptor_access_enabled )
> + if ( currd->arch.monitor.descriptor_access_enabled &&
> + vm_event_is_enabled(curr) )
While functionally it won't matter, logically this looks the wrong way round.
In principle I'd expect the "monitor" field to also disappear when VM_EVENT=n,
at which point the order will need to be the other way around anyway (as the
explicit CONFIG_VM_EVENT then needs to come first).
> {
> ASSERT(curr->arch.vm_event);
> +
> hvm_monitor_descriptor_access(exit_info, vmx_exit_qualification,
> descriptor, is_write);
> }
Stray change (especially in an already big patch)?
> @@ -2551,7 +2552,7 @@ void asmlinkage svm_vmexit_handler(void)
> uint64_t exit_reason;
> struct vcpu *v = current;
> struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb;
> - int insn_len, rc;
> + int insn_len, rc = 0;
This is almost 200 lines apart from ...
> @@ -2720,11 +2721,14 @@ void asmlinkage svm_vmexit_handler(void)
> break;
> }
>
> - rc = hvm_monitor_debug(regs->rip,
> - HVM_MONITOR_DEBUG_EXCEPTION,
> - trap_type, insn_len, 0);
> - if ( rc < 0 )
> - goto unexpected_exit_type;
> + if ( vm_event_is_enabled(v) )
> + {
> + rc = hvm_monitor_debug(regs->rip,
> + HVM_MONITOR_DEBUG_EXCEPTION,
> + trap_type, insn_len, 0);
> + if ( rc < 0 )
> + goto unexpected_exit_type;
> + }
> if ( !rc )
> hvm_inject_exception(X86_EXC_DB,
> trap_type, insn_len, X86_EVENT_NO_EC);
... where it first comes into play. I wonder whether the initialization
wouldn't better move closer, also for the code to be less fragile going
forward (where a new earlier use of rc might easily appear). Or, like VMX
code has it, limit the scope of "rc" (requiring several instances then in
relatively narrow scopes).
> --- a/xen/arch/x86/include/asm/vm_event.h
> +++ b/xen/arch/x86/include/asm/vm_event.h
> @@ -45,4 +45,13 @@ void vm_event_sync_event(struct vcpu *v, bool value);
>
> void vm_event_reset_vmtrace(struct vcpu *v);
>
> +static inline bool vm_event_is_enabled(struct vcpu *v)
Pointer-to-const please for (almost?) all predicate-like functions.
> +{
> +#ifdef CONFIG_VM_EVENT
> + return v->arch.vm_event != NULL;
> +#else
> + return false;
> +#endif
> +}
As long a vm_event is always a member of struct arch_vcpu, IS_ENABLED() should
be sufficient here? Or did you merely forget to add an #ifdef around the field
as well? Albeit I realize that would break with e.g. the use in
hvmemul_rep_outs_set_context(). Otoh that function (and likely others there)
should be compiled out when VM_EVENT=n. Maybe that's the subject of the next
patch ...
Jan
^ permalink raw reply [flat|nested] 68+ messages in thread* Re: [PATCH v3 08/28] xen/vm_event: introduce vm_event_is_enabled()
2025-10-29 15:02 ` [PATCH v3 08/28] xen/vm_event: introduce vm_event_is_enabled() Jan Beulich
@ 2025-10-30 11:10 ` Grygorii Strashko
0 siblings, 0 replies; 68+ messages in thread
From: Grygorii Strashko @ 2025-10-30 11:10 UTC (permalink / raw)
To: Penny Zheng
Cc: ray.huang, oleksii.kurochko, Andrew Cooper, Roger Pau Monné,
Tamas K Lengyel, Alexandru Isaila, Petre Pircalabu, xen-devel,
Jan Beulich
Hi Penny,
For some reasons this patch is not in the list nor in patchwork.
At least I can't find it :(
On 29.10.25 17:02, Jan Beulich wrote:
> On 13.10.2025 12:15, Penny Zheng wrote:
>> @@ -2340,6 +2341,7 @@ int hvm_set_cr0(unsigned long value, bool may_defer)
>> (value & (X86_CR0_PE | X86_CR0_PG)) == X86_CR0_PG )
>> return X86EMUL_EXCEPTION;
>>
>> + may_defer &= vm_event_is_enabled(v);
>
> I think this wants to move to the very top of the function, so that it's clear
> that all uses (current and future) in the function are covered. Same for the
> sibling functions, of course.
>
>> @@ -3544,6 +3548,7 @@ int hvm_vmexit_cpuid(struct cpu_user_regs *regs, unsigned int inst_len)
>> struct vcpu *curr = current;
>> unsigned int leaf = regs->eax, subleaf = regs->ecx;
>> struct cpuid_leaf res;
>> + int ret = 0;
>>
>> if ( curr->arch.msrs->misc_features_enables.cpuid_faulting &&
>> hvm_get_cpl(curr) > 0 )
>> @@ -3560,7 +3565,10 @@ int hvm_vmexit_cpuid(struct cpu_user_regs *regs, unsigned int inst_len)
>> regs->rcx = res.c;
>> regs->rdx = res.d;
>>
>> - return hvm_monitor_cpuid(inst_len, leaf, subleaf);
>> + if ( vm_event_is_enabled(curr) )
>> + ret = hvm_monitor_cpuid(inst_len, leaf, subleaf);
>> +
>> + return ret;
>
> Just to mention, could also do without a new local variable:
>
> return vm_event_is_enabled(curr)
> ? hvm_monitor_cpuid(inst_len, leaf, subleaf)
> : 0;
>
>> @@ -3860,9 +3869,11 @@ int hvm_descriptor_access_intercept(uint64_t exit_info,
>> struct vcpu *curr = current;
>> struct domain *currd = curr->domain;
>>
>> - if ( currd->arch.monitor.descriptor_access_enabled )
>> + if ( currd->arch.monitor.descriptor_access_enabled &&
>> + vm_event_is_enabled(curr) )
>
> While functionally it won't matter, logically this looks the wrong way round.
> In principle I'd expect the "monitor" field to also disappear when VM_EVENT=n,
> at which point the order will need to be the other way around anyway (as the
> explicit CONFIG_VM_EVENT then needs to come first).
>
>> {
>> ASSERT(curr->arch.vm_event);
>> +
>> hvm_monitor_descriptor_access(exit_info, vmx_exit_qualification,
>> descriptor, is_write);
>> }
>
> Stray change (especially in an already big patch)?
>
>> @@ -2551,7 +2552,7 @@ void asmlinkage svm_vmexit_handler(void)
>> uint64_t exit_reason;
>> struct vcpu *v = current;
>> struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb;
>> - int insn_len, rc;
>> + int insn_len, rc = 0;
>
> This is almost 200 lines apart from ...
>
>> @@ -2720,11 +2721,14 @@ void asmlinkage svm_vmexit_handler(void)
>> break;
>> }
>>
>> - rc = hvm_monitor_debug(regs->rip,
>> - HVM_MONITOR_DEBUG_EXCEPTION,
>> - trap_type, insn_len, 0);
>> - if ( rc < 0 )
>> - goto unexpected_exit_type;
>> + if ( vm_event_is_enabled(v) )
>> + {
>> + rc = hvm_monitor_debug(regs->rip,
>> + HVM_MONITOR_DEBUG_EXCEPTION,
>> + trap_type, insn_len, 0);
>> + if ( rc < 0 )
>> + goto unexpected_exit_type;
>> + }
>> if ( !rc )
>> hvm_inject_exception(X86_EXC_DB,
>> trap_type, insn_len, X86_EVENT_NO_EC);
>
> ... where it first comes into play. I wonder whether the initialization
> wouldn't better move closer, also for the code to be less fragile going
> forward (where a new earlier use of rc might easily appear). Or, like VMX
> code has it, limit the scope of "rc" (requiring several instances then in
> relatively narrow scopes).
>
>> --- a/xen/arch/x86/include/asm/vm_event.h
>> +++ b/xen/arch/x86/include/asm/vm_event.h
>> @@ -45,4 +45,13 @@ void vm_event_sync_event(struct vcpu *v, bool value);
>>
>> void vm_event_reset_vmtrace(struct vcpu *v);
>>
>> +static inline bool vm_event_is_enabled(struct vcpu *v)
>
> Pointer-to-const please for (almost?) all predicate-like functions.
>
>> +{
>> +#ifdef CONFIG_VM_EVENT
>> + return v->arch.vm_event != NULL;
>> +#else
>> + return false;
>> +#endif
>> +}
>
> As long a vm_event is always a member of struct arch_vcpu, IS_ENABLED() should
> be sufficient here? Or did you merely forget to add an #ifdef around the field
> as well? Albeit I realize that would break with e.g. the use in
> hvmemul_rep_outs_set_context(). Otoh that function (and likely others there)
> should be compiled out when VM_EVENT=n. Maybe that's the subject of the next
> patch ...
>
> Jan
>
--
Best regards,
-grygorii
^ permalink raw reply [flat|nested] 68+ messages in thread