[xen staging-4.18] domctl: handle XEN_DOMCTL_ioport_mapping without acquiring domctl lock

[patchbot@xxxxxxx]

commit 53ff9705c103f7d79b7795f56d836a980a5240b6
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Jun 4 21:41:59 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Thu Jun 4 22:29:00 2026 +0100

    domctl: handle XEN_DOMCTL_ioport_mapping without acquiring domctl lock
    
    With dedicated locking added, the domctl lock isn't required here anymore.
    As the handling is in arch-specific code (x86 only), almost no code is
    being moved, but a 2nd (extensible to other sub-ops) invocation of
    arch_do_domctl() is being added. Move just the re-purposed dedicated XSM
    check as early as possible.
    
    In flask_domctl() don't put #ifdef around the moved case label.
    
    This is part of XSA-492.
    
    Fixes: fda49f9b3fbb ("Add build option to allow more hypercalls from 
stubdoms")
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 9ac94138a5f31b5325fe4401e5cd9e377bbedcdb)
---
 xen/arch/x86/domctl.c   | 9 ++++++---
 xen/common/domctl.c     | 4 ++++
 xen/include/xsm/dummy.h | 4 ++--
 xen/xsm/flask/hooks.c   | 2 +-
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index abc2b5ef47..8bb3e694f8 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -618,12 +618,15 @@ long arch_do_domctl(
             break;
         }
 
+        ret = xsm_ioport_mapping(XSM_DM_PRIV, d, fmp, fmp + np - 1, add);
+        if ( ret )
+            break;
+
         hvm = &d->arch.hvm;
         iocaps_double_lock(d, true);
 
-        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) ||
-             (ret = xsm_ioport_mapping(XSM_HOOK, d, fmp, fmp + np - 1, add)) )
-            ret = ret ?: -EPERM;
+        if ( !ioports_access_permitted(currd, fmp, fmp + np - 1) )
+            ret = -EPERM;
         else if ( add )
         {
             printk(XENLOG_G_INFO
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 1e13a0b485..88b5aab418 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -422,6 +422,10 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
         goto domctl_out_unlock_domonly;
     }
 
+    case XEN_DOMCTL_ioport_mapping:
+        ret = arch_do_domctl(op, d, u_domctl);
+        goto domctl_out_unlock_domonly;
+
     default:
         /* Everything else handled further down. */
         break;
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index c5f5a38f7d..42d5ebe013 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -167,12 +167,12 @@ static XSM_INLINE int cf_check xsm_domctl(
     XSM_ASSERT_ACTION(XSM_OTHER);
     switch ( cmd )
     {
-    case XEN_DOMCTL_ioport_mapping:
     case XEN_DOMCTL_bind_pt_irq:
     case XEN_DOMCTL_unbind_pt_irq:
         return xsm_default_action(XSM_DM_PRIV, current->domain, d);
 
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_ioport_mapping:
     case XEN_DOMCTL_memory_mapping:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
@@ -771,7 +771,7 @@ static XSM_INLINE int cf_check xsm_ioport_permission(
 static XSM_INLINE int cf_check xsm_ioport_mapping(
     XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow)
 {
-    XSM_ASSERT_ACTION(XSM_HOOK);
+    XSM_ASSERT_ACTION(XSM_DM_PRIV);
     return xsm_default_action(action, current->domain, d);
 }
 
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 201db0fa50..0c687aa9e7 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -680,6 +680,7 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
 
     /* These have individual XSM hooks and don't make it here. */
     case XEN_DOMCTL_getdomaininfo:
+    case XEN_DOMCTL_ioport_mapping:
     case XEN_DOMCTL_memory_mapping:
         ASSERT_UNREACHABLE();
         return -EILSEQ;
@@ -698,7 +699,6 @@ static int cf_check flask_domctl(struct domain *d, unsigned 
int cmd,
     /* These have individual XSM hooks (arch/x86/domctl.c) */
     case XEN_DOMCTL_shadow_op:
     case XEN_DOMCTL_ioport_permission:
-    case XEN_DOMCTL_ioport_mapping:
 #endif
 #ifdef CONFIG_HAS_PASSTHROUGH
     /*
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.18