Re: [XEN PATCH v2] xen: introduce kconfig options to disable hypercalls

[Jan Beulich <jbeulich@xxxxxxxx>]

On 19.12.2024 10:29, Sergiy Kibrik wrote:
> --- a/xen/arch/x86/Makefile
> +++ b/xen/arch/x86/Makefile
> @@ -74,12 +74,12 @@ obj-y += hpet.o
>  obj-y += vm_event.o
>  obj-y += xstate.o
>  
> -ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
> -obj-y += domctl.o
> +obj-$(CONFIG_DOMCTL) += domctl.o
> +ifeq ($(CONFIG_PLATFORM_OP),y)
>  obj-y += platform_hypercall.o
>  obj-$(CONFIG_COMPAT) += x86_64/platform_hypercall.o
> -obj-y += sysctl.o
>  endif

Personally I'd prefer if we avoided ifeq here:

obj-$(CONFIG_PLATFORM_OP) += platform_hypercall.o
obj-$(filter $(CONFIG_COMPAT),$(CONFIG_PLATFORM_OP)) += 
x86_64/platform_hypercall.o

Yet I realize this (once again) may be contentious.

> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -516,4 +516,33 @@ config TRACEBUFFER
>         to be collected at run time for debugging or performance analysis.
>         Memory and execution overhead when not active is minimal.
>  
> +menu "Supported hypercall interfaces"
> +     visible if DOM0LESS_BOOT && EXPERT
> +
> +config SYSCTL
> +     bool "Enable sysctl hypercall"
> +     depends on !PV_SHIM_EXCLUSIVE
> +     default y
> +
> +config DOMCTL
> +     bool "Enable domctl hypercalls"
> +     depends on !PV_SHIM_EXCLUSIVE
> +     default y
> +
> +config HVM_OP
> +     bool "Enable HVM hypercalls"
> +     depends on HVM
> +     default y
> +
> +config PLATFORM_OP
> +     bool "Enable platform hypercalls"
> +     depends on !PV_SHIM_EXCLUSIVE
> +     default y

Just to re-iterate an earlier comment: Andrew (imo validly) raised concern of
such negative dependencies. As said before, imo we'd better resolve that before
extending the issue (whether by the patch I once sent or something else is then
secondary).

> --- a/xen/common/Makefile
> +++ b/xen/common/Makefile
> @@ -66,10 +66,10 @@ obj-bin-$(CONFIG_X86) += $(foreach n,decompress bunzip2 
> unxz unlzma lzo unlzo un
>  obj-$(CONFIG_COMPAT) += $(addprefix compat/,domain.o memory.o multicall.o 
> xlat.o)
>  
>  ifneq ($(CONFIG_PV_SHIM_EXCLUSIVE),y)
> -obj-y += domctl.o
>  obj-y += monitor.o
> -obj-y += sysctl.o
>  endif
> +obj-$(CONFIG_DOMCTL) += domctl.o
> +obj-$(CONFIG_SYSCTL) += sysctl.o

These two then want to move back up into their normal slots.

Jan