[PATCH v8] xen/domain: introduce DOMID_ANY

[dmukhin@xxxxxxxx]

From: Denis Mukhin <dmukhin@xxxxxxxx> 

Add a new symbol DOMID_ANY to improve the readability of the code.

Update all relevant domid_alloc() call sites and harden the domid_alloc()
input value check.

Also, fix problem with passing invalid domain IDs in
XEN_DOMCTL_createdomain: turns out libxl__domain_make() (toolstack)
uses 0xffff as domain ID.

Fix failing tools tests too.

Amends: 2d5065060710 ("xen/domain: unify domain ID allocation")
Signed-off-by: Denis Mukhin <dmukhin@xxxxxxxx>
---
Changes since v7:
- aligned the DOMID_ANY comment with another patch sent separately to
  unblock xenstore series: 
https://lore.kernel.org/xen-devel/20260429120619.1013440-2-jgross@xxxxxxxx/
- added fixups to mem-claim, paging-mempool, resource and tsx tests.
- Link to v7: 
https://lore.kernel.org/xen-devel/20260408234046.1314021-1-dmukhin@xxxxxxxx/
- Link to full CI: 
https://gitlab.com/xen-project/people/sstabellini/xen/-/pipelines/2508345752
---
 tools/libs/light/libxl_create.c                  |  4 +++-
 tools/tests/domid/harness.h                      |  1 +
 tools/tests/domid/test-domid.c                   | 12 ++++++------
 tools/tests/mem-claim/test-mem-claim.c           |  6 +++---
 tools/tests/paging-mempool/test-paging-mempool.c |  2 +-
 tools/tests/resource/test-resource.c             |  2 +-
 tools/tests/tsx/test-tsx.c                       |  2 +-
 xen/common/device-tree/dom0less-build.c          |  2 +-
 xen/common/domctl.c                              |  3 +--
 xen/common/domid.c                               |  5 ++++-
 xen/include/public/xen.h                         |  7 +++++++
 11 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/tools/libs/light/libxl_create.c b/tools/libs/light/libxl_create.c
index bfc9149096a3..6fd62d140389 100644
--- a/tools/libs/light/libxl_create.c
+++ b/tools/libs/light/libxl_create.c
@@ -681,8 +681,10 @@ int libxl__domain_make(libxl__gc *gc, libxl_domain_config 
*d_config,
                     continue;
 
                 local_domid = v;
+            } else if (libxl_domid_valid_guest(info->domid)) {
+                local_domid = info->domid;
             } else {
-                local_domid = info->domid; /* May not be valid */
+                local_domid = DOMID_ANY;
             }
 
             ret = xc_domain_create(ctx->xch, &local_domid, &create);
diff --git a/tools/tests/domid/harness.h b/tools/tests/domid/harness.h
index 17eb22a9a854..65da0d075a2b 100644
--- a/tools/tests/domid/harness.h
+++ b/tools/tests/domid/harness.h
@@ -41,6 +41,7 @@ extern unsigned long find_next_zero_bit(const unsigned long 
*addr,
 
 #define DOMID_FIRST_RESERVED            (100)
 #define DOMID_INVALID                   (101)
+#define DOMID_ANY                       (102)
 
 #endif /* _TEST_HARNESS_ */
 
diff --git a/tools/tests/domid/test-domid.c b/tools/tests/domid/test-domid.c
index 5915c4699a5c..71cc4e7fd86d 100644
--- a/tools/tests/domid/test-domid.c
+++ b/tools/tests/domid/test-domid.c
@@ -41,20 +41,20 @@ int main(int argc, char **argv)
         domid_free(expected);
 
     /*
-     * Test that that two consecutive calls of domid_alloc(DOMID_INVALID)
+     * Test that that two consecutive calls of domid_alloc(DOMID_ANY)
      * will never return the same ID.
      * NB: ID#0 is reserved and shall not be allocated by
-     * domid_alloc(DOMID_INVALID).
+     * domid_alloc(DOMID_ANY).
      */
     for ( expected = 1; expected < DOMID_FIRST_RESERVED; expected++ )
     {
-        allocated = domid_alloc(DOMID_INVALID);
+        allocated = domid_alloc(DOMID_ANY);
         verify(allocated == expected,
                "TEST 3: expected %u allocated %u\n", expected, allocated);
     }
     for ( expected = 1; expected < DOMID_FIRST_RESERVED; expected++ )
     {
-        allocated = domid_alloc(DOMID_INVALID);
+        allocated = domid_alloc(DOMID_ANY);
         verify(allocated == DOMID_INVALID,
                "TEST 4: expected %u allocated %u\n", DOMID_INVALID, allocated);
     }
@@ -64,7 +64,7 @@ int main(int argc, char **argv)
         domid_free(expected);
     for ( expected = 1; expected < DOMID_FIRST_RESERVED / 2; expected++ )
     {
-        allocated = domid_alloc(DOMID_INVALID);
+        allocated = domid_alloc(DOMID_ANY);
         verify(allocated == expected,
                "TEST 5: expected %u allocated %u\n", expected, allocated);
     }
@@ -72,7 +72,7 @@ int main(int argc, char **argv)
     /* Re-allocate last ID from [1..DOMID_FIRST_RESERVED - 1]. */
     expected = DOMID_FIRST_RESERVED - 1;
     domid_free(DOMID_FIRST_RESERVED - 1);
-    allocated = domid_alloc(DOMID_INVALID);
+    allocated = domid_alloc(DOMID_ANY);
     verify(allocated == expected,
            "TEST 6: expected %u allocated %u\n", expected, allocated);
 
diff --git a/tools/tests/mem-claim/test-mem-claim.c 
b/tools/tests/mem-claim/test-mem-claim.c
index ad038e45d188..69dc99cfdd51 100644
--- a/tools/tests/mem-claim/test-mem-claim.c
+++ b/tools/tests/mem-claim/test-mem-claim.c
@@ -21,7 +21,7 @@ static unsigned int nr_failures;
 #define MB_PAGES(x) (MB(x) / XC_PAGE_SIZE)
 
 static xc_interface *xch;
-static uint32_t domid = DOMID_INVALID;
+static uint32_t domid = DOMID_ANY;
 
 static xc_physinfo_t physinfo;
 
@@ -142,7 +142,7 @@ static void run_tests(void)
     rc = xc_domain_destroy(xch, domid);
 
     /* Cancel the cleanup path, even in the case of an error. */
-    domid = DOMID_INVALID;
+    domid = DOMID_ANY;
 
     if ( rc )
         return fail("  Failed to destroy domain: %d - %s\n",
@@ -171,7 +171,7 @@ int main(int argc, char **argv)
 
     run_tests();
 
-    if ( domid != DOMID_INVALID )
+    if ( domid != DOMID_ANY )
     {
         rc = xc_domain_destroy(xch, domid);
         if ( rc )
diff --git a/tools/tests/paging-mempool/test-paging-mempool.c 
b/tools/tests/paging-mempool/test-paging-mempool.c
index 1ebc13455ac2..7e417d9798ac 100644
--- a/tools/tests/paging-mempool/test-paging-mempool.c
+++ b/tools/tests/paging-mempool/test-paging-mempool.c
@@ -18,7 +18,7 @@ static unsigned int nr_failures;
 })
 
 static xc_interface *xch;
-static uint32_t domid;
+static uint32_t domid = DOMID_ANY;
 
 static struct xen_domctl_createdomain create = {
     .flags = XEN_DOMCTL_CDF_hvm | XEN_DOMCTL_CDF_hap,
diff --git a/tools/tests/resource/test-resource.c 
b/tools/tests/resource/test-resource.c
index a7f2d0464326..236da0dcd45e 100644
--- a/tools/tests/resource/test-resource.c
+++ b/tools/tests/resource/test-resource.c
@@ -178,7 +178,7 @@ static void test_domain_configurations(void)
     for ( unsigned int i = 0; i < ARRAY_SIZE(tests); ++i )
     {
         struct test *t = &tests[i];
-        uint32_t domid = 0;
+        uint32_t domid = DOMID_ANY;
         int rc;
         xen_pfn_t ram[1] = { 0 };
 
diff --git a/tools/tests/tsx/test-tsx.c b/tools/tests/tsx/test-tsx.c
index 5af04953f340..ea7c03ad302e 100644
--- a/tools/tests/tsx/test-tsx.c
+++ b/tools/tests/tsx/test-tsx.c
@@ -362,7 +362,7 @@ static void test_def_max_policies(void)
 
 static void test_guest(struct xen_domctl_createdomain *c)
 {
-    uint32_t domid = 0;
+    uint32_t domid = DOMID_ANY;
     int rc;
 
     rc = xc_domain_create(xch, &domid, c);
diff --git a/xen/common/device-tree/dom0less-build.c 
b/xen/common/device-tree/dom0less-build.c
index 6d6882a34b5a..eacfd93087ae 100644
--- a/xen/common/device-tree/dom0less-build.c
+++ b/xen/common/device-tree/dom0less-build.c
@@ -871,7 +871,7 @@ void __init create_domUs(void)
         if ( (max_init_domid + 1) >= DOMID_FIRST_RESERVED )
             panic("No more domain IDs available\n");
 
-        domid = domid_alloc(DOMID_INVALID);
+        domid = domid_alloc(DOMID_ANY);
         if ( domid == DOMID_INVALID )
             panic("Error allocating ID for domain %s\n", dt_node_name(node));
 
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 93738931c575..b969f5ada6cc 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -409,8 +409,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
 
     case XEN_DOMCTL_createdomain:
     {
-        /* NB: ID#0 is reserved, find the first suitable ID instead. */
-        domid_t domid = domid_alloc(op->domain ?: DOMID_INVALID);
+        domid_t domid = domid_alloc(op->domain);
 
         if ( domid == DOMID_INVALID )
         {
diff --git a/xen/common/domid.c b/xen/common/domid.c
index 2387ddb08300..b0258e477c1a 100644
--- a/xen/common/domid.c
+++ b/xen/common/domid.c
@@ -19,7 +19,7 @@ static DECLARE_BITMAP(domid_bitmap, DOMID_FIRST_RESERVED);
  * @param domid Domain ID hint:
  * - If an explicit domain ID is provided, verify its availability and use it
  *   if ID is not used;
- * - If DOMID_INVALID is provided, search [1..DOMID_FIRST_RESERVED-1] range,
+ * - If DOMID_ANY is provided, search [1..DOMID_FIRST_RESERVED-1] range,
  *   starting from the last used ID. Implementation guarantees that two
  *   consecutive calls will never return the same ID. ID#0 is reserved for
  *   the first boot domain (currently, dom0) and excluded from the allocation
@@ -31,6 +31,9 @@ domid_t domid_alloc(domid_t domid)
 {
     static domid_t domid_last;
 
+    if ( domid >= DOMID_FIRST_RESERVED && domid != DOMID_ANY )
+        return DOMID_INVALID;
+
     spin_lock(&domid_lock);
 
     /* Exact match. */
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index b12fd10e6315..2149b8dd3808 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -608,6 +608,13 @@ DEFINE_XEN_GUEST_HANDLE(mmuext_op_t);
 /* DOMID_INVALID is used to identify pages with unknown owner. */
 #define DOMID_INVALID        xen_mk_uint(0x7FF4)
 
+/*
+ * DOMID_ANY is used to signal no specific domain ID requested.
+ * Handler should pick a valid ID, or handle it as a wildcard value
+ * depending on the context.
+ */
+#define DOMID_ANY            xen_mk_uint(0x7FF5)
+
 /* Idle domain. */
 #define DOMID_IDLE           xen_mk_uint(0x7FFF)
 
-- 
2.54.0