diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 07793a9d0b..b3f3c99c41 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -512,17 +512,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
         /* Other sub-ops handled further down. */
         break;
 
-    case XEN_DOMCTL_shadow_op:
-        if ( op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_CLEAN ||
-             op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_PEEK )
-        {
-            ret = xsm_domctl(XSM_PRIV, d, op);
-            if ( !ret )
-                ret = arch_do_domctl(op, d, u_domctl);
-            goto domctl_out_unlock_rcuonly;
-        }
-        break;
-
     case XEN_DOMCTL_get_device_group:
         ret = iommu_do_domctl(op, d, u_domctl);
         goto domctl_out_unlock_rcuonly;
@@ -568,6 +557,16 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
         goto domctl_out_unlock_rcuonly;
     }
 
+    case XEN_DOMCTL_shadow_op:
+        if ( op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_CLEAN ||
+             op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_PEEK )
+        {
+            ret = arch_do_domctl(op, d, u_domctl);
+            goto domctl_out_unlock_rcuonly;
+        }
+        /* Other sub-ops handled by arch_do_domctl() further down. */
+        break;
+
     default:
         /* Everything else handled further up or further down. */
         break;