From d1d1287764911f869e373703f53edc1b706edbbf Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 3 Aug 2026 16:32:25 +0200
Subject: [PATCH] XSM: make .grant_*() hooks dependent upon GRANT_TABLE=y

They're unreachable / dead otherwise.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
---
 xen/include/xsm/dummy.h | 4 ++++
 xen/include/xsm/hooks.h | 2 ++
 xen/xsm/flask/hooks.c   | 4 ++++
 xen/xsm/silo.c          | 6 ++++++
 4 files changed, 16 insertions(+)

diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 50ef246467..d75285477d 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -191,6 +191,8 @@ static XSM_INLINE void cf_check xsm_free_security_domain(struct domain *d)
     return;
 }
 
+#ifdef CONFIG_GRANT_TABLE
+
 static XSM_INLINE int cf_check xsm_grant_mapref(
     XSM_DEFAULT_ARG struct domain *d1, struct domain *d2, uint32_t flags)
 {
@@ -233,6 +235,8 @@ static XSM_INLINE int cf_check xsm_grant_query_size(
     return xsm_default_action(action, d1, d2);
 }
 
+#endif /* CONFIG_GRANT_TABLE */
+
 static XSM_INLINE int cf_check xsm_memory_exchange(
     XSM_DEFAULT_ARG struct domain *d)
 {
diff --git a/xen/include/xsm/hooks.h b/xen/include/xsm/hooks.h
index 87e357508d..8dbce67bd1 100644
--- a/xen/include/xsm/hooks.h
+++ b/xen/include/xsm/hooks.h
@@ -35,12 +35,14 @@ XSM_HOOK(int, evtchn_send, struct domain *, struct evtchn *)
 XSM_HOOK(int, evtchn_status, struct domain *, struct evtchn *)
 XSM_HOOK(int, evtchn_reset, struct domain *, struct domain *)
 
+#ifdef CONFIG_GRANT_TABLE
 XSM_HOOK(int, grant_mapref, struct domain *, struct domain *, uint32_t)
 XSM_HOOK(int, grant_unmapref, struct domain *, struct domain *)
 XSM_HOOK(int, grant_setup, struct domain *, struct domain *)
 XSM_HOOK(int, grant_transfer, struct domain *, struct domain *)
 XSM_HOOK(int, grant_copy, struct domain *, struct domain *)
 XSM_HOOK(int, grant_query_size, struct domain *, struct domain *)
+#endif
 
 XSM_HOOK(int, init_hardware_domain, struct domain *)
 
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index d7dac0dea3..d861b08d8b 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -434,6 +434,8 @@ static int cf_check flask_init_hardware_domain(struct domain *d)
     return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CREATE_HARDWARE_DOMAIN);
 }
 
+#ifdef CONFIG_GRANT_TABLE
+
 static int cf_check flask_grant_mapref(
     struct domain *d1, struct domain *d2, uint32_t flags)
 {
@@ -470,6 +472,8 @@ static int cf_check flask_grant_query_size(struct domain *d1, struct domain *d2)
     return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__QUERY);
 }
 
+#endif /* CONFIG_GRANT_TABLE */
+
 static int cf_check flask_get_pod_target(struct domain *d)
 {
     return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETPODTARGET);
diff --git a/xen/xsm/silo.c b/xen/xsm/silo.c
index b89b364287..39f4f581a3 100644
--- a/xen/xsm/silo.c
+++ b/xen/xsm/silo.c
@@ -60,6 +60,8 @@ static int cf_check silo_evtchn_interdomain(
     return -EPERM;
 }
 
+#ifdef CONFIG_GRANT_TABLE
+
 static int cf_check silo_grant_mapref(
     struct domain *d1, struct domain *d2, uint32_t flags)
 {
@@ -82,6 +84,8 @@ static int cf_check silo_grant_copy(struct domain *d1, struct domain *d2)
     return -EPERM;
 }
 
+#endif /* CONFIG_GRANT_TABLE */
+
 #ifdef CONFIG_ARGO
 
 static int cf_check silo_argo_register_single_source(
@@ -105,9 +109,11 @@ static int cf_check silo_argo_send(
 static const struct xsm_ops __initconst_cf_clobber silo_xsm_ops = {
     .evtchn_unbound = silo_evtchn_unbound,
     .evtchn_interdomain = silo_evtchn_interdomain,
+#ifdef CONFIG_GRANT_TABLE
     .grant_mapref = silo_grant_mapref,
     .grant_transfer = silo_grant_transfer,
     .grant_copy = silo_grant_copy,
+#endif
 #ifdef CONFIG_ARGO
     .argo_register_single_source = silo_argo_register_single_source,
     .argo_send = silo_argo_send,