From e3aa330017c533cc312ee4751b8387d988682efc Mon Sep 17 00:00:00 2001 From: Michal Orzel Date: Thu, 9 Jul 2026 08:36:43 +0200 Subject: [PATCH] xen/arm: Fail domain construction if a secondary vCPU cannot be created construct_domain() creates the secondary vCPUs in a loop, but on a vcpu_create() failure it only prints a message and breaks out of the loop returning success. As a result the domain can be partially constructed with fewer vCPUs than d->max_vcpus. This causes two contract violations: - Xen-Guest: domain's FDT is generated before vCPU creation - Xen exposes incorrect information (e.g. two vCPUs listed in a device tree while only one is actually created), - User-Xen: unlike x86, on Arm port we try to bail out as soon as possible on unsatisfied user requests (e.g. user requested two vCPUs for a domain but it was created with only one). Return an error instead of breaking out of the loop. Both callers (construct_domU() and construct_hwdom()) already propagate a negative return value and fail domain construction. Fixes: 6b0e8e43348a ("xen/arm: allocate secondaries dom0 vcpus") Signed-off-by: Michal Orzel Reviewed-by: Ayan Kumar Halder Release-Acked-by: Oleksii Kurochko Acked-by: Stefano Stabellini --- xen/arch/arm/domain_build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 550617f152..72d5316180 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1847,7 +1847,7 @@ int __init construct_domain(struct domain *d, struct kernel_info *kinfo) if ( vcpu_create(d, i) == NULL ) { printk("Failed to allocate d%dv%d\n", d->domain_id, i); - break; + return -ENOMEM; } if ( is_64bit_domain(d) )