From ffe7a07597b43c77245d7acf3e57d8a2ed0896cf Mon Sep 17 00:00:00 2001 From: Ross Lagerwall Date: Tue, 9 Jun 2026 16:15:28 +0100 Subject: [PATCH] domctl: Handle some of XEN_DOMCTL_shadow_op without the domctl lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Handle XEN_DOMCTL_SHADOW_OP_{CLEAN,PEEK} without taking the domctl lock. This is safe because for these subops, the paging lock is mostly held which prevents it from operating concurrently on the same domain. There are some parts that are called without the paging lock held: * hvm_mapped_guest_frames_mark_dirty() - The function itself takes a spinlock so is protected from concurrent calls. In any case, it will mark all the pages dirty as required. * domain_{,un}pause() - The toolstack cannot {,un}pause the domain while in paging_log_dirty_op() because the toolstack's pause/unpause ops have a separate ref count. * p2m_flush_hardware_cached_dirty() - This is called elsewhere without the domctl lock held so holding it wouldn't achieve anything. It should be fine as long as it is called at least once. * log_dirty.ops->clean() - If the callback is hap_clean_dirty_bitmap(), then it will hold the p2m lock while modifying the table. If the callback is sh_clean_dirty_bitmap(), it will hold the paging lock while modifying the table. In both cases, this is OK. Signed-off-by: Ross Lagerwall Reviewed-by: Roger Pau Monné Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/mm/paging.c | 8 ++++++-- xen/common/domctl.c | 13 +++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c index 1a58228086..bfb5b423a0 100644 --- a/xen/arch/x86/mm/paging.c +++ b/xen/arch/x86/mm/paging.c @@ -746,11 +746,15 @@ long do_paging_domctl_cont( ret = xsm_domctl(XSM_OTHER, d, &op); if ( !ret ) { - if ( domctl_lock_acquire() ) + bool lock = !(op.u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_CLEAN || + op.u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_PEEK); + + if ( !lock || domctl_lock_acquire() ) { ret = paging_domctl(d, &op.u.shadow_op, u_domctl, 1); - domctl_lock_release(); + if ( lock ) + domctl_lock_release(); } else ret = -ERESTART; diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 35144d95b8..6f71a68d51 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -546,6 +546,19 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) /* Other sub-ops handled further down. */ break; + case XEN_DOMCTL_shadow_op: + if ( op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_CLEAN || + op->u.shadow_op.op == XEN_DOMCTL_SHADOW_OP_PEEK ) + { + ret = xsm_domctl(XSM_OTHER, d, op); + if ( ret ) + goto domctl_out_unlock_domonly; + + ret = arch_do_domctl(op, d, u_domctl); + goto domctl_out_unlock_domonly; + } + break; + case XEN_DOMCTL_get_device_group: ret = iommu_do_domctl(op, d, u_domctl); goto domctl_out_unlock_domonly;