Re: [PATCH] xen/arm, xen/common: Add Kconfig option to control Dom0 boot

[Jan Beulich <jbeulich@xxxxxxxx>]

On 23.07.2025 16:05, Oleksii Moisieiev wrote:
> This commit introduces a new Kconfig option, `CONFIG_DOM0_BOOT`, to
> allow for building Xen without support for booting a regular domain (Dom0).
> This functionality is primarily intended for the ARM architecture.
> 
> A new Kconfig symbol, `HAS_DOM0`, has been added and is selected by
> default for ARM architecture. This symbol signifies that an
> architecture has the capability to support a Dom0.
> 
> The `DOM0_BOOT` option depends on `HAS_DOM0` and defaults to 'y'. For
> expert users, this option can be disabled (`CONFIG_EXPERT=y` and no
> `CONFIG_DOM0_BOOT` in the config), which will compile out the Dom0
> creation code on ARM. This is useful for embedded or dom0less-only
> scenarios to reduce binary size and complexity.
> 
> The ARM boot path has been updated to panic if it detects a non-dom0less
> configuration while `CONFIG_DOM0_BOOT` is disabled, preventing an invalid
> boot.
> 
> Signed-off-by: Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>

Oh, also - can you please avoid Cc-ing (or even having as To: as you had
it here) email addresses that will reject replies (see attached)?

Jan

--- Begin Message ---

• To: jbeulich@xxxxxxxx
• From: Mail Delivery Subsystem <mailer-daemon@xxxxxxxxxxxxxx>
• Date: Wed, 23 Jul 2025 07:27:29 -0700 (PDT)
• Arc-authentication-results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20230601 header.b=XkL4SKhL; spf=none (google.com: postmaster@xxxxxxxxxxxxxxxxxxxxxxx does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com; dara=pass header.i=@suse.com
• Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=in-reply-to:references:subject:from:date:message-id:auto-submitted :to:dkim-signature; bh=wJ47Bdqmnplm4mxLVEz8cCI30zRuG8c8LRvzDR2mxX4=; fh=1F3UM0FYF+P+9KQLobQQV/FcbYgLvya74ksf/MgpYhI=; b=eqDpGWuCTFi89swQNx/dQ3G/4DZkEnb+RddWOUrKv4HTqG7mbNcZ6bqB0ZmZ6xiEl3 b8EMyfANyv5zaTHrz3Qlq5VpuHFtC1w2TlEcGG+/U6gWZwqJHEKayVuwsC8jIUPkSVEK 5M1Hf94PJUQRIXVGIU5lEeA9610VawzOLKPEjXvtVsjiQp1XjipRq/xda1K3SRrLUQ9X 5E9/x75giIQ6ZxjjOxRBGKB4U/aVto9UROG+vnnuF3y36h8Sv70zW7FGjbwoeHeXRP3L 8CLYygBiUI/OJ8ScPsAq7p0ihZzrWun5lXhW1hdRMtyWUuqg0hDJ3XjrTvIx6RCxq0JJ 4+Ug==; dara=google.com
• Arc-seal: i=1; a=rsa-sha256; t=1753280849; cv=none; d=google.com; s=arc-20240605; b=j1Kn+NAfGZ1mHmilwSA1ItpPDhvUrcPCt2GPKk+uaNVhxmyNyu6PsokRJejthpzsap 42fDpdMZ9cI+HgyC5HpVz+Tw2Axwn6CQZnbXuih7RMB7FsTFBo+Z2cxC1PeS25TNPZ5R PHPJ0uPqDr5WejSnCZv9i9WkarSDLWTnoKaRqL8VvOPm8pwCycpDhoT96+FWUlYZd3lV DI6MR3AprHOn+a9dYkuH7yYy4kJ+Yo9AVWxyZFEFM/3oE2/ovi1GiLc+tbR8rQVgFVFn oW8zviXA0XasGTOubh7tFOUBmm89bOLd05XHvEHSQC7aSN7BIlSAHMXMjKbiRSNtnna4 cFmg==
• Authentication-results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20230601 header.b=XkL4SKhL; spf=none (google.com: postmaster@xxxxxxxxxxxxxxxxxxxxxxx does not designate permitted sender hosts) smtp.helo=mail-sor-f69.google.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com; dara=pass header.i=@suse.com
• Auto-submitted: auto-replied
• Delivered-to: jbeulich@xxxxxxxx

Address not found

Your message wasn't delivered to amd-xen-safety@xxxxxxxxx because the address couldn't be found, or is unable to receive mail.

LEARN MORE

This link will take you to a third-party site

The response from the remote server was:

510 5.1.1 Your email address, jbeulich@xxxxxxxx, is not subscribed to that group. To subscribe, send an email to amd-xen-safety+subscribe@xxxxxxxxx, or visit https://groups.io/g/amd-xen-safety

Reporting-MTA: dns; googlemail.com
Received-From-MTA: dns; jbeulich@suse.com
Arrival-Date: Wed, 23 Jul 2025 07:27:26 -0700 (PDT)
X-Original-Message-ID: <60627444-420d-42a1-b7b6-d74dec2479e0@suse.com>

Final-Recipient: rfc822; amd-xen-safety@groups.io
Action: failed
Status: 5.1.1
Remote-MTA: dns; lb02.groups.io. (173.255.221.194, the server for the domain 
groups.io.)
Diagnostic-Code: smtp; 510 5.1.1 Your email address, jbeulich@suse.com, is not 
subscribed to that group. To subscribe, send an email to 
amd-xen-safety+subscribe@groups.io, or visit https://groups.io/g/amd-xen-safety
Last-Attempt-Date: Wed, 23 Jul 2025 07:27:29 -0700 (PDT)

--- Begin Message ---

• To: Oleksii Moisieiev <Oleksii_Moisieiev@xxxxxxxx>
• From: Jan Beulich <jbeulich@xxxxxxxx>
• Date: Wed, 23 Jul 2025 16:27:14 +0200
• Autocrypt: addr=jbeulich@xxxxxxxx; keydata= xsDiBFk3nEQRBADAEaSw6zC/EJkiwGPXbWtPxl2xCdSoeepS07jW8UgcHNurfHvUzogEq5xk hu507c3BarVjyWCJOylMNR98Yd8VqD9UfmX0Hb8/BrA+Hl6/DB/eqGptrf4BSRwcZQM32aZK 7Pj2XbGWIUrZrd70x1eAP9QE3P79Y2oLrsCgbZJfEwCgvz9JjGmQqQkRiTVzlZVCJYcyGGsD /0tbFCzD2h20ahe8rC1gbb3K3qk+LpBtvjBu1RY9drYk0NymiGbJWZgab6t1jM7sk2vuf0Py O9Hf9XBmK0uE9IgMaiCpc32XV9oASz6UJebwkX+zF2jG5I1BfnO9g7KlotcA/v5ClMjgo6Gl MDY4HxoSRu3i1cqqSDtVlt+AOVBJBACrZcnHAUSuCXBPy0jOlBhxPqRWv6ND4c9PH1xjQ3NP nxJuMBS8rnNg22uyfAgmBKNLpLgAGVRMZGaGoJObGf72s6TeIqKJo/LtggAS9qAUiuKVnygo 3wjfkS9A3DRO+SpU7JqWdsveeIQyeyEJ/8PTowmSQLakF+3fote9ybzd880fSmFuIEJldWxp Y2ggPGpiZXVsaWNoQHN1c2UuY29tPsJgBBMRAgAgBQJZN5xEAhsDBgsJCAcDAgQVAggDBBYC AwECHgECF4AACgkQoDSui/t3IH4J+wCfQ5jHdEjCRHj23O/5ttg9r9OIruwAn3103WUITZee e7Sbg12UgcQ5lv7SzsFNBFk3nEQQCACCuTjCjFOUdi5Nm244F+78kLghRcin/awv+IrTcIWF hUpSs1Y91iQQ7KItirz5uwCPlwejSJDQJLIS+QtJHaXDXeV6NI0Uef1hP20+y8qydDiVkv6l IreXjTb7DvksRgJNvCkWtYnlS3mYvQ9NzS9PhyALWbXnH6sIJd2O9lKS1Mrfq+y0IXCP10eS FFGg+Av3IQeFatkJAyju0PPthyTqxSI4lZYuJVPknzgaeuJv/2NccrPvmeDg6Coe7ZIeQ8Yj t0ARxu2xytAkkLCel1Lz1WLmwLstV30g80nkgZf/wr+/BXJW/oIvRlonUkxv+IbBM3dX2OV8 AmRv1ySWPTP7AAMFB/9PQK/VtlNUJvg8GXj9ootzrteGfVZVVT4XBJkfwBcpC/XcPzldjv+3 HYudvpdNK3lLujXeA5fLOH+Z/G9WBc5pFVSMocI71I8bT8lIAzreg0WvkWg5V2WZsUMlnDL9 mpwIGFhlbM3gfDMs7MPMu8YQRFVdUvtSpaAs8OFfGQ0ia3LGZcjA6Ik2+xcqscEJzNH+qh8V m5jjp28yZgaqTaRbg3M/+MTbMpicpZuqF4rnB0AQD12/3BNWDR6bmh+EkYSMcEIpQmBM51qM EKYTQGybRCjpnKHGOxG0rfFY1085mBDZCH5Kx0cl0HVJuQKC+dV2ZY5AqjcKwAxpE75MLFkr wkkEGBECAAkFAlk3nEQCGwwACgkQoDSui/t3IH7nnwCfcJWUDUFKdCsBH/E5d+0ZnMQi+G0A nAuWpQkjM1ASeQwSHEeAWPgskBQL
• Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Julien Grall <julien@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>, Oleksandr Tyshchenko <Oleksandr_Tyshchenko@xxxxxxxx>, "amd-xen-safety@xxxxxxxxx" <amd-xen-safety@xxxxxxxxx>

On 23.07.2025 16:05, Oleksii Moisieiev wrote:
> --- a/xen/arch/arm/Kconfig
> +++ b/xen/arch/arm/Kconfig
> @@ -19,6 +19,7 @@ config ARM
>       select HAS_ALTERNATIVE if HAS_VMAP
>       select HAS_DEVICE_TREE
>       select HAS_DOM0LESS
> +     select HAS_DOM0

This wants to move one line up, for the set to remain sorted. But see below.

> --- a/xen/common/Kconfig
> +++ b/xen/common/Kconfig
> @@ -21,6 +21,14 @@ config DOM0LESS_BOOT
>         Xen boot without the need of a control domain (Dom0), which could be
>         present anyway.
>  
> +config DOM0_BOOT
> +     bool "Dom0 boot support" if EXPERT
> +     depends on HAS_DOM0 && HAS_DEVICE_TREE && DOMAIN_BUILD_HELPERS
> +     default y
> +     help
> +       Dom0 boot support enables Xen to boot to the control domain (Dom0) and
> +       manage domU guests using the Xen toolstack with provided 
> configurations.

What about non-Arm? x86 has a Dom0 too, but doesn't select HAS_DOM0. It
actually requires a Dom0 for now, so to me HAS_DOM0 is a misnomer. Maybe
HAS_OPTIONAL_DOM0?

> @@ -92,6 +100,9 @@ config HAS_DEVICE_TREE
>  config HAS_DOM0LESS
>       bool
>  
> +config HAS_DOM0
> +     bool

Same here as to sorting, no matter that ...

>  config HAS_DIT # Data Independent Timing
>       bool
>  

... HAS_DOM0LESS and this one are misplaced with one another.

Jan

--- End Message ---

--- End Message ---