Re: [Xen-devel] [PATCH 16/17] xen/mm: Convert {s, g}et_gpfn_from_mfn() to use typesafe MFN

2020-03-30 Thread Jan Beulich 
On 28.03.2020 12:14, Julien Grall wrote:
> On 27/03/2020 13:15, Jan Beulich wrote:
>> On 22.03.2020 17:14, jul...@xen.org wrote:
>>> @@ -983,19 +984,20 @@ long p2m_pt_audit_p2m(struct p2m_domain *p2m)
>>>   /* check for 1GB super page */
>>>   if ( l3e_get_flags(l3e[i3]) & _PAGE_PSE )
>>>   {
>>> -    mfn = l3e_get_pfn(l3e[i3]);
>>> -    ASSERT(mfn_valid(_mfn(mfn)));
>>> +    mfn = l3e_get_mfn(l3e[i3]);
>>> +    ASSERT(mfn_valid(mfn));
>>>   /* we have to cover 512x512 4K pages */
>>>   for ( i2 = 0;
>>>     i2 < (L2_PAGETABLE_ENTRIES * 
>>> L1_PAGETABLE_ENTRIES);
>>>     i2++)
>>>   {
>>> -    m2pfn = get_gpfn_from_mfn(mfn+i2);
>>> +    m2pfn = get_pfn_from_mfn(mfn_add(mfn, i2));
>>>   if ( m2pfn != (gfn + i2) )
>>>   {
>>>   pmbad++;
>>> -    P2M_PRINTK("mismatch: gfn %#lx -> mfn %#lx -> 
>>> gfn %#lx\n",
>>> -   gfn + i2, mfn + i2, m2pfn);
>>> +    P2M_PRINTK("mismatch: gfn %#lx -> mfn 
>>> %"PRI_mfn" gfn %#lx\n",
>>> +   gfn + i2, mfn_x(mfn_add(mfn, i2)),
>>
>> As in the earlier patch, "mfn_x(mfn) + i2" would be shorter and
>> hence imo preferable, especially in printk() and alike invocations.
> 
> The goal of using typesafe is to make the code safer not try to
> open-code everything because it might be shorter to write.

I'm not talking about "everything". As soon as you use mfn_x()
_anywhere_, type-safety is gone. Since in printk() and alike you
unavoidably have to use it (at least for now), there's no win
from using e.g. mfn_add() as you do here, imo. And hence the
readability aspect gets even higher significance.

>> I would also prefer if you left %#lx alone, with the 2nd best
>> option being to also use PRI_gfn alongside PRI_mfn. Primarily
>> I'd like to avoid having a mixture.
> The two options would be wrong:
> * gfn is an unsigned long and not gfn_t, so using PRI_gfn would be 
> incorrect
> * mfn is now an mfn_t so using %lx would be incorrect
> 
> So the format string used in the patch is correct based on the types used.

Hmm, xen/mm.h suggests a partial connection between e.g. mfn_t
and PRI_mfn, yes, but I think this is unhelpful as long as
mfn_x() needs to be explicitly used when specifying the printk()
arguments. Instead I view PRI_mfn and alike as a more general
format usable also for MFNs stored in unsigned long rather than
mfn_t.

I agree though that views here may differ. Hence wider agreement
on what the intentions are (also mid/long term), and hence how
well formed code ought to look like, would seem necessary here.

> This...
> 
>>
>> Same (for both) at least one more time further down.
> 
> ... would likely be applicable for all the other uses.

Agreed.

>>> --- a/xen/include/asm-x86/mm.h
>>> +++ b/xen/include/asm-x86/mm.h
>>> @@ -500,9 +500,10 @@ extern paddr_t mem_hotplug;
>>>    */
>>>   extern bool machine_to_phys_mapping_valid;
>>>   -static inline void set_gpfn_from_mfn(unsigned long mfn, unsigned long 
>>> pfn)
>>> +static inline void set_pfn_from_mfn(mfn_t mfn_, unsigned long pfn)
>>>   {
>>> -    const struct domain *d = page_get_owner(mfn_to_page(_mfn(mfn)));
>>> +    const unsigned long mfn = mfn_x(mfn_);
>>
>> I think it would be better overall if the parameter was named
>> "mfn" and there was no local variable altogether. This would
>> bring things in line with ...
> 
> You asked for this approach on the previous version [1]:
> 
> "Btw, the cheaper (in terms of code churn) change here would seem to
> be to name the function parameter mfn_, and the local variable mfn.
> That'll also reduce the number of uses of the unfortunate trailing-
> underscore-name."
> 
> So can you pick a side and stick with it?

Well, things like this happen when you see the final result, sorry.
And indeed I recalled commenting on this before, but upon searching
I didn't manage to find the earlier reply, to better justify what I
also suspected might have been a change of mind.

Jan

Re: [Xen-devel] [PATCH 16/17] xen/mm: Convert {s, g}et_gpfn_from_mfn() to use typesafe MFN

2020-03-28 Thread Julien Grall 

Hi,

On 27/03/2020 13:15, Jan Beulich wrote:

On 22.03.2020 17:14, jul...@xen.org wrote:

@@ -983,19 +984,20 @@ long p2m_pt_audit_p2m(struct p2m_domain *p2m)
  /* check for 1GB super page */
  if ( l3e_get_flags(l3e[i3]) & _PAGE_PSE )
  {
-mfn = l3e_get_pfn(l3e[i3]);
-ASSERT(mfn_valid(_mfn(mfn)));
+mfn = l3e_get_mfn(l3e[i3]);
+ASSERT(mfn_valid(mfn));
  /* we have to cover 512x512 4K pages */
  for ( i2 = 0;
i2 < (L2_PAGETABLE_ENTRIES * L1_PAGETABLE_ENTRIES);
i2++)
  {
-m2pfn = get_gpfn_from_mfn(mfn+i2);
+m2pfn = get_pfn_from_mfn(mfn_add(mfn, i2));
  if ( m2pfn != (gfn + i2) )
  {
  pmbad++;
-P2M_PRINTK("mismatch: gfn %#lx -> mfn %#lx -> gfn 
%#lx\n",
-   gfn + i2, mfn + i2, m2pfn);
+P2M_PRINTK("mismatch: gfn %#lx -> mfn %"PRI_mfn" gfn 
%#lx\n",
+   gfn + i2, mfn_x(mfn_add(mfn, i2)),


As in the earlier patch, "mfn_x(mfn) + i2" would be shorter and
hence imo preferable, especially in printk() and alike invocations.


The goal of using typesafe is to make the code safer not try to 
open-code everything because it might be shorter to write.




I would also prefer if you left %#lx alone, with the 2nd best
option being to also use PRI_gfn alongside PRI_mfn. Primarily
I'd like to avoid having a mixture.

The two options would be wrong:
	* gfn is an unsigned long and not gfn_t, so using PRI_gfn would be 
incorrect

* mfn is now an mfn_t so using %lx would be incorrect

So the format string used in the patch is correct based on the types 
used. This...




Same (for both) at least one more time further down.


... would likely be applicable for all the other uses.


@@ -974,7 +974,7 @@ guest_physmap_add_entry(struct domain *d, gfn_t gfn, mfn_t 
mfn,
  P2M_DEBUG("old gfn=%#lx -> mfn %#lx\n",
gfn_x(ogfn) , mfn_x(omfn));
  if ( mfn_eq(omfn, mfn_add(mfn, i)) )
-p2m_remove_page(p2m, gfn_x(ogfn), mfn_x(mfn_add(mfn, i)),
+p2m_remove_page(p2m, gfn_x(ogfn), mfn_add(mfn, i),
  0);


Pull this up then onto the now shorter prior line?


Ok.




@@ -2843,53 +2843,53 @@ void audit_p2m(struct domain *d,
  spin_lock(>page_alloc_lock);
  page_list_for_each ( page, >page_list )
  {
-mfn = mfn_x(page_to_mfn(page));
+mfn = page_to_mfn(page);
  
-P2M_PRINTK("auditing guest page, mfn=%#lx\n", mfn);

+P2M_PRINTK("auditing guest page, mfn=%"PRI_mfn"\n", mfn_x(mfn));
  
  od = page_get_owner(page);
  
  if ( od != d )

  {
-P2M_PRINTK("mfn %"PRI_mfn" owner %pd != %pd\n", mfn, od, d);
+P2M_PRINTK("mfn %"PRI_mfn" owner %pd != %pd\n", mfn_x(mfn), od, d);
  continue;
  }
  
-gfn = get_gpfn_from_mfn(mfn);

+gfn = get_pfn_from_mfn(mfn);
  if ( gfn == INVALID_M2P_ENTRY )
  {
  orphans_count++;
-P2M_PRINTK("orphaned guest page: mfn=%#lx has invalid gfn\n",
-   mfn);
+P2M_PRINTK("orphaned guest page: mfn=%"PRI_mfn" has invalid gfn\n",
+   mfn_x(mfn));
  continue;
  }
  
  if ( SHARED_M2P(gfn) )

  {
-P2M_PRINTK("shared mfn (%lx) on domain page list!\n",
-mfn);
+P2M_PRINTK("shared mfn (%"PRI_mfn") on domain page list!\n",
+   mfn_x(mfn));
  continue;
  }
  
  p2mfn = get_gfn_type_access(p2m, gfn, , , 0, NULL);

-if ( mfn_x(p2mfn) != mfn )
+if ( !mfn_eq(p2mfn, mfn) )
  {
  mpbad++;
-P2M_PRINTK("map mismatch mfn %#lx -> gfn %#lx -> mfn %#lx"
+P2M_PRINTK("map mismatch mfn %"PRI_mfn" -> gfn %#lx -> mfn 
%"PRI_mfn""
 " (-> gfn %#lx)\n",
-   mfn, gfn, mfn_x(p2mfn),
+   mfn_x(mfn), gfn, mfn_x(p2mfn),
 (mfn_valid(p2mfn)
-? get_gpfn_from_mfn(mfn_x(p2mfn))
+? get_pfn_from_mfn(p2mfn)
  : -1u));


I realize this is an entirely unrelated change, but the -1u here
is standing out too much to not mention it: Could I talk you into
making this gfn_x(INVALID_GFN) at this occasion?


Hmmm, I am not sure why I missed this one. I will use gfn_x(INVALID_GFN).




--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -500,9 +500,10 @@ extern paddr_t mem_hotplug;
   */

Re: [Xen-devel] [PATCH 16/17] xen/mm: Convert {s, g}et_gpfn_from_mfn() to use typesafe MFN

2020-03-27 Thread Jan Beulich 
On 22.03.2020 17:14, jul...@xen.org wrote:
> @@ -983,19 +984,20 @@ long p2m_pt_audit_p2m(struct p2m_domain *p2m)
>  /* check for 1GB super page */
>  if ( l3e_get_flags(l3e[i3]) & _PAGE_PSE )
>  {
> -mfn = l3e_get_pfn(l3e[i3]);
> -ASSERT(mfn_valid(_mfn(mfn)));
> +mfn = l3e_get_mfn(l3e[i3]);
> +ASSERT(mfn_valid(mfn));
>  /* we have to cover 512x512 4K pages */
>  for ( i2 = 0; 
>i2 < (L2_PAGETABLE_ENTRIES * L1_PAGETABLE_ENTRIES);
>i2++)
>  {
> -m2pfn = get_gpfn_from_mfn(mfn+i2);
> +m2pfn = get_pfn_from_mfn(mfn_add(mfn, i2));
>  if ( m2pfn != (gfn + i2) )
>  {
>  pmbad++;
> -P2M_PRINTK("mismatch: gfn %#lx -> mfn %#lx -> 
> gfn %#lx\n",
> -   gfn + i2, mfn + i2, m2pfn);
> +P2M_PRINTK("mismatch: gfn %#lx -> mfn %"PRI_mfn" 
> gfn %#lx\n",
> +   gfn + i2, mfn_x(mfn_add(mfn, i2)),

As in the earlier patch, "mfn_x(mfn) + i2" would be shorter and
hence imo preferable, especially in printk() and alike invocations.

I would also prefer if you left %#lx alone, with the 2nd best
option being to also use PRI_gfn alongside PRI_mfn. Primarily
I'd like to avoid having a mixture.

Same (for both) at least one more time further down.

> @@ -974,7 +974,7 @@ guest_physmap_add_entry(struct domain *d, gfn_t gfn, 
> mfn_t mfn,
>  P2M_DEBUG("old gfn=%#lx -> mfn %#lx\n",
>gfn_x(ogfn) , mfn_x(omfn));
>  if ( mfn_eq(omfn, mfn_add(mfn, i)) )
> -p2m_remove_page(p2m, gfn_x(ogfn), mfn_x(mfn_add(mfn, i)),
> +p2m_remove_page(p2m, gfn_x(ogfn), mfn_add(mfn, i),
>  0);

Pull this up then onto the now shorter prior line?

> @@ -2843,53 +2843,53 @@ void audit_p2m(struct domain *d,
>  spin_lock(>page_alloc_lock);
>  page_list_for_each ( page, >page_list )
>  {
> -mfn = mfn_x(page_to_mfn(page));
> +mfn = page_to_mfn(page);
>  
> -P2M_PRINTK("auditing guest page, mfn=%#lx\n", mfn);
> +P2M_PRINTK("auditing guest page, mfn=%"PRI_mfn"\n", mfn_x(mfn));
>  
>  od = page_get_owner(page);
>  
>  if ( od != d )
>  {
> -P2M_PRINTK("mfn %"PRI_mfn" owner %pd != %pd\n", mfn, od, d);
> +P2M_PRINTK("mfn %"PRI_mfn" owner %pd != %pd\n", mfn_x(mfn), od, 
> d);
>  continue;
>  }
>  
> -gfn = get_gpfn_from_mfn(mfn);
> +gfn = get_pfn_from_mfn(mfn);
>  if ( gfn == INVALID_M2P_ENTRY )
>  {
>  orphans_count++;
> -P2M_PRINTK("orphaned guest page: mfn=%#lx has invalid gfn\n",
> -   mfn);
> +P2M_PRINTK("orphaned guest page: mfn=%"PRI_mfn" has invalid 
> gfn\n",
> +   mfn_x(mfn));
>  continue;
>  }
>  
>  if ( SHARED_M2P(gfn) )
>  {
> -P2M_PRINTK("shared mfn (%lx) on domain page list!\n",
> -mfn);
> +P2M_PRINTK("shared mfn (%"PRI_mfn") on domain page list!\n",
> +   mfn_x(mfn));
>  continue;
>  }
>  
>  p2mfn = get_gfn_type_access(p2m, gfn, , , 0, NULL);
> -if ( mfn_x(p2mfn) != mfn )
> +if ( !mfn_eq(p2mfn, mfn) )
>  {
>  mpbad++;
> -P2M_PRINTK("map mismatch mfn %#lx -> gfn %#lx -> mfn %#lx"
> +P2M_PRINTK("map mismatch mfn %"PRI_mfn" -> gfn %#lx -> mfn 
> %"PRI_mfn""
> " (-> gfn %#lx)\n",
> -   mfn, gfn, mfn_x(p2mfn),
> +   mfn_x(mfn), gfn, mfn_x(p2mfn),
> (mfn_valid(p2mfn)
> -? get_gpfn_from_mfn(mfn_x(p2mfn))
> +? get_pfn_from_mfn(p2mfn)
>  : -1u));

I realize this is an entirely unrelated change, but the -1u here
is standing out too much to not mention it: Could I talk you into
making this gfn_x(INVALID_GFN) at this occasion?

> --- a/xen/include/asm-x86/mm.h
> +++ b/xen/include/asm-x86/mm.h
> @@ -500,9 +500,10 @@ extern paddr_t mem_hotplug;
>   */
>  extern bool machine_to_phys_mapping_valid;
>  
> -static inline void set_gpfn_from_mfn(unsigned long mfn, unsigned long pfn)
> +static inline void set_pfn_from_mfn(mfn_t mfn_, unsigned long pfn)
>  {
> -const struct domain *d = page_get_owner(mfn_to_page(_mfn(mfn)));
> +const unsigned long mfn = mfn_x(mfn_);

I think it would be better overall if the parameter was named
"mfn" and there was no local variable altogether. This would
bring

Re: [Xen-devel] [PATCH 16/17] xen/mm: Convert {s, g}et_gpfn_from_mfn() to use typesafe MFN

2020-03-23 Thread Julien Grall 

Hi,

On 23/03/2020 12:11, Hongyan Xia wrote:

On Sun, 2020-03-22 at 16:14 +, jul...@xen.org wrote:

From: Julien Grall 

The first parameter of {s,g}et_gpfn_from_mfn() is an MFN, so it can
be
switched to use the typesafe.

At the same time, replace gpfn with pfn in the helpers as they all
deal
with PFN and also turn the macros to static inline.

Note that the return of the getter and the 2nd parameter of the
setter
have not been converted to use typesafe PFN because it was requiring
more changes than expected.

Signed-off-by: Julien Grall 

---
 This was originally sent as part of "xen/arm: Properly disable
M2P
 on Arm" [1].

 Changes since the original version:
 - mfn_to_gmfn() is still present for now so update it
 - Remove stray +
 - Avoid churn in set_pfn_from_mfn() by inverting mfn and mfn_
 - Remove tags
 - Fix build in mem_sharing

 [1] <20190603160350.29806-1-julien.gr...@arm.com>
---
  xen/arch/x86/cpu/mcheck/mcaction.c |  2 +-
  xen/arch/x86/mm.c  | 14 +++
  xen/arch/x86/mm/mem_sharing.c  | 20 -
  xen/arch/x86/mm/p2m-pod.c  |  4 +-
  xen/arch/x86/mm/p2m-pt.c   | 35 
  xen/arch/x86/mm/p2m.c  | 66 +++-
--
  xen/arch/x86/mm/paging.c   |  4 +-
  xen/arch/x86/pv/dom0_build.c   |  6 +--
  xen/arch/x86/x86_64/traps.c|  8 ++--
  xen/common/page_alloc.c|  2 +-
  xen/include/asm-arm/mm.h   |  2 +-
  xen/include/asm-x86/grant_table.h  |  2 +-
  xen/include/asm-x86/mm.h   | 12 --
  xen/include/asm-x86/p2m.h  |  2 +-
  14 files changed, 93 insertions(+), 86 deletions(-)




[...]


diff --git a/xen/include/asm-arm/mm.h b/xen/include/asm-arm/mm.h
index abf4cc23e4..11614f9107 100644
--- a/xen/include/asm-arm/mm.h
+++ b/xen/include/asm-arm/mm.h
@@ -319,7 +319,7 @@ struct page_info *get_page_from_gva(struct vcpu
*v, vaddr_t va,
  #define SHARED_M2P(_e)   ((_e) == SHARED_M2P_ENTRY)
  
  /* Xen always owns P2M on ARM */

-#define set_gpfn_from_mfn(mfn, pfn) do { (void) (mfn), (void)(pfn);
} while (0)
+static inline void set_pfn_from_mfn(mfn_t mfn, unsigned long pfn) {}
  #define mfn_to_gmfn(_d, mfn)  (mfn)


I do not have a setup to compile and test code for Arm, but wouldn't
the compiler complain about unused arguments here? The marco version
explicitly silenced compiler complaints.


The macro version does not use (void)(arg) for silencing unused 
parameter. It is for evaluating (mfn) but ignore the result. A compiler 
would warn without (void) because we build Xen with -Wall which include 
-Wunused-value.


Xen is not used with -Wunused-parameter, so there is no concern about 
unused parameters. If we ever decided to turn on -Wunused-parameter (or 
-Wextra), then we will have quite a bit of code to modify (such as 
callbacks not using all the parameters) to make it compile.


  

diff --git a/xen/include/asm-x86/grant_table.h b/xen/include/asm-
x86/grant_table.h
index 5871238f6d..b6a09c4c6c 100644
--- a/xen/include/asm-x86/grant_table.h
+++ b/xen/include/asm-x86/grant_table.h
@@ -41,7 +41,7 @@ static inline int
replace_grant_host_mapping(uint64_t addr, mfn_t frame,
  #define gnttab_get_frame_gfn(gt, st, idx)
({ \
  mfn_t mfn_ = (st) ? gnttab_status_mfn(gt,
idx)   \
: gnttab_shared_mfn(gt,
idx);  \
-unsigned long gpfn_ =
get_gpfn_from_mfn(mfn_x(mfn_));\
+unsigned long gpfn_ =
get_pfn_from_mfn(mfn_);\
  VALID_M2P(gpfn_) ? _gfn(gpfn_) :
INVALID_GFN;\
  })
  
diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h

index 53f2ed7c7d..2a4f42e78f 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -500,9 +500,10 @@ extern paddr_t mem_hotplug;
   */
  extern bool machine_to_phys_mapping_valid;
  
-static inline void set_gpfn_from_mfn(unsigned long mfn, unsigned

long pfn)
+static inline void set_pfn_from_mfn(mfn_t mfn_, unsigned long pfn)
  {
-const struct domain *d = page_get_owner(mfn_to_page(_mfn(mfn)));
+const unsigned long mfn = mfn_x(mfn_);
+const struct domain *d = page_get_owner(mfn_to_page(mfn_));
  unsigned long entry = (d && (d == dom_cow)) ? SHARED_M2P_ENTRY :
pfn;
  
  if ( !machine_to_phys_mapping_valid )

@@ -515,11 +516,14 @@ static inline void set_gpfn_from_mfn(unsigned
long mfn, unsigned long pfn)
  
  extern struct rangeset *mmio_ro_ranges;
  
-#define get_gpfn_from_mfn(mfn)  (machine_to_phys_mapping[(mfn)])

+static inline unsigned long get_pfn_from_mfn(mfn_t mfn)
+{
+return machine_to_phys_mapping[mfn_x(mfn)];
+}


Any specific reason this (and some other macros) are turned into static
inline? I don't have a problem with them being inline functions but
just wondering if there is a reason to do so.


static inline provides better safety check than

Re: [Xen-devel] [PATCH 16/17] xen/mm: Convert {s, g}et_gpfn_from_mfn() to use typesafe MFN

2020-03-23 Thread Hongyan Xia 
On Sun, 2020-03-22 at 16:14 +, jul...@xen.org wrote:
> From: Julien Grall 
> 
> The first parameter of {s,g}et_gpfn_from_mfn() is an MFN, so it can
> be
> switched to use the typesafe.
> 
> At the same time, replace gpfn with pfn in the helpers as they all
> deal
> with PFN and also turn the macros to static inline.
> 
> Note that the return of the getter and the 2nd parameter of the
> setter
> have not been converted to use typesafe PFN because it was requiring
> more changes than expected.
> 
> Signed-off-by: Julien Grall 
> 
> ---
> This was originally sent as part of "xen/arm: Properly disable
> M2P
> on Arm" [1].
> 
> Changes since the original version:
> - mfn_to_gmfn() is still present for now so update it
> - Remove stray +
> - Avoid churn in set_pfn_from_mfn() by inverting mfn and mfn_
> - Remove tags
> - Fix build in mem_sharing
> 
> [1] <20190603160350.29806-1-julien.gr...@arm.com>
> ---
>  xen/arch/x86/cpu/mcheck/mcaction.c |  2 +-
>  xen/arch/x86/mm.c  | 14 +++
>  xen/arch/x86/mm/mem_sharing.c  | 20 -
>  xen/arch/x86/mm/p2m-pod.c  |  4 +-
>  xen/arch/x86/mm/p2m-pt.c   | 35 
>  xen/arch/x86/mm/p2m.c  | 66 +++-
> --
>  xen/arch/x86/mm/paging.c   |  4 +-
>  xen/arch/x86/pv/dom0_build.c   |  6 +--
>  xen/arch/x86/x86_64/traps.c|  8 ++--
>  xen/common/page_alloc.c|  2 +-
>  xen/include/asm-arm/mm.h   |  2 +-
>  xen/include/asm-x86/grant_table.h  |  2 +-
>  xen/include/asm-x86/mm.h   | 12 --
>  xen/include/asm-x86/p2m.h  |  2 +-
>  14 files changed, 93 insertions(+), 86 deletions(-)
> 
> 

[...]

> diff --git a/xen/include/asm-arm/mm.h b/xen/include/asm-arm/mm.h
> index abf4cc23e4..11614f9107 100644
> --- a/xen/include/asm-arm/mm.h
> +++ b/xen/include/asm-arm/mm.h
> @@ -319,7 +319,7 @@ struct page_info *get_page_from_gva(struct vcpu
> *v, vaddr_t va,
>  #define SHARED_M2P(_e)   ((_e) == SHARED_M2P_ENTRY)
>  
>  /* Xen always owns P2M on ARM */
> -#define set_gpfn_from_mfn(mfn, pfn) do { (void) (mfn), (void)(pfn);
> } while (0)
> +static inline void set_pfn_from_mfn(mfn_t mfn, unsigned long pfn) {}
>  #define mfn_to_gmfn(_d, mfn)  (mfn) 

I do not have a setup to compile and test code for Arm, but wouldn't
the compiler complain about unused arguments here? The marco version
explicitly silenced compiler complaints.
 
> diff --git a/xen/include/asm-x86/grant_table.h b/xen/include/asm-
> x86/grant_table.h
> index 5871238f6d..b6a09c4c6c 100644
> --- a/xen/include/asm-x86/grant_table.h
> +++ b/xen/include/asm-x86/grant_table.h
> @@ -41,7 +41,7 @@ static inline int
> replace_grant_host_mapping(uint64_t addr, mfn_t frame,
>  #define gnttab_get_frame_gfn(gt, st, idx)
> ({ \
>  mfn_t mfn_ = (st) ? gnttab_status_mfn(gt,
> idx)   \
>: gnttab_shared_mfn(gt,
> idx);  \
> -unsigned long gpfn_ =
> get_gpfn_from_mfn(mfn_x(mfn_));\
> +unsigned long gpfn_ =
> get_pfn_from_mfn(mfn_);\
>  VALID_M2P(gpfn_) ? _gfn(gpfn_) :
> INVALID_GFN;\
>  })
>  
> diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
> index 53f2ed7c7d..2a4f42e78f 100644
> --- a/xen/include/asm-x86/mm.h
> +++ b/xen/include/asm-x86/mm.h
> @@ -500,9 +500,10 @@ extern paddr_t mem_hotplug;
>   */
>  extern bool machine_to_phys_mapping_valid;
>  
> -static inline void set_gpfn_from_mfn(unsigned long mfn, unsigned
> long pfn)
> +static inline void set_pfn_from_mfn(mfn_t mfn_, unsigned long pfn)
>  {
> -const struct domain *d = page_get_owner(mfn_to_page(_mfn(mfn)));
> +const unsigned long mfn = mfn_x(mfn_);
> +const struct domain *d = page_get_owner(mfn_to_page(mfn_));
>  unsigned long entry = (d && (d == dom_cow)) ? SHARED_M2P_ENTRY :
> pfn;
>  
>  if ( !machine_to_phys_mapping_valid )
> @@ -515,11 +516,14 @@ static inline void set_gpfn_from_mfn(unsigned
> long mfn, unsigned long pfn)
>  
>  extern struct rangeset *mmio_ro_ranges;
>  
> -#define get_gpfn_from_mfn(mfn)  (machine_to_phys_mapping[(mfn)])
> +static inline unsigned long get_pfn_from_mfn(mfn_t mfn)
> +{
> +return machine_to_phys_mapping[mfn_x(mfn)];
> +}

Any specific reason this (and some other macros) are turned into static
inline? I don't have a problem with them being inline functions but
just wondering if there is a reason to do so.
 
>  #define mfn_to_gmfn(_d, mfn)\
>  ( (paging_mode_translate(_d))   \
> -  ? get_gpfn_from_mfn(mfn)  \
> +  ? get_pfn_from_mfn(_mfn(mfn)) \
>: (mfn) )
>  
>  #define compat_pfn_to_cr3(pfn) (((unsigned)(pfn) << 12) |
> ((unsigned)(pfn) >> 20))
> diff --git a/xen/include/asm-x86/p2m.h b/xen/include/asm-x86/p2m.h
> index