... ("A macro parameter used as an operand to the `#' or `##' operators,
which is itself subject to further macro replacement, shall only be used
as an operand to these operators"). Leverage the SAF-6 annotation we have
available.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
As per the placement in arm/tee/ffa.c two instances of the SAF comment
(ahead of the macro definitions) should suffice. Eclair demands one
instance per macro use here, however (much like we have it in
x86/dom{ain,ctl}.c).
---
v2: Use SAF-6 annotations.

--- a/xen/arch/x86/pv/shim.c
+++ b/xen/arch/x86/pv/shim.c
@@ -124,8 +124,10 @@ void __init pv_shim_fixup_e820(void)
     ASSERT(i < ARRAY_SIZE(reserved_pages));     \
     reserved_pages[i++].mfn = pfn;              \
 })
+    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
     MARK_PARAM_RAM(HVM_PARAM_STORE_PFN);
     if ( !pv_console )
+        /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
         MARK_PARAM_RAM(HVM_PARAM_CONSOLE_PFN);
 #undef MARK_PARAM_RAM
 }
@@ -207,10 +209,14 @@ void __init pv_shim_setup_dom(struct dom
         evtchn_reserve(d, param);                                              \
     }                                                                          \
 })
+    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
     SET_AND_MAP_PARAM(HVM_PARAM_STORE_PFN, si->store_mfn, store_va);
+    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
     SET_AND_MAP_PARAM(HVM_PARAM_STORE_EVTCHN, si->store_evtchn, 0);
+    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
     SET_AND_MAP_PARAM(HVM_PARAM_CONSOLE_EVTCHN, si->console.domU.evtchn, 0);
     if ( !pv_console )
+        /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
         SET_AND_MAP_PARAM(HVM_PARAM_CONSOLE_PFN, si->console.domU.mfn,
                           console_va);
 #undef SET_AND_MAP_PARAM

On 2026-05-18 13:42, Jan Beulich wrote:
> ... ("A macro parameter used as an operand to the `#' or `##' 
> operators,
> which is itself subject to further macro replacement, shall only be 
> used
> as an operand to these operators"). Leverage the SAF-6 annotation we 
> have
> available.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> ---
> As per the placement in arm/tee/ffa.c two instances of the SAF comment
> (ahead of the macro definitions) should suffice. Eclair demands one
> instance per macro use here, however (much like we have it in
> x86/dom{ain,ctl}.c).
> ---
> v2: Use SAF-6 annotations.
> 
> --- a/xen/arch/x86/pv/shim.c
> +++ b/xen/arch/x86/pv/shim.c
> @@ -124,8 +124,10 @@ void __init pv_shim_fixup_e820(void)
>      ASSERT(i < ARRAY_SIZE(reserved_pages));     \
>      reserved_pages[i++].mfn = pfn;              \
>  })
> +    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>      MARK_PARAM_RAM(HVM_PARAM_STORE_PFN);
>      if ( !pv_console )
> +        /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>          MARK_PARAM_RAM(HVM_PARAM_CONSOLE_PFN);
>  #undef MARK_PARAM_RAM
>  }
> @@ -207,10 +209,14 @@ void __init pv_shim_setup_dom(struct dom
>          evtchn_reserve(d, param);                                      
>         \
>      }                                                                  
>         \
>  })
> +    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>      SET_AND_MAP_PARAM(HVM_PARAM_STORE_PFN, si->store_mfn, store_va);
> +    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>      SET_AND_MAP_PARAM(HVM_PARAM_STORE_EVTCHN, si->store_evtchn, 0);
> +    /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>      SET_AND_MAP_PARAM(HVM_PARAM_CONSOLE_EVTCHN, 
> si->console.domU.evtchn, 0);
>      if ( !pv_console )
> +        /* SAF-6-safe Rule 20.12 expansion of macros HVM_PARAM_*. */
>          SET_AND_MAP_PARAM(HVM_PARAM_CONSOLE_PFN, si->console.domU.mfn,
>                            console_va);
>  #undef SET_AND_MAP_PARAM

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

On 18.05.2026 16:33, Nicola Vetrini wrote:
> On 2026-05-18 13:42, Jan Beulich wrote:
>> ... ("A macro parameter used as an operand to the `#' or `##' 
>> operators,
>> which is itself subject to further macro replacement, shall only be 
>> used
>> as an operand to these operators"). Leverage the SAF-6 annotation we 
>> have
>> available.
>>
>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>

Thanks.

>> ---
>> As per the placement in arm/tee/ffa.c two instances of the SAF comment
>> (ahead of the macro definitions) should suffice. Eclair demands one
>> instance per macro use here, however (much like we have it in
>> x86/dom{ain,ctl}.c).

Do you perhaps have any insight on this (apparent?) anomaly?

Jan