Would it be safer to check for ret != 0 here? xc_get_hvm_param calls do_hvm_op, which looks like it can return >0.