[xen stable-4.20] xen/arm: fix sparse cpu_possible_map calculation on SMP boot

[patchbot@xxxxxxx]

commit 77015ef70d4fde7a095d7f085bc69d2a66b71296
Author:     Hirokazu Takahashi <taka@xxxxxxxxxxxxx>
AuthorDate: Thu Jul 2 07:40:57 2026 +0900
Commit:     Michal Orzel <michal.orzel@xxxxxxx>
CommitDate: Wed Jul 15 09:48:36 2026 +0200

    xen/arm: fix sparse cpu_possible_map calculation on SMP boot
    
    Currently, during ARM Xen's SMP initialization, if there is
    a Device Tree error (such as an invalid 'enable-method'),
    cpu_possible_map can end up being sparse.
    
    The issue here is that nr_cpu_ids is calculated in a way that
    doesn't properly account for the maximum CPU ID when the map is
    sparse, causing a mismatch. For example, if cpu_possible_map is
    0xff0f, nr_cpu_ids becomes 12, but the actual maximum CPU ID
    is 15. Xen's common code is built on the assumption that
    'CPU ID < nr_cpu_ids', so this mismatch can break things.
    
    To fix this, modify dt_smp_init_cpus() so that if the
    arch_cpu_init() call fails, we don't consume the CPU ID slot.
    
    Fixes: 4557c2292854 ("xen: arm: rewrite start of day page table and cpu 
bring up")
    Signed-off-by: Hirokazu Takahashi <taka@xxxxxxxxxxxxx>
    Reviewed-by: Michal Orzel <michal.orzel@xxxxxxx>
    (cherry picked from commit ccde3773c1762d32fb5f6037d6b22780c30895d3)
---
 xen/arch/arm/smpboot.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/xen/arch/arm/smpboot.c b/xen/arch/arm/smpboot.c
index 04e363088d..0f9300aad8 100644
--- a/xen/arch/arm/smpboot.c
+++ b/xen/arch/arm/smpboot.c
@@ -242,7 +242,9 @@ static void __init dt_smp_init_cpus(void)
         if ( (rc = arch_cpu_init(i, cpu)) < 0 )
         {
             printk("cpu%d init failed (hwid %"PRIregister"): %d\n", i, hwid, 
rc);
-            tmp_map[i] = MPIDR_INVALID;
+
+            if ( i != 0 )
+                cpuidx--;
         }
         else
             tmp_map[i] = hwid;
@@ -255,10 +257,9 @@ static void __init dt_smp_init_cpus(void)
         return;
     }
 
-    for ( i = 0; i < cpuidx; i++ )
+    /* Skip CPU 0 as it was already initialized in smp_prepare_boot_cpu(). */
+    for ( i = 1; i < cpuidx; i++ )
     {
-        if ( tmp_map[i] == MPIDR_INVALID )
-            continue;
         cpumask_set_cpu(i, &cpu_possible_map);
         cpu_logical_map(i) = tmp_map[i];
     }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20