Ping: [PATCH] x86: invoke xenheap_max_mfn() unconditionally

[Jan Beulich <jbeulich@xxxxxxxx>]

On 12.10.2026 13:11, Jan Beulich wrote:
> Calling the function only conditionally can, when highmem_start isn't set
> and when hotplugged memory appears above the boundary where the "short"
> directmap ends, result in Xenheap allocations to yield memory which isn't
> accessible through the "short" directmap. Accesses from PV guest context
> would then either fault or access guest controlled memory.
> 
> With this the bifurcation done by 88e3ed61642b ("x86/NUMA: make
> init_node_heap() respect Xen heap limit") can also be undone:
> end_boot_allocator() can be called from a single place, and system_state
> is bumped right afterwards.
> 
> Fixes: adc5afbf1c70 ("x86: support up to 16Tb")
> Assisted-by: Claude Opus 5.5
> Reported-by: George Dunlap <gwd@xxxxxxxxxxxxxx>
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

This being a bugfix, can we please work towards getting it in?

Thanks, Jan

> --- a/xen/arch/x86/setup.c
> +++ b/xen/arch/x86/setup.c
> @@ -1908,16 +1908,17 @@ if(j == 1/*bm->kind == BOOTMOD_RAMDISK*/
>  
>      numa_initmem_init(0, raw_max_page);
>  
> +    if ( !highmem_start )
> +        xenheap_max_mfn(virt_to_mfn(HYPERVISOR_VIRT_END - 1));
> +
> +    end_boot_allocator();
> +    system_state = SYS_STATE_boot;
> +
>      if ( max_page - 1 > virt_to_mfn(HYPERVISOR_VIRT_END - 1) )
>      {
>          unsigned long lo = virt_to_mfn(HYPERVISOR_VIRT_END - 1);
>          uint64_t mask = PAGE_SIZE - 1;
>  
> -        if ( !highmem_start )
> -            xenheap_max_mfn(lo);
> -
> -        end_boot_allocator();
> -
>          /* Pass the remaining memory in (lo, max_page) to the allocator. */
>          for ( i = 0; i < boot_e820.nr_map; i++ )
>          {
> @@ -1936,10 +1937,6 @@ if(j == 1/*bm->kind == BOOTMOD_RAMDISK*/
>              init_domheap_pages(s, e);
>          }
>      }
> -    else
> -        end_boot_allocator();
> -
> -    system_state = SYS_STATE_boot;
>  
>      bsp_stack = cpu_alloc_stack(0); /* Needs to know IDT vs FRED */
>      if ( !bsp_stack )