[xen master] x86: invoke xenheap_max_mfn() unconditionally

[patchbot@xxxxxxx]

commit f93ffa1309cd7a265038d376d80a007fdea9bf3c
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Nov 2 10:59:27 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Nov 2 10:59:27 2026 +0100

    x86: invoke xenheap_max_mfn() unconditionally
    
    Calling the function only conditionally can, when highmem_start isn't set
    and when hotplugged memory appears above the boundary where the "short"
    directmap ends, result in Xenheap allocations to yield memory which isn't
    accessible through the "short" directmap. Accesses from PV guest context
    would then either fault or access guest controlled memory.
    
    With this the bifurcation done by 88e3ed61642b ("x86/NUMA: make
    init_node_heap() respect Xen heap limit") can also be undone:
    end_boot_allocator() can be called from a single place, and system_state
    is bumped right afterwards.
    
    Fixes: adc5afbf1c70 ("x86: support up to 16Tb")
    Assisted-by: Claude Opus 5.5
    Reported-by: George Dunlap <gwd@xxxxxxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: George Dunlap <gwd@xxxxxxxxxxxxxx>
---
 xen/arch/x86/setup.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 446cd81276..df7cfcc563 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -1916,16 +1916,17 @@ void asmlinkage __init noreturn __start_xen(void)
 
     numa_initmem_init(0, raw_max_page);
 
+    if ( !highmem_start )
+        xenheap_max_mfn(virt_to_mfn(HYPERVISOR_VIRT_END - 1));
+
+    end_boot_allocator();
+    system_state = SYS_STATE_boot;
+
     if ( max_page - 1 > virt_to_mfn(HYPERVISOR_VIRT_END - 1) )
     {
         unsigned long lo = virt_to_mfn(HYPERVISOR_VIRT_END - 1);
         uint64_t mask = PAGE_SIZE - 1;
 
-        if ( !highmem_start )
-            xenheap_max_mfn(lo);
-
-        end_boot_allocator();
-
         /* Pass the remaining memory in (lo, max_page) to the allocator. */
         for ( i = 0; i < boot_e820.nr_map; i++ )
         {
@@ -1944,10 +1945,6 @@ void asmlinkage __init noreturn __start_xen(void)
             init_domheap_pages(s, e);
         }
     }
-    else
-        end_boot_allocator();
-
-    system_state = SYS_STATE_boot;
 
     bsp_stack = cpu_alloc_stack(0); /* Needs to know IDT vs FRED */
     if ( !bsp_stack )
--
generated by git-patchbot for /home/xen/git/xen.git#master