linux-kernel - [PATCH] Partial revert "x86/xen: fix balloon target initialization for PVH dom0"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260120140648.25977-1-roger.pau@citrix.com>
Date: Tue, 20 Jan 2026 15:06:47 +0100
From: Roger Pau Monne <roger.pau@...rix.com>
To: xen-devel@...ts.xenproject.org,
	linux-kernel@...r.kernel.org
Cc: Roger Pau Monne <roger.pau@...rix.com>,
	James Dingwall <james@...gwall.me.uk>,
	Juergen Gross <jgross@...e.com>,
	Stefano Stabellini <sstabellini@...nel.org>,
	Oleksandr Tyshchenko <oleksandr_tyshchenko@...m.com>
Subject: [PATCH] Partial revert "x86/xen: fix balloon target initialization for PVH dom0"

This partially reverts commit 87af633689ce16ddb166c80f32b120e50b1295de so
the current memory target for PV guests is still fetched from
start_info->nr_pages, which matches exactly what the toolstack sets the
initial memory target to.

Using get_num_physpages() is possible on PV also, but needs adjusting to
take into account the ISA hole and the PFN at 0 not considered usable
memory depite being populated, and hence would need extra adjustments.
Instead of carrying those extra adjustments switch back to the previous
code.  That leaves Linux with a difference in how current memory target is
obtained for HVM vs PV, but that's better than adding extra logic just for
PV.

Also, for HVM the target is not (and has never been) accurately calculated,
as in that case part of what starts as guest memory is reused by hvmloader
and possibly other firmware to store ACPI tables and similar firmware
information, thus the memory is no longer being reported as RAM in the
memory map.

Reported-by: James Dingwall <james@...gwall.me.uk>
Signed-off-by: Roger Pau Monné <roger.pau@...rix.com>
---
 drivers/xen/balloon.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 49c3f9926394..e799650f6c8c 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -724,6 +724,7 @@ static int __init balloon_add_regions(void)
 static int __init balloon_init(void)
 {
 	struct task_struct *task;
+	unsigned long current_pages;
 	int rc;

 	if (!xen_domain())
@@ -731,12 +732,15 @@ static int __init balloon_init(void)

 	pr_info("Initialising balloon driver\n");

-	if (xen_released_pages >= get_num_physpages()) {
+	current_pages = xen_pv_domain() ? min(xen_start_info->nr_pages, max_pfn)
+	                                : get_num_physpages();
+
+	if (xen_released_pages >= current_pages) {
 		WARN(1, "Released pages underflow current target");
 		return -ERANGE;
 	}

-	balloon_stats.current_pages = get_num_physpages() - xen_released_pages;
+	balloon_stats.current_pages = current_pages - xen_released_pages;
 	balloon_stats.target_pages  = balloon_stats.current_pages;
 	balloon_stats.balloon_low   = 0;
 	balloon_stats.balloon_high  = 0;
-- 
2.51.0