Harden the code by panicing if direct map is too small for current memory
layout taking into account possible PDX compression. Otherwise the assert
is observed:
Assertion '(mfn_to_pdx(maddr_to_mfn(ma)) - directmap_base_pdx) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at ./arch/arm/include/asm/mmu/mm.h:72

At the moment, we don't set max_pdx denoting maximum usable PDX which
should be based on max_page. Consolidate setting of max_page and max_pdx
in init_pdx() for both arm32 and arm64. max_pdx will be used in the
future to set up frametable mappings respecting the PDX grouping.

Signed-off-by: Michal Orzel <michal.orzel@amd.com>
---
A similar check for frametable will be introduced with other changes to
frametable setting in the future.
---
 xen/arch/arm/arm32/mmu/mm.c | 1 -
 xen/arch/arm/arm64/mmu/mm.c | 4 +++-
 xen/arch/arm/setup.c        | 6 +++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/xen/arch/arm/arm32/mmu/mm.c b/xen/arch/arm/arm32/mmu/mm.c
index 4d22f35618aa..e6d9b49acd3c 100644
--- a/xen/arch/arm/arm32/mmu/mm.c
+++ b/xen/arch/arm/arm32/mmu/mm.c
@@ -190,7 +190,6 @@ void __init setup_mm(void)
 
     /* Frame table covers all of RAM region, including holes */
     setup_frametable_mappings(ram_start, ram_end);
-    max_page = PFN_DOWN(ram_end);
 
     /*
      * The allocators may need to use map_domain_page() (such as for
diff --git a/xen/arch/arm/arm64/mmu/mm.c b/xen/arch/arm/arm64/mmu/mm.c
index a0a2dd8cc762..3e64be6ae664 100644
--- a/xen/arch/arm/arm64/mmu/mm.c
+++ b/xen/arch/arm/arm64/mmu/mm.c
@@ -224,6 +224,9 @@ static void __init setup_directmap_mappings(unsigned long base_mfn,
          */
         directmap_virt_start = DIRECTMAP_VIRT_START +
             (base_mfn - mfn_gb) * PAGE_SIZE;
+
+        if ( (max_pdx - directmap_base_pdx) > (DIRECTMAP_SIZE >> PAGE_SHIFT) )
+            panic("Direct map is too small\n");
     }
 
     if ( base_mfn < mfn_x(directmap_mfn_start) )
@@ -278,7 +281,6 @@ void __init setup_mm(void)
     directmap_mfn_end = maddr_to_mfn(ram_end);
 
     setup_frametable_mappings(ram_start, ram_end);
-    max_page = PFN_DOWN(ram_end);
 
     init_staticmem_pages();
     init_sharedmem_pages();
diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c
index 58acc2d0d4b8..93b730ffb5fb 100644
--- a/xen/arch/arm/setup.c
+++ b/xen/arch/arm/setup.c
@@ -254,7 +254,7 @@ static void __init relocate_fdt(const void **dtb_vaddr, size_t dtb_size)
 void __init init_pdx(void)
 {
     const struct membanks *mem = bootinfo_get_mem();
-    paddr_t bank_start, bank_size, bank_end;
+    paddr_t bank_start, bank_size, bank_end, ram_end = 0;
 
     /*
      * Arm does not have any restrictions on the bits to compress. Pass 0 to
@@ -290,10 +290,14 @@ void __init init_pdx(void)
         bank_start = mem->bank[bank].start;
         bank_size = mem->bank[bank].size;
         bank_end = bank_start + bank_size;
+        ram_end = max(ram_end, bank_end);
 
         set_pdx_range(paddr_to_pfn(bank_start),
                       paddr_to_pfn(bank_end));
     }
+
+    max_page = PFN_DOWN(ram_end);
+    max_pdx = pfn_to_pdx(max_page - 1) + 1;
 }
 
 size_t __read_mostly dcache_line_bytes;
-- 
2.25.1

On Fri, 4 Jul 2025, Michal Orzel wrote:
> Harden the code by panicing if direct map is too small for current memory
> layout taking into account possible PDX compression. Otherwise the assert
> is observed:
> Assertion '(mfn_to_pdx(maddr_to_mfn(ma)) - directmap_base_pdx) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at ./arch/arm/include/asm/mmu/mm.h:72
> 
> At the moment, we don't set max_pdx denoting maximum usable PDX which
> should be based on max_page. Consolidate setting of max_page and max_pdx
> in init_pdx() for both arm32 and arm64. max_pdx will be used in the
> future to set up frametable mappings respecting the PDX grouping.
> 
> Signed-off-by: Michal Orzel <michal.orzel@amd.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>

On Fri, Jul 04, 2025 at 09:54:27AM +0000, Michal Orzel wrote:
> Harden the code by panicing if direct map is too small for current memory

NIT: s/panicing/panicking

> layout taking into account possible PDX compression. Otherwise the assert
> is observed:
> Assertion '(mfn_to_pdx(maddr_to_mfn(ma)) - directmap_base_pdx) < (DIRECTMAP_SIZE >> PAGE_SHIFT)' failed at ./arch/arm/include/asm/mmu/mm.h:72
> 
> At the moment, we don't set max_pdx denoting maximum usable PDX which
> should be based on max_page. Consolidate setting of max_page and max_pdx
> in init_pdx() for both arm32 and arm64. max_pdx will be used in the
> future to set up frametable mappings respecting the PDX grouping.
> 
> Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Hari Limaye <hari.limaye@arm.com>
Tested-by: Hari Limaye <hari.limaye@arm.com>

LGTM! Tested (compilation) via both Arm AArch32 and AArch64 builds.

Many thanks,
Hari