[PATCH 0/7] xen/mm: Normalize per-domain page counters, >16 TiB per domain

[PATCH 0/7] xen/mm: Normalize per-domain page counters, >16 TiB per domain

[Bernhard Kaindl]

Summary of a comment by Jan Beulich motivating this submission:
> Considering that systems (and hence guests) only ever get larger, we
> should consider to normalize per-domain page counters to unsigned long.

This series enables supporting guests >16 TiB in the future
once the system support for machines >16 TiB is implemented.

1. xen/mm: Normalize common per-domain page counters to unsigned long
2. x86/mm: Normalize X86 per-domain page counters to unsigned long
3. xen/mm: Static memory: Widen assign_pages(nr) to unsigned long
4. xen/mm: Static memory: Widen domstatic plumbing to unsigned long
5. xen/mm: device-tree: Widen static page counts to unsigned long
6. xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages
7. tools/libs/stat/xenstat.c: Extend the "no maximum" sentinel for max_pages

This series is based on the NUMA claim sets v7 series:
https://lists.xen.org/archives/html/xen-devel/2026-05/msg00363.html

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>

Bernhard Kaindl (7):
  xen/mm: Normalize common per-domain page counters to unsigned long
  x86/mm: Normalize X86 per-domain page counters to unsigned long
  xen/mm: Static memory: Widen assign_pages(nr) to unsigned long
  xen/mm: Static memory: Widen domstatic plumbing to unsigned long
  xen/mm: device-tree: Widen static page counts to unsigned long
  xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages
  tools/libs/stat/xenstat.c: Extend the "no maximum" sentinel for
    max_pages

 tools/libs/stat/xenstat.c               |  2 +-
 xen/arch/arm/include/asm/p2m.h          |  2 +-
 xen/arch/x86/dom0_build.c               |  2 +-
 xen/arch/x86/include/asm/domain.h       |  6 ++--
 xen/arch/x86/include/asm/hap.h          |  4 +--
 xen/arch/x86/include/asm/paging.h       |  2 +-
 xen/arch/x86/include/asm/shadow.h       |  2 +-
 xen/arch/x86/mm/hap/hap.c               | 19 ++++++-----
 xen/arch/x86/mm/p2m-pod.c               |  2 +-
 xen/arch/x86/mm/paging.c                |  9 +++---
 xen/arch/x86/mm/shadow/common.c         | 42 ++++++++++++-------------
 xen/common/device-tree/dom0less-build.c |  2 +-
 xen/common/device-tree/static-memory.c  |  9 +-----
 xen/common/device-tree/static-shmem.c   |  9 +++---
 xen/common/grant_table.c                |  2 +-
 xen/common/keyhandler.c                 |  8 ++---
 xen/common/numa.c                       |  2 +-
 xen/common/page_alloc.c                 | 20 ++++++------
 xen/include/xen/mm.h                    |  4 +--
 xen/include/xen/sched.h                 | 16 +++++-----
 20 files changed, 77 insertions(+), 87 deletions(-)

-- 
2.39.5

[PATCH 1/7] xen/mm: Normalize common per-domain page counters to unsigned long

[Bernhard Kaindl]

Prepare common code for >16 TiB domains by normalizing the per-domain
page counts in struct domain (tot_pages, xenheap_pages, extra_pages,
outstanding_pages, max_pages, node_claims and claims[MAX_NUMNODES])
to unsigned long and update related code accordingly:

- Update format specifiers for widened types across affected files. NB:
  - shr_pages and paged_pages are atomic_t; their formats are %d.
  - pod.entry_count in p2m-pod.c is unsigned long; %lu is correct.

Updates for domain_tot_pages():
- unsigned int domain_tot_pages(d) -> unsigned long domain_tot_pages(d).
- assign_pages(): Assign domain_tot_pages(d) to unsigned long likewise.
- sh_min_allocation(): 0U -> 0UL for unsigned long domain_tot_pages().

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 xen/arch/x86/mm/p2m-pod.c       |  2 +-
 xen/arch/x86/mm/shadow/common.c |  2 +-
 xen/common/grant_table.c        |  2 +-
 xen/common/keyhandler.c         |  8 ++++----
 xen/common/numa.c               |  2 +-
 xen/common/page_alloc.c         |  8 ++++----
 xen/include/xen/sched.h         | 16 ++++++++--------
 7 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c
index 7a0bebd2d3b5..14d18b726e80 100644
--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -1270,7 +1270,7 @@ p2m_pod_demand_populate(struct p2m_domain *p2m, gfn_t gfn,
 out_of_memory:
     pod_unlock_and_flush(p2m);
 
-    printk("%s: Dom%d out of PoD memory! (tot=%"PRIu32" ents=%ld dom%d)\n",
+    printk("%s: Dom%d out of PoD memory! (tot=%lu ents=%lu dom%d)\n",
            __func__, d->domain_id, domain_tot_pages(d),
            p2m->pod.entry_count, current->domain->domain_id);
     domain_crash(d);
diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index ed698fa90bc7..e300898fe789 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -768,7 +768,7 @@ static unsigned int sh_min_allocation(const struct domain *d)
      * up of slot zero and an LAPIC page), plus one for HVM's 1-to-1 pagetable.
      */
     unsigned int extra = max(domain_tot_pages(d) / 256,
-                             is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0U) +
+                             is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0UL) +
                          is_hvm_domain(d);
 
     return shadow_min_acceptable_pages(d) +
diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index ac9fed600101..3c1f8876da22 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -2396,7 +2396,7 @@ gnttab_transfer(
                          e->domain_id);
             else
                 gdprintk(XENLOG_INFO,
-                         "Transferee %pd has no headroom (tot %u, max %u, ex %u)\n",
+                         "Transferee %pd has no headroom (tot %lu, max %lu, ex %lu)\n",
                          e, domain_tot_pages(e), e->max_pages, e->extra_pages);
 
             gop.status = GNTST_general_error;
diff --git a/xen/common/keyhandler.c b/xen/common/keyhandler.c
index cb6df2823b00..b1cb9e7ba8d9 100644
--- a/xen/common/keyhandler.c
+++ b/xen/common/keyhandler.c
@@ -278,14 +278,14 @@ static void cf_check dump_domains(unsigned char key)
         printk("    refcnt=%d dying=%d pause_count=%d\n",
                atomic_read(&d->refcnt), d->is_dying,
                atomic_read(&d->pause_count));
-        printk("    nr_pages=%u xenheap_pages=%u"
+        printk("    nr_pages=%lu xenheap_pages=%lu"
 #ifdef CONFIG_MEM_SHARING
-               " shared_pages=%u"
+               " shared_pages=%d"
 #endif
 #ifdef CONFIG_MEM_PAGING
-               " paged_pages=%u"
+               " paged_pages=%d"
 #endif
-               " dirty_cpus={%*pbl} max_pages=%u\n",
+               " dirty_cpus={%*pbl} max_pages=%lu\n",
                domain_tot_pages(d), d->xenheap_pages,
 #ifdef CONFIG_MEM_SHARING
                atomic_read(&d->shr_pages),
diff --git a/xen/common/numa.c b/xen/common/numa.c
index ad75955a1622..8c561578615c 100644
--- a/xen/common/numa.c
+++ b/xen/common/numa.c
@@ -743,7 +743,7 @@ static void cf_check dump_numa(unsigned char key)
 
         process_pending_softirqs();
 
-        printk("%pd (total: %u):\n", d, domain_tot_pages(d));
+        printk("%pd (total: %lu):\n", d, domain_tot_pages(d));
 
         memset(page_num_node, 0, sizeof(page_num_node));
 
diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 1801afc96a0a..3f8b300d8c29 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -2892,11 +2892,11 @@ int assign_pages(
     }
     else if ( !(memflags & MEMF_no_refcount) )
     {
-        unsigned int tot_pages = domain_tot_pages(d);
+        unsigned long tot_pages = domain_tot_pages(d);
 
         if ( unlikely(tot_pages > d->max_pages) )
         {
-            gprintk(XENLOG_INFO, "Inconsistent allocation for %pd: %u > %u\n",
+            gprintk(XENLOG_INFO, "Inconsistent allocation for %pd: %lu > %lu\n",
                     d, tot_pages, d->max_pages);
             rc = -EPERM;
             goto out;
@@ -2904,7 +2904,7 @@ int assign_pages(
 
         if ( unlikely(nr > d->max_pages - tot_pages) )
         {
-            gprintk(XENLOG_INFO, "Over-allocation for %pd: %Lu > %u\n",
+            gprintk(XENLOG_INFO, "Over-allocation for %pd: %Lu > %lu\n",
                     d, tot_pages + 0ULL + nr, d->max_pages);
             rc = -E2BIG;
             goto out;
@@ -2916,7 +2916,7 @@ int assign_pages(
         if ( unlikely(d->tot_pages + nr < nr) )
         {
             gprintk(XENLOG_INFO,
-                    "Excess allocation for %pd: %Lu (%u extra)\n",
+                    "Excess allocation for %pd: %Lu (%lu extra)\n",
                     d, d->tot_pages + 0ULL + nr, d->extra_pages);
             if ( pg[0].count_info & PGC_extra )
                 d->extra_pages -= nr;
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index f671e0c4c7b3..ee9d4a7ff9e3 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -414,17 +414,17 @@ struct domain
      * This field should only be directly accessed by domain_adjust_tot_pages()
      * and the domain_tot_pages() helper function defined below.
      */
-    unsigned int     tot_pages;
+    unsigned long    tot_pages;
 
-    unsigned int     xenheap_pages;     /* pages allocated from Xen heap */
+    unsigned long    xenheap_pages;     /* pages allocated from Xen heap */
     /* Pages claimed but not possessed, protected by global heap_lock. */
-    unsigned int     outstanding_pages;
-    unsigned int     node_claims;       /* Sum of per-node claims. */
+    unsigned long    outstanding_pages;
+    unsigned long    node_claims;       /* Sum of per-node claims. */
     /* Domain objects use dedicated pages, leaving room for per-node claims. */
-    unsigned int     claims[MAX_NUMNODES]; /* Per-NUMA-node claims. */
+    unsigned long    claims[MAX_NUMNODES]; /* Per-NUMA-node claims. */
 
-    unsigned int     max_pages;         /* maximum value for domain_tot_pages() */
-    unsigned int     extra_pages;       /* pages not included in domain_tot_pages() */
+    unsigned long    max_pages;         /* maximum value for domain_tot_pages() */
+    unsigned long    extra_pages;       /* pages not included in domain_tot_pages() */
 
 #ifdef CONFIG_MEM_SHARING
     atomic_t         shr_pages;         /* shared pages */
@@ -691,7 +691,7 @@ static inline struct page_list_head *page_to_list(
 }
 
 /* Return number of pages currently posessed by the domain */
-static inline unsigned int domain_tot_pages(const struct domain *d)
+static inline unsigned long domain_tot_pages(const struct domain *d)
 {
     ASSERT(d->extra_pages <= d->tot_pages);
 
-- 
2.39.5

[PATCH 2/7] x86/mm: Normalize X86 per-domain page counters to unsigned long

[Bernhard Kaindl]

Prepare x86 for >16 TiB domains by normalizing the per-domain page counts
in paging_domain (total_pages, free_pages, p2m_pages) to unsigned long
and widen page counts in related x86 allocation functions accordingly:

- paging_domain.{total,free,p2m}_pages: unsigned int -> unsigned long
- x86/mm/shadow/common.c:
  - unsigned long sh_min_allocation(d)
  - unsigned long shadow_min_acceptable_pages(d)
  - unsigned long shadow_get_allocation(d)
  - shadow_set_allocation(unsigned long pages)
  - shadow_enable(): fix narrowing from d->arch.paging.total_pages to
    unsigned int
- x86/mm/hap/hap.c:
  - unsigned long hap_get_allocation(d)
  - hap_set_allocation(unsigned long pages)
  - hap_enable(): fix narrowing from d->arch.paging.total_pages to
    unsigned int
- x86/mm/paging.c:
  - paging_set_allocation(unsigned long pages)
  - arch_set_paging_mempool_size() don't truncate pages

Note: pages in _shadow_prealloc(), shadow_alloc(), shadow_free() and
shadow_prealloc() is intentionally kept as unsigned int.  It carries
the per-shadow-entry page count from shadow_size() (uint8_t-backed,
max 4), not the pool allocation count.

Note: xen_domctl_shadow_op.mb stays uint32_t, and the domctl ABI remains
MB-based and caps at 4 PiB, replacing the 16 TiB per-domain limit.
Casts widen the mb-to-pages arithmetic to unsigned long where needed.

Suggested-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 xen/arch/x86/include/asm/domain.h |  6 ++---
 xen/arch/x86/include/asm/hap.h    |  4 +--
 xen/arch/x86/include/asm/paging.h |  2 +-
 xen/arch/x86/include/asm/shadow.h |  2 +-
 xen/arch/x86/mm/hap/hap.c         | 19 +++++++-------
 xen/arch/x86/mm/paging.c          |  9 +++----
 xen/arch/x86/mm/shadow/common.c   | 42 +++++++++++++++----------------
 7 files changed, 41 insertions(+), 43 deletions(-)

diff --git a/xen/arch/x86/include/asm/domain.h b/xen/arch/x86/include/asm/domain.h
index 385a6666dafa..d3021a863353 100644
--- a/xen/arch/x86/include/asm/domain.h
+++ b/xen/arch/x86/include/asm/domain.h
@@ -221,9 +221,9 @@ struct paging_domain {
 
     /* Memory allocation (common to shadow and HAP) */
     struct page_list_head   freelist;
-    unsigned int            total_pages;  /* number of pages allocated */
-    unsigned int            free_pages;   /* number of pages on freelists */
-    unsigned int            p2m_pages;    /* number of pages allocated to p2m */
+    unsigned long           total_pages;  /* number of pages allocated */
+    unsigned long           free_pages;   /* number of pages on freelists */
+    unsigned long           p2m_pages;    /* number of pages allocated to p2m */
 
     /* log dirty support */
     struct log_dirty_domain log_dirty;
diff --git a/xen/arch/x86/include/asm/hap.h b/xen/arch/x86/include/asm/hap.h
index f01ce73fb4f3..061181724e90 100644
--- a/xen/arch/x86/include/asm/hap.h
+++ b/xen/arch/x86/include/asm/hap.h
@@ -33,8 +33,8 @@ int   hap_track_dirty_vram(struct domain *d,
                            XEN_GUEST_HANDLE(void) guest_dirty_bitmap);
 
 extern const struct paging_mode *hap_paging_get_mode(struct vcpu *v);
-int hap_set_allocation(struct domain *d, unsigned int pages, bool *preempted);
-unsigned int hap_get_allocation(struct domain *d);
+int hap_set_allocation(struct domain *d, unsigned long pages, bool *preempted);
+unsigned long hap_get_allocation(struct domain *d);
 
 #endif /* XEN_HAP_H */
 
diff --git a/xen/arch/x86/include/asm/paging.h b/xen/arch/x86/include/asm/paging.h
index 291ab386e865..fd52290cfe89 100644
--- a/xen/arch/x86/include/asm/paging.h
+++ b/xen/arch/x86/include/asm/paging.h
@@ -310,7 +310,7 @@ void paging_dump_vcpu_info(struct vcpu *v);
  * Input might be rounded up to at minimum amount of pages, plus
  * space for the p2m table.
  * Returns 0 for success, non-zero for failure. */
-int paging_set_allocation(struct domain *d, unsigned int pages,
+int paging_set_allocation(struct domain *d, unsigned long pages,
                           bool *preempted);
 
 /* Is gfn within maxphysaddr for the domain? */
diff --git a/xen/arch/x86/include/asm/shadow.h b/xen/arch/x86/include/asm/shadow.h
index 60589c3cacee..8aac018132ac 100644
--- a/xen/arch/x86/include/asm/shadow.h
+++ b/xen/arch/x86/include/asm/shadow.h
@@ -91,7 +91,7 @@ void shadow_blow_tables_per_domain(struct domain *d);
  * Input will be rounded up to at least shadow_min_acceptable_pages(),
  * plus space for the p2m table.
  * Returns 0 for success, non-zero for failure. */
-int shadow_set_allocation(struct domain *d, unsigned int pages,
+int shadow_set_allocation(struct domain *d, unsigned long pages,
                           bool *preempted);
 
 /* Helper to invoke for deferred releasing of a top-level shadow's reference. */
diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c
index 5ccb80bda5d3..ccea676c361b 100644
--- a/xen/arch/x86/mm/hap/hap.c
+++ b/xen/arch/x86/mm/hap/hap.c
@@ -327,18 +327,18 @@ static void cf_check hap_free_p2m_page(struct domain *d, struct page_info *pg)
 }
 
 /* Return the size of the pool, rounded up to the nearest MB */
-unsigned int hap_get_allocation(struct domain *d)
+unsigned long hap_get_allocation(struct domain *d)
 {
-    unsigned int pg = d->arch.paging.total_pages
+    unsigned long pg = d->arch.paging.total_pages
         + d->arch.paging.p2m_pages;
 
     return ((pg >> (20 - PAGE_SHIFT))
-            + ((pg & ((1 << (20 - PAGE_SHIFT)) - 1)) ? 1 : 0));
+            + ((pg & ((1UL << (20 - PAGE_SHIFT)) - 1)) ? 1 : 0));
 }
 
 /* Set the pool of pages to the required number of pages.
  * Returns 0 for success, non-zero for failure. */
-int hap_set_allocation(struct domain *d, unsigned int pages, bool *preempted)
+int hap_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
 {
     struct page_info *pg;
 
@@ -456,7 +456,6 @@ void hap_domain_init(struct domain *d)
 /* return 0 for success, -errno for failure */
 int hap_enable(struct domain *d, u32 mode)
 {
-    unsigned int old_pages;
     unsigned int i;
     int rv = 0;
 
@@ -469,8 +468,7 @@ int hap_enable(struct domain *d, u32 mode)
 
     domain_pause(d);
 
-    old_pages = d->arch.paging.total_pages;
-    if ( old_pages == 0 )
+    if ( d->arch.paging.total_pages == 0UL )
     {
         paging_lock(d);
         rv = hap_set_allocation(d, 256, NULL);
@@ -623,14 +621,14 @@ void hap_teardown(struct domain *d, bool *preempted)
 
     paging_lock(d); /* Keep various asserts happy */
 
-    if ( d->arch.paging.total_pages != 0 )
+    if ( d->arch.paging.total_pages != 0UL )
     {
         hap_set_allocation(d, 0, preempted);
 
         if ( preempted && *preempted )
             goto out;
 
-        ASSERT(d->arch.paging.total_pages == 0);
+        ASSERT(d->arch.paging.total_pages == 0UL);
     }
 
     d->arch.paging.mode &= ~PG_log_dirty;
@@ -651,7 +649,8 @@ int hap_domctl(struct domain *d, struct xen_domctl_shadow_op *sc,
     {
     case XEN_DOMCTL_SHADOW_OP_SET_ALLOCATION:
         paging_lock(d);
-        rc = hap_set_allocation(d, sc->mb << (20 - PAGE_SHIFT), &preempted);
+        rc = hap_set_allocation(d, (unsigned long)sc->mb << (20 - PAGE_SHIFT),
+                                &preempted);
         paging_unlock(d);
         if ( preempted )
             /* Not finished.  Set up to re-run the call. */
diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index 2396f81ad54a..fa269b8cf39c 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -812,7 +812,7 @@ void paging_final_teardown(struct domain *d)
 {
     bool hap = hap_enabled(d);
 
-    PAGING_PRINTK("%pd start: total = %u, free = %u, p2m = %u\n",
+    PAGING_PRINTK("%pd start: total = %lu, free = %lu, p2m = %lu\n",
                   d, d->arch.paging.total_pages,
                   d->arch.paging.free_pages, d->arch.paging.p2m_pages);
 
@@ -834,7 +834,7 @@ void paging_final_teardown(struct domain *d)
     /* It is now safe to pull down the p2m map. */
     p2m_teardown(p2m_get_hostp2m(d), true, NULL);
 
-    PAGING_PRINTK("%pd done: total = %u, free = %u, p2m = %u\n",
+    PAGING_PRINTK("%pd done: total = %lu, free = %lu, p2m = %lu\n",
                   d, d->arch.paging.total_pages,
                   d->arch.paging.free_pages, d->arch.paging.p2m_pages);
     ASSERT(!d->arch.paging.p2m_pages);
@@ -941,7 +941,7 @@ void paging_update_nestedmode(struct vcpu *v)
     hvm_asid_flush_vcpu(v);
 }
 
-int __init paging_set_allocation(struct domain *d, unsigned int pages,
+int __init paging_set_allocation(struct domain *d, unsigned long pages,
                                  bool *preempted)
 {
     int rc;
@@ -983,8 +983,7 @@ int arch_set_paging_mempool_size(struct domain *d, uint64_t size)
     if ( is_pv_domain(d) )                 /* TODO: Relax in due course */
         return -EOPNOTSUPP;
 
-    if ( size & ~PAGE_MASK ||              /* Non page-sized request? */
-         pages != (unsigned int)pages )    /* Overflow $X_set_allocation()? */
+    if ( size & ~PAGE_MASK )               /* Non page-sized request? */
         return -EINVAL;
 
     paging_lock(d);
diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index e300898fe789..814907cec31e 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -302,7 +302,7 @@ sh_validate_guest_entry(struct vcpu *v, mfn_t gmfn, void *entry, u32 size)
  * allow for more than ninety allocated pages per vcpu.  We round that
  * up to 128 pages, or half a megabyte per vcpu.
  */
-static unsigned int shadow_min_acceptable_pages(const struct domain *d)
+static unsigned long shadow_min_acceptable_pages(const struct domain *d)
 {
     return d->max_vcpus * 128;
 }
@@ -408,7 +408,7 @@ static bool __must_check _shadow_prealloc(struct domain *d, unsigned int pages)
     /* Nothing more we can do: all remaining shadows are of pages that
      * hold Xen mappings for some vcpu.  This can never happen. */
     printk(XENLOG_ERR "Can't pre-allocate %u shadow pages!\n"
-           "  shadow pages total = %u, free = %u, p2m=%u\n",
+           "  shadow pages total = %lu, free = %lu, p2m=%lu\n",
            pages, d->arch.paging.total_pages,
            d->arch.paging.free_pages, d->arch.paging.p2m_pages);
 
@@ -709,7 +709,7 @@ shadow_alloc_p2m_page(struct domain *d)
         {
             d->arch.paging.p2m_alloc_failed = 1;
             dprintk(XENLOG_ERR,
-                    "d%d failed to allocate from shadow pool (tot=%u p2m=%u min=%u)\n",
+                    "d%d failed to allocate from shadow pool (tot=%lu p2m=%lu min=%lu)\n",
                     d->domain_id, d->arch.paging.total_pages,
                     d->arch.paging.p2m_pages,
                     shadow_min_acceptable_pages(d));
@@ -760,22 +760,22 @@ shadow_free_p2m_page(struct domain *d, struct page_info *pg)
     paging_unlock(d);
 }
 
-static unsigned int sh_min_allocation(const struct domain *d)
+static unsigned long sh_min_allocation(const struct domain *d)
 {
     /*
      * Don't allocate less than the minimum acceptable, plus one page per
      * megabyte of RAM (for the p2m table, minimally enough for HVM's setting
      * up of slot zero and an LAPIC page), plus one for HVM's 1-to-1 pagetable.
      */
-    unsigned int extra = max(domain_tot_pages(d) / 256,
-                             is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0UL) +
-                         is_hvm_domain(d);
+    unsigned long extra = max(domain_tot_pages(d) / 256,
+                              is_hvm_domain(d) ? CONFIG_PAGING_LEVELS + 2 : 0UL) +
+                          is_hvm_domain(d);
 
     return shadow_min_acceptable_pages(d) +
            max(extra, d->arch.paging.p2m_pages);
 }
 
-int shadow_set_allocation(struct domain *d, unsigned int pages, bool *preempted)
+int shadow_set_allocation(struct domain *d, unsigned long pages, bool *preempted)
 {
     struct page_info *sp;
 
@@ -784,14 +784,14 @@ int shadow_set_allocation(struct domain *d, unsigned int pages, bool *preempted)
     if ( pages > 0 )
     {
         /* Check for minimum value. */
-        unsigned int lower_bound = sh_min_allocation(d);
+        unsigned long lower_bound = sh_min_allocation(d);
 
         if ( pages < lower_bound )
             pages = lower_bound;
         pages -= d->arch.paging.p2m_pages;
     }
 
-    SHADOW_PRINTK("current %i target %i\n",
+    SHADOW_PRINTK("current %lu target %lu\n",
                    d->arch.paging.total_pages, pages);
 
     for ( ; ; )
@@ -846,12 +846,12 @@ int shadow_set_allocation(struct domain *d, unsigned int pages, bool *preempted)
 }
 
 /* Return the size of the shadow pool, rounded up to the nearest MB */
-static unsigned int shadow_get_allocation(struct domain *d)
+static unsigned long shadow_get_allocation(struct domain *d)
 {
-    unsigned int pg = d->arch.paging.total_pages
+    unsigned long pg = d->arch.paging.total_pages
         + d->arch.paging.p2m_pages;
     return ((pg >> (20 - PAGE_SHIFT))
-            + ((pg & ((1 << (20 - PAGE_SHIFT)) - 1)) ? 1 : 0));
+            + ((pg & ((1UL << (20 - PAGE_SHIFT)) - 1)) ? 1 : 0));
 }
 
 /**************************************************************************/
@@ -2085,7 +2085,6 @@ int shadow_enable(struct domain *d, u32 mode)
  * disabled.
  * Returns 0 for success, -errno for failure. */
 {
-    unsigned int old_pages;
     struct page_info *pg = NULL;
     uint32_t *e;
     int rv = 0;
@@ -2103,8 +2102,7 @@ int shadow_enable(struct domain *d, u32 mode)
     }
 
     /* Init the shadow memory allocation if the user hasn't done so */
-    old_pages = d->arch.paging.total_pages;
-    if ( old_pages < sh_min_allocation(d) )
+    if ( d->arch.paging.total_pages < sh_min_allocation(d) )
     {
         paging_lock(d);
         rv = shadow_set_allocation(d, 1024, NULL); /* Use at least 4MB */
@@ -2283,7 +2281,7 @@ void shadow_teardown(struct domain *d, bool *preempted)
     }
 #endif /* (SHADOW_OPTIMIZATIONS & (SHOPT_VIRTUAL_TLB|SHOPT_OUT_OF_SYNC)) */
 
-    if ( d->arch.paging.total_pages != 0 )
+    if ( d->arch.paging.total_pages != 0UL )
     {
         /* Destroy all the shadows and release memory to domheap */
         shadow_set_allocation(d, 0, preempted);
@@ -2295,7 +2293,7 @@ void shadow_teardown(struct domain *d, bool *preempted)
         if (d->arch.paging.shadow.hash_table)
             shadow_hash_teardown(d);
 
-        ASSERT(d->arch.paging.total_pages == 0);
+        ASSERT(d->arch.paging.total_pages == 0UL);
     }
 
     /* Free the non-paged-vcpus pagetable; must happen after we've
@@ -2410,7 +2408,7 @@ static int shadow_one_bit_disable(struct domain *d, u32 mode)
     {
         /* Get this domain off shadows */
         SHADOW_PRINTK("un-shadowing of domain %u starts."
-                       "  Shadow pages total = %u, free = %u, p2m=%u\n",
+                       "  Shadow pages total = %lu, free = %lu, p2m=%lu\n",
                        d->domain_id, d->arch.paging.total_pages,
                        d->arch.paging.free_pages, d->arch.paging.p2m_pages);
         for_each_vcpu(d, v)
@@ -2441,7 +2439,7 @@ static int shadow_one_bit_disable(struct domain *d, u32 mode)
             BUG(); /* In fact, we will have BUG()ed already */
         shadow_hash_teardown(d);
         SHADOW_PRINTK("un-shadowing of domain %u done."
-                       "  Shadow pages total = %u, free = %u, p2m=%u\n",
+                       "  Shadow pages total = %lu, free = %lu, p2m=%lu\n",
                        d->domain_id, d->arch.paging.total_pages,
                        d->arch.paging.free_pages, d->arch.paging.p2m_pages);
     }
@@ -2573,7 +2571,9 @@ int shadow_domctl(struct domain *d,
             paging_unlock(d);
             return -EINVAL;
         }
-        rc = shadow_set_allocation(d, sc->mb << (20 - PAGE_SHIFT), &preempted);
+        rc = shadow_set_allocation(d,
+                                   (unsigned long)sc->mb << (20 - PAGE_SHIFT),
+                                   &preempted);
         paging_unlock(d);
         if ( preempted )
             /* Not finished.  Set up to re-run the call. */
-- 
2.39.5

[PATCH 3/7] xen/mm: Static memory: Widen assign_pages(nr) to unsigned long

[Bernhard Kaindl]

Static memory assignment is currently limited UINT_MAX pages.
To normalize on unsigned long, widen assign_pages() for unsigned long.

Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 xen/common/page_alloc.c | 8 ++++----
 xen/include/xen/mm.h    | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 3f8b300d8c29..8670233c550d 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -2851,12 +2851,12 @@ void init_domheap_pages(paddr_t ps, paddr_t pe)
 
 int assign_pages(
     struct page_info *pg,
-    unsigned int nr,
+    unsigned long nr,
     struct domain *d,
     unsigned int memflags)
 {
     int rc = 0;
-    unsigned int i;
+    unsigned long i;
 
     nrspin_lock(&d->page_alloc_lock);
 
@@ -2870,7 +2870,7 @@ int assign_pages(
 
 #ifndef NDEBUG
     {
-        unsigned int extra_pages = 0;
+        unsigned long extra_pages = 0;
 
         for ( i = 0; i < nr; i++ )
         {
@@ -2947,7 +2947,7 @@ int assign_pages(
 int assign_page(struct page_info *pg, unsigned int order, struct domain *d,
                 unsigned int memflags)
 {
-    return assign_pages(pg, 1U << order, d, memflags);
+    return assign_pages(pg, 1UL << order, d, memflags);
 }
 
 struct page_info *alloc_domheap_pages(
diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
index b3a35c4bc8d6..b4330269418d 100644
--- a/xen/include/xen/mm.h
+++ b/xen/include/xen/mm.h
@@ -168,7 +168,7 @@ void heap_init_late(void);
 
 int assign_pages(
     struct page_info *pg,
-    unsigned int nr,
+    unsigned long nr,
     struct domain *d,
     unsigned int memflags);
 
-- 
2.39.5

[PATCH 4/7] xen/mm: Static memory: Widen domstatic plumbing to unsigned long

[Bernhard Kaindl]

As assign_pages() accepts unsigned long nr, we can widen
its domstatic users to pass unsigned long nr_mfns to it:

- acquire_domstatic_pages(), assign_domstatic_pages(): Widen nr_mfns.
- acquire_static_memory_bank() remove check for psize to fit in unsigned int

Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 xen/common/device-tree/static-memory.c | 7 -------
 xen/common/page_alloc.c                | 4 ++--
 xen/include/xen/mm.h                   | 2 +-
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/xen/common/device-tree/static-memory.c b/xen/common/device-tree/static-memory.c
index ffbc12aa24df..e04d6cc06505 100644
--- a/xen/common/device-tree/static-memory.c
+++ b/xen/common/device-tree/static-memory.c
@@ -46,13 +46,6 @@ static mfn_t __init acquire_static_memory_bank(struct domain *d,
 
     device_tree_get_reg(cell, addr_cells, size_cells, pbase, psize);
     ASSERT(IS_ALIGNED(*pbase, PAGE_SIZE) && IS_ALIGNED(*psize, PAGE_SIZE));
-    if ( PFN_DOWN(*psize) > UINT_MAX )
-    {
-        printk(XENLOG_ERR "%pd: static memory size too large: %#"PRIpaddr,
-               d, *psize);
-        return INVALID_MFN;
-    }
-
     smfn = maddr_to_mfn(*pbase);
     res = acquire_domstatic_pages(d, smfn, PFN_DOWN(*psize), 0);
     if ( res )
diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 8670233c550d..cb2618f6aee5 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -3368,7 +3368,7 @@ static struct page_info * __init acquire_staticmem_pages(mfn_t smfn,
 }
 
 static int assign_domstatic_pages(struct domain *d, struct page_info *pg,
-                                  unsigned int nr_mfns, unsigned int memflags)
+                                  unsigned long nr_mfns, unsigned int memflags)
 {
     if ( !d || (memflags & (MEMF_no_owner | MEMF_no_refcount)) )
     {
@@ -3391,7 +3391,7 @@ static int assign_domstatic_pages(struct domain *d, struct page_info *pg,
  * then assign them to one specific domain #d.
  */
 int __init acquire_domstatic_pages(struct domain *d, mfn_t smfn,
-                                   unsigned int nr_mfns, unsigned int memflags)
+                                   unsigned long nr_mfns, unsigned int memflags)
 {
     struct page_info *pg;
 
diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
index b4330269418d..48feb664f057 100644
--- a/xen/include/xen/mm.h
+++ b/xen/include/xen/mm.h
@@ -107,7 +107,7 @@ bool scrub_free_pages(void);
 void unprepare_staticmem_pages(struct page_info *pg, unsigned long nr_mfns,
                                bool need_scrub);
 void free_domstatic_page(struct page_info *page);
-int acquire_domstatic_pages(struct domain *d, mfn_t smfn, unsigned int nr_mfns,
+int acquire_domstatic_pages(struct domain *d, mfn_t smfn, unsigned long nr_mfns,
                             unsigned int memflags);
 
 /* Map machine page range in Xen virtual address space. */
-- 
2.39.5

[PATCH 5/7] xen/mm: device-tree: Widen static page counts to unsigned long

[Bernhard Kaindl]

As the domstatic memory plumbing supports unsigned long nr_mfns,
update the device tree handlers to no longer truncate to unsigned int:

- xen/common/device-tree/static-memory.c:
  - append_static_memory_to_bank() Widen nr_pages to unsigned long

- xen/common/device-tree/static-shmem.c:
  - process_shm(): Widen loop variable to unsigned long.

- xen/common/device-tree/dom0less-build.c, static-shmem.c,
  - alloc_xenstore_page() and acquire_shared_memory_bank():
    Update checks narrowing pages to UINT_MAX to ULONG_MAX.

- xen/arch/arm/include/asm/p2m.h: guest_physmap_add_pages():
  Accept and pass-through unsigned long nr_pages(used for static maps)

Already correct:
- struct paging_domain.p2m_total_pages is unsigned long.
- p2m_set_allocation() takes unsigned long pages.
- arch_get_paging_mempool_size() uses (uint64_t)... << PAGE_SHIFT.
- p2m_insert_mapping(), map_regions_p2mt(), unmap_regions_p2mt(),
  map_mmio_regions() and unmap_mmio_regions() all already take
  unsigned long nr.

Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 xen/arch/arm/include/asm/p2m.h          | 2 +-
 xen/common/device-tree/dom0less-build.c | 2 +-
 xen/common/device-tree/static-memory.c  | 2 +-
 xen/common/device-tree/static-shmem.c   | 9 ++++-----
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/xen/arch/arm/include/asm/p2m.h b/xen/arch/arm/include/asm/p2m.h
index 4a4913716bdd..f719b8f1291f 100644
--- a/xen/arch/arm/include/asm/p2m.h
+++ b/xen/arch/arm/include/asm/p2m.h
@@ -348,7 +348,7 @@ guest_physmap_add_page(struct domain *d, gfn_t gfn, mfn_t mfn,
 static inline int guest_physmap_add_pages(struct domain *d,
                                           gfn_t gfn,
                                           mfn_t mfn,
-                                          unsigned int nr_pages)
+                                          unsigned long nr_pages)
 {
     return p2m_insert_mapping(d, gfn, nr_pages, mfn, p2m_ram_rw);
 }
diff --git a/xen/common/device-tree/dom0less-build.c b/xen/common/device-tree/dom0less-build.c
index eacfd93087ae..16c72682db54 100644
--- a/xen/common/device-tree/dom0less-build.c
+++ b/xen/common/device-tree/dom0less-build.c
@@ -592,7 +592,7 @@ static int __init alloc_xenstore_page(struct domain *d)
     gfn_t gfn;
     int rc;
 
-    if ( (UINT_MAX - d->max_pages) < 1 )
+    if ( (ULONG_MAX - d->max_pages) < 1 )
     {
         printk(XENLOG_ERR "%pd: Over-allocation for d->max_pages by 1 page.\n",
                d);
diff --git a/xen/common/device-tree/static-memory.c b/xen/common/device-tree/static-memory.c
index e04d6cc06505..3abc62f080e5 100644
--- a/xen/common/device-tree/static-memory.c
+++ b/xen/common/device-tree/static-memory.c
@@ -11,7 +11,7 @@ static bool __init append_static_memory_to_bank(struct domain *d,
                                                 paddr_t size)
 {
     int res;
-    unsigned int nr_pages = PFN_DOWN(size);
+    unsigned long nr_pages = PFN_DOWN(size);
     gfn_t sgfn;
 
     /*
diff --git a/xen/common/device-tree/static-shmem.c b/xen/common/device-tree/static-shmem.c
index 4c4cc1b123ac..64ed04e68487 100644
--- a/xen/common/device-tree/static-shmem.c
+++ b/xen/common/device-tree/static-shmem.c
@@ -96,7 +96,7 @@ static mfn_t __init acquire_shared_memory_bank(struct domain *d,
      * into domain_tot_pages().
      */
     nr_pfns = PFN_DOWN(psize);
-    if ( (UINT_MAX - d->max_pages) < nr_pfns )
+    if ( (ULONG_MAX - d->max_pages) < nr_pfns )
     {
         printk(XENLOG_ERR "%pd: Over-allocation for d->max_pages: %lu.\n",
                d, nr_pfns);
@@ -313,7 +313,6 @@ int __init process_shm(struct domain *d, struct kernel_info *kinfo,
         uint32_t addr_cells;
         paddr_t gbase, pbase, psize;
         int ret = 0;
-        unsigned int i;
         const char *role_str;
         const char *shm_id;
 
@@ -362,11 +361,11 @@ int __init process_shm(struct domain *d, struct kernel_info *kinfo,
                 return -EINVAL;
             }
 
-            for ( i = 0; i < PFN_DOWN(psize); i++ )
-                if ( !mfn_valid(mfn_add(maddr_to_mfn(pbase), i)) )
+            for ( unsigned long page = 0; page < PFN_DOWN(psize); page++ )
+                if ( !mfn_valid(mfn_add(maddr_to_mfn(pbase), page)) )
                 {
                     printk("%pd: invalid physical address 0x%"PRI_mfn"\n",
-                        d, mfn_x(mfn_add(maddr_to_mfn(pbase), i)));
+                           d, mfn_x(mfn_add(maddr_to_mfn(pbase), page)));
                     return -EINVAL;
                 }
 
-- 
2.39.5

[PATCH 6/7] xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages

[Bernhard Kaindl]

dom0_compute_nr_pages(): Update the upper limit for Dom0's max_pages
in dom0_compute_nr_pages() to limit from UINT_MAX to ULONG_MAX.

Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
----
Creating a Dom0 of > 16TB isn't a useful thing, but could be for testing.
---
 xen/arch/x86/dom0_build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/dom0_build.c b/xen/arch/x86/dom0_build.c
index 80308ca9af46..2ebb8308fbaf 100644
--- a/xen/arch/x86/dom0_build.c
+++ b/xen/arch/x86/dom0_build.c
@@ -440,7 +440,7 @@ unsigned long __init dom0_compute_nr_pages(
         }
     }
 
-    d->max_pages = min_t(unsigned long, max_pages, UINT_MAX);
+    d->max_pages = min_t(unsigned long, max_pages, ULONG_MAX);
 
     return nr_pages;
 }
-- 
2.39.5

[PATCH 7/7] tools/libs/stat/xenstat.c: Extend the "no maximum" sentinel for max_pages

[Bernhard Kaindl]

In xenstat_get_node(), update the "no maximum" sentinel for max_pages
from UINT_MAX to ULONG_MAX, which is converted to (unsigned long long)-1.

Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
---
 tools/libs/stat/xenstat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/libs/stat/xenstat.c b/tools/libs/stat/xenstat.c
index 8bab2e66a7fe..376136871487 100644
--- a/tools/libs/stat/xenstat.c
+++ b/tools/libs/stat/xenstat.c
@@ -221,7 +221,7 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, unsigned int flags)
 			    ((unsigned long long)domaininfo[i].tot_pages)
 			    * handle->page_size;
 			domain->max_mem =
-			    domaininfo[i].max_pages == UINT_MAX
+			    domaininfo[i].max_pages == ULONG_MAX
 			    ? (unsigned long long)-1
 			    : (unsigned long long)(domaininfo[i].max_pages
 						   * handle->page_size);
-- 
2.39.5

Re: [PATCH 0/7] xen/mm: Normalize per-domain page counters, >16 TiB per domain

[Jan Beulich]

On 29.05.2026 14:43, Bernhard Kaindl wrote:
> Summary of a comment by Jan Beulich motivating this submission:
>> Considering that systems (and hence guests) only ever get larger, we
>> should consider to normalize per-domain page counters to unsigned long.
> 
> This series enables supporting guests >16 TiB in the future
> once the system support for machines >16 TiB is implemented.
> 
> 1. xen/mm: Normalize common per-domain page counters to unsigned long
> 2. x86/mm: Normalize X86 per-domain page counters to unsigned long
> 3. xen/mm: Static memory: Widen assign_pages(nr) to unsigned long
> 4. xen/mm: Static memory: Widen domstatic plumbing to unsigned long
> 5. xen/mm: device-tree: Widen static page counts to unsigned long
> 6. xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages
> 7. tools/libs/stat/xenstat.c: Extend the "no maximum" sentinel for max_pages
> 
> This series is based on the NUMA claim sets v7 series:
> https://lists.xen.org/archives/html/xen-devel/2026-05/msg00363.html
> 
> Suggested-by: Jan Beulich <jbeulich@suse.com>
> Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
> 
> Bernhard Kaindl (7):
>   xen/mm: Normalize common per-domain page counters to unsigned long
>   x86/mm: Normalize X86 per-domain page counters to unsigned long
>   xen/mm: Static memory: Widen assign_pages(nr) to unsigned long
>   xen/mm: Static memory: Widen domstatic plumbing to unsigned long
>   xen/mm: device-tree: Widen static page counts to unsigned long
>   xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages
>   tools/libs/stat/xenstat.c: Extend the "no maximum" sentinel for
>     max_pages

Btw, I have no copy of this last patch in may mailbox. Going from the
list archive, imo using ULONG_MAX is as bad as UINT_MAX: There'll be the
same issue again when the field type changes another time. This really
needs abstracting properly, imo. Yet then I'm not a toolstack
maintainer ...

Jan

Re: [PATCH 1/7] xen/mm: Normalize common per-domain page counters to unsigned long

[Jan Beulich]

On 29.05.2026 14:43, Bernhard Kaindl wrote:
> --- a/xen/include/xen/sched.h
> +++ b/xen/include/xen/sched.h
> @@ -414,17 +414,17 @@ struct domain
>       * This field should only be directly accessed by domain_adjust_tot_pages()
>       * and the domain_tot_pages() helper function defined below.
>       */
> -    unsigned int     tot_pages;
> +    unsigned long    tot_pages;
>  
> -    unsigned int     xenheap_pages;     /* pages allocated from Xen heap */
> +    unsigned long    xenheap_pages;     /* pages allocated from Xen heap */

I'd like to at least raise the question: Are we perhaps going too far by
promoting this and ...

>      /* Pages claimed but not possessed, protected by global heap_lock. */
> -    unsigned int     outstanding_pages;
> -    unsigned int     node_claims;       /* Sum of per-node claims. */
> +    unsigned long    outstanding_pages;
> +    unsigned long    node_claims;       /* Sum of per-node claims. */
>      /* Domain objects use dedicated pages, leaving room for per-node claims. */
> -    unsigned int     claims[MAX_NUMNODES]; /* Per-NUMA-node claims. */
> +    unsigned long    claims[MAX_NUMNODES]; /* Per-NUMA-node claims. */
>  
> -    unsigned int     max_pages;         /* maximum value for domain_tot_pages() */
> -    unsigned int     extra_pages;       /* pages not included in domain_tot_pages() */
> +    unsigned long    max_pages;         /* maximum value for domain_tot_pages() */
> +    unsigned long    extra_pages;       /* pages not included in domain_tot_pages() */

... this field as well?

For claims[] in particular the doubling of space needed also isn't entirely
nice, especially when people (distros) build with a large NR_NUMA_NODES (aka
MAX_NUMNODES) but the hypervisor then runs on a few-nodes or even non-NUMA
system.

Jan

Re: [PATCH 2/7] x86/mm: Normalize X86 per-domain page counters to unsigned long

[Jan Beulich]

On 29.05.2026 14:43, Bernhard Kaindl wrote:
> Prepare x86 for >16 TiB domains by normalizing the per-domain page counts
> in paging_domain (total_pages, free_pages, p2m_pages) to unsigned long
> and widen page counts in related x86 allocation functions accordingly:
> 
> - paging_domain.{total,free,p2m}_pages: unsigned int -> unsigned long
> - x86/mm/shadow/common.c:
>   - unsigned long sh_min_allocation(d)
>   - unsigned long shadow_min_acceptable_pages(d)
>   - unsigned long shadow_get_allocation(d)
>   - shadow_set_allocation(unsigned long pages)
>   - shadow_enable(): fix narrowing from d->arch.paging.total_pages to
>     unsigned int
> - x86/mm/hap/hap.c:
>   - unsigned long hap_get_allocation(d)
>   - hap_set_allocation(unsigned long pages)
>   - hap_enable(): fix narrowing from d->arch.paging.total_pages to
>     unsigned int
> - x86/mm/paging.c:
>   - paging_set_allocation(unsigned long pages)
>   - arch_set_paging_mempool_size() don't truncate pages
> 
> Note: pages in _shadow_prealloc(), shadow_alloc(), shadow_free() and
> shadow_prealloc() is intentionally kept as unsigned int.  It carries
> the per-shadow-entry page count from shadow_size() (uint8_t-backed,
> max 4), not the pool allocation count.
> 
> Note: xen_domctl_shadow_op.mb stays uint32_t, and the domctl ABI remains
> MB-based and caps at 4 PiB, replacing the 16 TiB per-domain limit.
> Casts widen the mb-to-pages arithmetic to unsigned long where needed.
> 
> Suggested-by: Jan Beulich <jbeulich@suse.com>

I don't think I suggested this, and yet more than for parts of the earlier
patch I wonder if this isn't going too far, at least right now. Certainly
a 32 TiB guest (i.e. one having 64G pages assigned) isn't going to need a
P2M pool of more than 4G pages. As per code you alter in patch 1 and here,
the internal ratio is rather 256, i.e. the widening would be needed when
we meant to have guests of about 256 TiB size.

Jan

Re: [PATCH 3/7] xen/mm: Static memory: Widen assign_pages(nr) to unsigned long

[Jan Beulich]

On 29.05.2026 14:43, Bernhard Kaindl wrote:
> Static memory assignment is currently limited UINT_MAX pages.
> To normalize on unsigned long, widen assign_pages() for unsigned long.
> 
> Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>

The code change looks okay, but where's the connection to static-mem?
assign_pages() is a more generic function, isn't it?

Jan

> --- a/xen/common/page_alloc.c
> +++ b/xen/common/page_alloc.c
> @@ -2851,12 +2851,12 @@ void init_domheap_pages(paddr_t ps, paddr_t pe)
>  
>  int assign_pages(
>      struct page_info *pg,
> -    unsigned int nr,
> +    unsigned long nr,
>      struct domain *d,
>      unsigned int memflags)
>  {
>      int rc = 0;
> -    unsigned int i;
> +    unsigned long i;
>  
>      nrspin_lock(&d->page_alloc_lock);
>  
> @@ -2870,7 +2870,7 @@ int assign_pages(
>  
>  #ifndef NDEBUG
>      {
> -        unsigned int extra_pages = 0;
> +        unsigned long extra_pages = 0;
>  
>          for ( i = 0; i < nr; i++ )
>          {
> @@ -2947,7 +2947,7 @@ int assign_pages(
>  int assign_page(struct page_info *pg, unsigned int order, struct domain *d,
>                  unsigned int memflags)
>  {
> -    return assign_pages(pg, 1U << order, d, memflags);
> +    return assign_pages(pg, 1UL << order, d, memflags);
>  }
>  
>  struct page_info *alloc_domheap_pages(
> diff --git a/xen/include/xen/mm.h b/xen/include/xen/mm.h
> index b3a35c4bc8d6..b4330269418d 100644
> --- a/xen/include/xen/mm.h
> +++ b/xen/include/xen/mm.h
> @@ -168,7 +168,7 @@ void heap_init_late(void);
>  
>  int assign_pages(
>      struct page_info *pg,
> -    unsigned int nr,
> +    unsigned long nr,
>      struct domain *d,
>      unsigned int memflags);
>  

Re: [PATCH 6/7] xen/arch/x86/dom0_build.c: Extend the upper limit for Dom0's max_pages

[Jan Beulich]

On 29.05.2026 14:44, Bernhard Kaindl wrote:
> dom0_compute_nr_pages(): Update the upper limit for Dom0's max_pages
> in dom0_compute_nr_pages() to limit from UINT_MAX to ULONG_MAX.
> 
> Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
> ----
> Creating a Dom0 of > 16TB isn't a useful thing,

How do you know?

> but could be for testing.
> ---
>  xen/arch/x86/dom0_build.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/xen/arch/x86/dom0_build.c b/xen/arch/x86/dom0_build.c
> index 80308ca9af46..2ebb8308fbaf 100644
> --- a/xen/arch/x86/dom0_build.c
> +++ b/xen/arch/x86/dom0_build.c
> @@ -440,7 +440,7 @@ unsigned long __init dom0_compute_nr_pages(
>          }
>      }
>  
> -    d->max_pages = min_t(unsigned long, max_pages, UINT_MAX);
> +    d->max_pages = min_t(unsigned long, max_pages, ULONG_MAX);

With this there's no need to use the (type-unsafe) min_t() anymore.
Wherever possible we want to use (type-safe) min().

Jan