[xen master] xen/arm: mpu: Fix ioremap_attr region size and return value

[patchbot@xxxxxxx]

commit 9e8aa00f627984670c782954e06fc3517c010f94
Author:     Michal Orzel <michal.orzel@xxxxxxx>
AuthorDate: Thu Apr 2 09:56:45 2026 +0200
Commit:     Michal Orzel <michal.orzel@xxxxxxx>
CommitDate: Fri Apr 3 08:44:07 2026 +0200

    xen/arm: mpu: Fix ioremap_attr region size and return value
    
    ioremap_attr() computes end_pg as round_pgup(start_pg + len), but
    start_pg has already had the sub-page offset stripped by round_pgdown().
    When start is not page-aligned, the sub-page offset is lost and the
    resulting MPU protection region can be one page too small, leaving the
    tail of the requested range covered by something else.
    
    Additionally, the function returns maddr_to_virt(start_pg) â?? the
    page-aligned base dropping the sub-page offset that callers (e.g. ioremap
    of an unaligned MMIO base) depend on to reach the correct register block.
    
    Fix end_pg to use the original start so the sub-page tail is included
    in the rounding, and return the original start address to preserve the
    offset, matching the behaviour of other ioremap implementations.
    
    Fixes: efeec4c70798 ("arm/mpu: Implement ioremap_attr for MPU")
    Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>
    Reviewed-by: Luca Fancellu <luca.fancellu@xxxxxxx>
---
 xen/arch/arm/mpu/mm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/arm/mpu/mm.c b/xen/arch/arm/mpu/mm.c
index 6b3b0b06e9..aff88bd3a9 100644
--- a/xen/arch/arm/mpu/mm.c
+++ b/xen/arch/arm/mpu/mm.c
@@ -596,13 +596,13 @@ void free_init_memory(void)
 void __iomem *ioremap_attr(paddr_t start, size_t len, unsigned int flags)
 {
     paddr_t start_pg = round_pgdown(start);
-    paddr_t end_pg = round_pgup(start_pg + len);
+    paddr_t end_pg = round_pgup(start + len);
 
     if ( xen_mpumap_update(start_pg, end_pg, flags) )
         return NULL;
 
     /* Mapped or already mapped */
-    return maddr_to_virt(start_pg);
+    return maddr_to_virt(start);
 }
 
 /*
--
generated by git-patchbot for /home/xen/git/xen.git#master