[xen staging-4.20] xen: arm: fix len type for guest copy functions

[patchbot@xxxxxxx]

commit 9b88e852eff72110bb0d67966ecc757a4d9328d0
Author:     Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
AuthorDate: Thu May 7 10:58:40 2026 +0200
Commit:     Michal Orzel <michal.orzel@xxxxxxx>
CommitDate: Wed Jul 15 09:48:36 2026 +0200

    xen: arm: fix len type for guest copy functions
    
    Widen the len argument of copy_to_guest_phys_flush_dcache() and the
    copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as
    the function can be used to copy large blobs such as the initrd which
    may exceed 4GB. Update the internal copy_guest() len argument to
    unsigned long accordingly.
    
    Change the type for local variable size in copy_guest() to avoid
    compilation error because of type mismatch.
    
    raw_* wrappers above copy_guest() keep returning unsigned long to
    avoid type narrowing; it is not an issue for raw_*'s len argument
    to remain 'unsigned int' since the assignment to copy_guest()'s wider
    unsigned long parameter is safe and there is no raw_* users who
    are using a value bigger than what can fit into 'unsigned int'.
    
    Fixes: 2986481b3d9e6 ("xen/arm: guest_copy: Extend the prototype to pass 
the vCPU")
    Fixes: 5302bd490bea7 ("xen/arm: Introduce copy_to_guest_phys_flush_dcache")
    Fixes: d07b7369aa65b ("xen/common: dom0less: introduce common 
domain-build.c")
    Reported-by: Jan Beulich <jbeulich@xxxxxxxx>
    Signed-off-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Luca Fancellu <luca.fancellu@xxxxxxx>
    Acked-by: Michal Orzel <michal.orzel@xxxxxxx>
    (cherry picked from commit e4424b9a635623b247a9a070db1238bf93f94764)
---
 xen/arch/arm/guestcopy.c                | 6 +++---
 xen/arch/arm/include/asm/guest_access.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/xen/arch/arm/guestcopy.c b/xen/arch/arm/guestcopy.c
index 497e785ec4..a257bee3e4 100644
--- a/xen/arch/arm/guestcopy.c
+++ b/xen/arch/arm/guestcopy.c
@@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t info, 
uint64_t addr,
     return page;
 }
 
-static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len,
+static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len,
                                 copy_info_t info, unsigned int flags)
 {
     /* XXX needs to handle faults */
@@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, 
unsigned int len,
     while ( len )
     {
         void *p;
-        unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset);
+        unsigned long size = min(len, PAGE_SIZE + 0UL - offset);
         struct page_info *page;
 
         page = translate_get_page(info, addr, flags & COPY_linear,
@@ -136,7 +136,7 @@ unsigned long raw_copy_from_guest(void *to, const void 
__user *from,
 unsigned long copy_to_guest_phys_flush_dcache(struct domain *d,
                                               paddr_t gpa,
                                               void *buf,
-                                              unsigned int len)
+                                              unsigned long len)
 {
     return copy_guest(buf, gpa, len, GPA_INFO(d),
                       COPY_to_guest | COPY_ipa | COPY_flush_dcache);
diff --git a/xen/arch/arm/include/asm/guest_access.h 
b/xen/arch/arm/include/asm/guest_access.h
index 18c88b70d7..c13cbec55b 100644
--- a/xen/arch/arm/include/asm/guest_access.h
+++ b/xen/arch/arm/include/asm/guest_access.h
@@ -14,7 +14,7 @@ unsigned long raw_clear_guest(void *to, unsigned int len);
 unsigned long copy_to_guest_phys_flush_dcache(struct domain *d,
                                               paddr_t gpa,
                                               void *buf,
-                                              unsigned int len);
+                                              unsigned long len);
 
 int access_guest_memory_by_gpa(struct domain *d, paddr_t gpa, void *buf,
                                uint32_t size, bool is_write);
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.20