Re: [PATCH v3 02/12] xen: fix len type for guest copy functions

[Jan Beulich <jbeulich@xxxxxxxx>]

On 10.04.2026 17:54, Oleksii Kurochko wrote:
> Widen the len argument of copy_to_guest_phys_flush_dcache() and the
> copy_to_guest_phys_cb typedef from unsigned int to unsigned long, as
> the function can be used to copy large blobs such as the initrd which
> may exceed 4GB. Update the internal copy_guest() len argument to
> unsigned long accordingly.
> 
> Change the type for local variable size in copy_guest() to avoid
> compilation error because of type mismatch.
> 
> raw_* wrappers above copy_guest() keep returning unsigned long to
> avoid type narrowing; it is not an issue for raw_*'s len argument
> to remain 'unsigned int' since the assignment to copy_guest()'s wider
> unsigned long parameter is safe and there is no raw_* users who
> are using a value bigger than what can fit into 'unsigned int'.
> 
> Reported-by: Jan Beulich <jbeulich@xxxxxxxx>
> Signed-off-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>

Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
With two suggestions: For one, the patch subject prefix may want to be (or
include) "arm:", to draw Arm maintainers' attention. And then ...

> --- a/xen/arch/arm/guestcopy.c
> +++ b/xen/arch/arm/guestcopy.c
> @@ -53,7 +53,7 @@ static struct page_info *translate_get_page(copy_info_t 
> info, uint64_t addr,
>      return page;
>  }
>  
> -static unsigned long copy_guest(void *buf, uint64_t addr, unsigned int len,
> +static unsigned long copy_guest(void *buf, uint64_t addr, unsigned long len,
>                                  copy_info_t info, unsigned int flags)
>  {
>      /* XXX needs to handle faults */
> @@ -65,7 +65,7 @@ static unsigned long copy_guest(void *buf, uint64_t addr, 
> unsigned int len,
>      while ( len )
>      {
>          void *p;
> -        unsigned int size = min(len, (unsigned int)PAGE_SIZE - offset);
> +        unsigned long size = min_t(unsigned long, len, PAGE_SIZE - offset);

... I think we'd be better off avoiding min_t() whenever possible, i.e.
when min() can sensibly be used (preferably, unlike originally here, also
without a cast). PAGE_SIZE being of type long, "PAGE_SIZE + 0UL - offset"
would look to be an option. Yet of course Arm maintainers may dislike
that form ...

Jan