Re: Question: AMD IOMMU v1 contiguous PTE OA encoding triggers FIELD_PREP overflow

[Jason Gunthorpe <jgg@ziepe.ca>]

On Tue, Dec 23, 2025 at 10:26:00AM +0800, Chunyu Hu wrote:
> While enabling CONFIG_CONSTRUCTORS + GCOV, I ran into a build-time
> FIELD_PREP() overflow in amdv1pt_install_leaf_entry() for the
> contiguous (NEXT_LEVEL = SIZE) mapping path.
> 
> Specifically, this block:
> 
> entry |= FIELD_PREP(AMDV1PT_FMT_NEXT_LEVEL,
>                     AMDV1PT_FMT_NL_SIZE) |
>          FIELD_PREP(AMDV1PT_FMT_OA,
>             oalog2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ - 1) - 1);
> 
> ends up producing a value that exceeds the width of AMDV1PT_FMT_OA
> (GENMASK_ULL(51, 12)), which compiler detect and reject at build time.

It depends if the compilers idea of what constant value oasz_lg2 has
is correct or not..

In my past adventures it is usually not correct since all of this code
passes runtime tests that would fail if it was actually out of bounds.

> In file included from <command-line>:
> In function ‘amdv1pt_install_leaf_entry’,
>     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:651:3,
>     inlined from ‘__map_single_page0’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1,
>     inlined from ‘pt_descend’ at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9,
>     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:658:10,
>     inlined from ‘__map_single_page1.constprop’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1:

For instance in this path __do_map_single_page has oasz_lg2 fixed to
12:

		pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT,
				      &map->attrs);

And the logic in amdv1pt_install_leaf_entry():

	unsigned int isz_lg2 = pt_table_item_lg2sz(pts);

	if (oasz_lg2 == isz_lg2) {
        } else {
		entry |= FIELD_PREP(AMDV1PT_FMT_NEXT_LEVEL,
				    AMDV1PT_FMT_NL_SIZE) |
			 FIELD_PREP(AMDV1PT_FMT_OA,
				    oalog2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ -
						  1) -

I can tell you that pt_table_item_lg2sz() is also 12, so the else
branch is never taken.

Not sure why the compiler is only raising an issue with the gcov
options, but it is not a functional problem with the code.

I don't know what to do about it though..

Jason