Question: AMD IOMMU v1 contiguous PTE OA encoding triggers FIELD_PREP overflow

Question: AMD IOMMU v1 contiguous PTE OA encoding triggers FIELD_PREP overflow

[Chunyu Hu]

While enabling CONFIG_CONSTRUCTORS + GCOV, I ran into a build-time
FIELD_PREP() overflow in amdv1pt_install_leaf_entry() for the
contiguous (NEXT_LEVEL = SIZE) mapping path.

Specifically, this block:

entry |= FIELD_PREP(AMDV1PT_FMT_NEXT_LEVEL,
                    AMDV1PT_FMT_NL_SIZE) |
         FIELD_PREP(AMDV1PT_FMT_OA,
            oalog2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ - 1) - 1);

ends up producing a value that exceeds the width of AMDV1PT_FMT_OA
(GENMASK_ULL(51, 12)), which compiler detect and reject at build time.

However, I’m not familiar with the AMD IOMMU internals, so I wanted
to ask the list: is OA supposed to be re-encoded for SIZE mappings, or
is this overflow indicating that the OA field should be left unchanged
in this case?

Any guidance or correction would be greatly appreciated.

Thanks,
Chunyu Hu

--<
"""
In file included from <command-line>:
In function ‘amdv1pt_install_leaf_entry’,
    inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:651:3,
    inlined from ‘__map_single_page0’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1,
    inlined from ‘pt_descend’ at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9,
    inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:658:10,
    inlined from ‘__map_single_page1.constprop’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1:
././include/linux/compiler_types.h:631:45: error: call to ‘__compiletime_assert_251’ declared with attribute error: FIELD_PREP: value too large for the field
  631 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |                                             ^
././include/linux/compiler_types.h:612:25: note: in definition of macro ‘__compiletime_assert’
  612 |                         prefix ## suffix();                             \
      |                         ^~~~~~
././include/linux/compiler_types.h:631:9: note: in expansion of macro ‘_compiletime_assert’
  631 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |         ^~~~~~~~~~~~~~~~~~~
./include/linux/build_bug.h:39:37: note: in expansion of macro ‘compiletime_assert’
   39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
      |                                     ^~~~~~~~~~~~~~~~~~
./include/linux/bitfield.h:69:17: note: in expansion of macro ‘BUILD_BUG_ON_MSG’
   69 |                 BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ?           \
      |                 ^~~~~~~~~~~~~~~~
./include/linux/bitfield.h:90:17: note: in expansion of macro ‘__BF_FIELD_CHECK_MASK’
   90 |                 __BF_FIELD_CHECK_MASK(mask, val, pfx);                  \
      |                 ^~~~~~~~~~~~~~~~~~~~~
./include/linux/bitfield.h:137:17: note: in expansion of macro ‘__FIELD_PREP’
  137 |                 __FIELD_PREP(_mask, _val, "FIELD_PREP: ");              \
      |                 ^~~~~~~~~~~~
drivers/iommu/generic_pt/fmt/amdv1.h:220:26: note: in expansion of macro ‘FIELD_PREP’
  220 |                          FIELD_PREP(AMDV1PT_FMT_OA,
      |                          ^~~~~~~~~~
"""

Re: Question: AMD IOMMU v1 contiguous PTE OA encoding triggers FIELD_PREP overflow

[Jason Gunthorpe]

On Tue, Dec 23, 2025 at 10:26:00AM +0800, Chunyu Hu wrote:
> While enabling CONFIG_CONSTRUCTORS + GCOV, I ran into a build-time
> FIELD_PREP() overflow in amdv1pt_install_leaf_entry() for the
> contiguous (NEXT_LEVEL = SIZE) mapping path.
> 
> Specifically, this block:
> 
> entry |= FIELD_PREP(AMDV1PT_FMT_NEXT_LEVEL,
>                     AMDV1PT_FMT_NL_SIZE) |
>          FIELD_PREP(AMDV1PT_FMT_OA,
>             oalog2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ - 1) - 1);
> 
> ends up producing a value that exceeds the width of AMDV1PT_FMT_OA
> (GENMASK_ULL(51, 12)), which compiler detect and reject at build time.

It depends if the compilers idea of what constant value oasz_lg2 has
is correct or not..

In my past adventures it is usually not correct since all of this code
passes runtime tests that would fail if it was actually out of bounds.

> In file included from <command-line>:
> In function ‘amdv1pt_install_leaf_entry’,
>     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:651:3,
>     inlined from ‘__map_single_page0’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1,
>     inlined from ‘pt_descend’ at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9,
>     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:658:10,
>     inlined from ‘__map_single_page1.constprop’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1:

For instance in this path __do_map_single_page has oasz_lg2 fixed to
12:

		pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT,
				      &map->attrs);

And the logic in amdv1pt_install_leaf_entry():

	unsigned int isz_lg2 = pt_table_item_lg2sz(pts);

	if (oasz_lg2 == isz_lg2) {
        } else {
		entry |= FIELD_PREP(AMDV1PT_FMT_NEXT_LEVEL,
				    AMDV1PT_FMT_NL_SIZE) |
			 FIELD_PREP(AMDV1PT_FMT_OA,
				    oalog2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ -
						  1) -

I can tell you that pt_table_item_lg2sz() is also 12, so the else
branch is never taken.

Not sure why the compiler is only raising an issue with the gcov
options, but it is not a functional problem with the code.

I don't know what to do about it though..

Jason

Re: Question: AMD IOMMU v1 contiguous PTE OA encoding triggers FIELD_PREP overflow

[Jason Gunthorpe]

On Wed, Jan 07, 2026 at 08:52:44PM -0400, Jason Gunthorpe wrote:
> > In file included from <command-line>:
> > In function ‘amdv1pt_install_leaf_entry’,
> >     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:651:3,
> >     inlined from ‘__map_single_page0’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1,
> >     inlined from ‘pt_descend’ at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9,
> >     inlined from ‘__do_map_single_page’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:658:10,
> >     inlined from ‘__map_single_page1.constprop’ at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1:

Does this work for you? clang 18 hit the same issue and it fixed it there:

diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h
index 14a73d3b291b42..a46f1dadefd521 100644
--- a/drivers/iommu/generic_pt/iommu_pt.h
+++ b/drivers/iommu/generic_pt/iommu_pt.h
@@ -691,7 +691,7 @@ static __always_inline int __do_map_single_page(struct pt_range *range,
 	struct pt_iommu_map_args *map = arg;
 
 	pts.type = pt_load_single_entry(&pts);
-	if (level == 0) {
+	if (pts.level == 0) {
 		if (pts.type != PT_ENTRY_EMPTY)
 			return -EADDRINUSE;
 		pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT,