On 05/03/2026 11:01 pm, Andrew Cooper wrote:
> On 05/03/2026 7:57 pm, Ayan Kumar Halder wrote:
>> The lr_mask bitmap tracks which List Registers (LRs) are in use for
>> virtual interrupt injection. Previously, lr_mask always used uint64_t
>> (8 bytes) to support the maximum number of LRs across both GIC versions.
>>
>> However, GICv2 and GICv3 have different hardware limits:
>> - GICv3: ICH_VTR_EL2[3:0] encodes LR count -> max 16 LRs (4 bits)
>> - GICv2: GICH_VTR[5:0] encodes LR count -> max 64 LRs (6 bits)
>>
>> This patch introduces conditional compilation to optimize lr_mask size:
>> - CONFIG_GICV3=y: Use uint16_t (2 bytes) - sufficient for 16 LRs
>> - CONFIG_GICV3=n: Use uint64_t (8 bytes) - required for 64 LRs
>>
>> With this, parameter 'lr' in gicv3_ich_read_lr(), gicv3_ich_write_lr()
>> cannot have a value > 15. Thus, it should not possible to hit the
>> BUG() in the default case.
>>
>> Signed-off-by: Ayan Kumar Halder <[email protected]>
> What does this actually get you?
>
> Because it doesn't actually eliminate the BUG()s you reference.
>
> If you really want to go ahead with this patch, then make a  lr_mask_t
> or the right type and don't double-code everything.

Also, this creates an Out-of-Bounds read in vgic_sync_from_lrs() amongst
others.

~Andrew

Reply via email to