Claude review: drm/i915/gvt: validate LRCA-derived guest context range

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness: Good.** The arithmetic is correct:

```c
max_lrca = (U32_MAX >> I915_GTT_PAGE_SHIFT) - (context_page_num - 1);
```

This yields `0xFFFFF - (context_page_num - 1)`, ensuring `lrca + (context_page_num - 1) <= 0xFFFFF`. The downstream code accesses pages at offsets up to `context_page_num - 1` from `lrca` (in `populate_shadow_context` line 264: `for (i = 2; i < context_page_num; i++)`, and `intel_vgpu_create_workload` line 1687: `desc->lrca + 1`), so the bound is tight and correct.

**The `lrca` field is 20 bits wide** (`:20` bitfield at `execlist.h:52`), so its maximum value is `0xFFFFF` — the same as `U32_MAX >> 12`. The check correctly validates that the full range of pages `[lrca, lrca + context_page_num - 1]` fits within this space.

**Placement is correct:** the validation happens at `scheduler.c:1680`, before the first use of `desc->lrca` at line 1687 `(desc->lrca + 1) << I915_GTT_PAGE_SHIFT`.

**Minor suggestions:**

1. **Missed opportunity to reuse the helper.** The new `intel_vgpu_context_page_num()` helper extracts the Broadwell RCS0 special-case logic that is duplicated inline at two other sites:

   - `populate_shadow_context()` (lines 254–258):
     ```c
     context_page_num = workload->engine->context_size;
     context_page_num = context_page_num >> PAGE_SHIFT;
     if (IS_BROADWELL(gvt->gt->i915) && workload->engine->id == RCS0)
         context_page_num = 19;
     ```
   - `update_guest_context()` (lines 1014–1018):
     ```c
     context_page_num = rq->engine->context_size;
     context_page_num = context_page_num >> PAGE_SHIFT;
     if (IS_BROADWELL(rq->i915) && rq->engine->id == RCS0)
         context_page_num = 19;
     ```

   Since the helper is now available, those two call sites should be converted to use `intel_vgpu_context_page_num()` to eliminate the duplication. This is a minor cleanup and could be a follow-up patch, but it would strengthen the series by ensuring all three sites stay in sync.

2. **The `context_page_num == 0` guard is defensive but reasonable.** `engine->context_size` should never be zero for a valid engine, but the guard at line 94 (`if (!context_page_num) return false;`) is a safe belt-and-suspenders check that avoids underflow in the `context_page_num - 1` subtraction. No objection.

3. **Nit: `unsigned long` vs `u32` for `context_page_num`.** The helper returns `unsigned long` but the value is used in a `u32` subtraction on line 97. On 64-bit kernels this is fine (no truncation risk since page counts are small), but for consistency with the `u32 max_lrca` on line 91, using a `u32` return type would be slightly cleaner. This is cosmetic.

**No correctness issues found. The patch is ready to merge as-is, with the deduplication cleanup as a nice-to-have follow-up.**

---
Generated by Claude Code Patch Reviewer