[PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Vasant Hegde]

This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
Event log and PPR log buffer sizes to the maximum supported value (512K)
on affected CPU families when SNP is enabled.

Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
  - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
  - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)

[1] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html

Cc: Borislav Petkov <bp@alien8.de>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Joerg Roedel <joerg.roedel@amd.com>

Vasant Hegde (2):
  iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19
  iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19

 drivers/iommu/amd/amd_iommu.h       |   3 +
 drivers/iommu/amd/amd_iommu_types.h |  21 +++--
 drivers/iommu/amd/init.c            | 123 ++++++++++++++++++++--------
 drivers/iommu/amd/iommu.c           |   2 +-
 drivers/iommu/amd/ppr.c             |   8 +-
 5 files changed, 110 insertions(+), 47 deletions(-)

-- 
2.31.1

[PATCH 1/2] iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19

[Vasant Hegde]

Due to CVE-2023-20585, the Event log buffer must use the maximum supported
size (512K) on Milan/Genoa (Family 0x19) systems when SNP is enabled,
to mitigate a potential security vulnerability. All other systems continue to
use the default Event log buffer size (8K).

Apply the errata fix by making the following changes:

* Introduce new global variable (amd_iommu_evtlog_size) to have event log
  buffer size. Adjust variable size for family 0x19.

* Since 'iommu_snp_enable()' must be called after the core IOMMU subsystem
  is initialized, it cannot be moved to the early init stage. The SNP errata
  must also be applied after the 'iommu_snp_enable()' check. Therefore,
  'alloc_event_buffer()' and 'iommu_enable_event_buffer()' are now called
  in the IOMMU_ENABLED state, after the errata is applied.

* Adjust alloc_event_buffer() and iommu_enable_event_buffer() to handle
  all IOMMU instances.

* Also rename EVT_* macros to make it more readable.

Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html
Cc: Borislav Petkov <bp@alien8.de>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
---
 drivers/iommu/amd/amd_iommu.h       |   2 +
 drivers/iommu/amd/amd_iommu_types.h |  10 ++-
 drivers/iommu/amd/init.c            | 110 +++++++++++++++++++---------
 drivers/iommu/amd/iommu.c           |   2 +-
 4 files changed, 86 insertions(+), 38 deletions(-)

diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
index 1342e764a548..f1c486dcf0f3 100644
--- a/drivers/iommu/amd/amd_iommu.h
+++ b/drivers/iommu/amd/amd_iommu.h
@@ -11,6 +11,8 @@
 
 #include "amd_iommu_types.h"
 
+extern int amd_iommu_evtlog_size;
+
 irqreturn_t amd_iommu_int_thread(int irq, void *data);
 irqreturn_t amd_iommu_int_thread_evtlog(int irq, void *data);
 irqreturn_t amd_iommu_int_thread_pprlog(int irq, void *data);
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index c685d3771436..c3430c09bc5c 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -15,6 +15,7 @@
 #include <linux/mutex.h>
 #include <linux/msi.h>
 #include <linux/list.h>
+#include <linux/sizes.h>
 #include <linux/spinlock.h>
 #include <linux/pci.h>
 #include <linux/iommufd.h>
@@ -141,7 +142,6 @@
 #define MMIO_STATUS_GALOG_INT_MASK		BIT(10)
 
 /* event logging constants */
-#define EVENT_ENTRY_SIZE	0x10
 #define EVENT_TYPE_SHIFT	28
 #define EVENT_TYPE_MASK		0xf
 #define EVENT_TYPE_ILL_DEV	0x1
@@ -259,8 +259,12 @@
 #define MMIO_CMD_BUFFER_TAIL(x) FIELD_GET(MMIO_CMD_TAIL_MASK, (x))
 
 /* constants for event buffer handling */
-#define EVT_BUFFER_SIZE		8192 /* 512 entries */
-#define EVT_LEN_MASK		(0x9ULL << 56)
+#define EVTLOG_ENTRY_SIZE	0x10
+#define EVTLOG_SIZE_SHIFT	56
+#define EVTLOG_SIZE_DEF		SZ_8K /* 512 entries */
+#define EVTLOG_LEN_MASK_DEF	(0x9ULL << EVTLOG_SIZE_SHIFT)
+#define EVTLOG_SIZE_MAX		SZ_512K /* 32K entries */
+#define EVTLOG_LEN_MASK_MAX	(0xFULL << EVTLOG_SIZE_SHIFT)
 
 /* Constants for PPR Log handling */
 #define PPR_LOG_ENTRIES		512
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index f3fd7f39efb4..74effb847f48 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -132,6 +132,8 @@ struct ivhd_entry {
 	u8 uid;
 } __attribute__((packed));
 
+int amd_iommu_evtlog_size = EVTLOG_SIZE_DEF;
+
 /*
  * An AMD IOMMU memory definition structure. It defines things like exclusion
  * ranges for devices and regions that should be unity mapped.
@@ -864,35 +866,47 @@ void *__init iommu_alloc_4k_pages(struct amd_iommu *iommu, gfp_t gfp,
 }
 
 /* allocates the memory where the IOMMU will log its events to */
-static int __init alloc_event_buffer(struct amd_iommu *iommu)
+static int __init alloc_event_buffer(void)
 {
-	iommu->evt_buf = iommu_alloc_4k_pages(iommu, GFP_KERNEL,
-					      EVT_BUFFER_SIZE);
+	struct amd_iommu *iommu;
 
-	return iommu->evt_buf ? 0 : -ENOMEM;
+	for_each_iommu(iommu) {
+		iommu->evt_buf = iommu_alloc_4k_pages(iommu, GFP_KERNEL,
+						      amd_iommu_evtlog_size);
+		if (!iommu->evt_buf)
+			return -ENOMEM;
+	}
+
+	return 0;
 }
 
-static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+static void iommu_enable_event_buffer(void)
 {
+	struct amd_iommu *iommu;
 	u64 entry;
 
-	BUG_ON(iommu->evt_buf == NULL);
+	for_each_iommu(iommu) {
+		BUG_ON(iommu->evt_buf == NULL);
 
-	if (!is_kdump_kernel()) {
-		/*
-		 * Event buffer is re-used for kdump kernel and setting
-		 * of MMIO register is not required.
-		 */
-		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
-		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
-			    &entry, sizeof(entry));
-	}
+		if (!is_kdump_kernel()) {
+			/*
+			 * Event buffer is re-used for kdump kernel and setting
+			 * of MMIO register is not required.
+			 */
+			entry = iommu_virt_to_phys(iommu->evt_buf);
+			entry |= (amd_iommu_evtlog_size == EVTLOG_SIZE_DEF) ?
+				EVTLOG_LEN_MASK_DEF : EVTLOG_LEN_MASK_MAX;
+
+			memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+				    &entry, sizeof(entry));
+		}
 
-	/* set head and tail to zero manually */
-	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
-	writel(0x00, iommu->mmio_base + MMIO_EVT_TAIL_OFFSET);
+		/* set head and tail to zero manually */
+		writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+		writel(0x00, iommu->mmio_base + MMIO_EVT_TAIL_OFFSET);
 
-	iommu_feature_enable(iommu, CONTROL_EVT_LOG_EN);
+		iommu_feature_enable(iommu, CONTROL_EVT_LOG_EN);
+	}
 }
 
 /*
@@ -981,15 +995,20 @@ static int __init alloc_cwwb_sem(struct amd_iommu *iommu)
 	return 0;
 }
 
-static int __init remap_event_buffer(struct amd_iommu *iommu)
+static int __init remap_event_buffer(void)
 {
+	struct amd_iommu *iommu;
 	u64 paddr;
 
 	pr_info_once("Re-using event buffer from the previous kernel\n");
-	paddr = readq(iommu->mmio_base + MMIO_EVT_BUF_OFFSET) & PM_ADDR_MASK;
-	iommu->evt_buf = iommu_memremap(paddr, EVT_BUFFER_SIZE);
+	for_each_iommu(iommu) {
+		paddr = readq(iommu->mmio_base + MMIO_EVT_BUF_OFFSET) & PM_ADDR_MASK;
+		iommu->evt_buf = iommu_memremap(paddr, amd_iommu_evtlog_size);
+		if (!iommu->evt_buf)
+			return -ENOMEM;
+	}
 
-	return iommu->evt_buf ? 0 : -ENOMEM;
+	return 0;
 }
 
 static int __init remap_command_buffer(struct amd_iommu *iommu)
@@ -1041,10 +1060,6 @@ static int __init alloc_iommu_buffers(struct amd_iommu *iommu)
 		ret = remap_command_buffer(iommu);
 		if (ret)
 			return ret;
-
-		ret = remap_event_buffer(iommu);
-		if (ret)
-			return ret;
 	} else {
 		ret = alloc_cwwb_sem(iommu);
 		if (ret)
@@ -1053,10 +1068,6 @@ static int __init alloc_iommu_buffers(struct amd_iommu *iommu)
 		ret = alloc_command_buffer(iommu);
 		if (ret)
 			return ret;
-
-		ret = alloc_event_buffer(iommu);
-		if (ret)
-			return ret;
 	}
 
 	return 0;
@@ -2890,7 +2901,6 @@ static void early_enable_iommu(struct amd_iommu *iommu)
 	iommu_init_flags(iommu);
 	iommu_set_device_table(iommu);
 	iommu_enable_command_buffer(iommu);
-	iommu_enable_event_buffer(iommu);
 	iommu_set_exclusion_range(iommu);
 	iommu_enable_gt(iommu);
 	iommu_enable_ga(iommu);
@@ -2954,7 +2964,6 @@ static void early_enable_iommus(void)
 			iommu_disable_event_buffer(iommu);
 			iommu_disable_irtcachedis(iommu);
 			iommu_enable_command_buffer(iommu);
-			iommu_enable_event_buffer(iommu);
 			iommu_enable_ga(iommu);
 			iommu_enable_xt(iommu);
 			iommu_enable_irtcachedis(iommu);
@@ -3067,6 +3076,7 @@ static void amd_iommu_resume(void *data)
 	for_each_iommu(iommu)
 		early_enable_iommu(iommu);
 
+	iommu_enable_event_buffer();
 	amd_iommu_enable_interrupts();
 }
 
@@ -3396,6 +3406,23 @@ static __init void iommu_snp_enable(void)
 #endif
 }
 
+static void amd_iommu_apply_erratum_snp(void)
+{
+#ifdef CONFIG_KVM_AMD_SEV
+	if (!amd_iommu_snp_en)
+		return;
+
+	/* Errata fix for Family 0x19 */
+	if (boot_cpu_data.x86 != 0x19)
+		return;
+
+	/* Set event log buffer size to max */
+	amd_iommu_evtlog_size = EVTLOG_SIZE_MAX;
+	pr_info("Applying erratum: Increase Event log size to 0x%x\n",
+		amd_iommu_evtlog_size);
+#endif
+}
+
 /****************************************************************************
  *
  * AMD IOMMU Initialization State Machine
@@ -3432,6 +3459,21 @@ static int __init state_next(void)
 	case IOMMU_ENABLED:
 		register_syscore(&amd_iommu_syscore);
 		iommu_snp_enable();
+
+		amd_iommu_apply_erratum_snp();
+
+		/* Allocate/enable event log buffer */
+		if (is_kdump_kernel())
+			ret = remap_event_buffer();
+		else
+			ret = alloc_event_buffer();
+
+		if (ret) {
+			init_state = IOMMU_INIT_ERROR;
+			break;
+		}
+		iommu_enable_event_buffer();
+
 		ret = amd_iommu_init_pci();
 		init_state = ret ? IOMMU_INIT_ERROR : IOMMU_PCI_INIT;
 		break;
@@ -4034,7 +4076,7 @@ int amd_iommu_snp_disable(void)
 		return 0;
 
 	for_each_iommu(iommu) {
-		ret = iommu_make_shared(iommu->evt_buf, EVT_BUFFER_SIZE);
+		ret = iommu_make_shared(iommu->evt_buf, amd_iommu_evtlog_size);
 		if (ret)
 			return ret;
 
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 760d5f4623b5..02b5eaae6843 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -1009,7 +1009,7 @@ static void iommu_poll_events(struct amd_iommu *iommu)
 		iommu_print_event(iommu, iommu->evt_buf + head);
 
 		/* Update head pointer of hardware ring-buffer */
-		head = (head + EVENT_ENTRY_SIZE) % EVT_BUFFER_SIZE;
+		head = (head + EVTLOG_ENTRY_SIZE) % amd_iommu_evtlog_size;
 		writel(head, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
 	}
 
-- 
2.31.1

[PATCH 2/2] iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19

[Vasant Hegde]

Due to CVE-2023-20585, the PPR log buffer must use the maximum supported
size (512K) on Genoa (Family 0x19, model >= 0x10) systems when SNP is
enabled, to mitigate a potential security vulnerability. Note that Family
0x19 models below 0x10 (Milan) do not support PPR when SNP is enabled.
Hence the PPR log size increase is only applied for model >= 0x10.
All other systems continue to use the default PPR log buffer size (8K).

Apply the errata fix by making the following changes:

- Introduce global new variable (amd_iommu_pprlog_size) to have PPR log buffer
  size. Adjust variable size for Genoa family.

- Extend 'amd_iommu_apply_erratum_snp()' to also set the PPR log buffer
  size to maximum for Family 0x19 model >= 0x10 when SNP is enabled.

- Rename rename PPR_* macros to make it more readable.

Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html
Cc: Borislav Petkov <bp@alien8.de>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
---
 drivers/iommu/amd/amd_iommu.h       |  1 +
 drivers/iommu/amd/amd_iommu_types.h | 11 ++++++-----
 drivers/iommu/amd/init.c            | 13 ++++++++++++-
 drivers/iommu/amd/ppr.c             |  8 +++++---
 4 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
index f1c486dcf0f3..834d8fabfba3 100644
--- a/drivers/iommu/amd/amd_iommu.h
+++ b/drivers/iommu/amd/amd_iommu.h
@@ -12,6 +12,7 @@
 #include "amd_iommu_types.h"
 
 extern int amd_iommu_evtlog_size;
+extern int amd_iommu_pprlog_size;
 
 irqreturn_t amd_iommu_int_thread(int irq, void *data);
 irqreturn_t amd_iommu_int_thread_evtlog(int irq, void *data);
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index c3430c09bc5c..f9f718087893 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -267,11 +267,12 @@
 #define EVTLOG_LEN_MASK_MAX	(0xFULL << EVTLOG_SIZE_SHIFT)
 
 /* Constants for PPR Log handling */
-#define PPR_LOG_ENTRIES		512
-#define PPR_LOG_SIZE_SHIFT	56
-#define PPR_LOG_SIZE_512	(0x9ULL << PPR_LOG_SIZE_SHIFT)
-#define PPR_ENTRY_SIZE		16
-#define PPR_LOG_SIZE		(PPR_ENTRY_SIZE * PPR_LOG_ENTRIES)
+#define PPRLOG_ENTRY_SIZE	0x10
+#define PPRLOG_SIZE_SHIFT	56
+#define PPRLOG_SIZE_DEF		SZ_8K	/* 512 entries */
+#define PPRLOG_LEN_MASK_DEF	(0x9ULL << PPRLOG_SIZE_SHIFT)
+#define PPRLOG_SIZE_MAX		SZ_512K	/* 32K entries */
+#define PPRLOG_LEN_MASK_MAX	(0xFULL << PPRLOG_SIZE_SHIFT)
 
 /* PAGE_SERVICE_REQUEST PPR Log Buffer Entry flags */
 #define PPR_FLAG_EXEC		0x002	/* Execute permission requested */
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 74effb847f48..a590f487937b 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -133,6 +133,7 @@ struct ivhd_entry {
 } __attribute__((packed));
 
 int amd_iommu_evtlog_size = EVTLOG_SIZE_DEF;
+int amd_iommu_pprlog_size = PPRLOG_SIZE_DEF;
 
 /*
  * An AMD IOMMU memory definition structure. It defines things like exclusion
@@ -3420,6 +3421,16 @@ static void amd_iommu_apply_erratum_snp(void)
 	amd_iommu_evtlog_size = EVTLOG_SIZE_MAX;
 	pr_info("Applying erratum: Increase Event log size to 0x%x\n",
 		amd_iommu_evtlog_size);
+
+	/*
+	 * Set PPR log buffer size to max.
+	 * (Family 0x19, model < 0x10 doesn't support PPR when SNP is enabled).
+	 */
+	if (boot_cpu_data.x86_model >= 0x10) {
+		amd_iommu_pprlog_size = PPRLOG_SIZE_MAX;
+		pr_info("Applying erratum: Increase PPR log size to 0x%x\n",
+			amd_iommu_pprlog_size);
+	}
 #endif
 }
 
@@ -4080,7 +4091,7 @@ int amd_iommu_snp_disable(void)
 		if (ret)
 			return ret;
 
-		ret = iommu_make_shared(iommu->ppr_log, PPR_LOG_SIZE);
+		ret = iommu_make_shared(iommu->ppr_log, amd_iommu_pprlog_size);
 		if (ret)
 			return ret;
 
diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index e6767c057d01..1f8d2823bea4 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -20,7 +20,7 @@
 int __init amd_iommu_alloc_ppr_log(struct amd_iommu *iommu)
 {
 	iommu->ppr_log = iommu_alloc_4k_pages(iommu, GFP_KERNEL | __GFP_ZERO,
-					      PPR_LOG_SIZE);
+					      amd_iommu_pprlog_size);
 	return iommu->ppr_log ? 0 : -ENOMEM;
 }
 
@@ -33,7 +33,9 @@ void amd_iommu_enable_ppr_log(struct amd_iommu *iommu)
 
 	iommu_feature_enable(iommu, CONTROL_PPR_EN);
 
-	entry = iommu_virt_to_phys(iommu->ppr_log) | PPR_LOG_SIZE_512;
+	entry = iommu_virt_to_phys(iommu->ppr_log);
+	entry |= (amd_iommu_pprlog_size == PPRLOG_SIZE_DEF) ?
+			PPRLOG_LEN_MASK_DEF : PPRLOG_LEN_MASK_MAX;
 
 	memcpy_toio(iommu->mmio_base + MMIO_PPR_LOG_OFFSET,
 		    &entry, sizeof(entry));
@@ -201,7 +203,7 @@ void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
 			raw[0] = raw[1] = 0UL;
 
 		/* Update head pointer of hardware ring-buffer */
-		head = (head + PPR_ENTRY_SIZE) % PPR_LOG_SIZE;
+		head = (head + PPRLOG_ENTRY_SIZE) % amd_iommu_pprlog_size;
 		writel(head, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
 
 		/* Handle PPR entry */
-- 
2.31.1

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Srivastava, Dheeraj Kumar]

On 4/20/2026 2:12 PM, Vasant Hegde wrote:
> This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
> Event log and PPR log buffer sizes to the maximum supported value (512K)
> on affected CPU families when SNP is enabled.
> 
> Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
>    - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
>    - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
> 
> [1] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html
> 
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
> Cc: Joerg Roedel <joerg.roedel@amd.com>
> 
> Vasant Hegde (2):
>    iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19
>    iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19
> 
>   drivers/iommu/amd/amd_iommu.h       |   3 +
>   drivers/iommu/amd/amd_iommu_types.h |  21 +++--
>   drivers/iommu/amd/init.c            | 123 ++++++++++++++++++++--------
>   drivers/iommu/amd/iommu.c           |   2 +-
>   drivers/iommu/amd/ppr.c             |   8 +-
>   5 files changed, 110 insertions(+), 47 deletions(-)
> 

Tested-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava@amd.com>

Thanks
Dheeraj

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Jörg Rödel]

On Mon, Apr 20, 2026 at 08:42:02AM +0000, Vasant Hegde wrote:
> Vasant Hegde (2):
>   iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19
>   iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19

Applied to fixes, thanks Vasant.

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Usama Arif]

On Mon, 20 Apr 2026 08:42:02 +0000 Vasant Hegde <vasant.hegde@amd.com> wrote:

> This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
> Event log and PPR log buffer sizes to the maximum supported value (512K)
> on affected CPU families when SNP is enabled.
> 
> Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
>   - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
>   - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
>

Hi,

This series seems to break kexec in our production on Milan hosts with SEV enabled.
This is on the 6.18.43 stable kernel backport.

If on top of 6.18.43 release, we revert the 2 commits, i.e.
Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19"
Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19"

kexec starts working again.

Could you help in fixing this issue?

Thanks

> [1] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html
> 
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
> Cc: Joerg Roedel <joerg.roedel@amd.com>
> 
> Vasant Hegde (2):
>   iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19
>   iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19
> 
>  drivers/iommu/amd/amd_iommu.h       |   3 +
>  drivers/iommu/amd/amd_iommu_types.h |  21 +++--
>  drivers/iommu/amd/init.c            | 123 ++++++++++++++++++++--------
>  drivers/iommu/amd/iommu.c           |   2 +-
>  drivers/iommu/amd/ppr.c             |   8 +-
>  5 files changed, 110 insertions(+), 47 deletions(-)
> 
> -- 
> 2.31.1
> 
> 

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Jason Gunthorpe]

On Thu, Aug 13, 2026 at 06:18:30AM -0700, Usama Arif wrote:
> On Mon, 20 Apr 2026 08:42:02 +0000 Vasant Hegde <vasant.hegde@amd.com> wrote:
> 
> > This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
> > Event log and PPR log buffer sizes to the maximum supported value (512K)
> > on affected CPU families when SNP is enabled.
> > 
> > Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
> >   - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
> >   - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
> >
> 
> Hi,
> 
> This series seems to break kexec in our production on Milan hosts with SEV enabled.
> This is on the 6.18.43 stable kernel backport.
> 
> If on top of 6.18.43 release, we revert the 2 commits, i.e.
> Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19"
> Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19"
> 
> kexec starts working again.

This sounds like the same issue Nicolin is facing on SMMUv3, these
larger allocations OOM the kexec kernel

Jason

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Vasant Hegde]

Usama,

On 8/13/2026 6:48 PM, Usama Arif wrote:
> [You don't often get email from usama.arif@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Mon, 20 Apr 2026 08:42:02 +0000 Vasant Hegde <vasant.hegde@amd.com> wrote:
> 
>> This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
>> Event log and PPR log buffer sizes to the maximum supported value (512K)
>> on affected CPU families when SNP is enabled.
>>
>> Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
>>   - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
>>   - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
>>
> 
> Hi,
> 
> This series seems to break kexec in our production on Milan hosts with SEV enabled.
> This is on the 6.18.43 stable kernel backport.

Do you have dmesg?

> 
> If on top of 6.18.43 release, we revert the 2 commits, i.e.
> Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19"
> Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19"
> 
> kexec starts working again.
> > Could you help in fixing this issue?

Sure. We will try to reproduce it internally and get back to you.

-Vasant

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Usama Arif]

On 13/08/2026 14:58, Vasant Hegde wrote:
> Usama,
> 
> On 8/13/2026 6:48 PM, Usama Arif wrote:
>> [You don't often get email from usama.arif@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> On Mon, 20 Apr 2026 08:42:02 +0000 Vasant Hegde <vasant.hegde@amd.com> wrote:
>>
>>> This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
>>> Event log and PPR log buffer sizes to the maximum supported value (512K)
>>> on affected CPU families when SNP is enabled.
>>>
>>> Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
>>>   - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
>>>   - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
>>>
>>
>> Hi,
>>
>> This series seems to break kexec in our production on Milan hosts with SEV enabled.
>> This is on the 6.18.43 stable kernel backport.
> 
> Do you have dmesg?
> 


We don't get any logs after kexec. So the last logs are:

[  OK  ] Reached target shutdown.target - System Shutdown.                                                                                                                                                                                                                                                    
[  OK  ] Reached target final.target - Late Shutdown Services.                                                                                                                                                                                                                                                
[  OK  ] Finished systemd-kexec.service - Reboot via kexec.                                                                                                                                                                                                                                                   
[  OK  ] Reached target kexec.target - Reboot via kexec. 

And then nothing after.

>>
>> If on top of 6.18.43 release, we revert the 2 commits, i.e.
>> Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19"
>> Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19"
>>
>> kexec starts working again.
>>> Could you help in fixing this issue?
> 
> Sure. We will try to reproduce it internally and get back to you.
> 

Thanks!

> -Vasant
> 

Re: [PATCH 0/2] iommu/amd: Use MAX buffer size when SNP is enabled on Family 0x19

[Usama Arif]

On 13/08/2026 14:35, Jason Gunthorpe wrote:
> On Thu, Aug 13, 2026 at 06:18:30AM -0700, Usama Arif wrote:
>> On Mon, 20 Apr 2026 08:42:02 +0000 Vasant Hegde <vasant.hegde@amd.com> wrote:
>>
>>> This series addresses CVE-2023-20585 [1] by increasing the AMD IOMMU
>>> Event log and PPR log buffer sizes to the maximum supported value (512K)
>>> on affected CPU families when SNP is enabled.
>>>
>>> Use MAX buffer size when SNP is enabled on Milan/Genoa. Impacted buffers:
>>>   - Milan : Event log (PPR/GALog is not supported when SNP is enabled)
>>>   - Genoa : Event and PPR log (GALog is not supported when SNP is enabled)
>>>
>>
>> Hi,
>>
>> This series seems to break kexec in our production on Milan hosts with SEV enabled.
>> This is on the 6.18.43 stable kernel backport.
>>
>> If on top of 6.18.43 release, we revert the 2 commits, i.e.
>> Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19"
>> Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19"
>>
>> kexec starts working again.
> 
> This sounds like the same issue Nicolin is facing on SMMUv3, these
> larger allocations OOM the kexec kernel
> 
> Jason

Thanks Jason!

Was there any solution for this issue. Could you point to a lore link for this?