From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-196.mta0.migadu.com [91.218.175.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53C3039FCB1 for ; Thu, 13 Aug 2026 13:24:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.196 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786627495; cv=none; b=TZYC0/xq4hXg4XMR/yPRZkD85EabETWR5oOPjOh0c5FwkzXWwRBBuOxh5FyQ63xnI10C3Zn80Tdnx0GDTVKo4W9ho4mGZdwcNYMuQV7ue5d899cEFANYAatSWHOZ4qaeQR1Oj8YVuPoq7O9tx+97VMfYTF0XoZNT5dVemIhh2Fw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786627495; c=relaxed/simple; bh=Pwsu2U0dH2/nTAlsUHKCHjUm/QcKVl/S0PAUrKyclVc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cGRLHHtTXyZcN5UQEulXIm/VDVN/jelHYsf/FuTlT5GhYpsyDfR7/uvqVbh9R34E0CpDaDvfgirD/X96GAt3lJ6/teUC9pDccpk2lImvEZbzTNxepOmVomZlbj64Jy2JTm6nuFBUkRa0raZO+oNu114DUB2SZKofxpzkw2MtPg8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=qmTfvHkJ; arc=none smtp.client-ip=91.218.175.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="qmTfvHkJ" X-Envelope-To: patches@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=Pwsu2U0dH2/nTAlsUHKCHjUm/QcKVl/S0PAUrKyclVc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786627490; v=1; x=1787232290; b=qmTfvHkJLSApu/4JeMyG5Tk6azPOh1yKj92v6vkP0IzSiwybPNKd+I7bBuqYpxd0KEFj2kRx u/AmFZyRlCv5IZ6WO8Fa8CAHioG7r+5cHmFwR7dZ/1cfYAKnLtfne9M9PVienPsunCD2lhv0efD EmDMhn0O5ipM5wkzbNxd/HC0= X-Envelope-To: patches@lists.linux.dev Received: from localhost (2a03:2880:10ff:42::) by mta12.migadu.com with ESMTPS id 4a9d9e7215df1a36; Thu, 13 Aug 2026 13:24:50 +0000 X-Migadu-Flow: FLOW_OUT From: Usama Arif To: Greg Kroah-Hartman Cc: Usama Arif , stable@vger.kernel.org, patches@lists.linux.dev, Borislav Petkov , Suravee Suthikulpanit , Joerg Roedel , Vasant Hegde , Dheeraj Kumar Srivastava , Sasha Levin , samuelcrossley@gmail.com Subject: Re: [PATCH 6.18 0019/1611] iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 Date: Thu, 13 Aug 2026 06:24:45 -0700 Message-ID: <20260813132447.3396830-1-usama.arif@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260721152515.228743536@linuxfoundation.org> References: Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Tue, 21 Jul 2026 17:02:15 +0200 Greg Kroah-Hartman wrote: > 6.18-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Vasant Hegde > > [ Upstream commit 1f44aab79bac31f459422dfb213e907bb386509c ] > > Due to CVE-2023-20585, the PPR log buffer must use the maximum supported > size (512K) on Genoa (Family 0x19, model >= 0x10) systems when SNP is > enabled, to mitigate a potential security vulnerability. Note that Family > 0x19 models below 0x10 (Milan) do not support PPR when SNP is enabled. > Hence the PPR log size increase is only applied for model >= 0x10. > All other systems continue to use the default PPR log buffer size (8K). > > Apply the errata fix by making the following changes: > > - Introduce global new variable (amd_iommu_pprlog_size) to have PPR log buffer > size. Adjust variable size for Genoa family. > > - Extend 'amd_iommu_apply_erratum_snp()' to also set the PPR log buffer > size to maximum for Family 0x19 model >= 0x10 when SNP is enabled. > > - Rename PPR_* macros to make it more readable. > > Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html > Cc: Borislav Petkov > Cc: Suravee Suthikulpanit > Cc: Joerg Roedel > Signed-off-by: Vasant Hegde > Tested-by: Dheeraj Kumar Srivastava > Signed-off-by: Joerg Roedel > Signed-off-by: Sasha Levin > --- > drivers/iommu/amd/amd_iommu.h | 1 + > drivers/iommu/amd/amd_iommu_types.h | 11 ++++++----- > drivers/iommu/amd/init.c | 13 ++++++++++++- > drivers/iommu/amd/ppr.c | 8 +++++--- > 4 files changed, 24 insertions(+), 9 deletions(-) > Hi, I have raised this in [1] but also raising it here, this series seems to break kexec on Milan hosts. kexec starts working on SNP hosts once we do: Revert "iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19" Revert "iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19" on top 6.18.43 release. [1] https://lore.kernel.org/all/20260813131833.2808948-1-usama.arif@linux.dev/ > diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h > index 57d7f3faa98c6e..ef397c5a2c4ab2 100644 > --- a/drivers/iommu/amd/amd_iommu.h > +++ b/drivers/iommu/amd/amd_iommu.h > @@ -12,6 +12,7 @@ > #include "amd_iommu_types.h" > > extern int amd_iommu_evtlog_size; > +extern int amd_iommu_pprlog_size; > > irqreturn_t amd_iommu_int_thread(int irq, void *data); > irqreturn_t amd_iommu_int_thread_evtlog(int irq, void *data); > diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h > index bdd6c38ddfec9b..2494b1958117b2 100644 > --- a/drivers/iommu/amd/amd_iommu_types.h > +++ b/drivers/iommu/amd/amd_iommu_types.h > @@ -257,11 +257,12 @@ > #define EVTLOG_LEN_MASK_MAX (0xFULL << EVTLOG_SIZE_SHIFT) > > /* Constants for PPR Log handling */ > -#define PPR_LOG_ENTRIES 512 > -#define PPR_LOG_SIZE_SHIFT 56 > -#define PPR_LOG_SIZE_512 (0x9ULL << PPR_LOG_SIZE_SHIFT) > -#define PPR_ENTRY_SIZE 16 > -#define PPR_LOG_SIZE (PPR_ENTRY_SIZE * PPR_LOG_ENTRIES) > +#define PPRLOG_ENTRY_SIZE 0x10 > +#define PPRLOG_SIZE_SHIFT 56 > +#define PPRLOG_SIZE_DEF SZ_8K /* 512 entries */ > +#define PPRLOG_LEN_MASK_DEF (0x9ULL << PPRLOG_SIZE_SHIFT) > +#define PPRLOG_SIZE_MAX SZ_512K /* 32K entries */ > +#define PPRLOG_LEN_MASK_MAX (0xFULL << PPRLOG_SIZE_SHIFT) > > /* PAGE_SERVICE_REQUEST PPR Log Buffer Entry flags */ > #define PPR_FLAG_EXEC 0x002 /* Execute permission requested */ > diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c > index 64964bb5ce0d36..6e5efc340c83e4 100644 > --- a/drivers/iommu/amd/init.c > +++ b/drivers/iommu/amd/init.c > @@ -133,6 +133,7 @@ struct ivhd_entry { > } __attribute__((packed)); > > int amd_iommu_evtlog_size = EVTLOG_SIZE_DEF; > +int amd_iommu_pprlog_size = PPRLOG_SIZE_DEF; > > /* > * An AMD IOMMU memory definition structure. It defines things like exclusion > @@ -3411,6 +3412,16 @@ static void amd_iommu_apply_erratum_snp(void) > amd_iommu_evtlog_size = EVTLOG_SIZE_MAX; > pr_info("Applying erratum: Increase Event log size to 0x%x\n", > amd_iommu_evtlog_size); > + > + /* > + * Set PPR log buffer size to max. > + * (Family 0x19, model < 0x10 doesn't support PPR when SNP is enabled). > + */ > + if (boot_cpu_data.x86_model >= 0x10) { > + amd_iommu_pprlog_size = PPRLOG_SIZE_MAX; > + pr_info("Applying erratum: Increase PPR log size to 0x%x\n", > + amd_iommu_pprlog_size); > + } > #endif > } > > @@ -4071,7 +4082,7 @@ int amd_iommu_snp_disable(void) > if (ret) > return ret; > > - ret = iommu_make_shared(iommu->ppr_log, PPR_LOG_SIZE); > + ret = iommu_make_shared(iommu->ppr_log, amd_iommu_pprlog_size); > if (ret) > return ret; > > diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c > index e6767c057d01fa..1f8d2823bea42c 100644 > --- a/drivers/iommu/amd/ppr.c > +++ b/drivers/iommu/amd/ppr.c > @@ -20,7 +20,7 @@ > int __init amd_iommu_alloc_ppr_log(struct amd_iommu *iommu) > { > iommu->ppr_log = iommu_alloc_4k_pages(iommu, GFP_KERNEL | __GFP_ZERO, > - PPR_LOG_SIZE); > + amd_iommu_pprlog_size); > return iommu->ppr_log ? 0 : -ENOMEM; > } > > @@ -33,7 +33,9 @@ void amd_iommu_enable_ppr_log(struct amd_iommu *iommu) > > iommu_feature_enable(iommu, CONTROL_PPR_EN); > > - entry = iommu_virt_to_phys(iommu->ppr_log) | PPR_LOG_SIZE_512; > + entry = iommu_virt_to_phys(iommu->ppr_log); > + entry |= (amd_iommu_pprlog_size == PPRLOG_SIZE_DEF) ? > + PPRLOG_LEN_MASK_DEF : PPRLOG_LEN_MASK_MAX; > > memcpy_toio(iommu->mmio_base + MMIO_PPR_LOG_OFFSET, > &entry, sizeof(entry)); > @@ -201,7 +203,7 @@ void amd_iommu_poll_ppr_log(struct amd_iommu *iommu) > raw[0] = raw[1] = 0UL; > > /* Update head pointer of hardware ring-buffer */ > - head = (head + PPR_ENTRY_SIZE) % PPR_LOG_SIZE; > + head = (head + PPRLOG_ENTRY_SIZE) % amd_iommu_pprlog_size; > writel(head, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET); > > /* Handle PPR entry */ > -- > 2.53.0 > > > >