Commit 6e2213dae78b for kernel

commit 6e2213dae78b41976c60133eb10cf99e81916638
Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date:   Tue Nov 10 14:00:20 2026 +0100

    iommu/amd: Force device table to maximum size

    IOMMU can perform out-of-bounds read of the device table entry (DTE)
    that is adjacent to the last DTE and falls outside the device table.
    For example, if the device table can hold 0 to N-1 entries, then the
    IOMMU can be made to fetch the Nth entry, which falls outside the
    device table.

    The device table is owned by the hypervisor (HV) and is assigned in 4KB
    pages that are contiguous in system physical address (SPA). If the
    out-of-bound DTE falls on a guest-owned page, then the guest can exploit
    this bug to setup malicious table walks to corrupt HV pages and/or bring
    down the system. Note that this bug does not manifest when the device
    table size is set to its maximum size of 2MB.

    Therefore, force the device table size to the maximum 2MB on affected
    processors. These are CPU family 0x17 (Zen1/Zen2) through family 0x1a
    (Zen5/BRH).

    This is a mitigation for CVE-2024-21963.

    kdump reuses the previous kernel's device table only when the size
    encoded in the IOMMU device-table register matches
    pci_seg->dev_table_size. A mixed rollout disagrees: the unpatched
    kernel uses the IVRS-derived size and the patched kernel uses 2MB,
    so __reuse_device_table() rejects the table. On SNP-capable IOMMUs
    that rejection panics the kdump kernel. Kernels that both have this
    patch agree on 2MB and reuse succeeds. Update the production kernel
    and the crash kernel together.

    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index edcc187b8f14..1c5dc0769065 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -1703,6 +1703,21 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
 	return 0;
 }

+/*
+ * Apply workaround for Zen1 to Zen5(BRH) generation of processors.
+ * References: CVE-2024-21963
+ */
+static bool __init amd_iommu_force_max_dev_table(void)
+{
+	if (boot_cpu_data.x86 >= 0x17 && boot_cpu_data.x86 <= 0x1a) {
+		if (cpu_feature_enabled(X86_FEATURE_ZEN6))
+			return false;
+		else
+			return true;
+	}
+	return false;
+}
+
 /* Allocate PCI segment data structure */
 static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
 					  struct acpi_table_header *ivrs_base)
@@ -1725,9 +1740,15 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,

 	pci_seg->last_bdf = last_bdf;
 	DUMP_printk("PCI segment : 0x%0x, last bdf : 0x%04x\n", id, last_bdf);
-	pci_seg->dev_table_size =
-		max(roundup_pow_of_two((last_bdf + 1) * DEV_TABLE_ENTRY_SIZE),
-		    SZ_4K);
+	if (amd_iommu_force_max_dev_table()) {
+		pr_info("Force device table to maximum size\n");
+		pci_seg->dev_table_size = SZ_2M;
+	} else {
+		pci_seg->dev_table_size =
+			max(roundup_pow_of_two((last_bdf + 1) *
+					       DEV_TABLE_ENTRY_SIZE),
+			    SZ_4K);
+	}

 	pci_seg->id = id;
 	init_llist_head(&pci_seg->dev_data_list);