6.6-stable patches

added patches:
	x86-amd_nb-use-rdmsr_safe-in-amd_get_mmconfig_range.patch
	x86-microcode-amd-add-some-forgotten-models-to-the-sha-check.patch

diff --git a/queue-6.6/series b/queue-6.6/series
index e8d4f1d967d6151340499401dfc8c8699f491ec5..44607054dde23e14191a5f8e39230ad94ac2da70 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -1,3 +1,4 @@
+x86-amd_nb-use-rdmsr_safe-in-amd_get_mmconfig_range.patch
 efi-don-t-map-the-entire-mokvar-table-to-determine-its-size.patch
 drm-i915-xe2lpd-move-d2d-enable-disable.patch
 drm-i915-ddi-fix-hdmi-port-width-programming-in-ddi_.patch
@@ -18,3 +19,4 @@ riscv-prevent-a-bad-reference-count-on-cpu-nodes.patch
 riscv-cacheinfo-use-of_property_present-for-non-bool.patch
 risc-v-enable-cbo.zero-in-usermode.patch
 riscv-signal-fix-signal_minsigstksz.patch
+x86-microcode-amd-add-some-forgotten-models-to-the-sha-check.patch

diff --git a/queue-6.6/x86-amd_nb-use-rdmsr_safe-in-amd_get_mmconfig_range.patch b/queue-6.6/x86-amd_nb-use-rdmsr_safe-in-amd_get_mmconfig_range.patch
new file mode 100644 (file)
index 0000000..615c79b
--- /dev/null
+++ b/queue-6.6/x86-amd_nb-use-rdmsr_safe-in-amd_get_mmconfig_range.patch
@@ -0,0 +1,73 @@
+From 14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Fri, 7 Mar 2025 00:28:46 +0000
+Subject: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
+
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+
+commit 14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457 upstream.
+
+Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests.  This results
+in the following warning:
+
+  unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0)
+  Call Trace:
+   xen_read_msr+0x1e/0x30
+   amd_get_mmconfig_range+0x2b/0x80
+   quirk_amd_mmconfig_area+0x28/0x100
+   pnp_fixup_device+0x39/0x50
+   __pnp_add_device+0xf/0x150
+   pnp_add_device+0x3d/0x100
+   pnpacpi_add_device_handler+0x1f9/0x280
+   acpi_ns_get_device_callback+0x104/0x1c0
+   acpi_ns_walk_namespace+0x1d0/0x260
+   acpi_get_devices+0x8a/0xb0
+   pnpacpi_init+0x50/0x80
+   do_one_initcall+0x46/0x2e0
+   kernel_init_freeable+0x1da/0x2f0
+   kernel_init+0x16/0x1b0
+   ret_from_fork+0x30/0x50
+   ret_from_fork_asm+0x1b/0x30
+
+based on quirks for a "PNP0c01" device.  Treating MMCFG as disabled is the
+right course of action, so no change is needed there.
+
+This was most likely exposed by fixing the Xen MSR accessors to not be
+silently-safe.
+
+Fixes: 3fac3734c43a ("xen/pv: support selecting safe/unsafe msr accesses")
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20250307002846.3026685-1-andrew.cooper3@citrix.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/amd_nb.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -360,7 +360,6 @@ bool __init early_is_amd_nb(u32 device)
+ 
+ struct resource *amd_get_mmconfig_range(struct resource *res)
+ {
+-      u32 address;
+       u64 base, msr;
+       unsigned int segn_busn_bits;
+ 
+@@ -368,13 +367,11 @@ struct resource *amd_get_mmconfig_range(
+           boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
+               return NULL;
+ 
+-      /* assume all cpus from fam10h have mmconfig */
+-      if (boot_cpu_data.x86 < 0x10)
++      /* Assume CPUs from Fam10h have mmconfig, although not all VMs do */
++      if (boot_cpu_data.x86 < 0x10 ||
++          rdmsrl_safe(MSR_FAM10H_MMIO_CONF_BASE, &msr))
+               return NULL;
+ 
+-      address = MSR_FAM10H_MMIO_CONF_BASE;
+-      rdmsrl(address, msr);
+-
+       /* mmconfig is not enabled */
+       if (!(msr & FAM10H_MMIO_CONF_ENABLE))
+               return NULL;

diff --git a/queue-6.6/x86-microcode-amd-add-some-forgotten-models-to-the-sha-check.patch b/queue-6.6/x86-microcode-amd-add-some-forgotten-models-to-the-sha-check.patch
new file mode 100644 (file)
index 0000000..b67281c
--- /dev/null
+++ b/queue-6.6/x86-microcode-amd-add-some-forgotten-models-to-the-sha-check.patch
@@ -0,0 +1,57 @@
+From 058a6bec37c6c3b826158f6d26b75de43816a880 Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Fri, 7 Mar 2025 23:02:56 +0100
+Subject: x86/microcode/AMD: Add some forgotten models to the SHA check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit 058a6bec37c6c3b826158f6d26b75de43816a880 upstream.
+
+Add some more forgotten models to the SHA check.
+
+Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches")
+Reported-by: Toralf Förster <toralf.foerster@gmx.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Toralf Förster <toralf.foerster@gmx.de>
+Link: https://lore.kernel.org/r/20250307220256.11816-1-bp@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/microcode/amd.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -177,23 +177,29 @@ static bool need_sha_check(u32 cur_rev)
+ {
+       switch (cur_rev >> 8) {
+       case 0x80012: return cur_rev <= 0x800126f; break;
++      case 0x80082: return cur_rev <= 0x800820f; break;
+       case 0x83010: return cur_rev <= 0x830107c; break;
+       case 0x86001: return cur_rev <= 0x860010e; break;
+       case 0x86081: return cur_rev <= 0x8608108; break;
+       case 0x87010: return cur_rev <= 0x8701034; break;
+       case 0x8a000: return cur_rev <= 0x8a0000a; break;
++      case 0xa0010: return cur_rev <= 0xa00107a; break;
+       case 0xa0011: return cur_rev <= 0xa0011da; break;
+       case 0xa0012: return cur_rev <= 0xa001243; break;
++      case 0xa0082: return cur_rev <= 0xa00820e; break;
+       case 0xa1011: return cur_rev <= 0xa101153; break;
+       case 0xa1012: return cur_rev <= 0xa10124e; break;
+       case 0xa1081: return cur_rev <= 0xa108109; break;
+       case 0xa2010: return cur_rev <= 0xa20102f; break;
+       case 0xa2012: return cur_rev <= 0xa201212; break;
++      case 0xa4041: return cur_rev <= 0xa404109; break;
++      case 0xa5000: return cur_rev <= 0xa500013; break;
+       case 0xa6012: return cur_rev <= 0xa60120a; break;
+       case 0xa7041: return cur_rev <= 0xa704109; break;
+       case 0xa7052: return cur_rev <= 0xa705208; break;
+       case 0xa7080: return cur_rev <= 0xa708009; break;
+       case 0xa70c0: return cur_rev <= 0xa70C009; break;
++      case 0xaa001: return cur_rev <= 0xaa00116; break;
+       case 0xaa002: return cur_rev <= 0xaa00218; break;
+       default: break;
+       }