From nobody Mon Mar 23 19:56:01 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1773662796; cv=none; d=zohomail.com; s=zohoarc; b=SYgSLFoXUESr/O/fg6vJIoe9BlFYEUzXHHHHpGhgucb9hb6FB31yw6NaauxVKX+qiwwVthpx65OxsoFmfwEPFkeCIr9XpshM8zXtSkTHLbnW2aC2SSf3f7snmDFj357/nnrna9qSA23iLghny5Gzp1H7XWevjK3V4zmXcGvqDaU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773662796; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0rWbpJ2be8sUH/WQvbkRx6j6nRNRuf+/YSo/lRPoWO4=; b=ZJnQfNv/S/v5qQdpTlXgTg88YKItVGe1MB65qHFXvzT7H1XkDsuuce5cVYnPu9Ez4DWp+7im56BIh5er5Q2no5dkOi5Molh6WOFBnftGTQknm2tG9udAEI8rnHNYuCbIoO69/kY5y0mqXCT1sRhst4iJkjIna5vGcpHyj4R8kNU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1773662795996503.4797892153555; Mon, 16 Mar 2026 05:06:35 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1255561.1550481 (Exim 4.92) (envelope-from ) id 1w26i3-0008EN-Ul; Mon, 16 Mar 2026 12:06:11 +0000 Received: by outflank-mailman (output) from mailman id 1255561.1550481; Mon, 16 Mar 2026 12:06:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1w26i3-0008EF-S0; Mon, 16 Mar 2026 12:06:11 +0000 Received: by outflank-mailman (input) for mailman id 1255561; Mon, 16 Mar 2026 12:06:10 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1w26i2-0008E9-HW for xen-devel@lists.xenproject.org; Mon, 16 Mar 2026 12:06:10 +0000 Received: from mail-wm1-x333.google.com (mail-wm1-x333.google.com [2a00:1450:4864:20::333]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 847d9a08-2130-11f1-b164-2bf370ae4941; Mon, 16 Mar 2026 13:06:09 +0100 (CET) Received: by mail-wm1-x333.google.com with SMTP id 5b1f17b1804b1-4855dbfc129so20868975e9.0 for ; Mon, 16 Mar 2026 05:06:09 -0700 (PDT) Received: from localhost.localdomain (host-92-22-18-152.as13285.net. [92.22.18.152]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4855640d915sm91540365e9.4.2026.03.16.05.06.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 05:06:07 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 847d9a08-2130-11f1-b164-2bf370ae4941 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1773662768; x=1774267568; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=0rWbpJ2be8sUH/WQvbkRx6j6nRNRuf+/YSo/lRPoWO4=; b=lq0avIugbPVTFIkF54Y8exXm1EQFWMPdWkRBOVxCATkeOVdoNjBaWEWxEqYi2YaI/B cmVtEv6C8LwrfWjGWul1Fk/+InCyWYIVooKASfVAwS6otLfECAynm6MNJYCzvOpHa+Yz NzAEOgrFdF/YrTP1WQEqL6yzEgjPaKnwSV/RM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773662768; x=1774267568; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=0rWbpJ2be8sUH/WQvbkRx6j6nRNRuf+/YSo/lRPoWO4=; b=VtUHVkFNgtA/EbLs5R/6l45f1DanANFGSoXuoIJS1JJyIfrOUHReCzGtyYq+7F1xJX UyHEoGFUutjGrteRBAIR/uyMZkF9atdNCX0A80E4wN2Ma8LgSf9iI8rx6SAf5I4yczKR JIm6DEuwVx7/Yiwm1+iFdbn1w73dTNweexWfQ4FRJ5h0GYEf5qFyWoYo332Ir4OVKW9l WF1uepKm7fZhh2mGxijhAlSq5joAPva5ShrG8bQoKvR+r9xjYzWBLJJEH/G3bspHILkG cLJIvDa3o1uRGv0YwYuAls1pCafj9xrfGMF18tPOD5rJq6TFq1ZJq92H6U+Fz3WuA2f9 ZFBQ== X-Gm-Message-State: AOJu0YyuxhWaTaJacfFPxA4wReOeR+6iQUp5isVys68UsT2wSBI152pY kaZWTFM4oJFjLytfuchcD6V+ODrxFNSKjkVpYkrbtGwHVW/gVUM+D+0qVUWNuRTuSs6LxdeN9ez hopuz X-Gm-Gg: ATEYQzzlFjobwkQ2g9Nu0j/ExijxHkRhmkV7vJcLnsf0sYghItrhiw2aNllu2hLjE9D KPcTcxEmYIftyW0RqsgjhyV8aVS0OtwjSov9Edej7A2zKjXSQIo5bosXYAFnTxDTw+yxJLG52/E qOKA3uaRSGwNrbw2dG5EQg1/uYURJ0Q6ofZDOtdiiCGABJGIfnA+qwtUvzMUoNxmm7wXQybe3RM fWUYNg+eKqPaGpweC22aUxk+DQjLPZX3uICWYBrUcwbwvmJoCcxqvdJdJ8ew8v99QfpJAHbkm/4 nDJVbjnQqAZd4n9EJMgl378R1KsflkWxeGxsgeY4GXRhZTOjOy5m17i80lcpGb5kFYGqs/DbcES ZZEbRVrox7GZGaO1dUSHsWB/qzEMXRNCXTV5/s77f+W+8VHHVUjSf+ef4mPzlZK/kghm5Ue9uRz o7jMQj/+//ZqCEYSs21oTssuoxNITbuHMNODa0LAOQ6uPZlhupuC+tkUAY5FZ/1SdUcVal4+Sms iMrq6JaUQ== X-Received: by 2002:a05:600c:4fc6:b0:485:3fc8:de9c with SMTP id 5b1f17b1804b1-485566d520cmr199054845e9.12.1773662768233; Mon, 16 Mar 2026 05:06:08 -0700 (PDT) From: Andrew Cooper To: Xen-devel Cc: Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Subject: [PATCH] x86/ucode: Exclude Zen6 from entrysign mitigations Date: Mon, 16 Mar 2026 12:06:05 +0000 Message-Id: <20260316120605.661823-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1773662797240154100 Family 0x1a covers both Zen5 and Zen6, but the latter is not believed to be vulnerable to entrysign. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 This does want backporting, but it depends on 8e4775d118c327 which collects leaf 7a1 early enough to be used in this way. So, it should hold off for t= he moment until the FRED backports are finalised. --- xen/arch/x86/cpu/microcode/amd.c | 6 ++++-- xen/arch/x86/include/asm/amd.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/= amd.c index 90f10ac8be37..2ba1fa825f2f 100644 --- a/xen/arch/x86/cpu/microcode/amd.c +++ b/xen/arch/x86/cpu/microcode/amd.c @@ -20,6 +20,7 @@ #include /* TODO: Fix asm/tlbflush.h breakage */ #include =20 +#include #include =20 #include "private.h" @@ -576,7 +577,7 @@ void __init ucode_probe_amd(struct microcode_ops *ops) */ if ( IS_ENABLED(CONFIG_MICROCODE_LOADING) && boot_cpu_data.family >=3D 0x17 && boot_cpu_data.family <=3D 0x1a = && - !opt_digest_check ) + !is_zen6_uarch() && !opt_digest_check ) { printk(XENLOG_WARNING "Microcode patch additional digest checks disabled\n"); @@ -618,7 +619,8 @@ void __init amd_check_entrysign(void) if ( !IS_ENABLED(CONFIG_MICROCODE_LOADING) || boot_cpu_data.vendor !=3D X86_VENDOR_AMD || boot_cpu_data.family < 0x17 || - boot_cpu_data.family > 0x1a ) + boot_cpu_data.family > 0x1a || + is_zen6_uarch() ) return; =20 /* diff --git a/xen/arch/x86/include/asm/amd.h b/xen/arch/x86/include/asm/amd.h index 4036dd549835..d21df0741a32 100644 --- a/xen/arch/x86/include/asm/amd.h +++ b/xen/arch/x86/include/asm/amd.h @@ -59,6 +59,8 @@ * For Zen3 and Zen4 (Fam19h) the heuristic is the presence of AutoIBRS, as * it's Zen4-specific. * + * For Zen5 and Zen6 (Fam1ah) the heuristic is the presence of FRED. + * * The caller is required to perform the appropriate vendor/family checks * first. */ @@ -66,6 +68,8 @@ #define is_zen2_uarch() boot_cpu_has(X86_FEATURE_AMD_STIBP) #define is_zen3_uarch() (!boot_cpu_has(X86_FEATURE_AUTO_IBRS)) #define is_zen4_uarch() boot_cpu_has(X86_FEATURE_AUTO_IBRS) +#define is_zen5_uarch() (!boot_cpu_has(X86_FEATURE_FRED)) +#define is_zen6_uarch() boot_cpu_has(X86_FEATURE_FRED) =20 struct cpuinfo_x86; int cpu_has_amd_erratum(const struct cpuinfo_x86 *cpu, int osvw_id, ...); --=20 2.39.5