x86/ucode: Exclude Zen6 from entrysign digest checking

[PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Andrew Cooper 1 month, 1 week ago

There is a 3rd path which should have gained an is_zen6_uarch() check to
exclude Zen6 from entrysign mitigations.

Fixes: bd15fdedafb3 ("x86/ucode: Exclude Zen6 from entrysign mitigations")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Teddy Astie <teddy.astie@vates.tech>
CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>

For 4.22.  This wants backporting too.
---
 xen/arch/x86/cpu/microcode/amd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
index 2ba1fa825f2f..2d4911022835 100644
--- a/xen/arch/x86/cpu/microcode/amd.c
+++ b/xen/arch/x86/cpu/microcode/amd.c
@@ -128,7 +128,8 @@ static bool check_digest(const struct container_microcode *mc)
      * the digest of the patch against a list of known provenance.
      */
     if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
-         entrysign_mitigated_in_firmware || !opt_digest_check )
+         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
+         !opt_digest_check )
         return true;
 
     pd = bsearch(&patch->patch_id, patch_digests, ARRAY_SIZE(patch_digests),

base-commit: 1cfceee62d8b086a1713d04522f741a09d50cbb3
-- 
2.39.5

Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Oleksii Kurochko 1 month, 1 week ago


On 6/16/26 12:45 PM, Andrew Cooper wrote:
> There is a 3rd path which should have gained an is_zen6_uarch() check to
> exclude Zen6 from entrysign mitigations.
> 
> Fixes: bd15fdedafb3 ("x86/ucode: Exclude Zen6 from entrysign mitigations")
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Teddy Astie <teddy.astie@vates.tech>
> CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
> 
> For 4.22.  This wants backporting too.

Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>

Thanks.

~ Oleksii

Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Jan Beulich 1 month, 1 week ago

On 16.06.2026 12:45, Andrew Cooper wrote:
> --- a/xen/arch/x86/cpu/microcode/amd.c
> +++ b/xen/arch/x86/cpu/microcode/amd.c
> @@ -128,7 +128,8 @@ static bool check_digest(const struct container_microcode *mc)
>       * the digest of the patch against a list of known provenance.
>       */
>      if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
> -         entrysign_mitigated_in_firmware || !opt_digest_check )
> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
> +         !opt_digest_check )
>          return true;

Besides being somewhat fragile towards future changes (to the family range
covered), this also sets a bad precedent towards the comment ahead is
is_zen<N>_uarch() saying "The caller is required to perform the appropriate
vendor/family checks first." My understanding was that a single family
should be checked for in all such cases, not - as is the case here - a
range of families. Using the (seemingly) opposite is_zen5_uarch() wouldn't
be correct here, after all.

Jan

Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Andrew Cooper 1 month, 1 week ago

On 16/06/2026 1:36 pm, Jan Beulich wrote:
> On 16.06.2026 12:45, Andrew Cooper wrote:
>> --- a/xen/arch/x86/cpu/microcode/amd.c
>> +++ b/xen/arch/x86/cpu/microcode/amd.c
>> @@ -128,7 +128,8 @@ static bool check_digest(const struct container_microcode *mc)
>>       * the digest of the patch against a list of known provenance.
>>       */
>>      if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
>> -         entrysign_mitigated_in_firmware || !opt_digest_check )
>> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
>> +         !opt_digest_check )
>>          return true;
> Besides being somewhat fragile towards future changes (to the family range
> covered), this also sets a bad precedent towards the comment ahead is
> is_zen<N>_uarch() saying "The caller is required to perform the appropriate
> vendor/family checks first." My understanding was that a single family
> should be checked for in all such cases, not - as is the case here - a
> range of families. Using the (seemingly) opposite is_zen5_uarch() wouldn't
> be correct here, after all.

It is true that they're not symmetric when used with ranges.

But "appropriate checks" doesn't mean single family.  I suppose it
really means "know what you're doing".

Entrysign is weird.  All other uses of is_zen?_uarch() come with single
family checks.

~Andrew

Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Jan Beulich 1 month, 1 week ago

On 16.06.2026 15:26, Andrew Cooper wrote:
> On 16/06/2026 1:36 pm, Jan Beulich wrote:
>> On 16.06.2026 12:45, Andrew Cooper wrote:
>>> --- a/xen/arch/x86/cpu/microcode/amd.c
>>> +++ b/xen/arch/x86/cpu/microcode/amd.c
>>> @@ -128,7 +128,8 @@ static bool check_digest(const struct container_microcode *mc)
>>>       * the digest of the patch against a list of known provenance.
>>>       */
>>>      if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
>>> -         entrysign_mitigated_in_firmware || !opt_digest_check )
>>> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
>>> +         !opt_digest_check )
>>>          return true;
>> Besides being somewhat fragile towards future changes (to the family range
>> covered), this also sets a bad precedent towards the comment ahead is
>> is_zen<N>_uarch() saying "The caller is required to perform the appropriate
>> vendor/family checks first." My understanding was that a single family
>> should be checked for in all such cases, not - as is the case here - a
>> range of families. Using the (seemingly) opposite is_zen5_uarch() wouldn't
>> be correct here, after all.
> 
> It is true that they're not symmetric when used with ranges.
> 
> But "appropriate checks" doesn't mean single family.  I suppose it
> really means "know what you're doing".
> 
> Entrysign is weird.  All other uses of is_zen?_uarch() come with single
> family checks.

If you're not afraid of building ourselves a trap here:
Acked-by: Jan Beulich <jbeulich@suse.com>

Jan

Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

Posted by Teddy Astie 1 month, 1 week ago

Le 16/06/2026 à 12:47, Andrew Cooper a écrit :
> There is a 3rd path which should have gained an is_zen6_uarch() check to
> exclude Zen6 from entrysign mitigations.
> 
> Fixes: bd15fdedafb3 ("x86/ucode: Exclude Zen6 from entrysign mitigations")
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <jbeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Teddy Astie <teddy.astie@vates.tech>
> CC: Oleksii Kurochko <oleksii.kurochko@gmail.com>
> 
> For 4.22.  This wants backporting too.
> ---
>   xen/arch/x86/cpu/microcode/amd.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c
> index 2ba1fa825f2f..2d4911022835 100644
> --- a/xen/arch/x86/cpu/microcode/amd.c
> +++ b/xen/arch/x86/cpu/microcode/amd.c
> @@ -128,7 +128,8 @@ static bool check_digest(const struct container_microcode *mc)
>        * the digest of the patch against a list of known provenance.
>        */
>       if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
> -         entrysign_mitigated_in_firmware || !opt_digest_check )
> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
> +         !opt_digest_check )
>           return true;
>   
>       pd = bsearch(&patch->patch_id, patch_digests, ARRAY_SIZE(patch_digests),
> 
> base-commit: 1cfceee62d8b086a1713d04522f741a09d50cbb3

Reviewed-by: Teddy Astie <teddy.astie@vates.tech>

Teddy