arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
---
arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index cdce885e2fd5..2a251de66b9d 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)
return true;
}
+static bool cpu_has_entrysign(void)
+{
+ unsigned int fam = x86_family(bsp_cpuid_1_eax);
+ unsigned int model = x86_model(bsp_cpuid_1_eax);
+
+ if (fam == 0x17)
+ return true;
+
+ if (fam == 0x19) {
+ if (model <= 0x2f ||
+ (0x40 <= model && model <= 0x4f) ||
+ (0x60 <= model && model <= 0x6f))
+ return true;
+ }
+
+ return false;
+}
+
static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len)
{
struct patch_digest *pd = NULL;
u8 digest[SHA256_DIGEST_SIZE];
int i;
- if (x86_family(bsp_cpuid_1_eax) < 0x17)
+ if (!cpu_has_entrysign())
return true;
if (!need_sha_check(cur_rev))
--
2.51.0
> Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
>
> ...
> +static bool cpu_has_entrysign(void) +{ + unsigned int fam =
> x86_family(bsp_cpuid_1_eax); + unsigned int model =
> x86_model(bsp_cpuid_1_eax); + + if (fam == 0x17) + return true; + + if
> (fam == 0x19) { + if (model <= 0x2f || + (0x40 <= model && model <=
> 0x4f) || + (0x60 <= model && model <= 0x6f)) + return true; + } + +
> return false; +}
That's Zen1-3. It's Fam 0x1a you need to split to separate Zen5 and 6.
~Andrew
On Mon, Oct 27, 2025 at 02:47:24PM +0000, Andrew Cooper wrote:
> That's Zen1-3. It's Fam 0x1a you need to split to separate Zen5 and 6.
/facepalm.
I deserve that when I try to do gazillion things at the same time. :-(
Thanks Andy!
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 8a9fb5129e8e64d24543ebc70de941a2d77a9e77
Gitweb: https://git.kernel.org/tip/8a9fb5129e8e64d24543ebc70de941a2d77a9e77
Author: Borislav Petkov (AMD) <bp@alien8.de>
AuthorDate: Thu, 23 Oct 2025 14:46:29 +02:00
Committer: Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Mon, 27 Oct 2025 17:07:17 +01:00
x86/microcode/AMD: Limit Entrysign signature checking to known generations
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org
---
arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 28ed8c0..b7c797d 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)
return true;
}
+static bool cpu_has_entrysign(void)
+{
+ unsigned int fam = x86_family(bsp_cpuid_1_eax);
+ unsigned int model = x86_model(bsp_cpuid_1_eax);
+
+ if (fam == 0x17 || fam == 0x19)
+ return true;
+
+ if (fam == 0x1a) {
+ if (model <= 0x2f ||
+ (0x40 <= model && model <= 0x4f) ||
+ (0x60 <= model && model <= 0x6f))
+ return true;
+ }
+
+ return false;
+}
+
static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len)
{
struct patch_digest *pd = NULL;
u8 digest[SHA256_DIGEST_SIZE];
int i;
- if (x86_family(bsp_cpuid_1_eax) < 0x17)
+ if (!cpu_has_entrysign())
return true;
if (!need_sha_check(cur_rev))© 2016 - 2026 Red Hat, Inc.