x86/microcode/AMD: Limit Entrysign signature checking to known generations
Subsystems (2)
PATCH 1/1 x86/microcode/AMD: Limit Entrysign signature checking to known generations
From: "Borislav Petkov (AMD)" <[email protected]>
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way too early, before the cpufeatures machinery has been set up.
--- arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +19 -1
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)return true; } +static bool cpu_has_entrysign (void ) +{ +unsigned int fam =x86_family (bsp_cpuid_1_eax); +unsigned int model =x86_model (bsp_cpuid_1_eax); + +if (fam ==0x17 ) +return true; + +if (fam ==0x19 ) { +if (model <=0x2f || + (0x40 <= model && model <=0x4f ) || + (0x60 <= model && model <=0x6f )) +return true; + } + +return false; +} +static bool verify_sha256_digest (u32 patch_id,u32 cur_rev,const u8 *data,unsigned int len) {struct patch_digest *pd =NULL ;u8 digest[SHA256_DIGEST_SIZE ];int i; -if (x86_family (bsp_cpuid_1_eax) <0x17 ) +if (!cpu_has_entrysign ())return true;if (!need_sha_check (cur_rev))
Signature · 1 line
2.51.0
Quoted 10 lines
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
...
+static boolcpu_has_entrysign(void)+{ + unsigned int fam =x86_family(bsp_cpuid_1_eax); + unsigned int model =x86_model(bsp_cpuid_1_eax); + + if (fam ==0x17) + return true; + + if (fam ==0x19) { + if (model <=0x2f|| + (0x40<= model && model <=0x4f) || + (0x60<= model && model <=0x6f)) + return true; + } + + return false; +}
That's Zen1-3. It's Fam 0x1a you need to split to separate Zen5 and 6.
~Andrew
Borislav Petkov
maintainerQuoted 1 line · Andrew Cooper
That's Zen1-3. It's Fam
0x1ayou need to split to separate Zen5 and 6.
/facepalm.
I deserve that when I try to do gazillion things at the same time. :-(
Thanks Andy!
Signature · 4 lines
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquetteThe following commit has been merged into the x86/urgent branch of tip:
The following commit has been merged into the x86/urgent branch of tip:
Commit-ID: 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 Gitweb: https://git.kernel.org/tip/8a9fb5129e8e64d24543ebc70de941a2d77a9e77 Author: Borislav Petkov (AMD) <[email protected]> AuthorDate: Thu, 23 Oct 2025 14:46:29 +02:00 Committer: Borislav Petkov (AMD) <[email protected]> CommitterDate: Mon, 27 Oct 2025 17:07:17 +01:00
x86/microcode/AMD: Limit Entrysign signature checking to known generations
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way too early, before the cpufeatures machinery has been set up.
--- arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +19 -1
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)return true; } +static bool cpu_has_entrysign (void ) +{ +unsigned int fam =x86_family (bsp_cpuid_1_eax); +unsigned int model =x86_model (bsp_cpuid_1_eax); + +if (fam ==0x17 || fam ==0x19 ) +return true; + +if (fam ==0x1a ) { +if (model <=0x2f || + (0x40 <= model && model <=0x4f ) || + (0x60 <= model && model <=0x6f )) +return true; + } + +return false; +} +static bool verify_sha256_digest (u32 patch_id,u32 cur_rev,const u8 *data,unsigned int len) {struct patch_digest *pd =NULL ;u8 digest[SHA256_DIGEST_SIZE ];int i; -if (x86_family (bsp_cpuid_1_eax) <0x17 ) +if (!cpu_has_entrysign ())return true;if (!need_sha_check (cur_rev))