[PATCH] x86/microcode/AMD: Limit Entrysign signature checking to known generations

[PATCH] x86/microcode/AMD: Limit Entrysign signature checking to known generations

[Borislav Petkov]

From: "Borislav Petkov (AMD)" <bp@alien8.de>

Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.

X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
---
 arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index cdce885e2fd5..2a251de66b9d 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)
 	return true;
 }
 
+static bool cpu_has_entrysign(void)
+{
+	unsigned int fam   = x86_family(bsp_cpuid_1_eax);
+	unsigned int model = x86_model(bsp_cpuid_1_eax);
+
+	if (fam == 0x17)
+		return true;
+
+	if (fam == 0x19) {
+		if (model <= 0x2f ||
+		    (0x40 <= model && model <= 0x4f) ||
+		    (0x60 <= model && model <= 0x6f))
+			return true;
+	}
+
+	return false;
+}
+
 static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len)
 {
 	struct patch_digest *pd = NULL;
 	u8 digest[SHA256_DIGEST_SIZE];
 	int i;
 
-	if (x86_family(bsp_cpuid_1_eax) < 0x17)
+	if (!cpu_has_entrysign())
 		return true;
 
 	if (!need_sha_check(cur_rev))
-- 
2.51.0

Re: [PATCH] x86/microcode/AMD: Limit Entrysign signature checking to known generations

[Andrew Cooper]

> Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
>
> ...
> +static bool cpu_has_entrysign(void) +{ + unsigned int fam =
> x86_family(bsp_cpuid_1_eax); + unsigned int model =
> x86_model(bsp_cpuid_1_eax); + + if (fam == 0x17) + return true; + + if
> (fam == 0x19) { + if (model <= 0x2f || + (0x40 <= model && model <=
> 0x4f) || + (0x60 <= model && model <= 0x6f)) + return true; + } + +
> return false; +}

That's Zen1-3.  It's Fam 0x1a you need to split to separate Zen5 and 6.

~Andrew

Re: [PATCH] x86/microcode/AMD: Limit Entrysign signature checking to known generations

[Borislav Petkov]

On Mon, Oct 27, 2025 at 02:47:24PM +0000, Andrew Cooper wrote:
> That's Zen1-3.  It's Fam 0x1a you need to split to separate Zen5 and 6.

/facepalm.

I deserve that when I try to do gazillion things at the same time. :-(

Thanks Andy!

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

[tip: x86/urgent] x86/microcode/AMD: Limit Entrysign signature checking to known generations

[tip-bot2 for Borislav Petkov (AMD)]

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     8a9fb5129e8e64d24543ebc70de941a2d77a9e77
Gitweb:        https://git.kernel.org/tip/8a9fb5129e8e64d24543ebc70de941a2d77a9e77
Author:        Borislav Petkov (AMD) <bp@alien8.de>
AuthorDate:    Thu, 23 Oct 2025 14:46:29 +02:00
Committer:     Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Mon, 27 Oct 2025 17:07:17 +01:00

x86/microcode/AMD: Limit Entrysign signature checking to known generations

Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.

X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org
---
 arch/x86/kernel/cpu/microcode/amd.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 28ed8c0..b7c797d 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -233,13 +233,31 @@ static bool need_sha_check(u32 cur_rev)
 	return true;
 }
 
+static bool cpu_has_entrysign(void)
+{
+	unsigned int fam   = x86_family(bsp_cpuid_1_eax);
+	unsigned int model = x86_model(bsp_cpuid_1_eax);
+
+	if (fam == 0x17 || fam == 0x19)
+		return true;
+
+	if (fam == 0x1a) {
+		if (model <= 0x2f ||
+		    (0x40 <= model && model <= 0x4f) ||
+		    (0x60 <= model && model <= 0x6f))
+			return true;
+	}
+
+	return false;
+}
+
 static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len)
 {
 	struct patch_digest *pd = NULL;
 	u8 digest[SHA256_DIGEST_SIZE];
 	int i;
 
-	if (x86_family(bsp_cpuid_1_eax) < 0x17)
+	if (!cpu_has_entrysign())
 		return true;
 
 	if (!need_sha_check(cur_rev))