TSA-mitigation not working: "no microcode" although microcode-revision should suffice

TSA-mitigation not working: "no microcode" although microcode-revision should suffice

[Rainer Fiebig]

Built 6.12.37 with CONFIG_MITIGATION_TSA=y on a Ryzen 5700G system.
According to [1] the minimum BIOS revision should be
ComboAM4v2PI 1.2.0.E which is installed.  According to [2] the minimum
microcode revision required for that CPU is 0x0A500012.  Installed is
0x0A500014.  So I think the mitigating should work.  But this is not the
case:

~> dmesg | grep -Ei 'ryzen|microcode'
[    0.171006] Transient Scheduler Attacks: Vulnerable: Clear CPU
buffers attempted, no microcode
[    0.288006] smpboot: CPU0: AMD Ryzen 7 5700G with Radeon Graphics
(family: 0x19, model: 0x50, stepping: 0x0)
[    0.480729] microcode: Current revision: 0x0a500014

I'm wondering why the mitigation isn't working.  Thanks.

Rainer


[1]
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
[2]
https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf


-- 
The truth always turns out to be simpler than you thought.
Richard Feynman

Re: TSA-mitigation not working: "no microcode" although microcode-revision should suffice

[Greg KH]

On Sun, Jul 13, 2025 at 03:12:42PM +0200, Rainer Fiebig wrote:
> Built 6.12.37 with CONFIG_MITIGATION_TSA=y on a Ryzen 5700G system.
> According to [1] the minimum BIOS revision should be
> ComboAM4v2PI 1.2.0.E which is installed.  According to [2] the minimum
> microcode revision required for that CPU is 0x0A500012.  Installed is
> 0x0A500014.  So I think the mitigating should work.  But this is not the
> case:
> 
> ~> dmesg | grep -Ei 'ryzen|microcode'
> [    0.171006] Transient Scheduler Attacks: Vulnerable: Clear CPU
> buffers attempted, no microcode
> [    0.288006] smpboot: CPU0: AMD Ryzen 7 5700G with Radeon Graphics
> (family: 0x19, model: 0x50, stepping: 0x0)
> [    0.480729] microcode: Current revision: 0x0a500014
> 
> I'm wondering why the mitigation isn't working.  Thanks.
> 
> Rainer
> 
> 
> [1]
> https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
> [2]
> https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf

Should be fixed in the next round of kernel releases, see this fix if
you want to grab it now:
	https://lore.kernel.org/r/20250711191844.GIaHFjlJiQi_HxyyWG@fat_crate.local

Let us know if this doesn't solve it for you.

thanks,

greg k-h