diff options
| author | Borislav Petkov (AMD) <bp@alien8.de> | 2025-10-23 14:46:29 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-12-01 11:43:35 +0100 |
| commit | 09c4f1a378d9c1381a4448909165571a118ea0a5 (patch) | |
| tree | d726ca7c69e843c0f9ad592477a03fa6ce63ce6b /arch | |
| parent | 47c8b35a1f1d53aac156480cea0a0c5c82919f03 (diff) | |
| download | linux-09c4f1a378d9c1381a4448909165571a118ea0a5.tar.gz linux-09c4f1a378d9c1381a4448909165571a118ea0a5.tar.bz2 linux-09c4f1a378d9c1381a4448909165571a118ea0a5.zip | |
x86/microcode/AMD: Limit Entrysign signature checking to known generations
[ Upstream commit 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 ]
Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.
X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/kernel/cpu/microcode/amd.c | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index 93cbf05b83a5..7e997360223b 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -224,6 +224,24 @@ static bool need_sha_check(u32 cur_rev) return true; } +static bool cpu_has_entrysign(void) +{ + unsigned int fam = x86_family(bsp_cpuid_1_eax); + unsigned int model = x86_model(bsp_cpuid_1_eax); + + if (fam == 0x17 || fam == 0x19) + return true; + + if (fam == 0x1a) { + if (model <= 0x2f || + (0x40 <= model && model <= 0x4f) || + (0x60 <= model && model <= 0x6f)) + return true; + } + + return false; +} + static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len) { struct patch_digest *pd = NULL; @@ -231,7 +249,7 @@ static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsi struct sha256_state s; int i; - if (x86_family(bsp_cpuid_1_eax) < 0x17) + if (!cpu_has_entrysign()) return true; if (!need_sha_check(cur_rev)) |