x86/microcode/AMD: Limit Entrysign signature checking to known generations

[ Upstream commit 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 ]

Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5.

X86_BUG cannot be used here because the loading on the BSP happens way
too early, before the cpufeatures machinery has been set up.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 93cbf05b83a56b38a73c245c83a3d14031f48ad9..7e997360223b2e9b97db8b214d403f695c9e89a5 100644 (file)
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -224,6 +224,24 @@ static bool need_sha_check(u32 cur_rev)
        return true;
 }
 
+static bool cpu_has_entrysign(void)
+{
+       unsigned int fam   = x86_family(bsp_cpuid_1_eax);
+       unsigned int model = x86_model(bsp_cpuid_1_eax);
+
+       if (fam == 0x17 || fam == 0x19)
+               return true;
+
+       if (fam == 0x1a) {
+               if (model <= 0x2f ||
+                   (0x40 <= model && model <= 0x4f) ||
+                   (0x60 <= model && model <= 0x6f))
+                       return true;
+       }
+
+       return false;
+}
+
 static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsigned int len)
 {
        struct patch_digest *pd = NULL;
@@ -231,7 +249,7 @@ static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsi
        struct sha256_state s;
        int i;
 
-       if (x86_family(bsp_cpuid_1_eax) < 0x17)
+       if (!cpu_has_entrysign())
                return true;
 
        if (!need_sha_check(cur_rev))