linux-kernel - [tip: x86/urgent] x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <174448975612.31282.16734992697448931716.tip-bot2@tip-bot2>
Date: Sat, 12 Apr 2025 20:29:15 -0000
From: "tip-bot2 for Borislav Petkov (AMD)" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: "Borislav Petkov (AMD)" <bp@...en8.de>, Ingo Molnar <mingo@...nel.org>,
  <stable@...nel.org>, Andrew Cooper <andrew.cooper3@...rix.com>,
 Boris Ostrovsky <boris.ostrovsky@...cle.com>,
 Linus Torvalds <torvalds@...ux-foundation.org>,
 "Maciej S. Szmigiero" <mail@...iej.szmigiero.name>,
 Nikolay Borisov <nik.borisov@...e.com>,
 Tom Lendacky <thomas.lendacky@....com>, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: x86/urgent] x86/microcode/AMD: Extend the SHA check to Zen5,
 block loading of any unreleased standalone Zen5 microcode patches

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     805b743fc163f1abef7ce1bea8eca8dfab5b685b
Gitweb:        https://git.kernel.org/tip/805b743fc163f1abef7ce1bea8eca8dfab5b685b
Author:        Borislav Petkov (AMD) <bp@...en8.de>
AuthorDate:    Thu, 10 Apr 2025 13:42:22 +02:00
Committer:     Ingo Molnar <mingo@...nel.org>
CommitterDate: Sat, 12 Apr 2025 21:09:42 +02:00

x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches

All Zen5 machines out there should get BIOS updates which update to the
correct microcode patches addressing the microcode signature issue.
However, silly people carve out random microcode blobs from BIOS
packages and think are doing other people a service this way...

Block loading of any unreleased standalone Zen5 microcode patches.

Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Cc: <stable@...nel.org>
Cc: Andrew Cooper <andrew.cooper3@...rix.com>
Cc: Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Maciej S. Szmigiero <mail@...iej.szmigiero.name>
Cc: Nikolay Borisov <nik.borisov@...e.com>
Cc: Tom Lendacky <thomas.lendacky@....com>
Link: https://lore.kernel.org/r/20250410114222.32523-1-bp@kernel.org
---
 arch/x86/kernel/cpu/microcode/amd.c |  9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index b61028c..4a10d35 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -199,6 +199,12 @@ static bool need_sha_check(u32 cur_rev)
 	case 0xa70c0: return cur_rev <= 0xa70C009; break;
 	case 0xaa001: return cur_rev <= 0xaa00116; break;
 	case 0xaa002: return cur_rev <= 0xaa00218; break;
+	case 0xb0021: return cur_rev <= 0xb002146; break;
+	case 0xb1010: return cur_rev <= 0xb101046; break;
+	case 0xb2040: return cur_rev <= 0xb204031; break;
+	case 0xb4040: return cur_rev <= 0xb404031; break;
+	case 0xb6000: return cur_rev <= 0xb600031; break;
+	case 0xb7000: return cur_rev <= 0xb700031; break;
 	default: break;
 	}

@@ -214,8 +220,7 @@ static bool verify_sha256_digest(u32 patch_id, u32 cur_rev, const u8 *data, unsi
 	struct sha256_state s;
 	int i;

-	if (x86_family(bsp_cpuid_1_eax) < 0x17 ||
-	    x86_family(bsp_cpuid_1_eax) > 0x19)
+	if (x86_family(bsp_cpuid_1_eax) < 0x17)
 		return true;

 	if (!need_sha_check(cur_rev))