Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 16/06/2026 1:36 pm, Jan Beulich wrote:
> On 16.06.2026 12:45, Andrew Cooper wrote:
>> --- a/xen/arch/x86/cpu/microcode/amd.c
>> +++ b/xen/arch/x86/cpu/microcode/amd.c
>> @@ -128,7 +128,8 @@ static bool check_digest(const struct 
>> container_microcode *mc)
>>       * the digest of the patch against a list of known provenance.
>>       */
>>      if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
>> -         entrysign_mitigated_in_firmware || !opt_digest_check )
>> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
>> +         !opt_digest_check )
>>          return true;
> Besides being somewhat fragile towards future changes (to the family range
> covered), this also sets a bad precedent towards the comment ahead is
> is_zen<N>_uarch() saying "The caller is required to perform the appropriate
> vendor/family checks first." My understanding was that a single family
> should be checked for in all such cases, not - as is the case here - a
> range of families. Using the (seemingly) opposite is_zen5_uarch() wouldn't
> be correct here, after all.

It is true that they're not symmetric when used with ranges.

But "appropriate checks" doesn't mean single family.  I suppose it
really means "know what you're doing".

Entrysign is weird.  All other uses of is_zen?_uarch() come with single
family checks.

~Andrew