Re: [PATCH for-4.22] x86/ucode: Exclude Zen6 from entrysign digest checking

[Jan Beulich <jbeulich@xxxxxxxx>]

On 16.06.2026 15:26, Andrew Cooper wrote:
> On 16/06/2026 1:36 pm, Jan Beulich wrote:
>> On 16.06.2026 12:45, Andrew Cooper wrote:
>>> --- a/xen/arch/x86/cpu/microcode/amd.c
>>> +++ b/xen/arch/x86/cpu/microcode/amd.c
>>> @@ -128,7 +128,8 @@ static bool check_digest(const struct 
>>> container_microcode *mc)
>>>       * the digest of the patch against a list of known provenance.
>>>       */
>>>      if ( boot_cpu_data.family < 0x17 || boot_cpu_data.family > 0x1a ||
>>> -         entrysign_mitigated_in_firmware || !opt_digest_check )
>>> +         is_zen6_uarch() || entrysign_mitigated_in_firmware ||
>>> +         !opt_digest_check )
>>>          return true;
>> Besides being somewhat fragile towards future changes (to the family range
>> covered), this also sets a bad precedent towards the comment ahead is
>> is_zen<N>_uarch() saying "The caller is required to perform the appropriate
>> vendor/family checks first." My understanding was that a single family
>> should be checked for in all such cases, not - as is the case here - a
>> range of families. Using the (seemingly) opposite is_zen5_uarch() wouldn't
>> be correct here, after all.
> 
> It is true that they're not symmetric when used with ranges.
> 
> But "appropriate checks" doesn't mean single family.  I suppose it
> really means "know what you're doing".
> 
> Entrysign is weird.  All other uses of is_zen?_uarch() come with single
> family checks.

If you're not afraid of building ourselves a trap here:
Acked-by: Jan Beulich <jbeulich@xxxxxxxx>

Jan