Re: [PATCH] x86/ucode: Exclude Zen6 from entrysign mitigations

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 19/03/2026 9:38 am, Jan Beulich wrote:
> On 16.03.2026 13:06, Andrew Cooper wrote:
>> Family 0x1a covers both Zen5 and Zen6, but the latter is not believed to be
>> vulnerable to entrysign.
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>

Thanks.

>
>> This does want backporting, but it depends on 8e4775d118c327 which collects
>> leaf 7a1 early enough to be used in this way.  So, it should hold off for the
>> moment until the FRED backports are finalised.
> Okay.
>
>> --- a/xen/arch/x86/include/asm/amd.h
>> +++ b/xen/arch/x86/include/asm/amd.h
>> @@ -59,6 +59,8 @@
>>   * For Zen3 and Zen4 (Fam19h) the heuristic is the presence of AutoIBRS, as
>>   * it's Zen4-specific.
>>   *
>> + * For Zen5 and Zen6 (Fam1ah) the heuristic is the presence of FRED.
>> + *
>>   * The caller is required to perform the appropriate vendor/family checks
>>   * first.
>>   */
>> @@ -66,6 +68,8 @@
>>  #define is_zen2_uarch()   boot_cpu_has(X86_FEATURE_AMD_STIBP)
>>  #define is_zen3_uarch() (!boot_cpu_has(X86_FEATURE_AUTO_IBRS))
>>  #define is_zen4_uarch()   boot_cpu_has(X86_FEATURE_AUTO_IBRS)
>> +#define is_zen5_uarch() (!boot_cpu_has(X86_FEATURE_FRED))
>> +#define is_zen6_uarch()   boot_cpu_has(X86_FEATURE_FRED)
> A more general remark here: This, I think, is one of the (rare) cases where
> we may want to use the raw CPU policy, for the distinction to remain
> unaffected by "cpuid=" command line options. Thoughts?

Yes, that's the plan, but raw is still collected too late right now. 
This is on the todo list.

~Andrew