mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
d6654c63e7
Collisions have been found in the microcode signing algorithm used by AMD Fam17h/19h CPUs, and now anyone can sign their own. For more details, see: https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html As a stopgap mitigation, check the digest of patches against a table of blobs with known provenance. These are all Fam17h and Fam19h blobs included in linux-firwmare at the time of writing, specifically: https://git.kernel.org/firmware/linux-firmware/c/48bb90cceb882cab8e9ab692bc5779d3bf3a13b8 This checks can be opted out of by booting with ucode=no-digest-check, but doing so is not recommended. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Roger Pau Monné <roger.pau@citrix.com> (cherry picked from commit630e8875ab) Xen: CI fix from XSN-2 * Add cf_check annotation to cmp_patch_id() used by bsearch(). Fixes:630e8875ab("x86/ucode: Perform extra SHA2 checks on AMD Fam17h/19h microcode") Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> (cherry picked from commit15fe2eb5f1)