This particular variant has an error that causes 16- and 32-bit forms of
RDSEED to frequently return 0 while still signaling success (CF=1). Refer
to AMD-SB-7055 / CVE-2025-62626.
Relevant data taken from Linux commit <TBD, see [1]>
("x86/CPU/AMD: Add RDSEED fix for Zen5").
As for the other RDSEED issue, the same command line override can be used
to keep RDSEED enabled.
[1]
https://lore.kernel.org/lkml/176165291198.2601451.3074910014537130674.tip-bot2@tip-bot2/T/#u
Signed-off-by: Jan Beulich <[email protected]>
---
See "x86/AMD: disable RDSEED on Fam17 model 47 stepping 0" for pending
opens.
---
v2: New.
--- a/xen/arch/x86/cpu/amd.c
+++ b/xen/arch/x86/cpu/amd.c
@@ -1246,6 +1246,43 @@ static void cf_check init_amd(struct cpu
if (!cpu_has_hypervisor && !cpu_has(c, X86_FEATURE_BTC_NO))
__set_bit(X86_FEATURE_BTC_NO, c->x86_capability);
break;
+
+ case 0x1a:
+ /*
+ * Zen5 have an error that causes the 16- and 32-bit forms of
+ * RDSEED to frequently return 0 while signaling success (CF=1).
+ * Sadly at the time of writing the fixed microcode revision is
+ * known for only two of the models.
+ */
+ if (c == &boot_cpu_data &&
+ cpu_has(c, X86_FEATURE_RDSEED) &&
+ !is_forced_cpu_cap(X86_FEATURE_RDSEED)) {
+ static const char __initconst text[] =
+ "RDSEED32 is unreliable on this hardware;
disabling its exposure\n";
+ bool good = false;
+
+ switch (c->model) {
+ case 0x02:
+ if (c->stepping == 1 &&
+ this_cpu(cpu_sig).rev >= 0x0b00215a)
+ good = true;
+ break;
+
+ case 0x11:
+ if (c->stepping == 0 &&
+ this_cpu(cpu_sig).rev >= 0x0b101054)
+ good = true;
+ break;
+ }
+
+ if (good)
+ break;
+
+ setup_clear_cpu_cap(X86_FEATURE_RDSEED);
+ cpuidmask_defaults._7ab0 &=
~cpufeat_mask(X86_FEATURE_RDSEED);
+ warning_add(text);
+ }
+ break;
}
display_cacheinfo(c);
