From: Jonathan Gray <jsg@jsg.id.au>
Subject: Re: check minimum microcode versions
To: Alexander Bluhm <bluhm@openbsd.org>
Cc: tech@openbsd.org
Date: Sat, 1 Nov 2025 08:36:55 +1100

On Fri, Oct 31, 2025 at 07:23:39PM +0100, Alexander Bluhm wrote:
> On Fri, Oct 31, 2025 at 01:28:40PM +1100, Jonathan Gray wrote:
> > On Sun, Oct 26, 2025 at 11:45:09AM +1100, Jonathan Gray wrote:
> > > Some AMD microcode now lists a minimum version for performing an
> > > MSR based update.  If the microcode is not at that level it seems a
> > > protection fault will be generated.  Only some server (Epyc) parts have
> > > a minimum version at the moment.  And not in the version currently in ports.
> > > 
> > > https://gitlab.com/kernel-firmware/linux-firmware/-/blob/main/amd-ucode/README?ref_type=heads
> > > "Minimum base ucode version for loading"
> > > 
> > > "#GP fault will occur if attempting to hot load microcode on older BIOS."
> > > https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
> > 
> > The latest family 19h microcode now has multiple patches for some parts.
> > A patch with no minimum version and a patch with a minimum version.
> > 
> > Specifically for:
> > 19-01-01	Milan-B1
> > 19-01-02	Milan-X B2
> > 19-11-01	Genoa-B1
> > 19-11-02	Genoa-X B2
> > 19-a0-02	Bergamo A1
> 
> I have tested it on 19-01-01.  As my machine seems to be up to date,
> nothing changes.  Below is dmesg with debug enabled.
> 
> bluhm

> cpu0: AMD EPYC 73F3 16-Core Processor, 3500.00 MHz, 19-01-01, patch 0a0011db

You'll also need the diff I sent to ports, included below.

In the 20251021 firmware there is a single 19-01-01 firmware
in the container file.

patch level a0011de (2025-04-18) minimum version a0011d9

In the commits after the tag the older firmware is also included.

patch level a0011d5 (2024-02-23) minimum version 0
patch level a0011de (2025-04-18) minimum version a0011d9

https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode

It appears they no longer provide git snapshots, so using the release.

Index: sysutils/firmware/amd/Makefile
===================================================================
RCS file: /cvs/ports/sysutils/firmware/amd/Makefile,v
diff -u -p -r1.19 Makefile
--- sysutils/firmware/amd/Makefile	9 Jul 2025 01:29:38 -0000	1.19
+++ sysutils/firmware/amd/Makefile	25 Oct 2025 23:42:04 -0000
@@ -1,6 +1,6 @@
 COMMENT=	microcode update binaries for AMD CPUs
 FW_DRIVER=	amd
-FW_VER=		20250708
+FW_VER=		20251021
 #DISTNAME=	linux-firmware-76af388fd7011dd3ab05b637cfb510a10d440487
 DISTNAME=	linux-firmware-${FW_VER}
 EXTRACT_SUFX=	.tar.xz
Index: sysutils/firmware/amd/distinfo
===================================================================
RCS file: /cvs/ports/sysutils/firmware/amd/distinfo,v
diff -u -p -r1.16 distinfo
--- sysutils/firmware/amd/distinfo	9 Jul 2025 01:29:38 -0000	1.16
+++ sysutils/firmware/amd/distinfo	25 Oct 2025 23:42:23 -0000
@@ -1,2 +1,2 @@
-SHA256 (firmware/linux-firmware-20250708.tar.xz) = bz7+5/YAwgH5stZ1iJpMzbjP5W4NKDZBeW7RDmTHIEc=
-SIZE (firmware/linux-firmware-20250708.tar.xz) = 530333772
+SHA256 (firmware/linux-firmware-20251021.tar.xz) = +mEwmI7NeWhgKTjHfdb40trOTgO6DaTA6WJN/tZX5s8=
+SIZE (firmware/linux-firmware-20251021.tar.xz) = 587183592
Index: sysutils/firmware/amd/pkg/PLIST
===================================================================
RCS file: /cvs/ports/sysutils/firmware/amd/pkg/PLIST,v
diff -u -p -r1.1 PLIST
--- sysutils/firmware/amd/pkg/PLIST	21 Jul 2023 23:51:51 -0000	1.1
+++ sysutils/firmware/amd/pkg/PLIST	25 Oct 2025 23:42:44 -0000
@@ -6,3 +6,4 @@ firmware/amd/microcode_amd_fam15h.bin
 firmware/amd/microcode_amd_fam16h.bin
 firmware/amd/microcode_amd_fam17h.bin
 firmware/amd/microcode_amd_fam19h.bin
+firmware/amd/microcode_amd_fam1ah.bin