amd64-microcode (3.20251202.1ubuntu2) resolute; urgency=medium

  * Recommend dracut over initramfs-tools (LP: #2142775)

 -- Benjamin Drung <bdrung@ubuntu.com>  Thu, 09 Apr 2026 18:59:22 +0200

amd64-microcode (3.20251202.1ubuntu1) resolute; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/initramfs.hook: initramfs-tools hook:
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.
    - debian/control: Depend on 3cpio for the initramfs-tools hook.

 -- Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com>  Mon, 02 Feb 2026 11:47:33 -0300

amd64-microcode (3.20251202.1) unstable; urgency=medium

  * Update package data from linux-firmware 20251202
    * ATTENTION: regression risk if backported to stable or LTS.
      The amd processor microcode updates in this release will not load on
      systems with outdated BIOS vulnerable to "Entrysign" unless a number of
      kernel patches are present.
    * amd-tee: update AMD PMF TA Firmware to v3.1.
    * amd-ucode: update with release 2025-12-02:
      + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)
        Fix RDSEED Failure on more AMD Zen 5 Processor models
        (closes: #1120005)
    * amd-ucode: update with release 2025-11-13:
      + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)
        Fix RDSEED Failure on more AMD Zen 5 Processor models
    * amd-ucode: update with release 2025-10-30:
      + SECURITY UPDATE (AMD-SB-7055 / CVE-2025-62626)
        Fix RDSEED Failure on some AMD Zen 5 Processor models
    + amd-ucode: update with release 2025-10-27:
      * This is the final microcode release for systems that have not
        been updated to fix vulnerability AMD-SB-7033 "Entrysign").
      * A kernel update is needed for the microcode driver to be able
        to select the appropriate microcode updates for outdated system
        firmware vulnerable to "Entrysign".
      * On non-updated kernels, this will potentially *regress* the
        microcode version on the running system back to the one in the
        (outdated, unpatched-for-Entrysign) BIOS.
    + amd-ucode: update with release 2025-07-29:
      + SECURITY UPDATE (AMD-SB-7029: CVE-2024-36350, CVE-2024-36357):
        Mitigate transient execution vulnerabilities in some AMD processors
        which might allow an attacker to infer data from previous stores
        (TSA-SQ) or data in the L1D cache (TSA-L1), potentially resulting in
        the leakage of privileged information and sensitive information across
        priviledged boundaries (closes: #1109035)
      * NOTE: Requires kernel and hypervisor changes for the security
        mitigations to be applied (issue VERW instruction at appropriate
        times).
  * initramfs: guard against copying non-microcode data into the
    early-initramfs bundle, for the benefit of those that copy all files from
    linux-firmware into /lib/firmware/*.  Thanks to Eric Valette for tracking
    it down (closes: #1101350)
  * debian/control: recommend cpio (closes: #1110987)
  * NEWS.Debian: update for post-Entrysign microcode updates
    Document that kernel patches are needed to avoid regressing the microcode
    release on vulnerable Zen2/3/4 systems (family 0x19), and also that these
    systems will not receive any future microcode updates.

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Sat, 06 Dec 2025 12:04:29 -0300

amd64-microcode (3.20250708.1ubuntu2) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@debian.org>  Tue, 03 Feb 2026 21:37:22 +0100

amd64-microcode (3.20250708.1ubuntu1) questing; urgency=medium

  [ Rodrigo Figueiredo Zaiden ]
  * SECURITY UPDATE: Update package data from linux-firmware 20250708 (LP: #2120893)
    - Updated microcodes:
      Family=0x19 Model=0x08 Stepping=0x02: Patch=0x0a00820d Length=5568 bytes
      Family=0x19 Model=0x18 Stepping=0x01: Patch=0x0a108109 Length=5568 bytes
      Family=0x19 Model=0x21 Stepping=0x00: Patch=0x0a20102e Length=5568 bytes
      Family=0x19 Model=0x21 Stepping=0x02: Patch=0x0a201211 Length=5568 bytes
      Family=0x19 Model=0x44 Stepping=0x01: Patch=0x0a404108 Length=5568 bytes
      Family=0x19 Model=0x50 Stepping=0x00: Patch=0x0a500012 Length=5568 bytes
      Family=0x19 Model=0x61 Stepping=0x02: Patch=0x0a60120a Length=5568 bytes
      Family=0x19 Model=0x74 Stepping=0x01: Patch=0x0a704108 Length=5568 bytes
      Family=0x19 Model=0x75 Stepping=0x02: Patch=0x0a705208 Length=5568 bytes
      Family=0x19 Model=0x78 Stepping=0x00: Patch=0x0a708008 Length=5568 bytes
      Family=0x19 Model=0x7c Stepping=0x00: Patch=0x0a70c008 Length=5568 bytes
    - CVE-2024-36350 (AMD-SB-7029)
      A transient execution vulnerability in some AMD processors may allow
      an attacker to infer data from previous stores, potentially resulting
      in the leakage of privileged information.
    - CVE-2024-36357 (AMD-SB-7029)
      A transient execution vulnerability in some AMD processors may allow
      an attacker to infer data in the L1D cache, potentially resulting in
      the leakage of sensitive information across privileged boundaries.
  * Remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

  [ Marc Deslauriers ]
  * Also Update AMD PMF TA Firmware to v3.1 to match the upstream git tag.

 -- Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com>  Mon, 18 Aug 2025 22:08:22 -0300

amd64-microcode (3.20250311.1ubuntu3) questing; urgency=medium

  * debian/initramfs.hook: fix find command for 3cpio

 -- Benjamin Drung <bdrung@ubuntu.com>  Wed, 13 Aug 2025 11:00:27 +0200

amd64-microcode (3.20250311.1ubuntu2) questing; urgency=medium

  * debian/initramfs.hook: use 3cpio for initrd generation
  * Depend on 3cpio for the initramfs-tools hook

 -- Benjamin Drung <bdrung@ubuntu.com>  Tue, 12 Aug 2025 12:42:37 +0200

amd64-microcode (3.20250311.1ubuntu1) questing; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 22 May 2025 13:11:30 -0400

amd64-microcode (3.20250311.1) unstable; urgency=medium

  * Update package data from linux-firmware 20250311
  * New AMD-SEV firmware from AMD upstream (20250221)
    * SECURITY UPDATE (AMD-SB-3019 / CVE-2024-56161):
      Update remote attestation to be compatible with AMD systems with
      up-to-date firmware (i.e. which fixes "EntrySign"), and update
      AMD-SEV for AMD-SB-3019 mitigations.  Note that this AMD-SEV
      update DOES NOT FIX the microcode "EntrySign" vulnerability.
      (closes: #1095470)
    + Updated SEV firmware:
        Family 17h models 30h-3fh: version 0.24 build 20
        Family 19h models 00h-0fh: version 1.55 build 29
        Family 19h models 10h-1fh: version 1.55 build 39
        Family 19h models a0h-afh: version 1.55 build 39
      + New SEV firmware:
        Family 1ah models 00h-0fh: version 1.55 build 54
  * New AMD microcode updates from AMD upstream (20241121)
    + Add patches for many (non-server) family 19h processors
    * Updated Microcode patches:
      + Family=0x17 Model=0xa0 Stepping=0x00: Patch=0x08a0000a
    * New Microcode patches:
      + Family=0x17 Model=0x60 Stepping=0x01: Patch=0x0860010d
      + Family=0x17 Model=0x68 Stepping=0x01: Patch=0x08608108
      + Family=0x17 Model=0x71 Stepping=0x00: Patch=0x08701034
      + Family=0x19 Model=0x08 Stepping=0x02: Patch=0x0a00820c
      + Family=0x19 Model=0x18 Stepping=0x01: Patch=0x0a108108
      + Family=0x19 Model=0x21 Stepping=0x00: Patch=0x0a20102d
      + Family=0x19 Model=0x21 Stepping=0x02: Patch=0x0a201210
      + Family=0x19 Model=0x44 Stepping=0x01: Patch=0x0a404107
      + Family=0x19 Model=0x50 Stepping=0x00: Patch=0x0a500011
      + Family=0x19 Model=0x61 Stepping=0x02: Patch=0x0a601209
      + Family=0x19 Model=0x74 Stepping=0x01: Patch=0x0a704107
      + Family=0x19 Model=0x75 Stepping=0x02: Patch=0x0a705206
      + Family=0x19 Model=0x78 Stepping=0x00: Patch=0x0a708007
      + Family=0x19 Model=0x7c Stepping=0x00: Patch=0x0a70c005

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Sun, 23 Mar 2025 21:13:20 -0300

amd64-microcode (3.20240820.1ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Thu, 21 Nov 2024 15:20:49 -0600

amd64-microcode (3.20240820.1) unstable; urgency=high

  * Update package data from linux-firmware 20240820
    * New AMD-SEV firmware from AMD upstream (20240820)
      + Updated SEV firmware:
        Family 17h models 30h-3fh: version 0.24 build 20
        Family 19h models 00h-0fh: version 1.55 build 21
        Family 19h models 10h-1fh: version 1.55 build 37
      + New SEV firmware:
        Family 19h models a0h-afh: version 1.55 build 37
  * SECURITY UPDATE (AMD-SB-3003):
    * Mitigates CVE-2023-20584: IOMMU improperly handles certain special
      address ranges with invalid device table entries (DTEs), which may allow
      an attacker with privileges and a compromised Hypervisor to induce DTE
      faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of
      guest integrity.
    * Mitigates CVE-2023-31356: Incomplete system memory cleanup in SEV
      firmware could allow a privileged attacker to corrupt guest private
      memory, potentially resulting in a loss of data integrity.

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Wed, 21 Aug 2024 21:31:07 -0300

amd64-microcode (3.20240710.2) unstable; urgency=high

  * postrm: activate the update-initramfs dpkg trigger on remove/purge
    instead of always executing update-initramfs directly, just like it
    was done for postinst in 3.20240710.1: call update-initramfs directly
    only if the dpkg-trigger activation call fails.

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Mon, 12 Aug 2024 09:00:19 -0300

amd64-microcode (3.20240710.1) unstable; urgency=high

  * Update package data from linux-firmware 20240709-141-g59460076
    (closes: #1076128)
  * SECURITY UPDATE: Mitigates "Sinkclose" CVE-2023-31315 (AMD-SB-7014) on
    AMD Epyc processors: SMM lock bypass - Improper validation in a model
    specific register (MSR) could allow a malicious program with ring 0
    access (kernel) to modify SMM configuration while SMI lock is enabled,
    potentially leading to arbitrary code execution.
    Note: a firmware update is recommended for AMD Epyc (to protect the
    system as early as possible).  Many other AMD processor models are
    also vulnerable to SinkClose, and can only be fixed by a firmware
    update at this time.
  * Updated Microcode patches:
    + Family=0x17 Model=0x01 Stepping=0x02: Patch=0x0800126f
    + Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107c
    + Family=0x19 Model=0x01 Stepping=0x00: Patch=0x0a00107a
    + Family=0x19 Model=0x11 Stepping=0x02: Patch=0x0a101248
    + Family=0x19 Model=0xa0 Stepping=0x02: Patch=0x0aa00215
    + Family=0x19 Model=0x01 Stepping=0x02: Patch=0x0a001238
    + Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a101148
    + Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011d5
  * README.Debian: "late" microcode updates are unsupported in Debian
    (closes: #1074514)
  * postinst: use dpkg-trigger to activate update-initramfs, this enables
    dracut integration (closes: #1000193)

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Sun, 11 Aug 2024 18:38:59 -0300

amd64-microcode (3.20240116.2+nmu1ubuntu1.1) oracular-security; urgency=medium

  * SECURITY UPDATE: arbitrary code execution via improper MSR access
    - amd-ucode/microcode_amd_fam{17,19}h.bin{,.asc}: add updated AMD
      fam17h and fam19h CPU microcodes
    - Updated microcodes:
      Family=0x17 Model=0x01 Stepping=0x02: Patch=0x0800126f Length=3200 bytes
      Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107c Length=3200 bytes
      Family=0x19 Model=0x01 Stepping=0x00: Patch=0x0a00107a Length=5568 bytes
      Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011d5 Length=5568 bytes
      Family=0x19 Model=0x01 Stepping=0x02: Patch=0x0a001238 Length=5568 bytes
      Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a101148 Length=5568 bytes
      Family=0x19 Model=0x11 Stepping=0x02: Patch=0x0a101248 Length=5568 bytes
      Family=0x19 Model=0xa0 Stepping=0x02: Patch=0x0aa00215 Length=5568 bytes
    - CVE-2023-31315

 -- Alex Murray <alex.murray@canonical.com>  Wed, 16 Oct 2024 15:38:44 +1030

amd64-microcode (3.20240116.2+nmu1ubuntu1) oracular; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Benjamin Drung <bdrung@ubuntu.com>  Tue, 06 Aug 2024 13:34:56 +0200

amd64-microcode (3.20240116.2+nmu1) unstable; urgency=medium

  * Non-maintainer upload.
  * Install files into /usr instead of /. (Closes: 1059372)

 -- Chris Hofstaedtler <zeha@debian.org>  Mon, 03 Jun 2024 22:41:28 +0200

amd64-microcode (3.20240116.2) unstable; urgency=medium

  * Add AMD-TEE firmware to the package (closes: #1062678)
    + amdtee: add amd_pmf TA firmware 20230906
  * debian: install amdtee to /lib/firmware/amdtee
  * debian/control: update short and long descriptions
  * debian/copyright: update with amd-pmf license

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Thu, 15 Feb 2024 16:56:06 -0300

amd64-microcode (3.20240116.1) unstable; urgency=medium

  * Update package data from linux-firmware 20240115-80-gb4b04a5c
  * Updated Microcode patches:
    + Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107b
    + Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011d3
    + Family=0x19 Model=0x01 Stepping=0x02: Patch=0x0a001236

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Tue, 06 Feb 2024 15:35:27 -0300

amd64-microcode (3.20231019.1ubuntu2) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 17:54:09 +0200

amd64-microcode (3.20231019.1ubuntu1) noble; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Alex Murray <alex.murray@canonical.com>  Tue, 14 Nov 2023 14:36:10 +1030

amd64-microcode (3.20231019.1) unstable; urgency=medium

  * Update package data from linux-firmware 20231019
  * Updated Microcode patches:
    + Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a101144
    + Family=0x19 Model=0x11 Stepping=0x02: Patch=0x0a101244
    + Family=0x19 Model=0xa0 Stepping=0x02: Patch=0x0aa00213

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Sat, 21 Oct 2023 15:06:29 -0300

amd64-microcode (3.20230823.1) unstable; urgency=medium

  * Update package data from linux-firmware 20230919
    * New AMD-SEV firmware from AMD upstream (20230823)
      + Updated SEV firmware:
        Family 19h models 00h-0fh: version 1.55 build 8
      + New SEV firmware:
        Family 19h models 10h-1fh: version 1.55 build 21
  * amd-ucode: Add note on fam19h warnings.

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Fri, 13 Oct 2023 02:02:47 -0300

amd64-microcode (3.20230808.1.1ubuntu1) mantic; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Alex Murray <alex.murray@canonical.com>  Wed, 16 Aug 2023 13:08:48 +0930

amd64-microcode (3.20230808.1.1) unstable; urgency=high

  * Update package data from linux-firmware 20230804-6-gf2eb058a
    * Fixes for CVE-2023-20569 "AMD Inception" on AMD Zen4 processors
    (closes: #1043381)
  * WARNING: for proper operation on AMD Genoa and Bergamo processors,
    either up-to-date BIOS (with AGESA 1.0.0.8 or newer) or up-to-date
    Linux kernels (minimal versions on each active Linux stable branch:
    v4.19.289 v5.4.250 v5.10.187 v5.15.120 v6.1.37 v6.3.11 v6.4.1)
    are *required*
  * New Microcode patches:
    +  Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a10113e
    +  Family=0x19 Model=0x11 Stepping=0x02: Patch=0x0a10123e
    +  Family=0x19 Model=0xa0 Stepping=0x02: Patch=0x0aa00212
    +  Family=0x19 Model=0xa0 Stepping=0x01: Patch=0x0aa00116
  * README: update for new release
  * debian/NEWS: AMD Genoa/Bergamo kernel version restrictions
  * debian/changelog: update entry for release 3.20230719.1, noting
    that it included fixes for "AMD Inception" for Zen3 processors.
    We did not know about AMD Inception at the time, but we always
    include all available microcode updates when issuing a new
    package, so we lucked out.
  * debian/changelog: correct some information in 3.20230808.1
    entry and reupload as 3.20230808.1.1.  There's no Zenbleed
    for Zen4... oops!

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Thu, 10 Aug 2023 10:18:38 -0300

amd64-microcode (3.20230719.1ubuntu1) mantic; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - initramfs-tools hook (debian/initramfs.hook):
      + Default to 'early' instead of 'auto' when building with
        MODULES=most
      + Do not override preset defaults from auto-exported conf
        snippets loaded by initramfs-tools.

 -- Alex Murray <alex.murray@canonical.com>  Tue, 25 Jul 2023 11:57:09 +0930

amd64-microcode (3.20230719.1) unstable; urgency=high

  * Update package data from linux-firmware 20230625-39-g59fbffa9:
    * Fixes for CVE-2023-20593 "Zenbleed" on AMD Zen2 processors
      (closes: #1041863)
    * Fixes for CVE-2023-20569 "AMD Inception" on AMD Zen3 processors
      (this changelog entry time-travelled from the future, we were
      lucky we always include all microcode updates available)
    * New Microcode patches:
      + Family=0x17 Model=0xa0 Stepping=0x00: Patch=0x08a00008
    * Updated Microcode patches:
      + Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107a
      + Family=0x19 Model=0x01 Stepping=0x00: Patch=0x0a001079
      + Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011d1
      + Family=0x19 Model=0x01 Stepping=0x02: Patch=0x0a001234
  * README: update for new release

 -- Henrique de Moraes Holschuh <hmh@debian.org>  Mon, 24 Jul 2023 13:07:34 -0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog amd64-microcode`.
