[BUG] amd-ucode 20250808: "No sha256 digest for patch ID: 0xa0011de" on Linux 6.12.37

[BUG] amd-ucode 20250808: "No sha256 digest for patch ID: 0xa0011de" on Linux 6.12.37

[Jinpu Wang]

Hi,

I am currently testing the latest `amd-ucode` from `linux-firmware
20250808` and encountering an early microcode load error on Linux
6.12.37. The CPU is an AMD EPYC 7713P 64-Core Processor (Milan, Zen
3).

Upon boot, the following error is reported in dmesg:
`microcode: No sha256 digest for patch ID: 0xa0011de found`

When I use the kernel parameter `microcode.amd_sha_check=off`, I
receive the following errors:

```
jwang@ps406a-1.stg2:~$ dmesg | grep micro
[ 0.000000] microcode: It is a very very bad idea to disable the blobs
SHA check\!
[ 0.000000] unchecked MSR access error: WRMSR to 0xc0010020 (tried to
write 0xffff888034ce5fd2) at rIP: 0xffffffff90064eeb
(__apply_microcode_amd+0x3b/0x90)
[ 0.000000] Command line:
BOOT_IMAGE=(http)/live-images/liveboot-k6.12-test-2025.450/vmlinuz
BOOTIF=58:a2:e1:b1:82:60 boot=live
fetch=http://mgmt/live-images/liveboot-k6.12-test-2025.450/root.squashfs
consoleblank=0 PHASE=Testing crashkernel=512M quiet
salt-master=stg-salt2.stg.profitbricks.net saltenv=base pillarenv=base
microcode.amd_sha_check=off liveboot.roce retbleed=off amd_iommu=off
intel_iommu=off iommu=soft
[ 0.018728] Kernel command line:
BOOT_IMAGE=(http)/live-images/liveboot-k6.12-test-2025.450/vmlinuz
BOOTIF=58:a2:e1:b1:82:60 boot=live
fetch=http://mgmt/live-images/liveboot-k6.12-test-2025.450/root.squashfs
consoleblank=0 PHASE=Testing crashkernel=512M quiet
salt-master=stg-salt2.stg.profitbricks.net saltenv=base pillarenv=base
microcode.amd_sha_check=off liveboot.roce retbleed=off amd_iommu=off
intel_iommu=off iommu=soft
[ 0.143803] Transient Scheduler Attacks: Vulnerable: Clear CPU buffers
attempted, no microcode
[ 0.014489] microcode: CPU1: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU2: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU3: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU4: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU5: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU6: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU7: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU8: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU9: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU10: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU11: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU12: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU13: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU14: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU15: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU16: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU17: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU18: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU19: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU20: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU21: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU22: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU23: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU24: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU25: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU26: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU27: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU28: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU29: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU30: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU31: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU32: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU33: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU34: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU35: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU36: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU37: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU38: update failed for patch_level=0x0a0011de
[ 0.014489] microcode: CPU39: update failed for patch_level=0x0a0011de
[ 0.01
```
Seems we have to patch arch/x86/kernel/cpu/microcode/amd_shas.c for
the new patch 0x0a0011de?

Thx!
Jinpu Wang

Re: [BUG] amd-ucode 20250808: "No sha256 digest for patch ID: 0xa0011de" on Linux 6.12.37

[Borislav Petkov]

On Tue, Aug 19, 2025 at 08:14:50AM +0200, Jinpu Wang wrote:
> Upon boot, the following error is reported in dmesg:
> `microcode: No sha256 digest for patch ID: 0xa0011de found`

[boris@zn: ~/kernel/firmware-linux> less amd-ucode/README

...

  Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011de Length=5568 bytes
    Minimum base ucode version for loading: 0x0a0011d9

So you need to update your BIOS in order to be able to load 11de.

HTH.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [BUG] amd-ucode 20250808: "No sha256 digest for patch ID: 0xa0011de" on Linux 6.12.37

[Jinpu Wang]

Hi Boris,

Thank you for the quick help and for clarifying the situation. I
apologize for overlooking the information in the `amd-ucode/README`
file regarding the required minimum base microcode version.

Thanks,
Jinpu

On Tue, Aug 19, 2025 at 12:55 PM Borislav Petkov <bp@alien8.de> wrote:
>
> On Tue, Aug 19, 2025 at 08:14:50AM +0200, Jinpu Wang wrote:
> > Upon boot, the following error is reported in dmesg:
> > `microcode: No sha256 digest for patch ID: 0xa0011de found`
>
> [boris@zn: ~/kernel/firmware-linux> less amd-ucode/README
>
> ...
>
>   Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011de Length=5568 bytes
>     Minimum base ucode version for loading: 0x0a0011d9
>
> So you need to update your BIOS in order to be able to load 11de.
>
> HTH.
>
> --
> Regards/Gruss,
>     Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette

Re: [BUG] amd-ucode 20250808: "No sha256 digest for patch ID: 0xa0011de" on Linux 6.12.37

[Borislav Petkov]

On Tue, Aug 19, 2025 at 02:16:29PM +0200, Jinpu Wang wrote:
> Thank you for the quick help and for clarifying the situation. I
> apologize for overlooking the information in the `amd-ucode/README`
> file regarding the required minimum base microcode version.

That's ok, having this documented on the mailing lists is a good thing too.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette