[SOLVED] Microcode updates conflict with pve-firmware

[apollo13]

Hi there,

I am trying to apply the amd64-microcode updates from Debian testing (which will probably end in stable soonish https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014593) and get the following errors:

Selecting previously unselected package amd64-microcode.
(Reading database ... 75640 files and directories currently installed.)
Preparing to unpack amd64-microcode_3.20220411.1_amd64.deb ...
Unpacking amd64-microcode (3.20220411.1) ...
dpkg: error processing archive amd64-microcode_3.20220411.1_amd64.deb (--install):
 trying to overwrite '/lib/firmware/amd/amd_sev_fam17h_model0xh.sbin', which is also in package pve-firmware 3.4-2
dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
Errors were encountered while processing:
 amd64-microcode_3.20220411.1_amd64.deb

This is caused by the fact that amd64-microcode now ships with the SEV firmwares (from the changelog https://metadata.ftp-master.debian....rocode/amd64-microcode_3.20220411.1_changelog):

    * New AMD-SEV firmware from AMD upstream (20220308)
      Fixes: CVE-2019-9836 (closes: #970395)
      + New SEV firmware:
        Family 17h models 00h-0fh: version 0.17 build 48
        Family 17h models 30h-3fh: version 0.24 build 15
        Family 19h models 00h-0fh: version 1.51 build 3

Should pve-firmware stop shipping the SEV firmware (and should I open a bug ticket for that) or do you recommend another way to install the firmwares? For now I verified that the firmware files are the same and did let dpkg override the files

 

[t.lamprecht]

Hi,

Thanks for the heads-up!

Should pve-firmware stop shipping the SEV firmware (and should I open a bug ticket for that) or do you recommend another way to install the firmwares?

We'll stop shipping the AMD µcode images in pve-firmware, upstream Debian is reactive enough w.r.t. those also in a stable release, so there's no real benefit in having those images shipped directly by us too.