84 lines
4.2 KiB
Plaintext
84 lines
4.2 KiB
Plaintext
Latest microcode updates for Intel Skylake/Cascade Lake Scalable Platform CPUs
|
|
(family 6, model 85, steppings 4, 6, and 7; CPUID 0x50654/0x50656/0x50657)
|
|
may cause system instability on some systems, namely, HPE Superdome Flex
|
|
and Supermicro systems, when an update is performed with the resivions
|
|
that come with microcode-20201110 release, so the previously released microcode
|
|
(with revisions 0x2006906, 0x4001f01, and 0x5002f01, respectively)
|
|
from microcode-20200609 release are used on these systems by default instead
|
|
for the OS-driven microcode update.
|
|
|
|
For the reference, SHA1 checksums of the relevant microcode files containing
|
|
microcode revisions in question are listed below:
|
|
* 06-55-04, revision 0x2006906: 5f18f985f6d5ad369b5f6549b7f3ee55acaef967
|
|
* 06-55-04, revision 0x2006a08: 4059fb1f60370297454177f63cd7cc20b3fa1212
|
|
|
|
* 06-55-06, revision 0x4004f01: 8affd949151a0badd3f71e23cf9ad668d4c1d82f
|
|
* 06-55-06, revision 0x4003003: b187866d2570f90ea69f434c2b012a8c88d85f43
|
|
|
|
* 06-55-07, revision 0x5002f01: a7121c5f49753cc783f82135e268bc4efe85d4be
|
|
* 06-55-07, revision 0x5003003: 74e129b108e676f0286742f609b2c1fa65d73db1
|
|
|
|
Please contact your system vendor for a BIOS/firmware update that contains
|
|
the latest microcode version. For the information regarding microcode versions
|
|
required for mitigating specific side-channel cache attacks, please refer
|
|
to the following knowledge base articles:
|
|
* CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface),
|
|
CVE-2020-8696 (Vector Register Leakage-Active),
|
|
CVE-2020-8698 (Fast Forward Store Predictor):
|
|
https://access.redhat.com/articles/5569051
|
|
|
|
The information regarding enforcing microcode update is provided below.
|
|
|
|
To enforce usage of the latest microcode revision for a specific kernel
|
|
version, please create a file "force-intel-06-55-0x-ipu-2020.2" inside
|
|
/lib/firmware/<kernel_version> directory, run
|
|
"/usr/libexec/microcode_ctl/update_ucode" to add it to firmware directory
|
|
where microcode will be available for late microcode update, and run
|
|
"dracut -f --kver <kernel_version>", so initramfs for this kernel version
|
|
is regenerated and the microcode can be loaded early, for example:
|
|
|
|
touch /lib/firmware/3.10.0-862.9.1/force-intel-06-55-0x-ipu-2020.2
|
|
/usr/libexec/microcode_ctl/update_ucode
|
|
dracut -f --kver 3.10.0-862.9.1
|
|
|
|
After that, it is possible to perform a late microcode update by executing
|
|
"/usr/libexec/microcode_ctl/reload_microcode" or by writing value "1" to
|
|
"/sys/devices/system/cpu/microcode/reload" directly.
|
|
|
|
To disallow usage of the latest microcode revision for a specific kernel
|
|
version, please create a file "disallow-intel-06-55-0x-ipu-2020.2" inside
|
|
/lib/firmware/<kernel_version> directory, run
|
|
"/usr/libexec/microcode_ctl/update_ucode" to update firmware directory
|
|
used for late microcode updates, and run "dracut -f --kver <kernel_version>",
|
|
so initramfs for this kernel version is regenerated, for example:
|
|
|
|
touch /lib/firmware/3.10.0-862.9.1/disallow-intel-06-55-0x-ipu-2020.2
|
|
/usr/libexec/microcode_ctl/update_ucode
|
|
dracut -f --kver 3.10.0-862.9.1
|
|
|
|
To enforce addition of this microcode for all kernels, please create a file
|
|
"/etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2", run
|
|
"/usr/libexec/microcode_ctl/update_ucode" for enabling late microcode updates,
|
|
and "dracut -f --regenerate-all" for enabling early microcode updates:
|
|
|
|
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
touch /etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2
|
|
/usr/libexec/microcode_ctl/update_ucode
|
|
dracut -f --regenerate-all
|
|
|
|
To disallow usage of the latest microcode revision for all kernels, please
|
|
create a file
|
|
"/etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2",
|
|
run "/usr/libexec/microcode_ctl/update_ucode" to update firmware directories
|
|
used for late microcode updates, and run "dracut -f --regenerate-all"
|
|
so initramfs images get regenerated, for example:
|
|
|
|
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2
|
|
/usr/libexec/microcode_ctl/update_ucode
|
|
dracut -f --regenerate-all
|
|
|
|
|
|
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
|
|
information.
|