|
 |
7fc171 |
Latest microcode updates for Intel Skylake/Cascade Lake Scalable Platform CPUs
|
|
|
7fc171 |
(family 6, model 85, steppings 4, 6, and 7; CPUID 0x50654/0x50656/0x50657)
|
|
|
7fc171 |
may cause system instability on some systems, namely, HPE Superdome Flex
|
|
|
7fc171 |
and Supermicro systems, when an update is performed with the resivions
|
|
|
7fc171 |
that come with microcode-20201110 release, so the previously released microcode
|
|
|
7fc171 |
(with revisions 0x2006906, 0x4001f01, and 0x5002f01, respectively)
|
|
|
7fc171 |
from microcode-20200609 release are used on these systems by default instead
|
|
|
7fc171 |
for the OS-driven microcode update.
|
|
|
7fc171 |
|
|
|
7fc171 |
For the reference, SHA1 checksums of the relevant microcode files containing
|
|
|
7fc171 |
microcode revisions in question are listed below:
|
|
|
7fc171 |
* 06-55-04, revision 0x2006906: 5f18f985f6d5ad369b5f6549b7f3ee55acaef967
|
|
|
7fc171 |
* 06-55-04, revision 0x2006a08: 4059fb1f60370297454177f63cd7cc20b3fa1212
|
|
|
7fc171 |
|
|
|
7fc171 |
* 06-55-06, revision 0x4004f01: 8affd949151a0badd3f71e23cf9ad668d4c1d82f
|
|
|
7fc171 |
* 06-55-06, revision 0x4003003: b187866d2570f90ea69f434c2b012a8c88d85f43
|
|
|
7fc171 |
|
|
|
7fc171 |
* 06-55-07, revision 0x5002f01: a7121c5f49753cc783f82135e268bc4efe85d4be
|
|
|
7fc171 |
* 06-55-07, revision 0x5003003: 74e129b108e676f0286742f609b2c1fa65d73db1
|
|
|
7fc171 |
|
|
|
7fc171 |
Please contact your system vendor for a BIOS/firmware update that contains
|
|
|
7fc171 |
the latest microcode version. For the information regarding microcode versions
|
|
|
7fc171 |
required for mitigating specific side-channel cache attacks, please refer
|
|
|
7fc171 |
to the following knowledge base articles:
|
|
|
7fc171 |
* CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface),
|
|
|
7fc171 |
CVE-2020-8696 (Vector Register Leakage-Active),
|
|
|
7fc171 |
CVE-2020-8698 (Fast Forward Store Predictor):
|
|
|
7fc171 |
https://access.redhat.com/articles/5569051
|
|
|
7fc171 |
|
|
|
7fc171 |
The information regarding enforcing microcode update is provided below.
|
|
|
7fc171 |
|
|
|
7fc171 |
To enforce usage of the latest microcode revision for a specific kernel
|
|
|
7fc171 |
version, please create a file "force-intel-06-55-0x-ipu-2020.2" inside
|
|
|
7fc171 |
/lib/firmware/<kernel_version> directory, run
|
|
|
7fc171 |
"/usr/libexec/microcode_ctl/update_ucode" to add it to firmware directory
|
|
|
7fc171 |
where microcode will be available for late microcode update, and run
|
|
|
7fc171 |
"dracut -f --kver <kernel_version>", so initramfs for this kernel version
|
|
|
7fc171 |
is regenerated and the microcode can be loaded early, for example:
|
|
|
7fc171 |
|
|
|
7fc171 |
touch /lib/firmware/3.10.0-862.9.1/force-intel-06-55-0x-ipu-2020.2
|
|
|
7fc171 |
/usr/libexec/microcode_ctl/update_ucode
|
|
|
7fc171 |
dracut -f --kver 3.10.0-862.9.1
|
|
|
7fc171 |
|
|
|
7fc171 |
After that, it is possible to perform a late microcode update by executing
|
|
|
7fc171 |
"/usr/libexec/microcode_ctl/reload_microcode" or by writing value "1" to
|
|
|
7fc171 |
"/sys/devices/system/cpu/microcode/reload" directly.
|
|
|
7fc171 |
|
|
|
7fc171 |
To disallow usage of the latest microcode revision for a specific kernel
|
|
|
7fc171 |
version, please create a file "disallow-intel-06-55-0x-ipu-2020.2" inside
|
|
|
7fc171 |
/lib/firmware/<kernel_version> directory, run
|
|
|
7fc171 |
"/usr/libexec/microcode_ctl/update_ucode" to update firmware directory
|
|
|
7fc171 |
used for late microcode updates, and run "dracut -f --kver <kernel_version>",
|
|
|
7fc171 |
so initramfs for this kernel version is regenerated, for example:
|
|
|
7fc171 |
|
|
|
7fc171 |
touch /lib/firmware/3.10.0-862.9.1/disallow-intel-06-55-0x-ipu-2020.2
|
|
|
7fc171 |
/usr/libexec/microcode_ctl/update_ucode
|
|
|
7fc171 |
dracut -f --kver 3.10.0-862.9.1
|
|
|
7fc171 |
|
|
|
7fc171 |
To enforce addition of this microcode for all kernels, please create a file
|
|
|
7fc171 |
"/etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2", run
|
|
|
7fc171 |
"/usr/libexec/microcode_ctl/update_ucode" for enabling late microcode updates,
|
|
|
7fc171 |
and "dracut -f --regenerate-all" for enabling early microcode updates:
|
|
|
7fc171 |
|
|
|
7fc171 |
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
|
7fc171 |
touch /etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2
|
|
|
7fc171 |
/usr/libexec/microcode_ctl/update_ucode
|
|
|
7fc171 |
dracut -f --regenerate-all
|
|
|
7fc171 |
|
|
|
7fc171 |
To disallow usage of the latest microcode revision for all kernels, please
|
|
|
7fc171 |
create a file
|
|
|
7fc171 |
"/etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2",
|
|
|
7fc171 |
run "/usr/libexec/microcode_ctl/update_ucode" to update firmware directories
|
|
|
7fc171 |
used for late microcode updates, and run "dracut -f --regenerate-all"
|
|
|
7fc171 |
so initramfs images get regenerated, for example:
|
|
|
7fc171 |
|
|
|
7fc171 |
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
|
7fc171 |
touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2
|
|
|
7fc171 |
/usr/libexec/microcode_ctl/update_ucode
|
|
|
7fc171 |
dracut -f --regenerate-all
|
|
|
7fc171 |
|
|
|
7fc171 |
|
|
|
7fc171 |
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
|
|
|
7fc171 |
information.
|