6c53eb
The microcode_ctl package contains microcode files (vendor-provided binary data
6c53eb
and/or code in proprietary format that affects behaviour of a device) for Intel
6c53eb
CPUs that may be loaded into the CPU during boot.
6c53eb
6c53eb
The microcode_ctl package contains provisions for some issues related
6c53eb
to microcode loading.  While those provisions are expected to suit most users,
6c53eb
several knobs are available in order to provide ability to override the default
6c53eb
behaviour.
4eb1a6
4eb1a6
4eb1a6
General behaviour
4eb1a6
=================
742279
In RHEL 7, there are currently two main handlers for CPU microcode update:
4eb1a6
 * Early microcode update. It uses GenuineIntel.bin or AuthenticAMD.bin file
4eb1a6
   placed at the beginning of an initramfs image
742279
   (/boot/initramfs-KERNEL_VERSION.img, where "KERNEL_VERSION" is a kernel
742279
   version in the same format as provided by "uname -r") as a source
742279
   of microcode data, and is performed very early during the boot process
742279
   (if the relevant microcode file is available in the aforementioned file).
4eb1a6
 * On-demand (late) microcode update. It can be triggered by writing "1" to
4eb1a6
   /sys/devices/system/cpu/microcode/reload file (provided my the "microcode"
742279
   module). It relies on request_firmware infrastructure, which searches (and
742279
   loads, if found) microcode from a file present in one of the following
742279
   directories (in the search order):
4eb1a6
       /lib/firmware/updates/KERNEL_VERSION/
4eb1a6
       /lib/firmware/updates/
4eb1a6
       /lib/firmware/KERNEL_VERSION/
4eb1a6
       /lib/firmware/
4eb1a6
  (there is also an additional directory that can be configured via the
4eb1a6
  "fw_path_para" module option of the "firmware_class" module; as this module
4eb1a6
  is built-in in RHEL kernel, a boot parameter "firmware_class.fw_path_para"
4eb1a6
  should be used for that purpose; this is out of the document's scope, however)
4eb1a6
4eb1a6
The firmware for Intel CPUs is searched in "intel-ucode" subdirectory, and for
4eb1a6
AMD CPUs, a file under "amd-ucode" is searched.
4eb1a6
4eb1a6
For Intel CPUs, the name of the specific microcode file the kernel tries to load
4eb1a6
has the format "FF-MM-SS", where "FF" is the family number, "MM" is the model
4eb1a6
number, and "SS" is the stepping. All those numbers are zero-filled to two digits
4eb1a6
and are written in hexadecimal (letters are in the lower case).  For AMD CPUs,
4eb1a6
the file name has the format "microcode_amd_famFFh.bin", where "FF" is the
4eb1a6
family number, written in hexadecimal, letters are in the lower case, not
4eb1a6
zero-filled.
4eb1a6
4eb1a6
The early microcode is placed into initramfs image by the "dracut" script, which
4eb1a6
scans the aforementioned subdirectories of the configured list of firmware
742279
directories (by default, the list consists of two directories in RHEL 7,
4eb1a6
"/lib/firmware/updates" and "/lib/firmware").
4eb1a6
742279
In RHEL 7, AMD CPU microcode is shipped as a part of the linux-firmware package,
4eb1a6
and Intel microcode is shipped as a part of the microcode_ctl package.
4eb1a6
4eb1a6
The microcode_ctl package currently includes the following:
742279
 * Intel CPU microcode files, placed in /usr/share/microcode_ctl/intel-ucode
742279
   directory (currently there are none);
4eb1a6
 * A dracut module, /usr/lib/dracut/modules.d/99microcode_ctl-fw_dir_override,
4eb1a6
   that controls which additional firmware directories will be added to dracut's
4eb1a6
   default configuration;
742279
 * A dracut configuration file, /usr/lib/dracut/dracut.conf.d/01-microcode.conf,
742279
   that enables inclusion of early microcode to the generated initramfs
742279
   in dracut;
742279
 * A dracut configuration file,
742279
   /usr/lib/dracut/dracut.conf.d/99-microcode-override.conf, that provides a way
742279
   to quickly disable 99microcode_ctl-fw_dir-override dracut module;
4eb1a6
 * A systemd service file, microcode.service, that triggers microcode reload
4eb1a6
   late during boot;
742279
 * A set of directories in /usr/share/microcode_ctl/ucode_with_caveats, each
742279
   of which contains configuration and related data for various caveats related
742279
   to microcode:
742279
   * readme - description of caveat and related information,
742279
   * config - caveat configuration file, with syntax as described in "Caveat
742279
     configuration" section below,
742279
   * intel-ucode - directory containing microcode files related to the caveat;
4eb1a6
 * A set of support scripts, placed in /usr/libexec/microcode_ctl:
4eb1a6
   * "check_caveats" is an utility script that performs checks of the target
4eb1a6
     kernel (and running CPU) in accordance with caveat configuration files
742279
     in ucode_with_caveats directory and reports whether it passes them or not,
4eb1a6
   * "reload_microcode" is a script that is called by microcode.service and
4eb1a6
     triggers microcode reloading (by writing "1" to
4eb1a6
     /sys/devices/system/cpu/microcode/reload) if the running kernel passes
742279
     check_caveats checks,
4eb1a6
   * "update_ucode" is a script that populates symlinks to microcode files
4eb1a6
     in /lib/firmware, so it can be picked up by relevant kernels for the late
4eb1a6
     microcode loading.
4eb1a6
4eb1a6
Also, microcode_ctl RPM includes triggers that run update_ucode script on every
4eb1a6
installation or removal of a kernel RPM in order to provide microcode files
4eb1a6
for newly installed kernels and cleanup symlinks for the uninstalled ones.
4eb1a6
4eb1a6
cc944f
Microcode file structure
cc944f
------------------------
cc944f
Intel x86 CPU microcode file (that is, one that can be directly consumed
cc944f
by the CPU/kernel, and not its text representation such as used in microcode.dat
cc944f
files) is a bundle of concatenated microcode blobs.  Each blob has a header,
cc944f
payload, and an optional additional data, as follows (for additional information
cc944f
please refer to "Intel® 64 and IA-32 Architectures Software Developer’s Manual"
cc944f
[1], Volume 3A, Section 9.11.1 "Microcode Update"):
cc944f
 * Header (48 bytes)
cc944f
    * Header version (unsigned 32-bit integer): version number of the update
cc944f
      header.  Must be 0x1.
cc944f
    * Microcode revision (signed 32-bit integer)
cc944f
    * Microcode date (unsigned 32-bit integer): encoded as BCD in mmddyyyy format
cc944f
      (0x03141592 is 1592-03-14 in ISO 8601)
cc944f
    * CPU signature (unsigned 32-bit integer): CPU ID, as provided
cc944f
      by the CPUID (EAX = 0x1) instruction in the EAX register:
cc944f
       * bits 31..28: reserved
cc944f
       * bits 27..20: "Extended Family", summed with the Family field value
cc944f
       * bits 19..16: "Extended Model", bits 7..4 of the CPU model
cc944f
       * bits 15..14: reserved
cc944f
       * bits 13..12: "Processor Type", non-zero value (other than the "primary
cc944f
         processor") so far used only for the Deschutes (Pentium II) CPU family,
cc944f
         with the processor type of 1, to signify it is an Overdrive processor:
cc944f
         CPUID 0x1632.
cc944f
       * bits 11..08: Family, summed with the Extended Family field value
cc944f
       * bits 07..04: Model (bits 3..0)
cc944f
       * bits 03..00: Stepping
cc944f
      In short, microcode file with Family-Model-Stepping of uv-wx-0z corresponds
cc944f
      to CPUID 0x0TUw0Vxz, where uv = TU + V, with V usually being 0xF when
cc944f
      uv >= 16; with Family being 6 on most of recent Intel CPUs this transforms
cc944f
      into 0x000w06xz.  Please also refer to README.intel-ucode, section "About
cc944f
      Processor Signature, Family, Model, Stepping and Platform ID"
cc944f
      for additional information.
cc944f
    * Checksum (unsigned 32-bit integer): correct if sum (in base 1 << 32) of all
cc944f
      the 32-bit integers comprising the microcode amounts to 0.
cc944f
    * Loader version (unsigned 32-bit integer): 0x1.
cc944f
    * Platform ID mask (unsigned 32-bit integer): lower 8 bits indicate the set
cc944f
      of possible values of bits 52..50 of MSR 0x17 ("Platform ID").  In old
cc944f
      (up to Pentium II) microcode blobs the mask may be zero.
cc944f
    * Data size (unsigned 32-bit integer): size of the Payload in bytes,
cc944f
      has to be divisible by 4.  0 means 2000.
cc944f
    * Total size (unsigned 32-bit integer): total microcode blob size (including
cc944f
      header and extended header), has to be divisible by 1024.  0 means 2048.
cc944f
    * Reserved (12 bytes).
cc944f
 * Payload
cc944f
 * Additional data (optional, 20 + 12 * n bytes)
cc944f
    * Extended signature table header (20 bytes)
cc944f
       * Extended signature count (unsigned 32-bit integer)
cc944f
       * Checksum (unsigned 32-bit integer): correct if sum (in base 1 << 32)
cc944f
         of all the 32-bit integers comprising the extender signature table
cc944f
         amounts to 0.
cc944f
       * Reserved (12 bytes).
cc944f
    * Extended signature (12 bytes each)
cc944f
       * CPU signature (unsigned 32-bit integer): see the description of the CPU
cc944f
         signature field in the Header above.
cc944f
       * Platform ID mask (unsigned 32-bit integer): see the description
cc944f
         of the Platform ID mask field in the Header above.
cc944f
       * Checksum (unsigned 32-bit integer): correct if sum (in base 1<< 32)
cc944f
         of all the 32-bit integers comprising the Header (with CPU signature
cc944f
         and Platform ID mask fields replaced with the values from this signature)
cc944f
         and the Payload amounts to 0.  Note that since External signature table
cc944f
         header has its own checksum, sum of all its 32-bit values amounts to 0,
cc944f
         so the Checksum in the Header and in the Extended signature will be
cc944f
         the same if the values of CPU signature and Platform ID mask fields
cc944f
         are the same,
cc944f
cc944f
[1] https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4.html
cc944f
cc944f
4eb1a6
Caveat configuration
4eb1a6
--------------------
4eb1a6
There is a directory for each caveat under
4eb1a6
/usr/share/microcode_ctl/ucode_with_caveats, containing the following files:
4eb1a6
 * "config", a configuration file for the caveat;
4eb1a6
 * "readme", that contains description of the caveat;
4eb1a6
 * set of related associated microcode files.
4eb1a6
4eb1a6
"config" file is a set of lines each containing option name and its value,
4eb1a6
separated by white space.  Currently, the following options are supported:
4eb1a6
 * "model" option, which has format "VENDOR_ID FF-MM-SS", that specifies
4eb1a6
   to which CPU model the caveat is applicable (check_caveats ignores caveats
4eb1a6
   with non-matching models if "-m" option is passed to it). Can be set
4eb1a6
   in the configuration file only once (the last provided value is used).
4eb1a6
 * "vendor" option specifies CPUs of which vendor (as provided
4eb1a6
   in the /proc/cpuinfo file) the caveat is applicable to (check_caveats
4eb1a6
   ignores caveats with non-matching models when it is invoked with "-m"
4eb1a6
   option). Can be set in the configuration file only once.
4eb1a6
 * "path" is a glob pattern that specifies set of microcode files associated
4eb1a6
   with the caveat as a relative path to the caveat directory. This option
4eb1a6
   is used for populating files in /lib/firmware by update_ucode script and
4eb1a6
   for matching microcode file when dracut is run in host-only mode
4eb1a6
   (as in that case it uses only the first directory in firmware directory list
4eb1a6
   to look for the microcode file applicable to the host CPU).  Can be set
4eb1a6
   in the configuration file multiple times.
4eb1a6
 * "kernel" is a minimal kernel version that supports proper handling
4eb1a6
   of the related microcode files during late microcode load.  It may be
4eb1a6
   provided in one of the following formats that affect the way it is compared
4eb1a6
   to the running kernel version:
4eb1a6
    * A.B.C (where A, B, and C are decimal numbers), "upstream version". In this
4eb1a6
      case, simple version comparison against the respective part of the running
4eb1a6
      kernel version is used, and the running kernel version should be greater
4eb1a6
      or equal than the version provided in the configuration option in order
4eb1a6
      for comparison to succeed (that is, the first part, major version number,
4eb1a6
      of the running kernel version should be greater than the value provided
4eb1a6
      in the configuration option, or those should be equal and the second part,
4eb1a6
      minor version number, should be greater than the minor version number
4eb1a6
      of the kernel version provided in the configuration option, or the first
4eb1a6
      two parts should be equal and the third part, patch level, should
4eb1a6
      be greater or equal the patch level of the version in the configuration
4eb1a6
      option).
4eb1a6
    * A.B.C-Y (where A, B, C, and Y are decimal numbers), "Y-stream version".
4eb1a6
      In this case, A.B.C part should be equal, and Y part of the running kernel
4eb1a6
      version should be greater or equal than the Y part of the configuration
4eb1a6
      option version in order to satisfy the comparison requirement.
4eb1a6
    * A.B.C-Y.Z1.Z2 (where A, B, C, Y, Z1, and Z2 are decimal numbers),
4eb1a6
      "Z-stream version". In this case, A.B.C-Y part should be equal and Z1.Z2
4eb1a6
      part of the running kernel should be greater or equal than the respective
4eb1a6
      part of the configuration option version (when compared as a version)
4eb1a6
      for comparison to succeed.
4eb1a6
   Kernel version check passed if at least one comparison of the running kernel
4eb1a6
   version against a kernel version provided in a configuration option
4eb1a6
   succeeded.  The "kernel" configuration option can be provided
4eb1a6
   in the configuration file multiple times.
4eb1a6
 * "kernel_early" is a minimal kernel version that supports proper handling
4eb1a6
   of the related microcode during early microcode load. The format of the
4eb1a6
   option and its semantics is similar to the "kernel" configuration options.
4eb1a6
   This option can be provided multiple times as well.
4eb1a6
 * "mc_min_ver_late" is the minimal version of the currently loaded microcode
4eb1a6
   on the CPU (as reported in /proc/cpuinfo) that supports late microcode
4eb1a6
   update.  Microcode update will be attempted only if the currently loaded
4eb1a6
   microcode version is greater or equal the microcode version provided
4eb1a6
   in the configuration option. Can be set in the configuration file only once.
4eb1a6
 * "disable" is a way to disable a specific caveat from inside its
4eb1a6
   configuration. Argument for the argument is a list of stages ("early",
4eb1a6
   "late") for which the caveat should be disable. The configuration option
4eb1a6
   can be provided multiple times in a configuration file.
347126
 * "pci_config_val" performs check for specific values in selected parts
347126
   of configuration space of specified PCI devices.  If "-m" option
347126
   is not specified, then the actual check is skipped, and the check returns
347126
   result in accordance with the provided "mode" option (se below).  Check
347126
   arguments are a white-space-separated list of "key=value" pairs.
347126
   The following keys are supported:
347126
    * "domain" - PCI domain number, or "*" (an asterisk) for any domain.
347126
      Default is "*".
347126
    * "bus" - PCI bus number, or "*" (an asterisk) for any bus.  Default is "*".
347126
    * "device" - PCI device number, or "*" (an asterisk) for any device.
347126
      Default is "*".
347126
    * "function" - PCI function number, or "*" (an asterisk) for any function.
347126
      Default is "*".
347126
    * "vid" - PCI vendor ID, or empty string for any vendor ID.  Default
347126
      is empty string.
347126
    * "did" - PCI device ID, or empty string for any device ID.  Default
347126
      is empty string.
347126
    * "offset" - offset in device's configuration space where the value resides.
347126
      Default is 0.
347126
    * "size" - field size.  Possible values are 1, 2, 4, or 8.  Default is 4.
347126
    * "mask" - mask applied to the values during the check.  Default is 0.
347126
    * "val" - comma-separated list of matching values.  Default is 0.
347126
    * "mode" - check mode, the way matches are interpreted:
347126
       * "success-any" - check succeeds if there was at least one match,
347126
         otherwise it fails.
347126
       * "success-all" - check succeeds if there was at least one device checked
347126
         and all the checked devices have matches, otherwise the check fails.
347126
       * "fail-any" - check fails if there was at least one match, otherwise
347126
         it succeeds.
347126
       * "fail-all" - check fails if there was at least one device checked
347126
         and all the checked devices have matches, otherwise the check succeeds.
347126
   An example of a check:
347126
       pci_config_val mode=success-all device=30 function=3 vid=0x8086 did=0x2083 offset=0x84 size=4 mask=0x38 val=0x38,0x18,0x8
347126
   It interprets 4 bytes at offset 0x84 of special files "config" under
347126
   directories that match glob pattern "/sys/bus/pci/devices/*:*:1e.3"
347126
   as an unsigned integer value, applies mask 0x38 (thus selecting bit 5..3
347126
   of it) and checks whether it is one of the values 0x38, 0x18, or 0x8 (0b111,
347126
   0b011, or 0b001 in bits 5..3, respectively); if there are such files,
347126
   and all the checked values in every checked file has matched at least one
347126
   of the aforementioned value, then the check is successful, otherwise
347126
   it fails (in accordance with "mode=success-all" semantics).  This check fails
347126
   if "-m" option is not specified.
50693b
 * "dmi" performs checks for specific values available in DMI sysfs files
f9176a
   (present under /sys/devices/virtual/dmi/id/).  The check (when it is actually
f9176a
   performed; see a not about "no-model-mode" below) fails if one of the files
f9176a
   is not readable.  If "-m" option is not specified, then the actual check
50693b
   is skipped, and the check returns value in accordance with "no-model-mode"
50693b
   parameter value (see below).  Check arguments are a white-space-separated
50693b
   list of "key=value" pairs.  The following keys are supported:
50693b
    * "key" - DMI file to check. Value can be one of the following: bios_date,
50693b
      bios_vendor, bios_version, board_asset_tag, board_name, board_serial,
50693b
      board_vendor, board_version, chassis_asset_tag, chassis_serial,
50693b
      chassis_type, chassis_vendor, chassis_version, product_family,
50693b
      product_name, product_serial, product_uuid, product_version, sys_vendor.
50693b
      Default is empty string.
f9176a
    * "val" - a string to match DMI data present in "key" against.
f9176a
      Can be enclosed in single or double quotes.  Default is empty string.
f9176a
    * "keyval" - a pair of "key" and "val" values (with semantics described
f9176a
      above), separated with either "=", ":", "!=", or "!:" characters.  Enables
f9176a
      providing of multiple key-value pairs by means of supplying multiple
f9176a
      keyval= parameters.  The exclamation sign ("!") character in separator
f9176a
      enables negated matching (so, non-equality of the value in DMI "key" file
f9176a
      and the value of "val" is).  The match considered successful when all
f9176a
      the key/val (non-)equalities are in effect.  This parameter works
f9176a
      in addition to the pair provided in "key" and "val" parameters
f9176a
      (but allows to avoid using them).  Default is empty.
f9176a
    * "mode" - check mode, the way successful matches are interpreted:
50693b
       * "success-equal" - returns 0 if the value present in the file
50693b
         with the name supplied via the "key" parameter file under
50693b
	 /sys/devices/virtual/dmi/id/ is equal to the value supplied as a value
f9176a
	 of "val" parameter and all the pairs provided in "keyval" parameters
f9176a
	 are equal and non-equal in accordance with their definition,
f9176a
	 otherwise 1.
f9176a
       * "fail-equal" - returns 1 if the value present in the file
50693b
         with the name supplied via the "key" parameter file under
50693b
	 /sys/devices/virtual/dmi/id/ is equal to the value supplied as a value
f9176a
	 of "val" parameter and all the pairs provided in "keyval" parameters
f9176a
	 are equal and non-equal in accordance with their definition,
f9176a
	 otherwise 0.
50693b
      Default is "success-any".
50693b
    * "no-model-mode" - return value if model filter ("-m" option)
50693b
      is not enabled:
50693b
       * "success" - return 0.
50693b
       * "fail" - return 1.
50693b
      Default is "success".
50693b
   An example of a check:
50693b
       dmi mode=fail-equal no-model-mode=success key=bios_vendor val="Dell Inc."
50693b
   It checks file /sys/devices/virtual/dmi/id/bios_vendor and fails if its
50693b
   content is "Dell Inc." (without quotes).  It succeeds if "-m" option
50693b
   is not enabled.
f9176a
   Another example:
f9176a
       dmi mode=fail-equal keyval="sys_vendor=Amazon EC2" keyval="product_name=u-18tb1.metal"
f9176a
       dmi mode=fail-equal keyval="sys_vendor=Lenovo" keyval="product_name=ThinkSystem SR950"
f9176a
   It blocks the caveat from using when either both
f9176a
   /sys/devices/virtual/dmi/id/sys_vendor contains the string "Amazon EC2"
f9176a
   and /sys/devices/virtual/dmi/id/product_name contains the string
f9176a
   "u-18tb1.metal" or both /sys/devices/virtual/dmi/id/sys_vendor contains
f9176a
   the string "Lenovo" and /sys/devices/virtual/dmi/id/product_name contains
f9176a
   the string "ThinkSystem SR950", but enables caveat loading for other products
f9176a
   with the aforementioned /sys/devices/virtual/dmi/id/sys_vendor values,
f9176a
   for example.
f9176a
 * "dependency" allows conditional enablement of a caveat based on the check
f9176a
   status of some other caveat(s).  It has the following format:
f9176a
       dependency DEPENDENCY_TYPE DEPENDENCY_NAME [OPTION...]
f9176a
   where DEPENDENCY_NAME is the configuration to be checked, OPTIONs
f9176a
   are per-DEPENDENCY_TYPE, and the only DEPENDENCY_TYPE that is supported
f9176a
   currently is "required".
f9176a
   Options for the "required" dependency type:
f9176a
    * "match-model-mode" - whether model matching mode ("-m" option)
f9176a
      has to be used for the nested configuration check. Possible values:
f9176a
       * "on" - model-matching mode is always used during the nested check;
f9176a
       * "off" - model-matching mode is never used during the nested check;
f9176a
       * "same" - used the same model-matching mode as it is now.
f9176a
      Default is "same".
f9176a
    * "skip" - controls result of the check when the nested check indicated
f9176a
      skipping of the configuration.
f9176a
       * "fail" - the dependent check fails;
f9176a
       * "success" - the dependent check succeeds;
f9176a
       * "skip" - the dependent check indicates that the configuration
f9176a
         is to be skipped.
f9176a
      Default is "skip".
f9176a
    * "force-skip" - controls result of the check when the nested check
f9176a
      indicated skipping of the configuration caused by the presence
f9176a
      of an override file (see "check_caveats script" section for details).
f9176a
       * "fail" - the dependent check fails;
f9176a
       * "success" - the dependent check succeeds;
f9176a
       * "skip" - the dependent check indicates that the configuration
f9176a
         is to be skipped.
f9176a
      Default is "skip".
f9176a
    * "nesting-too-deep" - as a measure against dependency loop, configuration
f9176a
      checking logic implements nesting limit on dependency checks (currently
f9176a
      set at 8).  This option controls the behaviour of the check
f9176a
      when the nested check cannot be performed due to this limit.
f9176a
       * "fail" - the dependent check fails;
f9176a
       * "success" - the dependent check succeeds;
f9176a
       * "skip" - the dependent check indicates that the configuration
f9176a
         is to be skipped.
f9176a
      Default is "fail".
f9176a
   An example of a check:
f9176a
       dependency required intel skip=success match-model-mode=off
f9176a
   It checks "intel" caveat configuration (see the "Early microcode load
f9176a
   inside a virtual machine" section) with model-matching mode being disabled,
f9176a
   treats skipping of the configuration as a success (unless the configuration
f9176a
   is forced to be skipped, in that case the dependent configuration
f9176a
   is to be skipped as well).
4eb1a6
4eb1a6
4eb1a6
check_caveats script
4eb1a6
--------------------
4eb1a6
"check_caveats" is an utility script (called by update_ucode, reload_microcode,
4eb1a6
dracut module) that performs checks of the target kernel (and running CPU)
4eb1a6
in accordance with caveat configuration files in directory
4eb1a6
"/usr/share/microcode_ctl/ucode_with_caveats", and returns information, whether
4eb1a6
the system passes the checks, or not.
4eb1a6
4eb1a6
Usage:
4eb1a6
    check_caveats [-e] [-k TARGET_KVER] [-c CONFIG]* [-m] [-v]'
4eb1a6
4eb1a6
Options:
4eb1a6
  -e - check for early microcode load possibility (instead of late microcode
4eb1a6
       load). "kernel_early" caveat configuration options are used for checking
4eb1a6
       instead of "kernel", and "mc_min_ver_late" is not checked.
4eb1a6
  -k - target kernel version to check against, $(uname -r) is used otherwise.
4eb1a6
  -c - caveat(s) to check, all caveat configurations found inside
4eb1a6
       $MC_CAVEATS_DATA_DIR are checked otherwise.
4eb1a6
  -m - ignore caveats that do not apply to the current CPU model.
4eb1a6
  -v - verbose output.
4eb1a6
4eb1a6
Environment:
742279
  MC_CAVEATS_DATA_DIR - directory that contains caveats configurations,
742279
                        "/usr/share/microcode_ctl/ucode_with_caveats"
742279
			by default.
4eb1a6
  FW_DIR - directory containing firmware files (per-kernel configuration
742279
           overrides are checked there), "/lib/firmware" by default.
742279
  CFG_DIR - directory containing global caveats overrides,
742279
            "/etc/microcode_ctl/ucode_with_caveats" by default.
4eb1a6
4eb1a6
Output:
4eb1a6
  Script returns information about caveats check results. Output has a format
4eb1a6
  of "KEY VALUE1 VALUE2 ..." with KEY defining the semantics of the VALUEs.
4eb1a6
  Currently, the following data is issued:
4eb1a6
   - "cfgs" - list of caveats that have been processed (and not skipped
4eb1a6
      due to missing "config", "readme", or a disallow-* override described
4eb1a6
      below);
4eb1a6
   - "skip_cfgs" - list of caveats that have been skipped (due to missing
4eb1a6
     config/readme file, or because of overrides);
4eb1a6
   - "paths" - list of glob patterns matching files associated with caveats
4eb1a6
     that have been processed;
4eb1a6
   - "ok_cfgs" - list of caveat configurations that have all the checks passed
4eb1a6
     (or have enforced by one of force-* overrides described below);
4eb1a6
   - "ok_paths" - list of glob patterns associated with caveat files from
4eb1a6
     the "ok_cfgs" list;
4eb1a6
   - "fail_cfgs" - list of caveats that have one of the checks failed.
4eb1a6
   - "fail_paths" - list of glob patterns associated with caveats from the
4eb1a6
     "fail_cfgs" list.
4eb1a6
4eb1a6
Return value:
4eb1a6
  - 0 in case caveats check has passed, 1 otherwise.
4eb1a6
  - In "-d" mode, 0 is always returned.
4eb1a6
4eb1a6
Overrides:
4eb1a6
4eb1a6
When check_caveats perform its checks, it also checks for presence of files
4eb1a6
in specific places, and, if they exist, check_caveats skips a caveat or ignores
4eb1a6
its checks; that mechanism allows overriding the information provided
4eb1a6
in configuration on local systems and affect the behaviour of the microcode
4eb1a6
update process.
4eb1a6
4eb1a6
Current list of overrides (where $FW_DIR and $CFG_DIR are the environment
4eb1a6
options described earlier; $kver - the currently processed kernel version,
4eb1a6
$s is the requested stage ("early" or "late"), $cfg is the caveat directory
4eb1a6
name):
4eb1a6
    $FW_DIR/$kver/disallow-$s-$cfg - skip a caveat for the requested stage for
4eb1a6
                                     a specific kernel version..
4eb1a6
    $FW_DIR/$kver/force-$s-$cfg - apply a specific caveat file for a specific
4eb1a6
                                  kernel version for the requested stage without
4eb1a6
				  performing any checks.
4eb1a6
    $FW_DIR/$kver/disallow-$cfg - skip a caveat for any stage for a specific
4eb1a6
                                  kernel version.
4eb1a6
    $FW_DIR/$kver/force-$cfg - apply a specific caveat for any stage
4eb1a6
                               for a specific kernel version without checks.
4eb1a6
    $FW_DIR/$kver/disallow-$s - skip all caveats for a specific stage
4eb1a6
                                for a specific kernel version.
4eb1a6
    $CFG_DIR/disallow-$s-$cfg - skip a caveat for a specific stage for all
4eb1a6
                                kernel versions.
4eb1a6
    $FW_DIR/$kver/force-$s - apply all caveats for a specific stage
4eb1a6
                             for a specific kernel version without checks.
4eb1a6
    $CFG_DIR/force-$s-$cfg - apply a specific caveat for a specific stage for
4eb1a6
                             all kernel versions without checks.
4eb1a6
    $FW_DIR/$kver/disallow - skip all caveats for all stages for a specific
4eb1a6
                             kernel version.
4eb1a6
    $CFG_DIR/disallow-$cfg - skip a caveat for all stages for all kernel
4eb1a6
                             versions.
4eb1a6
    $FW_DIR/$kver/force - apply all caveats for all stages for a specific kernel
4eb1a6
                          version without checks.
4eb1a6
    $CFG_DIR/force-$cfg - apply a caveat for all stages for all kernel versions
4eb1a6
                          without checks.
4eb1a6
    $CFG_DIR/disallow-$s - skip all caveat for all kernel versions
4eb1a6
                           for a specific stage.
4eb1a6
    $CFG_DIR/force-$s - apply all caveats for all kernel versions for  specific
4eb1a6
                        stage without checks.
4eb1a6
    $CFG_DIR/disallow - skip all caveats for all stages for all kernel versions
4eb1a6
                        (disable everything).
4eb1a6
    $CFG_DIR/force - force all caveats for all stages for all kernel versions
4eb1a6
                     (enable everything).
4eb1a6
4eb1a6
The "apply" action above means creating symlinks in /lib/firmware by
4eb1a6
update_ucode in case of the "late" stage and adding caveat directory to the list
4eb1a6
of firmware directories by dracut plugin in case of the "early" stage.
4eb1a6
4eb1a6
The files are checked for existence until the first match, so more specific
4eb1a6
overrides can override more broad ones.
4eb1a6
4eb1a6
Also, a caveat is ignored if it lacks either config or readme file.
4eb1a6
4eb1a6
4eb1a6
update_ucode script
4eb1a6
-------------------
4eb1a6
"update_ucode" populates symlinks to microcode files in accordance with caveats
4eb1a6
configuration.  It enables late microcode loading that is invoked by triggering
4eb1a6
/sys/devices/system/cpu/microcode/reload file.  Since caveats depend
4eb1a6
on the kernel version, symlinks are populated inside
4eb1a6
"/lib/firmware/KERNEL_VERSION" directory for each installed kernel.
4eb1a6
As a consequence, this script is triggered upon each kernel package installation
4eb1a6
and removal.
4eb1a6
4eb1a6
The script has two parts: common and kernel-version-specific.
4eb1a6
4eb1a6
During the common part, files are populated from
4eb1a6
/usr/share/microcode_ctl/intel-ucode in /lib/firmware/intel-ucode. There are
4eb1a6
several possibilities to affect the process:
4eb1a6
 * Presence of "/etc/microcode_ctl/intel-ucode-disallow" file leads to skipping
4eb1a6
   the common part of the script.
4eb1a6
 * The same for "/lib/firmware/intel-ucode-disallow".
4eb1a6
4eb1a6
During the kernel-version-specific part, each caveat is checked against every
4eb1a6
kernel version, and those combinations, for which caveat check succeeds,
4eb1a6
gets the symlinks to the associated microcode files populated.
4eb1a6
 * Absence of "/lib/firmware/KERNEL_VERSION/readme-CAVEAT" prevents update_ucode
4eb1a6
   from removing symlinks related to the caveat for specific kernel version.
4eb1a6
 * Since the check is being done by check_caveats, all the overrides that
4eb1a6
   described there also stay.
4eb1a6
4eb1a6
Usage:
4eb1a6
    update_ucode [--action {add|remove|refresh|list}] [--kernel KERNELVER]*
4eb1a6
                 [--verbose] [--dry-run] [--cleanup intel_ucode caveats_ucode]
4eb1a6
                 [--skip-common] [--skip-kernel-specific]
4eb1a6
4eb1a6
Options:
4eb1a6
  --action - action to perform. Currently, the following actions are supported:
4eb1a6
              * "add" - create new symlinks.
4eb1a6
              * "remove" - remove old symlinks that are no longer needed.
4eb1a6
              * "refresh" - re-populate symlinks.
4eb1a6
              * "list" - list files under control of update_ucode.
4eb1a6
             By default, "refresh" action is executed.
4eb1a6
  --kernel - kernel version to process. By default, list of kernel versions
4eb1a6
             is formed based on contents of /lib/firmware and /lib/modules
4eb1a6
             directories.
4eb1a6
  --verbose - verbose output.
4eb1a6
  --dry-run - do not call commands, just print the invocation lines.
4eb1a6
  --cleanup - cleanup mode. Used by post-uninstall script during package
4eb1a6
              upgrades. Removes excess files in accordance to the contents
4eb1a6
              of the files provided in the arguments to the option.
4eb1a6
  --skip-common - do not process /lib/firmware directory.
4eb1a6
  --skip-kernel-specific - do not process /lib/firmware/KERNEL_VERSION
4eb1a6
                           directories.
4eb1a6
4eb1a6
Return value:
4eb1a6
  0 on success, 1 on error.
4eb1a6
4eb1a6
4eb1a6
reload_microcode script
4eb1a6
-----------------------
4eb1a6
"reload_microcode" is a script that is called by microcode.service and
4eb1a6
triggers late microcode reloading (by writing "1" to
742279
/sys/devices/system/cpu/microcode/reload) if the following check are passed:
742279
 * the microcode update performed not in a virtualised environment;
742279
 * running kernel passes "check_caveats" checks that applicable to the current
742279
   CPU model.
4eb1a6
742279
For a virtualised environment check, the script searches the "/proc/cpuinfo"
742279
file for presence of the "hypervisor" flag among CPU features (it corresponds
742279
to a CPUID feature bit set by hypervisors in order to inform that the kernel
742279
operates inside a virtual machine).  This check can be overridden and skipped
742279
by creation of a file "/etc/microcode_ctl/ignore-hypervisor-flag".
4eb1a6
4eb1a6
The script has no options and always returns 0.
4eb1a6
4eb1a6
4eb1a6
99microcode_ctl-fw_dir_override dracut module
4eb1a6
---------------------------------------------
4eb1a6
This dracut module injects directories with microcode files for caveats
4eb1a6
that pass "early" check_caveats check (with "-e" flag). In addition
742279
to "check_caveats" overrides, the following abilities to control module's
742279
behaviour are present:
4eb1a6
 * Presence of one of the following files:
4eb1a6
   - /etc/microcode_ctl/ucode_with_caveats/skip-host-only-check
4eb1a6
   - /etc/microcode_ctl/ucode_with_caveats/skip-host-only-check-$cfg
4eb1a6
   - /lib/firmware/$kver/skip-host-only-check
4eb1a6
   - /lib/firmware/$kver/skip-host-only-check-$cfg
4eb1a6
   (where "$kver" is the kernel version in question and "$cfg" is the caveat
4eb1a6
   directory name) allows skipping matching of microcode file name when dracut's
4eb1a6
   Host-Only mode is enabled.
4eb1a6
742279
When caveats_check succeeds, caveats directory (not its possibly populated
742279
version for late microcode update: "/lib/firmware/KERNEL_VERSION";
742279
it is done so in order
742279
to have ability to configure list of caveats enabled for early and late
742279
microcode update, independently) is added to dracut's list of firmware search
742279
directories.
4eb1a6
4eb1a6
The module can be disabled by running dracut with
742279
"-o microcode_ctl-fw_dir_override" (for one-time exclusion), or it can
742279
be disabled permanently by uncommenting string
742279
"omit_dracutmodules+=' microcode_ctl-fw_dir_override '" in
742279
/usr/lib/dracut/dracut.conf.d/99-microcode-override.conf configuration file.
742279
742279
See dracut(8), section "Omitting dracut Modules", and dracut.conf(5), variable
742279
"omit_dracutmodules" for additional information.
4eb1a6
4eb1a6
4eb1a6
Caveats
4eb1a6
=======
4eb1a6
4eb1a6
Intel Broadwell-EP/EX ("BDX-ML B/M/R0") caveat
4eb1a6
----------------------------------------------
742279
Microcode update process on Intel Broadwell-EP/EX CPUs (BDX-ML B/M/R0,
742279
family 6, model 79, stepping 1) has issues that lead to system instability.
742279
A series of changes for the Linux kernel has been developed in order to work
742279
around those issues; however, as it turned out, some systems have issues even
742279
when a microcode update performed on a kernel that contains those changes.
742279
As a result, microcode update for this CPU model is disabled by default;
742279
the microcode file, however, is still shipped as a part of microcode_ctl
742279
package and can be used for performing a microcode update if it is enforced
f3c512
via the aforementioned overrides. (See the sections "check_caveats script"
ee041c
and "reload_microcode script" for details.)
4eb1a6
f3c512
Caveat name: intel-06-4f-01
f3c512
4eb1a6
Affected microcode: intel-ucode/06-4f-01.
4eb1a6
f9176a
Dependencies: intel
f9176a
6c53eb
Mitigation: microcode loading is disabled for the affected CPU model.
4eb1a6
742279
Minimum versions of the kernel package that contain the aforementioned patch
742279
series:
742279
 - Upstream/RHEL 8: 4.17.0
742279
 - RHEL 7.6 onwards:  3.10.0-894
4eb1a6
 - RHEL 7.5:  3.10.0-862.6.1
4eb1a6
 - RHEL 7.4:  3.10.0-693.35.1
4eb1a6
 - RHEL 7.3:  3.10.0-514.52.1
4eb1a6
 - RHEL 7.2:  3.10.0-327.70.1
4eb1a6
 - RHEL 6.10: 2.6.32-754.1.1
4eb1a6
 - RHEL 6.7:  2.6.32-573.58.1
4eb1a6
 - RHEL 6.6:  2.6.32-504.71.1
4eb1a6
 - RHEL 6.5:  2.6.32-431.90.1
4eb1a6
 - RHEL 6.4:  2.6.32-358.90.1
4eb1a6
4eb1a6
4eb1a6
Early microcode load inside a virtual machine
4eb1a6
---------------------------------------------
742279
RHEL 7 kernel supports performing microcode update during early boot stage
742279
from a cpio archive placed at the beginning of the initramfs image.  However,
742279
when an early microcode update is attempted inside some virtualised
742279
environments, that may result in unexpected system behaviour.
4eb1a6
f3c512
Caveat name: intel
f3c512
4eb1a6
Affected microcode: all.
4eb1a6
f9176a
Dependencies: (none)
f9176a
f3c512
Mitigation: early microcode loading is disabled for all CPU models on kernels
f3c512
without the fix.
4eb1a6
6c53eb
Minimum versions of the kernel package that contain the fix:
742279
 - Upstream/RHEL 8: 4.10.0
742279
 - RHEL 7.6 onwards: 3.10.0-930
4eb1a6
 - RHEL 7.5: 3.10.0-862.14.1
4eb1a6
 - RHEL 7.4: 3.10.0-693.38.1
4eb1a6
 - RHEL 7.3: 3.10.0-514.57.1
6c53eb
 - RHEL 7.2: 3.10.0-327.73.1
742279
742279
ee041c
Intel Sandy Bridge-E/EN/EP caveat
ee041c
---------------------------------
9db7ba
Microcode revision 0x718 for Intel Sandy Bridge-E/EN/EP (SNB-EP, family 6,
9db7ba
model 45, stepping 7), that was released to address MDS vulnerability,
9db7ba
and was available from microcode-20190618 up to microcode-20190508 release)
9db7ba
could lead to system instability[1][2].  In order to address this,
9db7ba
this microcode update was not used and the previous microcode revision
9db7ba
was provided instead by default; the microcode file, however, was still shipped
9db7ba
as part of microcode_ctl package and could be used for performing a microcode
9db7ba
update if it is enforced via the aforementioned overrides.  With the release
9db7ba
of 0x71a revision of the microcode (as art of microcode-20200520 release)
9db7ba
that aims at fixing the aforementioned stability issue, the latest microcode
9db7ba
revision is again used by default; it is still provided via the caveat
9db7ba
mechanism, hovewer, in order to enable ability to disable it in case such
9db7ba
a need arises.  (See the sections "check_caveats script" and "reload_microcode
9db7ba
script" for details regarding caveats mechanism operation.)
f3c512
347126
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/15
347126
[2] https://access.redhat.com/solutions/4593951
347126
f3c512
Caveat name: intel-06-2d-07
ee041c
ee041c
Affected microcode: intel-ucode/06-2d-07.
ee041c
f9176a
Dependencies: intel
f9176a
9db7ba
Mitigation: None; the latest revision of the microcode file is used by default;
9db7ba
previously published microcode revision 0x714 is still available as a fallback
9db7ba
as part of "intel" caveat.
ee041c
ee041c
f3c512
Intel Skylake-SP/W/X caveat
f3c512
---------------------------
9db7ba
Microcode revision 0x2000065 (that was provided with microcode releases
9db7ba
microcode-20191112 up to microcode-20200520) for some CPU models that belong
9db7ba
to Intel Skylake Scalable Platform (SKL-W/X, family 6, model 85, stepping 4,
9db7ba
Workstation/HEDT segments) could lead to hangs during reboot[1].  In order
9db7ba
to address this, by default this microcode update was disabled by default and
9db7ba
and the previous 0x2000064 microcode revision was used instead; the microcode
9db7ba
file with, however, is still shipped as part of microcode_ctl package and can
9db7ba
be used for performing a microcode update if it is enforced
9db7ba
via the aforementioned overrides. With the availability of 0x2006906 revision
9db7ba
of the microcode (in the microcode-20200609 release) that fixes
9db7ba
the aforementioned issue, the latest microcode revision is again used
9db7ba
by default; it is still provided via caveat mechanism, hovewer, in order
9db7ba
to enable ability to disable it in case such a need arises.  (See the sections
9db7ba
"check_caveats script" and "reload_microcode script" for details regarding
9db7ba
caveats mechanism operation.)
347126
347126
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/21
f3c512
f3c512
Caveat name: intel-06-55-04
f3c512
f3c512
Affected microcode: intel-ucode/06-55-04.
f3c512
f9176a
Dependencies: intel
f9176a
9db7ba
Mitigation: None; the latest revision of the microcode file is used by default;
9db7ba
previously published microcode revision 0x2000064 is still available
9db7ba
as a fallback as part of "intel" caveat.
9db7ba
9db7ba
f9176a
Intel Skylake-U/Y caveat
f9176a
------------------------
f9176a
Some Intel Skylake CPU models (SKL-U/Y, family 6, model 78, stepping 3)
f9176a
have reports of system hangs when revision 0xdc of microcode, that is included
f9176a
in microcode-20200609 update to address CVE-2020-0543, CVE-2020-0548,
f9176a
and CVE-2020-0549, is applied[1].  In order to address this, microcode update
f9176a
to the newer revision has been disabled by default on these systems,
f9176a
and the previously published microcode revision 0xd6 is used instead; the newer
f9176a
microcode files, however, are still shipped as part of microcode_ctl package
f9176a
and can be used for performing a microcode update if they are enforced
f9176a
via the aforementioned overrides.  (See the sections "check_caveats script"
f9176a
and "reload_microcode script" for details.)
9db7ba
9db7ba
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31
9db7ba
f9176a
Caveat name: intel-06-4e-03
9db7ba
f9176a
Affected microcode: intel-ucode/06-4e-03
f9176a
f9176a
Dependencies: intel
9db7ba
9db7ba
Mitigation: previously published microcode revision 0xd6 is used by default.
f3c512
f3c512
f9176a
Intel Skylake-H/S/Xeon E3 v5 caveat
f9176a
-----------------------------------
f9176a
Some Intel Skylake CPU models (SKL-H/S/Xeon E3 v5, family 6, model 94,
f9176a
stepping 3) had reports of system hangs when revision 0xdc of microcode,
f9176a
that is included in microcode-20200609 update to address CVE-2020-0543,
f9176a
CVE-2020-0548, and CVE-2020-0549, was applied[1].  In order to address this,
f9176a
microcode update to the newer revision had been disabled by default on these
f9176a
systems, and the previously published microcode revision 0xd6 was used instead.
f9176a
The revision 0xea seems[2] to have fixed the aforementioned issue, hence
f9176a
the latest microcode revision usage it is enabled by default,
f9176a
but can be disabled explicitly via the aforementioned overrides.  (See
f9176a
the sections "check_caveats script" and "reload_microcode script" for details.)
f9176a
f9176a
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31#issuecomment-644885826
f9176a
[2] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31#issuecomment-857806014
f9176a
f9176a
Caveat names: intel-06-5e-03
f9176a
f9176a
Affected microcode: intel-ucode/06-5e-03.
f9176a
f9176a
Dependencies: intel
f9176a
f9176a
Mitigation: None; the latest revision of the microcode file is used by default;
f9176a
previously published microcode revision 0xd6 is still available as a fallback
f9176a
as part of "intel" caveat.
f9176a
f9176a
501af6
Intel Tiger Lake-UP3/UP4 caveat
501af6
-------------------------------
501af6
Some systems with Intel Tiger Lake-UP3/UP4 CPUs (TGL, family 6, model 140,
f9176a
stepping 1) had reports of system hangs when a microcode update,
f9176a
that was included since microcode-20201110 release, was applied[1].
f9176a
In order to address this, microcode update to a newer revision had been disabled
f9176a
by default on these systems.  The revision 0x88 seems to have fixed
f9176a
the aforementioned issue, hence it is enabled by default; however, it is still
f9176a
can be disabled via the aforementioned overrides.  (See the sections
501af6
"check_caveats script" and "reload_microcode script" for details.)
501af6
501af6
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/44
501af6
501af6
Caveat names: intel-06-8c-01
501af6
501af6
Affected microcode: intel-ucode/06-8c-01.
501af6
f9176a
Dependencies: intel
f9176a
f9176a
Mitigation: None; the latest revision of the microcode file is used by default.
501af6
501af6
ee041c
742279
Additional information
742279
======================
ee041c
Red Hat provides updated microcode, developed by its microprocessor partners,
ee041c
as a customer convenience.  Please contact your hardware vendor to determine
ee041c
whether more recent BIOS/firmware updates are recommended because additional
ee041c
improvements may be available.
6c53eb
6c53eb
Information regarding microcode revisions required for mitigating specific
f3c512
Intel CPU vulnerabilities is available in the following knowledge base articles:
742279
 * CVE-2017-5715 ("Spectre"):
742279
   https://access.redhat.com/articles/3436091
742279
 * CVE-2018-3639 ("Speculative Store Bypass"):
742279
   https://access.redhat.com/articles/3540901
742279
 * CVE-2018-3620, CVE-2018-3646 ("L1 Terminal Fault Attack"):
742279
   https://access.redhat.com/articles/3562741
6c53eb
 * CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091
6c53eb
   ("Microarchitectural Data Sampling"):
6c53eb
   https://access.redhat.com/articles/4138151
f3c512
 * CVE-2019-0117 (Intel SGX Information Leak),
f3c512
   CVE-2019-0123 (Intel SGX Privilege Escalation),
f3c512
   CVE-2019-11135 (TSX Asynchronous Abort),
f3c512
   CVE-2019-11139 (Voltage Setting Modulation):
f3c512
   https://access.redhat.com/solutions/2019-microcode-nov
9db7ba
 * CVE-2020-0543 (Special Register Buffer Data Sampling),
9db7ba
   CVE-2020-0548 (Vector Register Data Sampling),
9db7ba
   CVE-2020-0549 (L1D Cache Eviction Sampling):
9db7ba
   https://access.redhat.com/solutions/5142751
501af6
 * CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface),
501af6
   CVE-2020-8696 (Vector Register Leakage-Active),
501af6
   CVE-2020-8698 (Fast Forward Store Predictor):
501af6
   https://access.redhat.com/articles/5569051
f9176a
 * CVE-2020-24489 (VT-d-related Privilege Escalation),
f9176a
   CVE-2020-24511 (Improper Isolation of Shared Resources),
f9176a
   CVE-2020-24512 (Observable Timing Discrepancy),
f9176a
   CVE-2020-24513 (Information Disclosure on Some Intel Atom Processors):
f9176a
   https://access.redhat.com/articles/6101171
fc0a9b
 * CVE-2021-0127 (Intel Processor Breakpoint Control Flow),
fc0a9b
   CVE-2021-0145 (Fast store forward predictor - Cross Domain Training),
fc0a9b
   CVE-2021-0146 (VT-d-related Privilege Escalation),
fc0a9b
   CVE-2021-33120 (Out of bounds read for some Intel Atom processors):
fc0a9b
   https://access.redhat.com/articles/6716541
72a479
 * CVE-2022-0005 (Informational disclosure via JTAG),
72a479
   CVE-2022-21123 (Shared Buffers Data Read),
72a479
   CVE-2022-21125 (Shared Buffers Data Sampling),
72a479
   CVE-2022-21127 (Update to Special Register Buffer Data Sampling),
72a479
   CVE-2022-21131 (Protected Processor Inventory Number (PPIN) access protection),
72a479
   CVE-2022-21136 (Overclocking service access protection),
72a479
   CVE-2022-21151 (Optimization Removal-Induced Informational Disclosure),
72a479
   CVE-2022-21166 (Device Register Partial Write):
72a479
   https://access.redhat.com/articles/6963124
4cfd03
 * CVE-2022-21233 (Stale Data Read from legacy xAPIC):
4cfd03
   https://access.redhat.com/articles/6976398