|
 |
c59b13 |
Older RHEL 7 kernels try to early load microcode even inside virtual
|
|
|
c59b13 |
machine, which may lead to panic on some hypervisors. In order to circumvent
|
|
|
c59b13 |
that, microcode is installed into a kernel-version-specific directory (which
|
|
|
c59b13 |
is not scanned by the dracut script, that constructs early microcode binary
|
|
|
c59b13 |
in initramfs, by default), and path to microcode files provided only in case
|
|
|
c59b13 |
initramfs is generated for the kernel version that properly handles early
|
|
|
c59b13 |
microcode inside a virtual machine (i.e. do not attempts yo load it).
|
|
|
c59b13 |
The versions of the kernel package that properly handle early microcode load
|
|
|
c59b13 |
inside a virtual machine are as follows:
|
|
|
c59b13 |
* RHEL 7.6 onwards: kernel-3.10.0-930 or newer;
|
|
|
c59b13 |
* RHEL 7.5: kernel-3.10.0-862.14.1 or newer;
|
|
|
c59b13 |
* RHEL 7.4: kernel-3.10.0-693.38.1 or newer;
|
|
|
c59b13 |
* RHEL 7.3: kernel-3.10.0-514.57.1 or newer;
|
|
|
c59b13 |
* RHEL 7.2: kernel-3.10.0-327.73.1 or newer.
|
|
|
c59b13 |
RHEL 8 kernels are not affected.
|
|
|
c59b13 |
|
|
|
c59b13 |
If you want to avoid early load of microcode for a specific kernel, please
|
|
|
c59b13 |
create "disallow-early-intel" file inside /lib/firmware/<kernel_version>
|
|
|
c59b13 |
directory and run dracut -f --kver "<kernel_version>":
|
|
|
c59b13 |
|
|
|
c59b13 |
touch /lib/firmware/3.10.0-862.9.1/disallow-intel
|
|
|
c59b13 |
/usr/libexec/microcode_ctl/update_ucode
|
|
|
c59b13 |
dracut -f --kver 3.10.0-862.9.1
|
|
|
c59b13 |
|
|
|
c59b13 |
If you want to avoid early load of microcode for all kernels, please create
|
|
|
c59b13 |
"disallow-early-intel" file inside the "/etc/microcode_ctl/ucode_with_caveats"
|
|
|
c59b13 |
directory and run dracut -f --regenerate-all:
|
|
|
c59b13 |
|
|
|
c59b13 |
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
|
c59b13 |
touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel
|
|
|
c59b13 |
dracut -f --kver 3.10.0-862.9.1
|
|
|
c59b13 |
|
|
|
c59b13 |
If you want to enforce early load of microcode for a specific kernel, please
|
|
|
c59b13 |
create "force-early-intel" file inside /lib/firmware/<kernel_version> directory
|
|
|
c59b13 |
and run dracut -f --kver "<kernel_version>":
|
|
|
c59b13 |
|
|
|
c59b13 |
modir -p/lib/firmware/3.10.0-862.9.1/
|
|
|
c59b13 |
touch /lib/firmware/3.10.0-862.9.1/force-early-intel
|
|
|
c59b13 |
dracut -f --kver 3.10.0-862.9.1
|
|
|
c59b13 |
|
|
|
c59b13 |
If you want to enforce early load of microcode for all kernels, please create
|
|
|
c59b13 |
"force-early-intel" file inside /etc/microcode_ctl/ucode_with_caveats
|
|
|
c59b13 |
directory and run dracut -f --kver "<kernel_version>":
|
|
|
c59b13 |
|
|
|
c59b13 |
mkdir -p /etc/microcode_ctl/ucode_with_caveats
|
|
|
c59b13 |
touch /etc/microcode_ctl/ucode_with_caveats/force-early-intel
|
|
|
c59b13 |
dracut -f --regenerate-all
|
|
|
c59b13 |
|
|
|
c59b13 |
In order to override late load behaviour, the "early" part of file names should
|
|
|
c59b13 |
be replaced with "late" (and there is no need to call dracut in that case).
|
|
|
c59b13 |
|
|
|
c59b13 |
|
|
|
c59b13 |
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
|
|
|
c59b13 |
information.
|