c59b13
Older RHEL 7 kernels try to early load microcode even inside virtual
c59b13
machine, which may lead to panic on some hypervisors.  In order to circumvent
c59b13
that, microcode is installed into a kernel-version-specific directory (which
c59b13
is not scanned by the dracut script, that constructs early microcode binary
c59b13
in initramfs, by default), and path to microcode files provided only in case
c59b13
initramfs is generated for the kernel version that properly handles early
c59b13
microcode inside a virtual machine (i.e. do not attempts yo load it).
c59b13
The versions of the kernel package that properly handle early microcode load
c59b13
inside a virtual machine are as follows:
c59b13
 * RHEL 7.6 onwards: kernel-3.10.0-930 or newer;
c59b13
 * RHEL 7.5: kernel-3.10.0-862.14.1 or newer;
c59b13
 * RHEL 7.4: kernel-3.10.0-693.38.1 or newer;
c59b13
 * RHEL 7.3: kernel-3.10.0-514.57.1 or newer;
c59b13
 * RHEL 7.2: kernel-3.10.0-327.73.1 or newer.
c59b13
RHEL 8 kernels are not affected.
c59b13
c59b13
If you want to avoid early load of microcode for a specific kernel, please
c59b13
create "disallow-early-intel" file inside /lib/firmware/<kernel_version>
c59b13
directory and run dracut -f --kver "<kernel_version>":
c59b13
078ac8
    touch /lib/firmware/3.10.0-862.9.1/disallow-early-intel
c59b13
    dracut -f --kver 3.10.0-862.9.1
c59b13
c59b13
If you want to avoid early load of microcode for all kernels, please create
c59b13
"disallow-early-intel" file inside the "/etc/microcode_ctl/ucode_with_caveats"
c59b13
directory and run dracut -f --regenerate-all:
c59b13
c59b13
    mkdir -p /etc/microcode_ctl/ucode_with_caveats
078ac8
    touch /etc/microcode_ctl/ucode_with_caveats/disallow-early-intel
078ac8
    dracut -f --regenerate-all
c59b13
c59b13
If you want to enforce early load of microcode for a specific kernel, please
c59b13
create "force-early-intel" file inside /lib/firmware/<kernel_version> directory
c59b13
and run dracut -f --kver "<kernel_version>":
c59b13
c59b13
    touch /lib/firmware/3.10.0-862.9.1/force-early-intel
c59b13
    dracut -f --kver 3.10.0-862.9.1
c59b13
c59b13
If you want to enforce early load of microcode for all kernels, please create
c59b13
"force-early-intel" file inside /etc/microcode_ctl/ucode_with_caveats
c59b13
directory and run dracut -f --kver "<kernel_version>":
c59b13
c59b13
    mkdir -p /etc/microcode_ctl/ucode_with_caveats
c59b13
    touch /etc/microcode_ctl/ucode_with_caveats/force-early-intel
c59b13
    dracut -f --regenerate-all
c59b13
078ac8
In order to override the late load behaviour, the "early" part of file names
078ac8
should be replaced with "late" (and there is no need to call dracut
078ac8
in that case).
c59b13
c59b13
c59b13
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
c59b13
information.