관리-도구

편집 파일: readme-intel-06-8c-01

Some Intel Tiger Lake-UP3/UP4 CPU models (TGL, family 6, model 140, stepping 1) had reports of system hangs when a microcode update, that was included since microcode-20201110 update, was applied[1]. In order to address this, microcode update had been disabled by default on these systems. The revision 0x88 seems to have fixed the aforementioned issue, hence it is enabled by default (but can be disabled explicitly; see below). [1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/44 For the reference, SHA1 checksums of 06-8c-01 microcode files containing microcode revisions in question are listed below: * 06-8c-01, revision 0x68: 2204a6dee1688980cd228268fdf4b6ed5904fe04 * 06-8c-01, revision 0x88: 61b6590feb2769046d5b0c394179beaf2df51290 * 06-8c-01, revision 0x9a: 48b3ae8d27d8138b5b47052d2f8184bf555ad18e * 06-8c-01, revision 0xa4: 70753f54f5be84376bdebeb710595e4dc2f6d92f * 06-8c-01, revision 0xa6: fdcf89e3a15a20df8aeee215b78bf5d13d731044 * 06-8c-01, revision 0xaa: cf84883f6b3184690c25ccade0b10fa839ac8657 * 06-8c-01, revision 0xac: b9f342e564a0be372ed1f4709263bf811feb022a * 06-8c-01, revision 0xb4: 6596bb8696cde85538bb833d090f0b7a42d6ae14 * 06-8c-01, revision 0xb6: 76556e8248a89f38cd55a6c83dccc995ba176091 * 06-8c-01, revision 0xb8: 6e9b138d1db2934479b179af4a3a19e843c4b4e4 Please contact your system vendor for a BIOS/firmware update that contains the latest microcode version. For the information regarding microcode versions required for mitigating specific side-channel cache attacks, please refer to the following knowledge base articles: * CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface), CVE-2020-8696 (Vector Register Leakage-Active), CVE-2020-8698 (Fast Forward Store Predictor): https://access.redhat.com/articles/5569051 * CVE-2020-24489 (VT-d-related Privilege Escalation), CVE-2020-24511 (Improper Isolation of Shared Resources), CVE-2020-24512 (Observable Timing Discrepancy), CVE-2020-24513 (Information Disclosure on Some Intel Atom Processors): https://access.redhat.com/articles/6101171 * CVE-2021-0145 (Fast store forward predictor - Cross Domain Training): https://access.redhat.com/articles/6716541 * CVE-2022-21123 (Shared Buffers Data Read): https://access.redhat.com/articles/6963124 The information regarding disabling microcode update is provided below. To disable 06-8c-01 microcode updates for a specific kernel version, please create a file "disallow-intel-06-8c-01" inside /lib/firmware/<kernel_version> directory, run "/usr/libexec/microcode_ctl/update_ucode" to remove it from the firmware directory where microcode is available for late microcode update, and run "dracut -f --kver <kernel_version>", so initramfs for this kernel version is regenerated, for example: touch /lib/firmware/3.10.0-862.9.1/disallow-intel-06-8c-01 /usr/libexec/microcode_ctl/update_ucode dracut -f --kver 3.10.0-862.9.1 To avoid addition of this microcode for all kernels, please create file "/etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-8c-01", run "/usr/libexec/microcode_ctl/update_ucode" for late microcode updates, and "dracut -f --regenerate-all" for early microcode updates: mkdir -p /etc/microcode_ctl/ucode_with_caveats touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-8c-01 /usr/libexec/microcode_ctl/update_ucode dracut -f --regenerate-all Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional information.