@ -41,7 +45,7 @@ After that, it is possible to perform a late microcode update by executing
@@ -41,7 +45,7 @@ After that, it is possible to perform a late microcode update by executing
"/usr/libexec/microcode_ctl/reload_microcode" or by writing value "1" to
@ -159,6 +159,49 @@ separated by white space. Currently, the following options are supported:
@@ -159,6 +159,49 @@ separated by white space. Currently, the following options are supported:
one model name per line. The model name of the running CPU (as reported
in /proc/cpuinfo) is compared against the names in the provided list, and,
if there is a match, caveat check fails.
* "pci_config_val" performs check for specific values in selected parts
of configuration space of specified PCI devices. If "-m" option
is not specified, then the actual check is skipped, and the check returns
result in accordance with the provided "mode" option (se below). Check
arguments are a white-space-separated list of "key=value" pairs.
The following keys are supported:
* "domain" - PCI domain number, or "*" (an asterisk) for any domain.
Default is "*".
* "bus" - PCI bus number, or "*" (an asterisk) for any bus. Default is "*".
* "device" - PCI device number, or "*" (an asterisk) for any device.
Default is "*".
* "function" - PCI function number, or "*" (an asterisk) for any function.
Default is "*".
* "vid" - PCI vendor ID, or empty string for any vendor ID. Default
is empty string.
* "did" - PCI device ID, or empty string for any device ID. Default
is empty string.
* "offset" - offset in device's configuration space where the value resides.
Default is 0.
* "size" - field size. Possible values are 1, 2, 4, or 8. Default is 4.
* "mask" - mask applied to the values during the check. Default is 0.
* "val" - comma-separated list of matching values. Default is 0.
* "mode" - check mode, the way matches are interpreted:
* "success-any" - check succeeds if there was at least one match,
otherwise it fails.
* "success-all" - check succeeds if there was at least one device checked
and all the checked devices have matches, otherwise the check fails.
* "fail-any" - check fails if there was at least one match, otherwise
it succeeds.
* "fail-all" - check fails if there was at least one device checked
and all the checked devices have matches, otherwise the check succeeds.
It interprets 4 bytes at offset 0x84 of special files "config" under
directories that match glob pattern "/sys/bus/pci/devices/*:*:1e.3"
as an unsigned integer value, applies mask 0x38 (thus selecting bit 5..3
of it) and checks whether it is one of the values 0x38, 0x18, or 0x8 (0b111,
0b011, or 0b001 in bits 5..3, respectively); if there are such files,
and all the checked values in every checked file has matched at least one
of the aforementioned value, then the check is successful, otherwise
it fails (in accordance with "mode=success-all" semantics). This check fails
if "-m" option is not specified.
check_caveats script
@ -342,10 +385,6 @@ by creation of a file "/etc/microcode_ctl/ignore-hypervisor-flag".
@@ -342,10 +385,6 @@ by creation of a file "/etc/microcode_ctl/ignore-hypervisor-flag".
The script has no options and always returns 0.
In addition to overrides that affect check_caveats, the presence of the
"/etc/microcode_ctl/ignore-hypervisor-flag" flag provides an ability
to skip "hypervisor" flag check.
99microcode_ctl-fw_dir_override dracut module
---------------------------------------------
@ -392,9 +431,11 @@ when a microcode update performed on a kernel that contains those changes.
@@ -392,9 +431,11 @@ when a microcode update performed on a kernel that contains those changes.
As a result, microcode update for this CPU model is disabled by default;
the microcode file, however, is still shipped as a part of microcode_ctl
package and can be used for performing a microcode update if it is enforced
via the aforementioned overriddes. (See sections "check_caveats script"
via the aforementioned overrides. (See the sections "check_caveats script"
and "reload_microcode script" for details.)
Caveat name: intel-06-4f-01
Affected microcode: intel-ucode/06-4f-01.
Mitigation: microcode loading is disabled for the affected CPU model.
@ -421,9 +462,12 @@ from a cpio archive placed at the beginning of the initramfs image. However,
@@ -421,9 +462,12 @@ from a cpio archive placed at the beginning of the initramfs image. However,
when an early microcode update is attempted inside some virtualised
environments, that may result in unexpected system behaviour.
Caveat name: intel
Affected microcode: all.
Mitigation: early microcode loading is disabled for all CPU models.
Mitigation: early microcode loading is disabled for all CPU models on kernels
without the fix.
Minimum versions of the kernel package that contain the fix:
- Upstream/RHEL 8: 4.10.0
@ -437,18 +481,45 @@ Minimum versions of the kernel package that contain the fix:
@@ -437,18 +481,45 @@ Minimum versions of the kernel package that contain the fix:
Intel Sandy Bridge-E/EN/EP caveat
---------------------------------
MDS-related microcode revision 0x718 for Intel Sandy Bridge-E/EN/EP
(SNB-EP, family 6, model 45, stepping 7) may lead to system instability.
(SNB-EP, family 6, model 45, stepping 7) may lead to system instability[1][2].
In order to address this, this microcode update is not used and the previous
microcode revision is provided instead by default; the microcode file, however,
is still shipped as part of microcode_ctl package and can be used for performing
a microcode update if it is enforced via the aforementioned overriddes. (See
sections "check_caveats script" and "reload_microcode script" for details.)
a microcode update if it is enforced via the aforementioned overrides. (See
the sections "check_caveats script" and "reload_microcode script" for details.)
Mitigation: previously published microcode revision 0x2000064 is used
by default.
Additional information
======================
@ -458,8 +529,7 @@ whether more recent BIOS/firmware updates are recommended because additional
@@ -458,8 +529,7 @@ whether more recent BIOS/firmware updates are recommended because additional
improvements may be available.
Information regarding microcode revisions required for mitigating specific
microarchitectural side-channel attacks is available in the following
knowledge base articles:
Intel CPU vulnerabilities is available in the following knowledge base articles:
* CVE-2017-5715 ("Spectre"):
https://access.redhat.com/articles/3436091
* CVE-2018-3639 ("Speculative Store Bypass"):
@ -469,3 +539,8 @@ knowledge base articles:
@@ -469,3 +539,8 @@ knowledge base articles:
* CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091
# Generator of RPM "Provides:" tags for Intel microcode files.
#
@ -21,31 +21,75 @@ for f in $(grep -E '/intel-ucode.*/[0-9a-f][0-9a-f]-[0-9a-f][0-9a-f]-[0-9a-f][0-
@@ -21,31 +21,75 @@ for f in $(grep -E '/intel-ucode.*/[0-9a-f][0-9a-f]-[0-9a-f][0-9a-f]-[0-9a-f][0-
basebuilder_pel7x64builder0
4 years ago