/usr/share/doc/microcode_ctl/caveats/
/usr/share/doc/microcode_ctl/caveats
NameSizeModeActions
06-2d-07_readme29780644editdlrm
06-4e-03_readme47310644editdlrm
06-4f-01_readme39480644editdlrm
06-5e-03_readme47790644editdlrm
06-8c-01_readme35930644editdlrm
06-8e-9e-0x-0xca_readme125470644editdlrm
06-8e-9e-0x-dell_readme125350644editdlrm
06-8f-08_readme21710644editdlrm
06-55-04_readme54500644editdlrm
intel_readme24610644editdlrm
Edit: /usr/share/doc/microcode_ctl/caveats/06-8c-01_readme (3593B)
Some Intel Tiger Lake-UP3/UP4 CPU models (TGL, family 6, model 140, stepping 1) had reports of system hangs when a microcode update, that was included since microcode-20201110 update, was applied[1]. In order to address this, microcode update had been disabled by default on these systems. The revision 0x88 seems to have fixed the aforementioned issue, hence it is enabled by default (but can be disabled explicitly; see below). [1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/44 For the reference, SHA1 checksums of 06-8c-01 microcode files containing microcode revisions in question are listed below: * 06-8c-01, revision 0x68: 2204a6dee1688980cd228268fdf4b6ed5904fe04 * 06-8c-01, revision 0x88: 61b6590feb2769046d5b0c394179beaf2df51290 * 06-8c-01, revision 0x9a: 48b3ae8d27d8138b5b47052d2f8184bf555ad18e * 06-8c-01, revision 0xa4: 70753f54f5be84376bdebeb710595e4dc2f6d92f * 06-8c-01, revision 0xa6: fdcf89e3a15a20df8aeee215b78bf5d13d731044 * 06-8c-01, revision 0xaa: cf84883f6b3184690c25ccade0b10fa839ac8657 * 06-8c-01, revision 0xac: b9f342e564a0be372ed1f4709263bf811feb022a * 06-8c-01, revision 0xb4: 6596bb8696cde85538bb833d090f0b7a42d6ae14 * 06-8c-01, revision 0xb6: 76556e8248a89f38cd55a6c83dccc995ba176091 * 06-8c-01, revision 0xb8: 6e9b138d1db2934479b179af4a3a19e843c4b4e4 * 06-8c-01, revision 0xbc: 7d529358aaf77df57c122db0b2eceb03989ea9ce Please contact your system vendor for a BIOS/firmware update that contains the latest microcode version. For the information regarding microcode versions required for mitigating specific side-channel cache attacks, please refer to the following knowledge base articles: * CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface), CVE-2020-8696 (Vector Register Leakage-Active), CVE-2020-8698 (Fast Forward Store Predictor): https://access.redhat.com/articles/5569051 * CVE-2020-24489 (VT-d-related Privilege Escalation), CVE-2020-24511 (Improper Isolation of Shared Resources), CVE-2020-24512 (Observable Timing Discrepancy), CVE-2020-24513 (Information Disclosure on Some Intel Atom Processors): https://access.redhat.com/articles/6101171 * CVE-2021-0145 (Fast store forward predictor - Cross Domain Training): https://access.redhat.com/articles/6716541 * CVE-2022-21123 (Shared Buffers Data Read): https://access.redhat.com/articles/6963124 The information regarding disabling microcode update is provided below. To disable 06-8c-01 microcode updates for a specific kernel version, please create a file "disallow-intel-06-8c-01" inside /lib/firmware/ directory, run "/usr/libexec/microcode_ctl/update_ucode" to remove it from the firmware directory where microcode is available for late microcode update, and run "dracut -f --kver ", so initramfs for this kernel version is regenerated, for example: touch /lib/firmware/3.10.0-862.9.1/disallow-intel-06-8c-01 /usr/libexec/microcode_ctl/update_ucode dracut -f --kver 3.10.0-862.9.1 To avoid addition of this microcode for all kernels, please create file "/etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-8c-01", run "/usr/libexec/microcode_ctl/update_ucode" for late microcode updates, and "dracut -f --regenerate-all" for early microcode updates: mkdir -p /etc/microcode_ctl/ucode_with_caveats touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-8c-01 /usr/libexec/microcode_ctl/update_ucode dracut -f --regenerate-all Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional information.