Latest microcode updates for Intel Skylake/Cascade Lake Scalable Platform CPUs

(family 6, model 85, steppings 4, 6, and 7; CPUID 0x50654/0x50656/0x50657)

may cause system instability on some systems, namely, HPE Superdome Flex

and Supermicro systems, when an update is performed with the resivions

that come with microcode-20201110 release, so the previously released microcode

(with revisions 0x2006906, 0x4001f01, and 0x5002f01, respectively)

from microcode-20200609 release are used on these systems by default instead

for the OS-driven microcode update.

For the reference, SHA1 checksums of the relevant microcode files containing

microcode revisions in question are listed below:

 * 06-55-04, revision 0x2006906: 5f18f985f6d5ad369b5f6549b7f3ee55acaef967

 * 06-55-04, revision 0x2006a08: 4059fb1f60370297454177f63cd7cc20b3fa1212

 * 06-55-06, revision 0x4004f01: 8affd949151a0badd3f71e23cf9ad668d4c1d82f

 * 06-55-06, revision 0x4003003: b187866d2570f90ea69f434c2b012a8c88d85f43

 * 06-55-07, revision 0x5002f01: a7121c5f49753cc783f82135e268bc4efe85d4be

 * 06-55-07, revision 0x5003003: 74e129b108e676f0286742f609b2c1fa65d73db1

Please contact your system vendor for a BIOS/firmware update that contains

the latest microcode version.  For the information regarding microcode versions

required for mitigating specific side-channel cache attacks, please refer

to the following knowledge base articles:

 * CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface),

   CVE-2020-8696 (Vector Register Leakage-Active),

   CVE-2020-8698 (Fast Forward Store Predictor):

   https://access.redhat.com/articles/5569051

The information regarding enforcing microcode update is provided below.

To enforce usage of the latest microcode revision for a specific kernel

version, please create a file "force-intel-06-55-0x-ipu-2020.2" inside

/lib/firmware/<kernel_version> directory, run

"/usr/libexec/microcode_ctl/update_ucode" to add it to firmware directory

where microcode will be available for late microcode update, and run

"dracut -f --kver <kernel_version>", so initramfs for this kernel version

is regenerated and the microcode can be loaded early, for example:

    touch /lib/firmware/3.10.0-862.9.1/force-intel-06-55-0x-ipu-2020.2

    /usr/libexec/microcode_ctl/update_ucode

    dracut -f --kver 3.10.0-862.9.1

After that, it is possible to perform a late microcode update by executing

"/usr/libexec/microcode_ctl/reload_microcode" or by writing value "1" to

"/sys/devices/system/cpu/microcode/reload" directly.

To disallow usage of the latest microcode revision for a specific kernel

version, please create a file "disallow-intel-06-55-0x-ipu-2020.2" inside

/lib/firmware/<kernel_version> directory, run

"/usr/libexec/microcode_ctl/update_ucode" to update firmware directory

used for late microcode updates, and run "dracut -f --kver <kernel_version>",

so initramfs for this kernel version is regenerated, for example:

    touch /lib/firmware/3.10.0-862.9.1/disallow-intel-06-55-0x-ipu-2020.2

    /usr/libexec/microcode_ctl/update_ucode

    dracut -f --kver 3.10.0-862.9.1

To enforce addition of this microcode for all kernels, please create a file

"/etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2", run

"/usr/libexec/microcode_ctl/update_ucode" for enabling late microcode updates,

and "dracut -f --regenerate-all" for enabling early microcode updates:

    mkdir -p /etc/microcode_ctl/ucode_with_caveats

    touch /etc/microcode_ctl/ucode_with_caveats/force-intel-06-55-0x-ipu-2020.2

    /usr/libexec/microcode_ctl/update_ucode

    dracut -f --regenerate-all

To disallow usage of the latest microcode revision for all kernels, please

create a file

"/etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2",

run "/usr/libexec/microcode_ctl/update_ucode" to update firmware directories

used for late microcode updates, and run "dracut -f --regenerate-all"

so initramfs images get regenerated, for example:

    mkdir -p /etc/microcode_ctl/ucode_with_caveats

    touch /etc/microcode_ctl/ucode_with_caveats/disallow-intel-06-55-0x-ipu-2020.2

    /usr/libexec/microcode_ctl/update_ucode

    dracut -f --regenerate-all

Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional

information.