shell bypass 403
Older RHEL 7 kernels try to early load microcode even inside virtual
machine, which may lead to panic on some hypervisors. In order to circumvent
that, microcode is installed into a kernel-version-specific directory (which
is not scanned by the dracut script, that constructs early microcode binary
in initramfs, by default), and path to microcode files provided only in case
initramfs is generated for the kernel version that properly handles early
microcode inside a virtual machine (i.e. do not attempts yo load it).
The versions of the kernel package that properly handle early microcode load
inside a virtual machine are as follows:
* RHEL 7.6 onwards: kernel-3.10.0-930 or newer;
* RHEL 7.5: kernel-3.10.0-862.14.1 or newer;
* RHEL 7.4: kernel-3.10.0-693.38.1 or newer;
* RHEL 7.3: kernel-3.10.0-514.57.1 or newer;
* RHEL 7.2: kernel-3.10.0-327.73.1 or newer.
If you want to avoid early load of microcode for a specific kernel, please
create "disallow-early-intel" file inside /lib/firmware/<kernel_version>
directory and run dracut -f --kver "<kernel_version>":
touch /lib/firmware/3.10.0-862.9.1/disallow-early-intel
dracut -f --kver 3.10.0-862.9.1
If you want to avoid early load of microcode for all kernels, please create
"disallow-early-intel" file inside the "/etc/microcode_ctl/ucode_with_caveats"
directory and run dracut -f --regenerate-all:
mkdir -p /etc/microcode_ctl/ucode_with_caveats
touch /etc/microcode_ctl/ucode_with_caveats/disallow-early-intel
dracut -f --regenerate-all
If you want to enforce early load of microcode for a specific kernel, please
create "force-early-intel" file inside /lib/firmware/<kernel_version> directory
and run dracut -f --kver "<kernel_version>":
touch /lib/firmware/3.10.0-862.9.1/force-early-intel
dracut -f --kver 3.10.0-862.9.1
If you want to enforce early load of microcode for all kernels, please create
"force-early-intel" file inside /etc/microcode_ctl/ucode_with_caveats
directory and run dracut -f --kver "<kernel_version>":
mkdir -p /etc/microcode_ctl/ucode_with_caveats
touch /etc/microcode_ctl/ucode_with_caveats/force-early-intel
dracut -f --regenerate-all
In order to override the late load behaviour, the "early" part of file names
should be replaced with "late" (and there is no need to call dracut
in that case).
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
information.