Re: [PATCH] x86/microcode/intel: Panic on partial microcode update

["Chang S. Bae" <chang.seok.bae@intel.com>]

On 6/30/2026 2:47 PM, Dave Hansen wrote:
> 
> I mean, the ucode update guys themselves could definitely have reset the
> system if it needed to. They also know when it is dangerous to keep the
> CPU running. They obviously don't think that this partial update thing
> is *THAT* dangerous or they wouldn't have even let the CPU keep
> churning. Right?


A revision of the spec doc adds some description of the severity, which 
looks worth referencing here for the review / decision.

Spec - https://cdrdv2.intel.com/v1/dl/getContent/782715

There are two bits in MSR_IA32_MCU_STATUS:

  * Bit 0 indicates a partial update occured
  * Bit 1 indicates authentication failed _after_ the update was
    committed and the revision ID was updated.

Section 2.7 summarizes the implications:

+----------------+----------------+--------------------------+
| partial update | authentication | note / recommendation    |
+----------------+----------------+--------------------------+
| no             | fail           | impossible               |
|----------------+----------------+--------------------------|
| yes            | success        | log the error            |
|----------------+----------------+--------------------------|
| yes            | fail           | raise a fatal error      |
+----------------+----------------+--------------------------+

It could be an option to handle those cases separately. But yes, a sane 
ucode can escalate an unrecoverable condition via #MC. I'll revise V2 to 
simply taint the kernel (TAINT_WARN) on any of those.

Thanks,
Chang