From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 18FE53CDBDD for ; Tue, 30 Jun 2026 19:39:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782848378; cv=none; b=c8BtpPWjj2fsM5/5RFMPWiVZLMYXZ9tp4sXlqewj/EUKBfK/IAizcGI27bjXcjm3PgqHVTLL6hC9dGO/aWOWdrTAHQ5bHMmWxvKq0LQZGEh/BCfWNOkdDSG41J3eLE0oQQ2B4hEYCcwgYwbpn+F1a5fdz9CAdiuh09+TKRNrBnM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782848378; c=relaxed/simple; bh=8zhvckgoQClF8FiGuEgSgFV4aLz0UOsPa6WJphiSqk0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nmyV4BnS5O2PjRmgvf0ebBgLo6/Bl04UM1OxIwfvjgWD5tFPhayrIDLoIpRzFgIczr0fI3Kt9H5/HYviYWLByVvUql5/eoPbbeZ5R0MaRhniFwWzwtL09lhPL6SmpTv1zAt2Uyz78221w+KPi49fFxXxU1TekwK8CtOM1+L469U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ABi7j7au; arc=none smtp.client-ip=198.175.65.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ABi7j7au" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1782848377; x=1814384377; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=8zhvckgoQClF8FiGuEgSgFV4aLz0UOsPa6WJphiSqk0=; b=ABi7j7autuZwfHFYWm7hPS7ONle8uAiksiIjLdgFceE5ca7k8/ivtzDU SnzTOVVDB03n2kjTkYKtOBvzm9RPgJEs0LalswsYWx30Qb14ftloIsW9+ jvsOpiLEzCHRpKylWjJ0eAHr+L6EP73MBqMpxUSy1NUm4lXW/mVSJBDmI xCJFhG21kU0izidzLSItmItoihDUL5hVOl4NxCQGUu1xzHCdArNcooWhB F4NKSZNvwFh9BVUnvFBScGnkf8OTRWFgAFip8SpkkJ6jT9OzF0pnF2TIG XSXpE7KxFNRFuFo1U7D3H6DuaqrrQy+0deKV+2lbPDUnJi5UQMSb/FNgD A==; X-CSE-ConnectionGUID: 0Zq4cd9KQdClwdUW3nIkpg== X-CSE-MsgGUID: 9+MyDb3FQoWlarmPIlHzCQ== X-IronPort-AV: E=McAfee;i="6800,10657,11833"; a="83657142" X-IronPort-AV: E=Sophos;i="6.24,234,1774335600"; d="scan'208";a="83657142" Received: from orviesa002.jf.intel.com ([10.64.159.142]) by orvoesa110.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jun 2026 12:39:37 -0700 X-CSE-ConnectionGUID: B8IE8uVDSuupiAjOIKVYSQ== X-CSE-MsgGUID: fxi/bZ4KTcG1Bcp88fvSsg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,234,1774335600"; d="scan'208";a="282413640" Received: from chang-linux-3.sc.intel.com (HELO chang-linux-3) ([172.25.66.174]) by orviesa002.jf.intel.com with ESMTP; 30 Jun 2026 12:39:36 -0700 From: "Chang S. Bae" To: linux-kernel@vger.kernel.org Cc: x86@kernel.org, tglx@kernel.org, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, chang.seok.bae@intel.com Subject: [PATCH] x86/microcode/intel: Panic on partial microcode update Date: Tue, 30 Jun 2026 19:13:49 +0000 Message-ID: <20260630191350.3837-1-chang.seok.bae@intel.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The MSR IA32_MCU_STATUS, if available, may report a partial update status on a microcode update. This indicates that only a subset of microcode components was updated successfully while other parts of updates failed, which in turn leaves the system in an undefined and (potentially) unreliable state. Panic when such a fatal condition is reported, since the system can no longer be trusted to make forward progress safely. Signed-off-by: Chang S. Bae --- This patch was once considered bundled with another feature enabling (uniform). But it can stand on its own as a reliability improvement. The status is possible on newer CPUs. While validation is expected to prevent these error conditions in normal deployments, handling them explicitly protects systems against an otherwise undefined state. Considered refactoring the enumeration code was obvious enough to fold into a signle patch here. Otherwise, next revision may separate it out. --- arch/x86/include/asm/msr-index.h | 4 +++ arch/x86/kernel/cpu/microcode/intel.c | 35 +++++++++++++++++++++++++-- 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index 18c4be75e927..7273d340470d 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -977,6 +977,10 @@ #define MSR_IA32_MCU_ENUMERATION 0x0000007b #define MCU_STAGING BIT(4) +#define MSR_IA32_MCU_STATUS 0x0000007c +#define MCU_PARTIAL_UPDATE BIT(0) +#define AUTH_FAIL_ON_MCU_COMPONENT BIT(1) + #define MSR_IA32_UCODE_REV 0x0000008b /* Intel SGX Launch Enclave Public Key Hash MSRs */ diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c index f4a444e6114d..0b474a7c6986 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -76,6 +76,9 @@ static struct microcode_intel *ucode_patch_late __read_mostly; /* last level cache size per core */ static unsigned int llc_size_per_core __ro_after_init; +/* CPU capability for update status and staging support */ +static bool cpu_has_mcu __ro_after_init; + /* microcode format is extended from prescott processors */ struct extended_signature { unsigned int sig; @@ -702,6 +705,16 @@ static enum ucode_state __apply_microcode(struct ucode_cpu_info *uci, /* write microcode via MSR 0x79 */ native_wrmsrq(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); + /* Check if the update put the system in an unreliable state */ + if (cpu_has_mcu) { + u64 status = native_rdmsrq(MSR_IA32_MCU_STATUS); + + if (status & (MCU_PARTIAL_UPDATE | AUTH_FAIL_ON_MCU_COMPONENT)) { + pr_emerg("Partial update: MSR_IA32_MCU_STATUS=0x%llx\n", status); + nmi_panic(NULL, "Microcode load: fatal status from partial update"); + } + } + rev = intel_get_microcode_revision(); if (rev != mc->hdr.rev) return UCODE_ERROR; @@ -779,11 +792,30 @@ static int __init save_builtin_microcode(void) } early_initcall(save_builtin_microcode); +#define CPUID_EDX_ARCH_CAP BIT(29) + +static __init bool mcu_capable(void) +{ + if (native_cpuid_eax(0) < 7) + return false; + + if (!(native_cpuid_edx(7) & CPUID_EDX_ARCH_CAP)) + return false; + + if (!(native_rdmsrq(MSR_IA32_ARCH_CAPABILITIES) & ARCH_CAP_MCU_ENUM)) + return false; + + return true; +} + /* Load microcode on BSP from initrd or builtin blobs */ void __init load_ucode_intel_bsp(struct early_load_data *ed) { struct ucode_cpu_info uci; + /* Indicate early enough to cover the early-loading path */ + cpu_has_mcu = mcu_capable(); + uci.mc = get_microcode_blob(&uci, false); ed->old_rev = uci.cpu_sig.rev; @@ -1023,8 +1055,7 @@ static __init bool staging_available(void) { u64 val; - val = x86_read_arch_cap_msr(); - if (!(val & ARCH_CAP_MCU_ENUM)) + if (!cpu_has_mcu) return false; rdmsrq(MSR_IA32_MCU_ENUMERATION, val); -- 2.51.0