Re: [PATCH] x86/microcode/intel: Panic on partial microcode update

[Chang S. Bae]

On 7/19/2026 8:52 AM, Dave Hansen wrote:
> Chang, have you seen anything at all in the specs or from our Intel
> colleagues that makes you think that it's _dangerous_ to keep running
> rather than killing the system as soon as possible?


I double-checked with the microcode guy, and here are what I heard so far:

 * The microcode implementation makes best effort to avoid partial
   updates in the first place
 * If an update leaves any critical state, e.g. data corruption and
   serious security breach, the processor will terminate execution
   rather than relying on the OS to take action.
 * That said, no implementation can perfectly cover every possible case.
   At the same time, panicking on every partial update could be also an
   overkill. It will depend on the specific failure condition in detail.

Then, they've defined those bits seemingly intended to summary the 
condition at abstraction.

I think the first two points have played in this thread already. There 
seems to be some caution, specifically around the authentication-failure 
as per spec. Perhaps it might be reassuring if handling that case 
conservatively (unless too much complicated).

In summary, I think options are:

 1. Panic on any partial update is the most conservative and secure
    option, but it may unnecessarily disrupt systems and users
 2. Warn admins that the system has entered a taint state, assuming the
    processor handles truly unrecoverable cases itself.
 3. Different reactions - for example, panic on an authentication
    failure but warn/taint otherwise.

Thanks,
Chang