4 ms·
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs
by JdeBP 9y ago
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip, the so-called microcode, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW).
Firmware updates are largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode image file. But that is just one way for that to be done; your operating system can do it, too.
* http://inertiawar.com/microcode/ http://inertiawar.com/microcode/
* https://news.ycombinator.com/item?id=16081366 https://news.ycombinator.com/item?id=16081366
* https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... (https://news.ycombinator.com/item?id=16079910 https://news.ycombinator.com/item?id=16079910)
- frik 9y agoAs I understand the microcode updates get installed by Linux distros and Windows by updates. Microcodes are loaded by the CPU at every boot. The question is, how can one check if the CPU already got the microcode update? Can a OS running inside a VM (over Intel VT ring-1) patch the CPU's microcode? (e.g. Linux host, and Win guest patches CPU's microcode) Nothing seems impossible anymore.
- _wmd 9y agoAFAIK on Intel it's not possible to load a microcode update over the top of one already loaded by your firmware, so if the firmware shipped an older update, the firmware really needs to be updated. (Please someone correct me if this isn't the case -- I can't even remember where I read this)
- wilun 9y agoI don't think this is correct at all. I've personally seen the contrary happening. EDIT: however for some rare features, it is preferable to have them loaded by the firmware. I don't know if this is the case here.
- amluto 9y agoNope, the OS or hypervisor (but not a guest) can freely update whenever they like, as long as all the updates are to newer versions. For updates that modify visible CPU features, like these, it's helpful to apply them before boot. Linux has a mechanism to apply "early" updates from initramfs that effectively function before the kernel boots. I don't think other OSes can do that.
- davidjade 9y agoWindows, at least for right now, does not seem to be updating CPU microcode during boot. If you run the PowerShell Get-SpeculationControl script that gives you the status of the updates it states that the CVE-2017-5715 fix requires hardware support. If you don't have it you are told to get a BIOS update from your OEM. WIthout it, the status for CVE-2017-5715 is listed as not enabled due to missing hardware support. Of all of my computers only one has been issued a BIOS update so far. I ran the PowerShell script before and after installing the BIOS. Installing the BIOS flipped the status of the fix for CVE-2017-5715 to on. I also ran the free HwInfo utility that will show the microcode revision before and after installing the Windows update and before and after installing the BIOS. It only ever changed with the BIOS update. I hope this changes and Windows does start updating CPU microcode. I also have a few older motherboard's that aren't likely to ever see a BIOS update again.
- JdeBP 9y agoThe situation with Windows NT is slightly tricky, and underreported. I have pointed to this once already on this page, but it bears repeating. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
- newman314 9y agoThis appears to be my experience too. I'm checking a few VMs and they are showing as missing hw support. Do note that Microsoft appears to have updated their doc in the last day or so. They are now saying that three registry settings need to be set (instead of 2 previously). reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f Some quick Googling seems to indicate that Windows has the ability to update microcode. http://forum.notebookreview.com/threads/how-to-update-microcode-from-windows.787152/ http://forum.notebookreview.com/threads/how-to-update-microc... Maybe this will happen with a later update from Microsoft as I'm doubtful that BIOS updates will happen with at least one of my systems.
- wilun 9y agoThe microcode updates can typically be stored and loaded by the motherboard fw, though, and some OSes don't even load their own version.
- tmitchell 9y agoVMware distributes a driver[1] one can install to patch the microcode on Windows at runtime. If these updates need to be recognized before OS boot, this may not mitigate the dangers. But in my test lab, HWiNFO64 shows the current microcode version. The Intel[2] and AMD[3] microcode can be downloaded but I can't vouch for how many Meltdown/Spectre mitigations these versions contain. The Intel one is dated 2017-11-17. [1] https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver https://labs.vmware.com/flings/vmware-cpu-microcode-update-d... [2] https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File?product=873 https://downloadcenter.intel.com/download/27337/Linux-Proces... [3] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/amd-ucode https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...