6 ms·

How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when

How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly? Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://support.microsoft.com/en-us/help/936357/a-microcode-reliability-update-is-available-that-improves-the-reliabil https://support.microsoft.com/en-us/help/936357/a-microcode-...

nickysielicki 9y ago
https://wiki.debian.org/Microcode https://wiki.debian.org/Microcode The real news here is that Intel thinks they can fix this via microcode. This is surprising because initially there were some strong arguments that this wouldn't be possible.
- maltalex 9y ago
  Yeah, well, let's not break out the champagne yet. According to your link: > The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems. We still need the various manufacturers to release a BIOS version for a bunch of hardware they manufactured years ago. I'm not sure that's going to happen, at least not quickly.
  - herpderperator 9y ago
    Microcode is updated by OSes as well as BIOSes. I explained this in a previous thread: https://news.ycombinator.com/item?id=16075376 https://news.ycombinator.com/item?id=16075376
    - zerocrates 9y ago
      Microsoft is still saying that users need firmware/BIOS updates to be protected. Their messaging is at best confusing on this if they're going to apply microcode updates themselves. In the early days after disclosure at least, a BIOS/firmware update for my machine (from Dell) was required to provide the necessary hardware support for their branch target injection mitigation. As far as I can tell, that's still the case today. Perhaps they're waiting for the updates to be available for more processors before pushing an update?
  - nickysielicki 9y ago
    I think that claim is incorrect. I'd be surprised if Windows Update didn't download and load updated vendor microcode, and most Linux distributions do (or can), too. At least, I know Fedora does it by default.
    - maltalex 9y ago
      I'm sure they would if that's possible. But if microcode can only be updated by the BIOS, you'd need a BIOS update.
      - nickysielicki 9y ago
        Microcode can definitely be loaded by the OS.
    - deleted 9y ago
      [deleted]
  - chadcatlett 9y ago
    OS vendors can update the microcode when first booting the OS.
    - deleted 9y ago
      [deleted]
    - umberladder 9y ago
      Yes, I was having a poke through dmesg after today's patch to see what my venerable i7 from ~2005 said relating to KPTI. The first line of output is: [ 0.000000] microcode: CPU0 microcode updated early to revision 0x19, date = 2013-06-21 I think the rest of the cores get updated a bit later in the process.
  - rob-olmos 9y ago
    Like others have said typically the microcode update is applied by both the BIOS and kernel. Typically the kernel has the latest microcode. However, there could be an issue where updating the microcode at kernel time can cause an issue due to a microcode version (or lack of) from the BIOS. Only other thing I could think of is the microcode update that disables TSX, I believe, could only disable it if TSX wasn't used yet. So I suppose it's also possible that the microcode has to be updated by the BIOS because some boot process prevents the kernel from being effective with its microcode update step.
- puzzle 9y ago
  I think it's more accurate to say that they believe they can fix this with a combination of SW + microcode. The microcode is a sort of HW assist for the new defensive measures. If you don't also update kernels, the new microcode is useless.
- noselasd 9y ago
  Those strong arguments were not coming from Intel. To me it's more surprising that someone not involved in the design of Intel CPUs can state what Intel can and can not do - after all, not that long ago people didn't even know the Intel CPUs ran a version of Minix (the Intel ME)
donaldihunter 9y ago
Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301 https://access.redhat.com/articles/3311301
- JumpCrisscross 9y ago
  > Very disingenuous of Intel tho This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable. Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about? Textbook case of PR and IR incompetence.
  - jacquesm 9y ago
    Well, they may have been more honest than they intended to be when they said that the CPUs were operating ´as designed´. Tinfoil hat stuff.
  - BuildTheRobots 9y ago
    As much as I hate to say it, I think the Intel PR machine is working stunningly. Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..." I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.
    - jayflux 9y ago
      Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.
Keyframe 9y ago
Unlikely, but maybe intel has some fuses inside a chip as well?
paulmd 9y ago
> How does one patch a CPU? Microcode updates that enable or disable various feature flags or patch the microcode used to interpret specific instructions from the outside CISC world to the native RISC world that all modern x86 processors use. In terms of deployment, there is support for OSs to deploy microcode from Ring 0 each time the system boots, or the permanent fix is a new UEFI that includes the new microcode at system init.

nickysielicki 9y ago

https://wiki.debian.org/Microcode https://wiki.debian.org/Microcode The real news here is that Intel thinks they can fix this via microcode. This is surprising because initially there were some strong arguments that this wouldn't be possible.

maltalex 9y ago
Yeah, well, let's not break out the champagne yet. According to your link: > The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems. We still need the various manufacturers to release a BIOS version for a bunch of hardware they manufactured years ago. I'm not sure that's going to happen, at least not quickly.
- herpderperator 9y ago
  Microcode is updated by OSes as well as BIOSes. I explained this in a previous thread: https://news.ycombinator.com/item?id=16075376 https://news.ycombinator.com/item?id=16075376
  - zerocrates 9y ago
    Microsoft is still saying that users need firmware/BIOS updates to be protected. Their messaging is at best confusing on this if they're going to apply microcode updates themselves. In the early days after disclosure at least, a BIOS/firmware update for my machine (from Dell) was required to provide the necessary hardware support for their branch target injection mitigation. As far as I can tell, that's still the case today. Perhaps they're waiting for the updates to be available for more processors before pushing an update?
- nickysielicki 9y ago
  I think that claim is incorrect. I'd be surprised if Windows Update didn't download and load updated vendor microcode, and most Linux distributions do (or can), too. At least, I know Fedora does it by default.
  - maltalex 9y ago
    I'm sure they would if that's possible. But if microcode can only be updated by the BIOS, you'd need a BIOS update.
    - nickysielicki 9y ago
      Microcode can definitely be loaded by the OS.
  - deleted 9y ago
    [deleted]
- chadcatlett 9y ago
  OS vendors can update the microcode when first booting the OS.
  - deleted 9y ago
    [deleted]
  - umberladder 9y ago
    Yes, I was having a poke through dmesg after today's patch to see what my venerable i7 from ~2005 said relating to KPTI. The first line of output is: [ 0.000000] microcode: CPU0 microcode updated early to revision 0x19, date = 2013-06-21 I think the rest of the cores get updated a bit later in the process.
- rob-olmos 9y ago
  Like others have said typically the microcode update is applied by both the BIOS and kernel. Typically the kernel has the latest microcode. However, there could be an issue where updating the microcode at kernel time can cause an issue due to a microcode version (or lack of) from the BIOS. Only other thing I could think of is the microcode update that disables TSX, I believe, could only disable it if TSX wasn't used yet. So I suppose it's also possible that the microcode has to be updated by the BIOS because some boot process prevents the kernel from being effective with its microcode update step.
puzzle 9y ago
I think it's more accurate to say that they believe they can fix this with a combination of SW + microcode. The microcode is a sort of HW assist for the new defensive measures. If you don't also update kernels, the new microcode is useless.
noselasd 9y ago
Those strong arguments were not coming from Intel. To me it's more surprising that someone not involved in the design of Intel CPUs can state what Intel can and can not do - after all, not that long ago people didn't even know the Intel CPUs ran a version of Minix (the Intel ME)

donaldihunter 9y ago

Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301 https://access.redhat.com/articles/3311301

JumpCrisscross 9y ago
> Very disingenuous of Intel tho This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable. Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about? Textbook case of PR and IR incompetence.
- jacquesm 9y ago
  Well, they may have been more honest than they intended to be when they said that the CPUs were operating ´as designed´. Tinfoil hat stuff.
- BuildTheRobots 9y ago
  As much as I hate to say it, I think the Intel PR machine is working stunningly. Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..." I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.
  - jayflux 9y ago
    Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.

Keyframe 9y ago

Unlikely, but maybe intel has some fuses inside a chip as well?

paulmd 9y ago

> How does one patch a CPU? Microcode updates that enable or disable various feature flags or patch the microcode used to interpret specific instructions from the outside CISC world to the native RISC world that all modern x86 processors use. In terms of deployment, there is support for OSs to deploy microcode from Ring 0 each time the system boots, or the permanent fix is a new UEFI that includes the new microcode at system init.