4 ms·

I am curious how the BIOS/Firmware updates will be managed. Microsoft points to manufacturer. Manufacturer may 1) not be in the consumer personal computer marke

I am curious how the BIOS/Firmware updates will be managed. Microsoft points to manufacturer. Manufacturer may 1) not be in the consumer personal computer market, or 2) even if the manufacturer is still in the business of selling computers may no longer be supporting specific devices. I'm specifically thinking of Toshiba, but there may be other examples out there. Ideally there will be a way to safely update BIOS/firmware directly from Intel.

dogma1138 9y ago
You don't need to wait for a BIOS update. On Linux download the microcode and update it manually. On Windows use the VMware Microcode installer and download the microcode from Intel and use that to update the Microcode on your machine. On Windows you'll need to edit cpumcupdate.inf to remove the AMD microcode files if you don't want to download the microcode from both vendors since the VMware tool needs both to work properly. Microcode update from Intel: https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?v=t https://downloadcenter.intel.com/download/27431/Linux-Proces... VMware Microcode Installer: https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver https://labs.vmware.com/flings/vmware-cpu-microcode-update-d...
- rabboRubble 9y ago
  Helpful about the VMware trick. That's new by me... I had been looking at Intel's online driver support assistant with the idea that my machine's cpu update would be available via this service. https://www.intel.com/content/www/us/en/support/intel-driver-support-assistant.html https://www.intel.com/content/www/us/en/support/intel-driver... One note, I did not exactly explain my concerns adequately. By "safe" I meant "tested to not brick a specific model computer". With enough poking about online, eventually I would figure out where and how to update the firmware. I don't however have a test machine on which I could verify the firmware update safe. My laptop is very slightly out of the vendor support window so I'll be doing the update without any vendor support whatsoever.
- biaachmonkie 9y ago
  I tried this and have the driver installed and the Get-SpeculationControlSettings Powershell module reports hardware support now. But I can't get windows to enable support, I've tried setting the registry keys in the referenced KB article https://support.microsoft.com/help/4073119 https://support.microsoft.com/help/4073119 I suspect that the driver loads to late, that windows has already done it's check to enable support before the driver loads the microcode update and I can't find anything about re-running the check or anyway to load the driver before that check. Output from Get-SpeculationControlSettings Powershell module --- Speculation control settings for CVE-2017-5715 [branch target injection] Hardware support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is enabled: False Windows OS support for branch target injection mitigation is disabled by system policy: False Windows OS support for branch target injection mitigation is disabled by absence of hardware support: False Speculation control settings for CVE-2017-5754 [rogue data cache load] Hardware requires kernel VA shadowing: True Windows OS support for kernel VA shadow is present: True Windows OS support for kernel VA shadow is enabled: True Windows OS support for PCID performance optimization is enabled: True [not required for security] Suggested actions * Follow the guidance for enabling Windows Client support for speculation control mitigations described in https://support.microsoft.com/help/4073119 BTIHardwarePresent : True BTIWindowsSupportPresent : True BTIWindowsSupportEnabled : False BTIDisabledBySystemPolicy : False BTIDisabledByNoHardwareSupport : False KVAShadowRequired : True KVAShadowWindowsSupportPresent : True KVAShadowWindowsSupportEnabled : True KVAShadowPcidEnabled : True
  - dogma1138 9y ago
    That is strange what CPU/OS combo? this worked on my desktop and laptop, try rolling back the Jan 2018 update and then push it again with the new microcode there shouldn't be any difference the OS reads the microcode either from it's own partition or from the UEFI partition (BIOS) which ever is newer is used.

dogma1138 9y ago

You don't need to wait for a BIOS update. On Linux download the microcode and update it manually. On Windows use the VMware Microcode installer and download the microcode from Intel and use that to update the Microcode on your machine. On Windows you'll need to edit cpumcupdate.inf to remove the AMD microcode files if you don't want to download the microcode from both vendors since the VMware tool needs both to work properly. Microcode update from Intel: https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?v=t https://downloadcenter.intel.com/download/27431/Linux-Proces... VMware Microcode Installer: https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver https://labs.vmware.com/flings/vmware-cpu-microcode-update-d...

rabboRubble 9y ago
Helpful about the VMware trick. That's new by me... I had been looking at Intel's online driver support assistant with the idea that my machine's cpu update would be available via this service. https://www.intel.com/content/www/us/en/support/intel-driver-support-assistant.html https://www.intel.com/content/www/us/en/support/intel-driver... One note, I did not exactly explain my concerns adequately. By "safe" I meant "tested to not brick a specific model computer". With enough poking about online, eventually I would figure out where and how to update the firmware. I don't however have a test machine on which I could verify the firmware update safe. My laptop is very slightly out of the vendor support window so I'll be doing the update without any vendor support whatsoever.
biaachmonkie 9y ago
I tried this and have the driver installed and the Get-SpeculationControlSettings Powershell module reports hardware support now. But I can't get windows to enable support, I've tried setting the registry keys in the referenced KB article https://support.microsoft.com/help/4073119 https://support.microsoft.com/help/4073119 I suspect that the driver loads to late, that windows has already done it's check to enable support before the driver loads the microcode update and I can't find anything about re-running the check or anyway to load the driver before that check. Output from Get-SpeculationControlSettings Powershell module --- Speculation control settings for CVE-2017-5715 [branch target injection] Hardware support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is enabled: False Windows OS support for branch target injection mitigation is disabled by system policy: False Windows OS support for branch target injection mitigation is disabled by absence of hardware support: False Speculation control settings for CVE-2017-5754 [rogue data cache load] Hardware requires kernel VA shadowing: True Windows OS support for kernel VA shadow is present: True Windows OS support for kernel VA shadow is enabled: True Windows OS support for PCID performance optimization is enabled: True [not required for security] Suggested actions * Follow the guidance for enabling Windows Client support for speculation control mitigations described in https://support.microsoft.com/help/4073119 BTIHardwarePresent : True BTIWindowsSupportPresent : True BTIWindowsSupportEnabled : False BTIDisabledBySystemPolicy : False BTIDisabledByNoHardwareSupport : False KVAShadowRequired : True KVAShadowWindowsSupportPresent : True KVAShadowWindowsSupportEnabled : True KVAShadowPcidEnabled : True
- dogma1138 9y ago
  That is strange what CPU/OS combo? this worked on my desktop and laptop, try rolling back the Jan 2018 update and then push it again with the new microcode there shouldn't be any difference the OS reads the microcode either from it's own partition or from the UEFI partition (BIOS) which ever is newer is used.