How does a firmware update help in mitigating Meltdown and Spectre vulnerabilities?

Is it true that vendors are only releasing a firmware update for the windows platform? What about Linux?

I believed that firmware updates provided a new version of the BIOS. But, how BIOS is related to features like speculative execution of processors?



It isn't.

The updates that need to happen are microcode updates. Microcode is code that runs inside your central processor itself, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW).

Firmware updates are in fact largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode, from a binary image that is embedded into the firmware image.

But that is just one way for that to be done; your operating system can do it, too. There is nothing special about the machine instruction that triggers a microcode update that restricts its execution to just your machine firmware.

Further reading

  • So, can we say that the firmware updates by vendors like hp, dell, etc. to mitigate meltdown contains the microcodes updates done by intel ? – nuggets Jan 13 '18 at 8:40
  • 1
    Yes. Note that the microcode update adds a feature to the processor that is (supposedly) helpful in mitigating the Spectre Variant 2; however it looks like the first microcode version with that feature caused problems to some systems. Also, the suggested Linux patches from Intel that actually use the new feature caused a "spirited discussion" among the Linux kernel devs. Looks like the devs are finding a solution that can achieve Spectre mitigation with better performance than the firmware feature, at least for non-Skylake CPUs. – telcoM Jan 30 '18 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.