Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly?
Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://support.microsoft.com/en-us/help/936357/a-microcode-...
EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301
This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable.
Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about?
Textbook case of PR and IR incompetence.
Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..."
I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.
My take on it is that non-tech savvy people are now largely desensitized to any vulnerability discovery, as long as it hasn't been exploited in the wild. Computers have bugs? What's new?
Intel's PR, good or bad, doesn't matter that much.
Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users.
1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are now countless breaches of data. The damage from Meltdown/Spectre is somewhat theoretical at this point whereas the data breaches have led to real fraud against countless individuals and business.
2. Even recent OS versions have large numbers of security bugs--see Greg Kroah-Hartmann's comments on obsolete kernels for specific Linux examples. [1]
3. State actors ranging from the US to North Korea have well-funded operations to steal or corrupt data. If they really want your data they will probably get it even if Meltdown/Spectre had not been discovered.
Finally it's only fair to point out that some of the claims of Intel being disingenuous on the august Hacker News forum [2] turned out to be overblown--other processors are subject to some of the same problems and many users will not notice much difference in the patched systems.
[0] https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac...
No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
With that in mind, and assuming computer hardware is still being tossed away after such short times of usage (I'd wager PC hardware is used more, but mobile phones are still being tossed like candy paper), I wonder if any IBM clones ever reached North Korean soil. If North Korea speculated on Bitcoins, which they supposedly did (with which computers?), they got some nice income out of that as well. Or would you recon this is all done outside of NK borders e.g. by spies?
Intel is being very disingenuous when they say "contact your OEM/vendor for microcode updates". In consumer reality, vendors mostly won't provide updates, and even if they do, consumers won't install them.
The only practical way to deliver microcode updates to Windows users is through Windows Update, so the real question is when these will make their way to Windows Update.
The real news here is that Intel thinks they can fix this via microcode. This is surprising because initially there were some strong arguments that this wouldn't be possible.
> The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems.
We still need the various manufacturers to release a BIOS version for a bunch of hardware they manufactured years ago. I'm not sure that's going to happen, at least not quickly.
[ 0.000000] microcode: CPU0 microcode updated early to revision 0x19, date = 2013-06-21
I think the rest of the cores get updated a bit later in the process.
In the early days after disclosure at least, a BIOS/firmware update for my machine (from Dell) was required to provide the necessary hardware support for their branch target injection mitigation. As far as I can tell, that's still the case today.
Perhaps they're waiting for the updates to be available for more processors before pushing an update?
However, there could be an issue where updating the microcode at kernel time can cause an issue due to a microcode version (or lack of) from the BIOS.
Only other thing I could think of is the microcode update that disables TSX, I believe, could only disable it if TSX wasn't used yet.
So I suppose it's also possible that the microcode has to be updated by the BIOS because some boot process prevents the kernel from being effective with its microcode update step.
Microcode updates that enable or disable various feature flags or patch the microcode used to interpret specific instructions from the outside CISC world to the native RISC world that all modern x86 processors use.
In terms of deployment, there is support for OSs to deploy microcode from Ring 0 each time the system boots, or the permanent fix is a new UEFI that includes the new microcode at system init.