On 21/01/2018 15:15, Brian Gregory wrote:
On 21/01/2018 09:58, Yousuf Khan wrote:
On 1/21/2018 1:57 AM, Paul wrote:
Yousuf Khan wrote:
Seems to be much easier than trying to install and run PowerShell
scripts, and much more reliable too:

https://www.grc.com/inspectre.htm

Have you decided what's it doing ?

What is it actually reading out ?

Â*Â*Â* Paul

The FAQ on that page mentions that since Meltdown doesn't affect AMD
systems, there is no patch needed to fix it on those systems. So you
can't enable or disable the fixes to test it, since the problem simply
doesn't exist on AMD. On Intel, if you don't have the latest patches
to fix Meltdown, then you also can't enable or disable the fix, since
the fix hasn't been applied.

For Spectre, it says that that requires a firmware upgrade. My
processor (AMD) shows that it's invulnerable to Meltdown, but
susceptible to Spectre. The way to fix Spectre requires a BIOS
upgrade. I have a feeling that I will never see another BIOS upgrade
for my system, as the last BIOS update for my board was 2013! The
board makers may update boards that are a year or two old, but not
this one.

Â*Â*Â*Â*Â*Yousuf Khan

It seems to be possible to update the microcode from the OS and
Microsoft could do that if they wanted. Linux can do it.

I'm currently trying to investigate whether a Windows driver can update
it satisfactorily after discovering:

https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver

http://forum.notebookreview.com/threads/how-to-update-microcode-from-windows.787152/


http://forum.notebookreview.com/threads/ucode-fix-for-spectre-ht-bug-fix-and-meltdown.806451/



I tried it by
1) extracting the contents of
CPU-microcode_06A14BA0506D12B69ED78E226F22CE0F9EEA6E1A .zip to a directory.
2) running install.bat using "Run as Administrator".
3) Changing the registry with:

=============FIX1.REG STARTS===============
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\cpumcupdate]
"Start"=dword:00000001

=============FIX1.REG ENDS================


Something definitely happens because, after rebooting, InSpectre
(Release 5) says "Vulnerable to Spect NO".

However something odd is going on and I'm not sure if it's because
Windows is patching the Microcode after it's decided what the microcode
patch level is, or maybe InSpectre (Release 5) has a bug.

The oddness is that Inspectre always starts with a button showing
"Enable Spectre Protection". This implies to me that this protection is
disabled. However pressing the button once leaves it as "Enable Spectre
Protection" but subsequent presses to toggle between "Disable Spectre
Protection" and "Enable Spectre Protection".

So maybe Inspectre (Release 5) just always starts showing "Enable
Spectre Protection" even if it is already correctly enabled.


I should add that my processor is Intel. If you do exactly the steps I
outlined it probably won't help with AMD since the AMD files in the
download I used seem to be very old.

But if you can find the AMD microcode files with the Spectre fix(es) in
them you're all set with AMD too. The latest I could find were December
2017, maybe AMD haven't finished testing yet.

--

Brian Gregory (in England).