Spectre and Meltdown require both Windows and BIOS updates to address vulnerabilities effectively.
Spectre and Meltdown require both Windows and BIOS updates to address vulnerabilities effectively.
The bios updates became necessary since they also deliver patches directly to the processors. Every processor contains microcode (some software runs continuously inside the CPU). These microcode changes are stored within the bios, allowing them to be distributed to the CPU when needed. Once you boot up the PC after a bios update, the system verifies the CPU's microcode version. If it's outdated compared to what's in the bios, the new microcode is uploaded to the processor. To fully address certain security issues, both the processor's microcode and the operating system must be upgraded. For some vulnerabilities, only the OS needed updating was sufficient. On AMD processors, I believe no microcode updates were required, and even OS updates were often unnecessary due to the complexity of exploiting them. Relying solely on bios updates means your CPU gets the latest microcode but may still lack fixes for all vulnerabilities. Without OS updates, certain attacks could remain possible or be straightforward, though I’m unsure about the exact risks.
Well, the situation isn't exactly what it seems. I own two computers: Haswell and Skylake. Haswell comes with an i7-4790 processor, 16GB RAM, and a Samsung SSD. Skylake has an i7-6700K, also with 16GB RAM and a similar SSD. The Skylake runs better with Windows 10 and its built-in security updates, while the Haswell version performs better when those updates are turned off. When I disable the Windows updates for Skylake, it runs a bit smoother. The patches seem to make a noticeable difference, but turning them off brings back most of the performance. It looks like the updates are having a bigger impact than the hardware differences alone.
It seems the exact update that reduces my i7-6700K to a lower model is the Spectre Windows patch. The Meltdown fix isn’t related to it. Good news there’s a forthcoming solution... https://www.zdnet.com/article/windows-10...ine-patch/