Exposed: The missing Meltdown/Spectre microcode updates - is Intel lying to the public?

In short:

This document reveals that Intel apparently refuses to release almost half of their Meltdown/Spectre microcode updates (MCU) to the public.

In the "Microcode Revision Guidance" (MRG) are 93 processor families listed. For 16 of these the MCU development has been stopped for various reasons, thus 77 families remain, which we examine.

On April 25 Intel made a new microcode download (MD) available to the public.
 
Of these 77 families, the MD only supplies 42 (55%) with new microcode files.

35 families (45%) do not get updates. Of these, 25 families the MD lacks any MCU, and for 10 it supplies obsolete MCUs with new file timestamps.

The text analyzes the situation and examines possible reasons why almost half (45%) of these crucial microcode updates have not been made available to the public, even months after they were declared production quality.

Several appendices containing detailed tables and listings substantiate the text.



(Published by Stefan Blachmann, May 15, 2018)

In their latest Microcode Revision Guidance (MRG) dated April 2, 2018 Intel provides a long list of production quality microcode updates (that allegedly help fixing the Meltdown/Spectre vulnerability.
Former versions of the MRG exist. According most of these microcode updates (MCU) were already of production quality in February, three months ago. (See table in appendix 4 below).

However, in spite of that, only slightly more than half of these MCUs have been released to the public.
This indicates that Intel withholds critical security updates from the public intentionally.

In appendices 1-3 below, I have prepared tables of the microcode updates listed in the latest MRG, and marked those in red which were not released to the public, at least not in the March 12th and April 25th MCU downloads.

The microcode updates that are in these downloads are up to 20 years old. Only the file's timestamp is new.
This alone seems to trick many people into believing that their processor got a MCU. (just one example here)

But there are some files missing, which is much more obvious.

When people inquire about these missing MCU on the Intel support forum, the first phase of Intels' reaction is turning them away by the Intel customer service people. (Examples here, here and here. Another example here regarding the memory sinkhole bug, illustrating Intels' apparent habit to regularly make security-critical MCU available only to OEMs, but not to the public.)


If customers stay insistent and demand information where to download these MCUs, Intel enters the second phase of customer deflection: the customer gets a copypasted schematic e-mail answer that these MCU will be released to the public at an unknown date yet to be planned.
Quoted from the email I got: "...  we have plans of launching it at some point in the future, but we cannot confirm a estimated date to be available, as the only source to track the development status is directly in this Intel® official document." [i.e.the MRG already mentioned]

Everybody insistently asking for the missing MCU seems to get the same copypasted email. The fact that it was copypasted is clearly recognizable, as it says "the microcode for this exact model of processor is currently listed under production (Page 8, product name Gemini Lake)", and nobody in the thread asked for this processor.

What could be the reason for Intels' behavior?
The two most probable possibilities:

• Intel made the MCUs, but does not care to release them to the public, putting their customers knowingly and willingly into peril of being exploited by Meltdown and Spectre malware.  If this is the case, it would show that Intel does not care much for the security of their customers, and indicate that their claim of being "committed to product and customer security" possibly cannot be trusted.

• Or Intel, in contrast to their public promises, never intended to provide MCUs to all processors introduced in the last 5 years. The MCUs they talk about in their Guidance which are missing in the downloads actually do not exist. If this is the case, Intel is just producing fake news about MCUs to give their customers a false sense of security, speculating on customers not realizing at all that they are being buggered, or having short memory and forgetting things quickly.

The latter possibility is supported by several observations:

• The missing MCUs were apparently not included in the Windows microcode updates released by Microsoft, the Wintel companion.
• They also do not appear in the Linux microcode downloads. (See also the links below)
• As early as middle of January, I got an email from a volume user using hundreds of the same Westmere EP processors that I happen to use, informing me that Intel told him that - contrary to their promises - they will never release a MCU for these processors.
• As quoted above, Intel themselves says the only source they have for the existence of these MCUs is this "Microcode Revision Guidance". Reading the quote from their emails above, this might be interpreted that from the beginning these promised MCUs were intended to remain vaporware never to be released.

There is probably only one way Intel can save their face and prove that they are not trying to bugger the public:

Intel, release the missing production quality microcode updates to the public now.





Questions, corrections, updates?
Want to say "thank you"?
If you find this article helpful, either for your information, or for your security by creating pressure on Intel to finally release the allegedly production-quality MCUs, you are welcome to send me a donation. Here is a short Paypal instruction how to donate.  

Use my email address for contacting me or sending donations:

       sblachmann (at) gmail.com


P.S.: Please apologize the text formatting flaws, these are because of blogger.com's buggy editor. Thank you.

Copyright 2018 by Stefan Blachmann.
Partial and full reproduction is permitted free-of-charge.
Providing a link to the source (i.e. this article URL) is highly appreciated, but not mandatory.

Appendices

Appendix 1:

Alphabetical list of allegedly "production quality" microcode updates

that are mentioned in the April 2nd MRG, in the order they are listed.
MCUs categorized as "Stopped" are not listed.
 

Red are those missing in the April 25th microcode download, 35 in total, 10 of them supplied with obsolete MCUs instead
Yellow are these which are present, but still marked as "Production Candidate" in the MRG, 2 in total.

Green are these which are present, 40 in total.

(The date shown is the internal microcode revision date in the microcode file header. It is not the file date stamp, which often makes people believe there)

The most recent internal date of the MCU files is February 16, 2018.  (This could indicate that Intel stopped working on MCUs already long ago.)

Processor names                         CPUID   MCU rev.

p.3
Anniedale > Moorefield                  506A0   00000039
        Missing
Apollo Lake D0                          506C9   0000002E
        Missing - Version 2C of 2017/03/25 is in the download
Apollo Lake E0                          506CA   00000008
        Missing
Arrandale                               20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download
Arrandale                               20655   0x6
        Missing - Version 04 of 2013/06/28 is in the download
Avoton/Rangeley                         406D8   0000012A
        Missing
p.4
Broadwell DE A1                         50665   0xE000009
        Present - Date 2018/01/22
Broadwell DE V1                         50662   0x15
        Present - Date 2018/01/22
Broadwell DE V2,V3                      50663   0x7000012
        Present - Date 2018/01/22
Broadwell DE Y0                         50664   0xF000011
        Present - Date 2018/01/22
Broadwell E                             406F1   0xB00002A
        Missing
p.5
Broadwell H 43e                         40671   0x1D
        Present - Date 2018/01/21
Broadwell Server E, EP, EP4S            406F1   0xB00002A
        Missing
Broadwell Server EX                     406F1   0xB00002A
        Missing
p.6
Broadwell U/Y                           306D4   0x2A
        Present - Date 2018/01/18
Broadwell Xeon E3                       40671   0x1D
        Present - Date 2018/01/21
Broxton                                 506C2   00000010
        Missing
Cherry View (Cherry Trail, Braswell)    406C3   00000367
        Missing
Cherry View (Cherry Trail, Braswell)    406C4   00000410
        Missing
p.7
Clarkdale                               20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download
Clarkdale                               20655   0x6
        Missing - Version 04 of 2013/06/28 is in the download
Clarkdale Xeon                          20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download
Coffee Lake H (6+2),
Coffee Lake S (6+2)                     906EA   0x84
        Present - Date 2018/01/21







Coffee Lake S (6+2) Xeon E              906EA   0x84
        Present - Date 2018/01/21

Coffee Lake U43e                        806EA   0x84
        Present - Date 2018/01/21
Coffee Lake-S (4+2)                     906EB   0x84
        Present - Date 2018/01/21
Coffee Lake-S (4+2) Xeon E              906EA   0x84
        Present - Date 2018/01/21
Coffee Lake-S (6+2) x/KBP               906EA   0x84
        Present - Date 2018/01/21
p.8
Cougar Mountain (AMT)                   606E1   0x106
        Missing
Denverton (GLM)                         506F1   00000020
        Missing
Gemini Lake                             706A1   00000022
        Present - Date 2017/12/26
Gladden                                 306A9   0x1F
        Present - Date 2018/02/07
p.9
Haswell (including H, S)                306C3   0x24
        Present - Date 2018/01/21
Haswell Perf Halo                       40661   0x19
        Present - Date 2018/01/21
Haswell Server E, EP, EP4S              306F2   0x3C
        Present - Date 2018/01/19
Haswell Server EX                       306F4   0x11
        Present - Date 2018/01/22
Haswell ULT                             40651   0x23
        Present - Date 2018/01/18
p.10
Haswell Xeon E3                         306C3   0x24
        Present - Date 2018/01/21
Ivy Bridge                              306A9   0x1F
        Present - Date 2018/02/07
Ivy Bridge Server E, EN, EP, EP4S       306E4   0x42C
        Present - Date 2018/01/25
Ivy Bridge Server EX                    306E7   0x713
        Present - Date 2018/02/16
Ivy Bridge Xeon E3                      306A9   0x1F
        Present - Date 2018/02/07
Ivy Bridge E                            306E4   0x42C
        Present - Date 2018/01/25
p.11
Kaby Lake H/S/X/G                       906E9   0x84
        Present - Date 2018/01/21
Kaby Lake Refresh U 4+2                 806EA   0x84
        Present - Date 2018/01/21
Kaby Lake U/Y, U23e                     806E9   0x84
        Present - Date 2018/01/21
Kaby Lake Xeon E3                       906E9   0x84
        Present - Date 2018/01/21
Knights Landing                         50671   0x1B6
        Missing
Knights Mill                            80650   0x18
        Missing
Lynnfield                               106E5   0x09
        Missing - Version 07 of 2013/08/20 is in the download
Lynnfield Xeon                          106E5   0x09
        Missing - Version 07 of 2013/08/20 is in the download
Nehalem EP, Nehalem WS                  106A5   0x1C
        Missing - Version 19 of 2013/06/21 is in the download
p.12
Nehalem EX                              206E6   0x0C
        Missing
Sandy Bridge                            206A7   0x2D
        Present - Date 2018/02/07
p.13
Sandy Bridge Server EN/EP/EP4S          206D6   0x61C
        Present - Date 2018/01/30
Sandy Bridge Server EN/EP/EP4S          206D7   0x713
        Present - Date 2018/01/26
Sandy Bridge Xeon E3                    206A7   0x2D
        Present - Date 2018/02/07
Skylake D, Bakerville                   50654   0x2000043
        Present - Date 2018/01/26
Skylake H/S                             506E3   0xC2***
        Present - Date 2017/11/16
p.14
Skylake Server                          50654   0x2000043
        Present - Date 2018/01/26
Skylake U/Y                             406E3   0xC2***

        Present - Date 2017/11/16

Skylake U23e                            406E3   0xC2***
        Present - Date 2017/11/16
Skylake W                               50654   0x2000043
        Present - Date 2018/01/26

Skylake X, Basin Falls                  50654   0x2000043
        Present - Date 2018/01/26
Skylake Xeon E3                         506E3   0xC2***
        Present - Date 2017/11/16
SoFIA 3G ES2.1 and Granite 4            506D1   00000103
        Missing
p.15
Tangier (SLM)                           406A8   00000833
        Missing
Tangier (SLM)                           406A9   00000833
        Missing
Valleyview, Bay Trail I (B2, B3 step)   30673   0000326
        Missing
Valleyview, Bay Trail I (D0, D1 step)
Valleyview, Bay Trail M/D (D1 step)     30679   0000090A
        Missing
Valleyview, Bay Trail M/D (B2,B3 step)  30673   0000326
        Missing
Valleyview, Bay Trail M/D (C0 step)     30678   00000836
        Missing
Valleyview, Bay Trail T (B2, B3 step)   30673   0000326
        Missing
Valleyview, Bay Trail T (C0 step)       30678   00000836
        Missing
p.16
Westmere EP, WS                         206C2   0x1E
        Missing
Westmere EX (EGL, WSM)                  206F2   0x3A

        Missing - Version 19 of 2013/06/18 is in the download
p.17
XGold 7272                              60650   00000015
        Missing
The sources used for this information are Intels Microcode Update Guidance already mentioned and the stats output function of my cpupdate program (see chapter "Internal microcode file stats" below).


Appendix 2:

Microcode updates list sorted into Present/Missing


Present:
(42 processor families)

Processor names                         CPUID   MCU rev.

p.4
Broadwell DE A1                         50665   0xE000009
Broadwell DE V1                         50662   0x15
Broadwell DE V2,V3                      50663   0x7000012
Broadwell DE Y0                         50664   0xF000011

p.5
Broadwell H 43e                         40671   0x1D

p.6
Broadwell U/Y                           306D4   0x2A
Broadwell Xeon E3                       40671   0x1D

p.7
Coffee Lake H (6+2),
Coffee Lake S (6+2)                     906EA   0x84

Coffee Lake S (6+2) Xeon E              906EA   0x84

Coffee Lake U43e                        806EA   0x84
 Coffee Lake-S (4+2)                     906EB   0x84
Coffee Lake-S (4+2) Xeon E              906EA   0x84
Coffee Lake-S (6+2) x/KBP               906EA   0x84

p.8
Gemini Lake                             706A1   00000022
Gladden                                 306A9   0x1F

p.9
Haswell (including H, S)                306C3   0x24
Haswell Perf Halo                       40661   0x19
Haswell Server E, EP, EP4S              306F2   0x3C
Haswell Server EX                       306F4   0x11
Haswell ULT                             40651   0x23

p.10
Haswell Xeon E3                         306C3   0x24
Ivy Bridge                              306A9   0x1F
Ivy Bridge Server E, EN, EP, EP4S       306E4   0x42C
Ivy Bridge Server EX                    306E7   0x713
Ivy Bridge Xeon E3                      306A9   0x1F
Ivy Bridge E                            306E4   0x42C

p.11
Kaby Lake H/S/X/G                       906E9   0x84
Kaby Lake Refresh U 4+2                 806EA   0x84
Kaby Lake U/Y, U23e                     806E9   0x84
Kaby Lake Xeon E3                       906E9   0x84

p.12
Sandy Bridge                            206A7   0x2D

p.13
Sandy Bridge Server EN/EP/EP4S          206D6   0x61C
Sandy Bridge Server EN/EP/EP4S          206D7   0x713
Sandy Bridge Xeon E3                    206A7   0x2D
Skylake D, Bakerville                   50654   0x2000043
Skylake H/S                             506E3   0xC2***

p.14
Skylake Server                          50654   0x2000043
Skylake U/Y                             406E3   0xC2*** 
Skylake U23e                            406E3   0xC2***
Skylake W                               50654   0x2000043 
Skylake X, Basin Falls                  50654   0x2000043
Skylake Xeon E3                         506E3   0xC2***


Missing (Group 1):
(25 processor families affected)
(No microcode file present)



Processor names                         CPUID   MCU rev.

p.3
Anniedale > Moorefield                  506A0   00000039
Apollo Lake E0                          506CA   00000008
Avoton/Rangeley                         406D8   0000012A

p.4
Broadwell E                             406F1   0xB00002A

p.5
Broadwell Server E, EP, EP4S            406F1   0xB00002A
Broadwell Server EX                     406F1   0xB00002A

p.6
Broxton                                 506C2   00000010
Cherry View (Cherry Trail, Braswell)    406C3   00000367
Cherry View (Cherry Trail, Braswell)    406C4   00000410

p.8
Cougar Mountain (AMT)                   606E1   0x106
Denverton (GLM)                         506F1   00000020

p.11
Knights Landing                         50671   0x1B6
Knights Mill                            80650   0x18

p.12
Nehalem EX                              206E6   0x0C

p.14
SoFIA 3G ES2.1 and Granite 4            506D1   00000103

p.15
Tangier (SLM)                           406A8   00000833
Tangier (SLM)                           406A9   00000833
Valleyview, Bay Trail I (B2, B3 step)   30673   0000326
Valleyview, Bay Trail I (D0, D1 step)
Valleyview, Bay Trail M/D (D1 step)     30679   0000090A
Valleyview, Bay Trail M/D (B2,B3 step)  30673   0000326
Valleyview, Bay Trail M/D (C0 step)     30678   00000836
Valleyview, Bay Trail T (B2, B3 step)   30673   0000326
Valleyview, Bay Trail T (C0 step)       30678   00000836

p.16
Westmere EP, WS                         206C2   0x1E

p.17
XGold 7272                              60650   00000015


Missing (Group 2):
(10 processor families affected)

(Obsolete microcode update file present, which neatly helps tricking many users in believing that they got an update)

Processor names                         CPUID   MCU rev.

p.3
Apollo Lake D0                          506C9   0000002E
        Missing - Version 2C of 2017/03/25 is in the download
Arrandale                               20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download
Arrandale                               20655   0x6
        Missing - Version 04 of 2013/06/28 is in the download

p.7
Clarkdale                               20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download
Clarkdale                               20655   0x6
        Missing - Version 04 of 2013/06/28 is in the download
Clarkdale Xeon                          20652   0x10
        Missing - Version 0E of 2013/06/26 is in the download

p.11
Lynnfield                               106E5   0x09
        Missing - Version 07 of 2013/08/20 is in the download
Lynnfield Xeon                          106E5   0x09
        Missing - Version 07 of 2013/08/20 is in the download

Nehalem EP, Nehalem WS                  106A5   0x1C
        Missing - Version 19 of 2013/06/21 is in the download
 p.16
Westmere EX (EGL, WSM)                  206F2   0x3A

        Missing - Version 19 of 2013/06/18 is in the download



Appendix 3:

Microcode update file list sorted by CPUID and Present/Missing

Some processor families share the same CPUID, thus the total number of files is smaller, as one file might contain multiple MCUs.

Present: 28 files
Missing (Group 1): 20 files
Missing and Obsolete MCU file supplied (Group 2): 6 files

Present: (28 cpuids)
CPUID   MCU version
206A7   0x2D
206D6   0x61C
206D7   0x713
306A9   0x1F
306C3   0x24
306D4   0x2A
306E4   0x42C
306E7   0x713
306F2   0x3C
306F4   0x11
40651   0x23
40661   0x19
40671   0x1D
406E3   0xC2***
50654   0x2000043
50654   0x2000043
50654   0x2000043
50662   0x15
50663   0x7000012
50664   0xF000011
50665   0xE000009
506E3   0xC2***
706A1   00000022
806E9   0x84
806EA   0x84
906E9   0x84
906EA   0x84
906EB   0x84

Missing: (Group 1 - 20 cpuids missing update files)
CPUID   MCU version

206E6   0x0C
206C2   0x1E
30673   0000326
30678   00000836
30679   0000090A
406A8   00000833
406A9   00000833
406C3   00000367
406C4   00000410
406D8   0000012A
406F1   0xB00002A

50671   0x1B6506A0   00000039
506C2   00000010
506CA   00000008
506D1   00000103
506F1   00000020

60650   00000015606E1   0x106
80650   0x18

Missing (Group 2 - 6 cpuids supplied with obsolete MCU)
CPUID   MCU version
106A5   0x1C - V. 19 of 2013/06/21 is in the download
106E5   0x09 - V. 07 of 2013/08/20 is in the download
20652   0x10 - V. 0E of 2013/06/26 is in the download
20655   0x6  - V. 04 of 2013/06/28 is in the download
206F2   0x3A - V. 19 of 2013/06/18 is in the download
506C9   2E   - V. 2C of 2017/03/25 is in the download





Stopped: 9 cpuids
 10676
10677
1067A
106A4
106A5
106E4
106E5
206C2
506D1





 
Appendix 4:

Table of development states of the missing microcode updates according to the Microcode Revision Guidance (MRG) versions of...

CPUID           ...February 26  ...March 6      ...April 2

106A5           Pre-Beta        Pre-Beta        Production
106E5           Planning        Pre-Beta        Production
20652           Planning        Pre-Beta/Beta   Production
20655           Pre-Beta        Beta            Production
206C2           Pre-Beta        Pre-Beta/Beta   Production
206E6           Pre-Beta        Pre-Beta        Production
206F2           Planning        Pre-Beta        Production
30673           Production      Production      Production
30678           Production      Production      Production
30679           Production      Production      Production
406A8           Production      Production      Production
406A9           Production      Production      Production
406C3           Production      Production      Production
406C4           Production      Production      Production
406D8           Production      Production      Production
406F1           Beta/Production Production      Production
50671           Production      Production      Production
506A0           Production      Production      Production
506C2           Production      Production      Production
506C9           Production      Production      Production
506CA           Production      Production      Production
506D1           Production      Production      Production
506F1           Production      Production      Production
60650           Production      Production      Production
606E1           Production      Production      Production
80650           Production      Production      Production


Note: Intel has only the latest MRG version, currently (May 15) the one dated April 2, available for download. I have asked Intel for permission to upload the older MRGs, to make possible for everybody to verify the correctness of the table above.



Appendix 5:

Comparison of the "Stopped" microcode CPUIDs 
Did Intel stop the development of the missing MCUs but did not dare to confess that to the public, and preferred to lie into the face of their customers, in the intention of leaving the public in a false sense of security?

(in brackets: PlatformID)

10676
Stopped For:
Harpertown Xeon C0 (40)
Wolfdale C0, M0 (91)
Wolfdale Xeon C0 (04)

10677
Stopped For:
Yorkfield
Yorkfield Xeon (all 10)

1067A
Stopped For:
    Harpertown Xeon E0 (44)
    Penryn/QC (B1)
    Wolfdale E0, R0 (B1)
    Wolfdale Xeon E0 (44)

106A4
Stopped For:
    Bloomfield (03)

106A5
Stopped For:
    Bloomfield
    Bloomfield Xeon (both 03)
Production (but missing) for:

    Nehalem EP
    Nehalem WS (both 03)

106E4
Stopped For:
    Jasper Forest (09)

106E5
Stopped For:
    Clarksfield (13)
Production (but missing) for:
    Lynnfield
    Lynnfield Xeon (all 13)

206C2
Stopped For:
    Gulftown (03)
Production (but missing) for:
    Westmere EP, WS (03)

506D1
Stopped For:
    SoFIA 3GR



Appendix 6:

Internal microcode file stats

The microcode file date stamps in the microcode updates are all identical.
So one has to use the internal data structures to find out their actual version and release date.

The only program I know of which can list these internal data of the microcode files is cpupdate. I used cpupdate -Ivvd <microcode-directory>, which outputs the internal statistics of every microcode file in that directory.

In case you need to know the actual versions and creation dates for the microcode files in the previous Intel microcode updates:

As cpupdate is currently available only for FreeBSD, I have uploaded its output for the various recent microcode updates to pastebin for your convenience:

April 25th 2018 microcode update internals
 
March 12th 2018 microcode update internals
January 8th 2018 microcode update internals
November 17th 2017 microcode update internals