Intel Says Some CPU Models Will Never Receive Microcode Updates (bleepingcomputer.com)

An anonymous reader writes: Intel released an update to the Meltdown and Spectre mitigation guide, revealing that it stopped working on mitigations for some processor series. The Meltdown and Spectre mitigation guide is a PDF document that Intel published in February. The file contains information on the status of microcode updates for each of Intel's CPU models released in the past years. Intel has constantly updated the document in the past weeks with new information about processor series and the microcode firmware version number that includes patches for the Meltdown and Spectre flaws.

An update published on Monday includes for the first time a "Stopped" production status. Intel says that processors with a "Stopped" status will not receive microcode updates. The reasons basically vary from "redesigning the CPU micro-architecture is impossible or not worth the effort" to "it's an old CPU" and "customers said they don't need it." The following Intel processor products received a "Stopped" status marker: Bloomfield, Bloomfield Xeon, Clarksfield, Gulftown, Harpertown Xeon C0, Harpertown Xeon E0, Jasper Forest, Penryn/QC, SoFIA 3GR, Wolfdale C0, Wolfdale M0, Wolfdale E0, Wolfdale R0, Wolfdale Xeon C0, Wolfdale Xeon E0, Yorkfield, and Yorkfield Xeon.

Comments

This is BS.

[Joey Vegetables]

I'm sorry, but if I'm investing in a high-end, server-class CPU, I expect it to be supported for as long as is reasonably possible. If they said they weren't updating 10 year old Celerons or Atoms, that might be understandable. But Xeons? Let's just say I don't plan to every buy one again, at least so long as AMD represents a reasonable alternative. In fact, I will always stick with AMD (as I long have, for other reasons) until and unless Intel makes some kind of definite, enforceable support commitment.

Re:This is BS.

[Anonymous Coward]

Get a brain.

Those processors are on the 10 year mark. Anyone thinking they should be in use should not deal with computers.

Re:This is BS.

[kelemvor4]

I'm sorry, but if I'm investing in a high-end, server-class CPU, I expect it to be supported for as long as is reasonably possible. If they said they weren't updating 10 year old Celerons or Atoms, that might be understandable. But Xeons? Let's just say I don't plan to every buy one again, at least so long as AMD represents a reasonable alternative. In fact, I will always stick with AMD (as I long have, for other reasons) until and unless Intel makes some kind of definite, enforceable support commitment.

Look at the release dates for the specific Xeons on their list. For example, the W3520. It was released 9 years ago. I don't blame them one bit for not updating ancient chips like that. If it was a chip released in 2016 I think owners could reasonably be upset. Intel only provides 3 year warranties on Xeon processors. If they were feeling generous, they might provide updates for chips 5 years out...

Re:This is BS.

[Joey Vegetables]

Hello Intel troll. Sorry you're feeling even more inadequate today than usual. Given the news, I can't say I blame you.

Re:This is BS.

[Opportunist]

I'm as upset as you are, but let's face it, we're dealing with 8-10 year old processors here. Yes, for many applications still way more than good enough, but still. I think it's asking a bit much to expect patches for hardware that is about 3-4 generations old.

Price isn't a deciding factor here, unless of course part of that price was the promise of support above and beyond what could reasonably be expected.

Re:This is BS.

[Joey Vegetables]

None of this makes me feel any more inclined to favor Intel over AMD. This isn't their first "brown paper bag" bug and I doubt it will be their last. If only a 3 year warranty is even offered on some of the highest-end chips they made at the time, when some new cars are warrantied for 10, I think that says something really awful about even Intel's own assessment of whether its products can be supported in the long term. AMD may or may not be drastically better, but Intel has set a very low bar, and it is going to take them serious time to earn back my business, assuming they ever do.

Re:This is BS.

[Archtech]

The processor of the PC on which I am writing this is just ten years old. Why do you believe that a ten-year-old processor should not be in use? (You should see my car: it's 18 years old. But then it's a Volvo, properly designed and robustly built).

It's not even as if you can buy processors today that are very much faster than my ancient i7-940. Their price/performance may be better, but guess what? I don't care because I *already paid for mine*. Of course, I am referring to single-core performance which is the limiting factor for most desktop applications. The i7-940 has four cores, which I feel is about right for a desktop - any software that does benefit from parallelism will see a significant speed-up.

Perhaps you are a devotee of the cult of technical progress. In which case you should take a long look at the facts, and understand that Intel microprocessors are not a very good example of such progress.

Re:This is BS.

[Aaden42]

Realistically most enterprise customers use hardware for 3 to a MAXIMUM of 5 years, then it's out the door. Even high-end Xeon CPU's. It's entirely plausible that the bulk of actual enterprise customers(*) don't care.

(*) Note: actual enterprise customers, not nerds who buy surplus servers off eBay to run in their basements.

Disclaimer: I am one such nerd.

Re:This is BS.

[Sarten-X]

For what it's worth, AMD also has only a 3-year warranty.

Re:This is BS.

[MightyYar]

I wish! We still have SPARC machines.

Re:This is BS.

[Barny]

Yes and no. I had an i7 960 myself, and was starting to find performance slipping on some media tasks (in my case exporting in GIMP) as well as general multitasking. I was planning an upgrade, and looked at the sky-high prices of modern intel CPUs, and decided to try AMD. Quite happy with my Rizon 1700X system I built, and I have yet to see it actually slow down at all.

Note: the i7 960 is still in use. It got migrated down the chain of ownership to be the center of a FreeNAS box. As such I don't need the microcode upgrade for it, since no potentially hostile code runs on it.

Re:This is BS.

[Penguinisto]

Query: Do these servers connect directly to the Internet w/o any sort of firewall, DMZ rigging, load balancer, or similar? If not, the odds are fairly low. If so, you got bigger problems than anything Intel does or doesn't do.

Re:This is BS.

[butzwonker]

I've had a slightly overclocked i7 920 until a few weeks ago and it was perfectly capable of running yesteryears games. I've only upgraded in order to be able to play this years games, and even those didn't really require the CPU update but rather need more than 6GB RAM and upgrading such an old machine wasn't worth it.

So yeah, for standard tasks like web browsing, development without large compilations, writing, and so on, even an i7 920 would be perfectly fine if it weren't for Intel's fuck-up. It kind of bothers me that by not fixing older CPUs they might make even more money.

That being said, I bought an AMD 1800x so the joke's on them.

Re:This is BS.

[Anonymous Coward]

Realistically most enterprise customers use hardware for 3 to a MAXIMUM of 5 years.

You must be thinking of desktops and notebooks.

It's not that uncommon for some larger organizations to be running servers that are much older than five years. The penny-pinching bean counters have significant influence over whether systems get maintained/upgraded and, too often, they rely on "look, it hasn't broken so far, right?" when deciding whether or not to upgrade. Some people are surprisingly short-sighted that way, preferring reactive over proactive.

Re:This is BS.

[The Grim Reefer]

Look at the release dates for the specific Xeons on their list. For example, the W3520. It was released 9 years ago. I don't blame them one bit for not updating ancient chips like that. If it was a chip released in 2016 I think owners could reasonably be upset. Intel only provides 3 year warranties on Xeon processors. If they were feeling generous, they might provide updates for chips 5 years out...

I find it amazing how most people are trying to be more conscious of pollution, CO2, and E-waste these days. There are a bunch of CPUs in use that are 10+ years old. And frankly if you're not gaming or doing video editing or other CPU intensive things, many, if not most, 10 year old CPUs are more than adequate.

I have at least three computers in use with processors that were released 8+ years ago. I have no plans to replace them either.

Intel fucked up, not me. But in their minds, and yours, that's not their problem. I should just toss out a perfectly functional system and send it off to India or China to pollute their land and water. I should also give them more money for a new system that also contributed to even more pollution. [s]Yea, that sounds perfectly reasonable to me. [/s]

I'm not saying that they should be providing updates for all processor until the end of time. But 10 years is not all that long for a computer any more. This isn't 1990. I'm not seeing substantial improvements every 2 years. If they don't want to release minor bug fixes and such after 3 to 5 years, that seem perfectly reasonable. But this is a security flaw. Companies that produce these products should be on the hook for security for as along as more than just a handful of the product is still in use. This includes security for IOT devices too. If a company can't implement proper security, then they shouldn't be in business in this day and age.

Re:This is BS.

[Anonymous Coward]

That's not how it works. Hardware tends to stay where it is as long as it works and does the job sufficiently well. Frequently longer than that.

Most businesses are run by economists, who see "IT" and "computers" as something which only costs money. The costs associated with failing or poorly performing hardware rarely enters their spreadsheets, which is why so often nothing is done about it until the long predicted disaster strikes.

Re:This is BS.

[Joey Vegetables]

Yeah. Shame on them too for that. But then I haven't needed to have an AMD chip re-microcoded, much less replaced. The Honda I drive has a much shorter factory warranty than the Hyundai I don't, but that doesn't bother me so much because I know from much experience (mine plus that of countless others) that a well-maintained Honda will typically last a very long time and the warranty won't likely be needed.

Re:This is BS.

[Joey Vegetables]

Exactly. If I expected to upgrade every 2-3 years, I'd be less irritated. But today I hope to keep even a mid-range laptop or desktop around for at least 5 and hopefully longer. And I've had plenty of much older machines retired from their main use but still doing other useful work. I now have to factor into my purchasing decisions that if Intel commits another abomination like this, it won't replace bubkes, and thus my options are (a) crap (replace it outright, long before I'd have done otherwise); or (b) crappier (risk a potentially life-changing security breach).

Re:This is BS.

[Joey Vegetables]

I evaluate desktop CPUs based on performance per unit cost, and laptops based on that *plus* power usage, battery life, etc. Usually, that favored AMD on the desktop but Intel on the laptop. But, now, I have to consider the large possibility that security concerns will obsolete a laptop before anything else does. So, now, I keep using AMD on desktops, but now favor AMD on laptops as well, which, previously, I did not.

Re:This is BS.

[Joey Vegetables]

The advent of laptops, thumb drives and mobile devices long ago rendered life inside the firewall or DMZ just as scary as life outside it. Yes, my experience is that servers are left running as long as they can be, and they are often very vulnerable. Companies typically value stability over security; in their view, a security upgrade is as likely to cause them inconvenience as would an overt security breach. And not to turn this into a yet another Windows versus Linux debate, but Windows servers are typically administered through the GUI, which increases their attack surface, one which you don't need to use necessarily, but most people do, because it's more convenient than to learn how to do Powershell or other command-line scripting. While many Linux servers do have GUIs (contrary to what I would consider best practice), they are strictly optional, and in my experience, Linux admins are not afraid of the command line as are some (not all) of their Windows counterparts.

Re:This is BS.

[Kokuyo]

I can only agree... I bought the same mobo off of ebay a few weeks back the replace my faulty one. Overclocked my i5-4670k gives me single core power I will be hard pressed to pull ahead of without investing several hundreds in a completely new system...

Re: This is BS.

[jddj]

My HTPC runs one of these "Stopped" chips, as does another similar machine I keep around 'cuz it's handy.

There's no reason for these perfectly functional machines to hit the landfill. Not while they're selling far less powerful or refined Raspberry Pi's for $35 without a case.

If you think of being involved in computing as "own a single huge honking piece of iron", perhaps you're not very involved in computing yourself.

Re:This is BS.

[Threni]

"I'm sorry, but if I'm investing in a high-end, server-class CPU, I expect it to be supported for as long as is reasonably possible."

You're not getting an update no matter what you post on Slashdot. Just pretend you're buying an Android phone.

The CEO of Intel sold all of his shares just in time, huh?!

Re:This is BS.

[rahvin112]

Hah, Most enterprises are using computers for a minimum of 5 years now because the hardware isn't improving at a fast enough rate. As an example, Anandtech recommended that with the most recent Kaby Lake processors it was finally worth it to replace Sandy Bridge processors as KL finally represented a 20 percent increase in performance over SB. KL and SB are more than 10 year apart (KL is generation 8 Core Microarchitecture, and SB is generation 2 Core Microarchitecture) that means it took 6 revisions before there was a 20% difference in performance.

CPU performance growth has drastically slowed since about 2008, you'd have to be crazy to replace a PC before 5 years at this point because there is literally no benefit to doing so.

Re:This is BS.

[Rick Schumann]

I wouldn't at all be surprised if part of the strategy here is to scare people into dumping older systems and buying new ones so they're 'protected'.

Re:This is BS.

[ddtmm]

Or until AMD does something similar...

Re:This is BS.

[luvirini]

Well, as example one of our customers has following servers in their server room doing variety of tasks:

-One is brand new and is the primary server running a bunch of virtual machines.
-A second is the four or five year old server that it replaced and is retained as backup to run the virtual machines if needed.
-The main production management system has 2 servers (main and backup), both were bought in 2007/2008. (so approx 10 years).
-There is the exchange server from about 2011(so about 7 years). Will be removed this summer so one less old server after that.
-There is the warehouse system that was migrated to a new server about 2005. It requires a dongle placed on a parallel port and a NT 3.51 driver, that luckily apparently works in server 2003 at least.
-There is the telephony server from about 2011 or 2012.

That customer is the most obvious such, but there is a surprising number of old servers here and there, though more and more of them are being replaced by cloud solutions or moved into virtual machines.

The main servers are often fairly new, but there is a surprising number of special servers doing some specific thing that were bought at one time and never updated, that could usually be migrated to virtual machines but many customers are reluctant to do anything on a system that works.

Looking at a few customers documentation there is quite often at least one server running something like windows server 2003 in the original server it was installed on.

Re:This is BS.

[ckaminski]

> rather need more than 6GB RAM

This right here.

I'm sick of downpurposing CPUs and being restricted to some stupid memory limitation. The NUCs are a fine example of this.

They'll last 10+ years most likely, and in those 10 years still be limited to 8GB - 16GB.

The only reason I'm updating some of my Atom machines is memory limitations, and I'm doing it with non-bleeding edge stuff. Intel doesn't really like the hobbyist I guess.

Re:This is BS.

[ckaminski]

You are most certainly correct. To replace dual E5450 would require an 8 core i7.

E5450 is LGA771

i7 is not. So you WOULD need a new motherboard. Quite likely the memroy would work (DDR3 and ECC) .

There are NO 8 core i7 processors.

Either way, you're looking at $4-500 for a modest increase in TDP and cache, and maybe burst performance.

Re:This is BS.

[ckaminski]

My mistake, there were a few i7 processors with >=8 cores

https://ark.intel.com/Search/FeatureFilter?productType=processors&CoreCountMin=8&FamilyText=Intel%C2%AE%20Core%E2%84%A2%20Processors

Re: This is BS.

[arth1]

I'm glad I didn't find my Tualatin-S on the "stopped" list.
I'm looking forward to a new update, because it's been a while since the last one.

Re:This is BS.

[Anne Thwacks]

Not the OP here, but I don't expect a fix. what I do expect in the absence of a fix, is pin compatible replacements made with today's technology. Failing that, compensation:

• to me, for having to replace my entire system including embroidery machine, ATE system, yacht navigation system,
• the world at large for huge numbers of large, complex systems going to landfill

Intel are causing massive disruption to people who are not nerdy games players trapped in their parents basement, or cloud providers, and don't need more performance than they have, and for whom the processor is less than 1% of the system cost.

No, you don't get to choose CPU supplier when buying a body scanner for $1m. Hopefully, this will change soon.

Re:This is BS.

[arth1]

I'm as upset as you are, but let's face it, we're dealing with 8-10 year old processors here. Yes, for many applications still way more than good enough, but still. I think it's asking a bit much to expect patches for hardware that is about 3-4 generations old.

When companies like Red Hat and Microsoft offer extended OS service plans so you can keep the OS updated with security patches for 10 years, it would be nice if the firmware on those machines certified for that OS could also receive security updates. Even for a price, because the price of migrating large software systems can be very high, and companies want to avoid doing it when it doesn't buy anything extra for as long as possible.
So yes, you will find 10 year old systems in many companies, going on doing what they always have, and making money for the business.

Re:This is BS.

[jddimarco]

There's no ECC on i7.

Re:This is BS.

[hairyfeet]

The netbox at the shop is a quad core Q9505S which means its getting screwed by Intel...now why EXACTLY should I be forced to replace a system that does its job VERY well? So Intel can make more money by trying to sell me a new chip because they BORKED their own CPU design? This chip is more than powerful enough to not only do its main job of downloading drivers and looking up parts but its also quite good for converting analog formats to digital thanks to the hauppauge built into the Pavilion Media Center...so why should I have to sink money to replace a unit whose ONLY issue is that Intel decided they weren't gonna bother fixing their mistakes?

The only thing this bullshit has convinced me of is that I made the right choice to be AMD exclusive and once this last Intel unit dies there won't be any more Intel at the shop that I'm not working on for a customer, they just aren't trustworthy.

Re:This is BS.

[SeaFox]

...rather need more than 6GB RAM

This right here.

I'm sick of downpurposing CPUs and being restricted to some stupid memory limitation. The NUCs are a fine example of this.

Pretty sure that poster just didn't see the reason to spend the money on the memory upgrade, it wasn't a limitation of the CPU. I have an i7 920 as well. I started with 6 GB of RAM also when I built it (3 x 2GB, triple-channel config), and a couple years ago I upgraded to 16 GB (4 x 4GB, dual-channel config) so there was room for VM work.

Re:This is BS.

[arth1]

You might not realize, but energy efficiency is so much better today that you might as well consider you are *still paying* for it. You know electricity isn't free right?

That's not always an argument. My main server runs on a PIII 1133S, which runs well without even a CPU fan. The load is so low that it most of the time pulls very little power, but even when it runs full out, the bogomips/TDP rating of 82.9 is so good that there aren't many newer options that do better.
There are some other server CPUs that are also quite frugal.
Newer CPUs can do more, but that's not always needed.

And, for some, increased power usage isn't that big of an issue either, unless you run a big datacenter. A server located in Northern cold climates will produce heat that's needed anyhow most of the year, and the heat produced by the server can be subtracted from the heat needed to be produced by a heater.

Re:This is BS.

[arth1]

The penny-pinching bean counters have significant influence over whether systems get maintained/upgraded and, too often, they rely on "look, it hasn't broken so far, right?" when deciding whether or not to upgrade. Some people are surprisingly short-sighted that way, preferring reactive over proactive.

It can be a bit more expensive than just replacing a server. Often, systems have bespoke software that requires specific hardware or capabilities not compatible in newer systems, or where new licenses aren't procurable. And porting large software projects can increase the costs a lot. I've seen a quote for over a million for porting the software on a server that would cost ten k to replace.

Re:This is BS.

[blind biker]

AMD may or may not be drastically better,

Seeing as though AMD CPUs are not susceptible to Meltdown, I would say they have an enormous advantage over intel's. The fact is that Meltdown, unlike Spectre, is very easily exploitable in practical terms, and is the one people should be actually worried about.

Re:This is BS.

[epine]

Intel only provides 3 year warranties on Xeon processors. If they were feeling generous, they might provide updates for chips 5 years out...

What does warranty have to do with this?

If a baby seat kills babies because it's defective by design, this is not a warranty issue. Not even if the baby seat only kills babies when combined with other safety systems that weren't invented yet at the time the baby seat was originally sold.

Both of these ends of the telescope are too extreme for the matter at hand, but at least mine is wide awake, whereas as yours is snoozing behind the wheel.

Re:This is BS.

[AbRASiON]

The law of diminishing returns, fairly reasonable quality components says you're off a bit there.

The innovations in performance nowadays has slowed down so much that a beast server built 7 or 8 years ago, is still perfectly acceptable at performing some tasks for customers. It's chewing a bit more power but the amount of performance they gain by replacing said server isn't that wildly different.

I would say the oldest I've seen is 10 but 7 was certainly still common in the last place I was at. Over 3000 servers, just had hardware support contracts for the older stuff.

Re:This is BS.

[TheRaven64]

For some value of exploited. Spectre lets the JavaScript snoop on the contents of RAM within the same process. Given that most web browsers perform tab-granularity sandboxing, that basically means that the JavaScript can snoop on all of the data that's associated with the tab that provided the JavaScript. It may mean that malicious JavaScript in an ad can snoop credentials from the enclosing page if it's in an iframe, but that's about it. The bigger danger is that this can be combined with other vulnerabilities to provide the disclosure step in a code reuse attack.

For most server workloads, unless you're allowing arbitrary untrusted code to run then it shouldn't matter.

Re:This is BS.

[tomxor]

...and was starting to find performance slipping...

Performance does not "slip" on CPUs, it's not like a mechanical engine with parts that wear out and a gradually decreasing torque... It's your expectations that creep, software that bloats and new software built on the assumption of bleeding edge performance.

Those issues can be alleviated with more OSS which is not trying to push products, I understand this does not suit everyone, especially for all those whom's profession relies on heavy propitiatory media applications (in which case you are locked in a forward march with those vendors), but if you are lucky enough to be potentially free from all that then using decade old hardware today is extremely comfortable and difficult to perceive substantial performance differences without measuring intentionally CPU intensive tasks.

I'm not against progress in hardware of course but intel provide very little carrot and lots of stick with this move... but that stick will driver me elsewhere thanks.

Re:This is BS.

[Archtech]

OK, my processor consumes 130W. Suppose I "upgrade" to one that may be slightly faster, and consumes 50W. So I save 80W.

Over a 12-hour day, that's about 1KWh. Here in England, that costs me 12p (£0.12). Less than 10 cents, or $36.5 a year.

I can live with that financial hit.

Re:This is BS.

[Archtech]

Or about 15 cents (about $55 a year) if I did the arithmetic the right way round.

Re:This is BS.

[Archtech]

Mine was made in 2000, and it is still running fine. My garage mechanic says I'd be foolish to part with it.

Re:This is BS.

[Opportunist]

I'd be interested in the potential threat scenario for these machines due to a bug that requires remote access to a machine for exploitation by a bad actor.

Re:This is BS.

[toddestan]

Electricity isn't free, but neither are high-end processors. If you bought a new one, it might pay for itself by the time it too is 10 years old. Less so if the computer is turned off or in sleep mode when you aren't using it.

PDF ends with "Intel - Experience what's inside"

[JoeyRox]

Apparently what's inside is the experience of abandonment.

nota bene

[phantomfive]

Please note, that just because it receives a microcode update, doesn't mean it's secure. The processors are still buggy as hell.

Code names

[H3lldr0p]

Can we get a run down of the retail names for these CPUs? I feel like Intel is running a fast one on us through these code names.

Bloomfield, Bloomfield Xeon, Clarksfield, Gulftown, Harpertown Xeon C0, Harpertown Xeon E0, Jasper Forest, Penryn/QC, SoFIA 3GR, Wolfdale C0, Wolfdale M0, Wolfdale E0, Wolfdale R0, Wolfdale Xeon C0, Wolfdale Xeon E0, Yorkfield, and Yorkfield Xeon

Are these 2012 or 2014 i5s or i7s? Xeons, are they the server or high end desktop kinds. Did HP or IBM use them in their products? Where should I be looking for more information guys?

Re:Code names

[Anonymous Coward]

Honestly, the response to Intel's behavior should be easy: buy AMD until Intel can fix Meltdown in silicon. They opened a gaping security hole to eek out a 10% performance improvement (which, btw, is what made them competitive over AMD). Why should anyone trust them?

Re:Code names

[EvilSS]

Where should I be looking for more information guys?

Maybe start with the linked PDF instead of asking in here like Intel reads /.

Re:Code names

[Xenolith0]

Wikipedia has a nice table: https://en.wikipedia.org/wiki/List_of_Intel_CPU_microarchitectures#Pentium_4_/_Core_Lines

Re:Code names

[G00F]

I to hate all the code names, buzz words,marketing names, and all that to label a single chip.

Re:Code names

[thegarbz]

I feel like Intel is running a fast one on us through these code names.

You feel like Intel is running a fast one despite a 19 page PDF file linked in the summary with a list of every Intel processor by Code Name, Public Name, CPUID, and Platform ID being listed?

Admission of inadequacy

[Archtech]

'Intel says that processors with a "Stopped" status will not receive microcode updates. The reasons basically vary from "redesigning the CPU micro-architecture is impossible or not worth the effort" to "it's an old CPU" and "customers said they don't need it."'

Well, I am writing this on an Intel Core i-7 940, and I *do* need it. I paid quite a lot for this PC (although a while ago) and I don't see why I should not expect it to work reliably.

In general, moreover, it seems axiomatic that anyone who owns and is using one of those processors marked "Stopped" does need a fix.

It seems that Intel is ready to admit that it was (and may be still) unable to design and build processors that were dependably secure in normal operation.

Also that it is willing to let its customers down without compensation.

Re:Admission of inadequacy

[MightyYar]

I'd waggle my cane at you and give you a lecture about disposable culture and such... but depending on where he gets his electricity from, this may not be a valid criticism.

Re:Admission of inadequacy

[Anonymous Coward]

You mean like having your passwords, encryption keys, and who knows what else swiped via javascript thus making using a web browser on most sites (which require javascript to function thanks to AJAX and such) a huge security risk?

Re:Admission of inadequacy

[tomxor]

Name one function that you use that has become unreliable and for which you deserve compensation.

Oh fuck off please... your argument is the same as Equifax's defence that it's ok to leak everyone's sensitive info because it's impossible to prove direct damages.

Re:Admission of inadequacy

[nbritton]

Well, I am writing this on an Intel Core i-7 940, and I *do* need it. I paid quite a lot for this PC (although a while ago)

Do you know that you can pickup a Xeon X5670 for $30 on eBay?

Re:Admission of inadequacy

[tomxor]

Your CPU still works fine, it's just if you run the wrong software then there's the possibility someone might be able to hack you

You do realise that your definition of "wrong software" is anything that runs potentially untrusted code that does not also contain spectre specific mitigation.

Re:Admission of inadequacy

[tomxor]

Yeah, just sandbox any risky software by running it in a vm... oh wait.

Yup only if you are happy turning off hardware virtualisation for super slow performance, oh and of course make sure you are running a hypervisor with spectre mitigation patches... Yeah I feel safe... I just have to make sure I don't use the wrong software... you know the software that has intel mitigation's sprinkled everywhere because that's the right way to fix this of course.

Re:Admission of inadequacy

[thegarbz]

and I don't see why I should not expect it to work reliably.

I don't see what reliability has to do with it. Is something not working reliably right now? I'll tell you what didn't work reliably, the last microcode update. If reliability is your concern you should probably prevent any microcode update from being installed given what happened last time it was released.

It seems that Intel is ready to admit that it was (and may be still) unable to design and build processors that were dependably secure in normal operation.

No. The only thing that you can seemingly imply from this situation is that Intel was unable to design and build a processor which allows this specific bug to be patched via microcode. And if you think that bugs in Intel, or AMD, or any other processor manufacturer are rare then you've clearly never looked up an errata document.

e.g.
Intel's Skylake errata list is already a 69 page document with 159 identified spec breaks. Some with workarounds, many without.
AMD is harder to list since they don't cover the entire generation in one document, but as an example Bulldozer processors 00h-0Fh errata list is a 95 page document, and there are about 4 other documents covering the family.

Designing processors is HARD, and no you won't get compensated for every unfixable bug that is found, in fact historically speaking you haven't even been compensated for 0.1% of the unfixable bugs found from any vendor.

Re:Admission of inadequacy

[DRJlaw]

You mean like having your passwords, encryption keys, and who knows what else swiped via javascript thus making using a web browser on most sites (which require javascript to function thanks to AJAX and such) a huge security risk?

So it's your position that browser mitigations do not exist or are insufficient?

Re:Admission of inadequacy

[DRJlaw]

You do realise that your definition of "wrong software" is anything that runs potentially untrusted code that does not also contain spectre specific mitigation.

Yes, I'm sure that you carefully vet all of the code that is running on your personal computer to ensure that it cannot break out of its virtualization sandbox.

Conversely, I'm sure that you're allowing third parties to execute code on your personal computer all the time and not just in a web browser.

Because if it's the former, you're a liar, and if it's the latter, you have just about the most inefficient ad hoc datacenter operation of all time.

Re:Admission of inadequacy

[tomxor]

Yes, I'm sure that you carefully vet all of the code that is running on your personal computer to ensure that it cannot break out of its virtualization sandbox.

You are arguing in my favor, it's even more likely anyone of those arbitrary environments to not have spectre and meltdown mitigations in place.

I'm sure that you're allowing third parties to execute code on your personal computer all the time and not just in a web browser

Yes, we all do, but I don't run them all under root.

Re:Gah please don't shoot us!

[Opportunist]

Live by the QWORD, die by the QWORD.

Re:Gah please don't shoot us!

[Archtech]

Speaking for myself, at least, I have no axe to grind with Intel employees in general. I am sure they are mostly splendid people, quite brainy, and morally admirable.

I suspect that the people responsible for this and other disasters are mainly PHBs (within the strict meaning of the term). Who listened to their Alices and Dilberts explaining the risks, and then decided to rush right ahead anyway, because it's the quarter's bottom line that counts.

and Manhattan erupted in

[nimbius]

the deafening cacophony of cheers and laughter as class action suit attorneys joined hands together again in a fit of glorious praise. For today, the Intel legal team had truly blessed them with a bountiful harvest. Yes, truly, the second summer home in the Hamptons would see a new wet bar and game room after all.

Refunds

[xxxLCxxx]

It's okay. Who wants updates anyway? ### REFUND ### is the word! ;-)

WTF

[DontBeAMoran]

Intel has so many CPUs that they can't even keep track of all of them.

They listed the old Core 2 Duo of my Mac mini as STOPPED (shocking, I know), but I can't even find the i5-4660 of my gaming PC in the document.

Re:WTF

[CriticalYetLazy]

Should be Haswell, which is not included in mentioned list (and therefor should recieve an update).

Re:WTF

[freeze128]

Don't search by model name/number. Instead, find your CPU's cpuid code and search the document for that.

Re:WTF

[squiggleslash]

Well, the i5-4660 doesn't actually exist. The 4660 is a Xeon. There is an i5-4460 though.

The i5-4460 is a Haswell. Haswell is covered in the document, it's just instead of listing by four digit number, for Haswell they list by product families. It's the first entry on page 9. FWIW, the Xeon E5-4660 is also listed directly by four digit number, that's in the third row on the same page, just in the improbable event you actually do have a Xeon in your gaming PC.

Re:WTF

[DontBeAMoran]

You're right it's actually 4460 and not 4660.

Re:WTF

[dunkelfalke]

What is so improbable about it? There are LGA2011 gaming motherboards out there. My gaming CPU is a E5-2665

Re:BIZX says...

[Opportunist]

So what, your phone manufacturer can't be assed to support UTF-8.

Apple can't move to ARM fast enough

[shm]

Really wish Apple had gone with AMD.

New wish. Apple should buy Intel for their fabs and shut the rest down.

Re:Apple can't move to ARM fast enough

[Rockoon]

Apple still cant afford to buy Intel, but that wont be a problem soon. I've been saying that Intel is in very serious trouble since their first round of layoffs and their new "cloud focus" marking. That hasnt changed.

These bugs are bad for Intel, but their real problem is much much deeper. They've lost their process edge and are now falling behind. They wasted several years trying to get 10nm 3D tri-gates working because 14nm 3D tri-gates was what gave them their huge lead. Dont know how much money they directly burned chasing their dead end design, but the real cost is the time. They were over a generation ahead. Now they are a walking into being a generation behind and no indication that they figured out 10nm yet.

What about their just-announced CPUs?

[DontBeAMoran]

Are the new i5, i7 and i9 CPUs also vulnerable to these flaws?

Re:What about their just-announced CPUs?

[xxxLCxxx]

Yes.

RL Support Timelines

[Zorro]

You can still buy parts for a 1955 Chevy or a 1964 Ford Mustang so why not an old computer?

For all the noise about "The Environment" you can do more by just using things as long as possible.

Re:RL Support Timelines

[mckwant]

I hear you, but there are valid reasons for driving a '55 Chevy. I'm a 2000 Civic guy myself, but old cars are pretty, and if mechanic-ing is your thing, Godspeed.

Less confident that's the case here, though. I haven't tracked Intel names for a while now, but got bored/curious, data Wikipedia except for one:

Bloomfield / Bloomfield Xeon: 4c/8t, running 2.4-3.3GHz, produced '08-'11.
Clarksfield: Mobile Quad i7, 1.6-2.0GHz base, 3.2 turbo. 45W TDP, produced '08-11.
Gulftown: 6 cores running 3.2-3.4GHz, production started in '11
Harpertown: Quad core, 2-3.4GHz, produced '07-present
Jasper Forest: Quad core, 1.7-2.4GHz, produced '10-present
Penryn: Mobile C2D, 2-4 cores, 1.2-3GHz, produced '07-'11
SoFIA 3GR: (Intel page) 2W TDP, 1.1GHz Atoms, and that's enough about that
Wolfdale: 2 cores, 2.5-3.5GHz, produced '07-'11
Yorkfield: Quad core, 2.3-3.2GHz, produced '07-'11

What in there is worth the time to refurbish? Bloomfield/Gulftown, we'll talk, maybe, but it would literally have to drop into my lap, come in a fully functioning box, and I'd have to invent a task for it. Even then, finding memory/cards/etc. would be problematic, and you're definitely stuck on USB 2.0. At best. No, I'm not doing the research.

I can see why folks are getting their shorts in a bind, but let's pump the brakes a little bit, anyway. I dunno. Probably just another "Yeah, you're officially old now" moment.

Re:RL Support Timelines

[Teun]

Sure, manufacturing has an environmental impact but only once.
Running outdated CPU's has an energy impact every day. (Cycles per Watt)
Remember modern GPU's are also large energy sponges.

Re:RL Support Timelines

[Anne Thwacks]

Cos CPU manufacturers own more congress-critters than the entire motor industry, and its easier to form/hide a cartel of two or three than a cartel of seven or more?

Re:RL Support Timelines

[grep -v '.*' *]

"Yeah, you're officially old now"

I'd agree with that comment, but I can't quite remember how old I actually am. Are 8080 CPUs and Digital Research's CP/M still a thing? PIP, anyone?? CALL 5??? Squeeze Q files???? Colonel David Winthrop????? (Sigh...)

Now get off my lawn and be sure and take some dandelions as you go.

Re:TRUMP's FAULT!!

[Penguinisto]

...didn't realize Trump worked for Intel's marketing department ;)

On a more serious note, the real reason is kinda two-fold:

* The marketing ROI is crap for many of these CPU models, to the point where the goodwill generated is gonna be way too low for the effort required to implement the fixes in them.

* The second reason can be summed up as "...maybe it's time to for you to buy some new gear...", which is still pretty much in Intel's favor (of course there's always going to be folks who get pissy enough about it to buy AMD CPU gear, but I'm betting that since most folks only see these fixes as a hindrance, the number of people going to AMD over this is not much more than statistical noise...)

It really doesn't matter for Linux...

[emil]

As long as "Full generic retpoline" is reported in the /sys/devices/system/cpu/vulnerabilities/spectre_v2 file, Spectre (and likely Meltdown) are not a concern.

The best was to accomplish that for Red Hat environments is to install Oracle's kernel RPM for the "Unbreakable Enterprise Kernel" (UEK).

Re:It really doesn't matter for Linux...

[Joey Vegetables]

Still waiting for Spectre patches to hit stable gentoo-sources. Meltdown wasn't a concern for AMD. Also, don't the retpoline patches depend on patched CPU microcode?

Re:It really doesn't matter for Linux...

[emil]

As I understand it, only Skylake and later CPUs are not completely addressed by retpolines.

Ubuntu released a kernel that reported this around 2/15.

Red Hat released one with partial support that seemed to require microcode around 3/8.

Oracle implemented the Full generic support starting 3/14.

Re:Old CPU's...and does it matter?

[freeze128]

A BIOS update would certainly be nice, but it's not necessary. The OS can apply microcode updates (both windows and linux) during boot time. Also, these microcode updates don't survive a power-off event. There is no flash memory on the CPU. The OS would need to apply the microcode on every boot, which is what it does.

Re:Old CPU's...and does it matter?

[AndroSyn]

AFAIK, these microcode updates need to be incorporated into a bios update.

Incorrect. Most operating systems have the ability to upload a microcode update very early in their boot process.

This link explains the Linux driver: microcode.txt

If I remember correctly, Windows has a similar method(but I do not know Windows well enough to confirm this).

This is not entirely fair.

[emil]

AMD isn't pushing a Spectre fix for older CPUs. Nor is Qualcomm for Snapdragon. Nor is Samsung for Exynos. We could go on for quite a long time with such a list.

If you need the fix for your i7 which Intel has abandoned (just like all the vendors above), run a modern Linux kernel where you see the file /sys/devices/system/cpu/vulnerabilities/spectre_v2. If this file contains the word "Full" then your kernel is protected, and you don't need microcode.

The microcode is only required on Skylake and newer for full remediation.

Re:This is not entirely fair.

[Archtech]

Thanks. That is a really useful, helpful reply - and I appreciate it.

Re:Old CPU's...and does it matter?

[Anonymous Coward]

You can update microcode post boot. Is there some specific reason this cannot be done?

Re:This! Is! Slashdot!

[Joey Vegetables]

Yeah, that could be taken several different ways, but let's just say that even though I'm well past the prime of my youth, I rarely get complaints about either one.

Cortex A75

[emil]

Do you think that ARM will be replacing all the Cortex A75s that are vulnerable to the full range of Meltdown and Spectre vulnerabilities? Are we sure that Apple's ARM implementations will have superior security architecture?

Re: Cortex A75

[shm]

Well there aren't any certainties in life. A few years ago I'd have asserted yes. But looking at the QA on macOS the last few releases, I'm not so sure.

Re:PDF ends with "Intel - Experience what's inside

[Shotgun]

Or that unpleasant feeling of fullness while being raped?

Linux applies microcode directly.

[emil]

OpenBSD just got this capability also.

$ rpm -qi microcode_ctl | tail -3
The microcode update is volatile and needs to be uploaded on each system boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts back to the old microcode.

Re:2008? Time to upgrade.... to Threadripper

[Tempest_2084]

Same here. I don' game on my PC so I don't need anything fancy, just an average graphics card and some RAM (12GB because it was cheap). Everything runs just fine (Windows 10 and Ubuntu). We're long past the 'need to upgrade every 3-4 years or be left in the dust' thing.

Unrealistic expectations

[sjbe]

None of this makes me feel any more inclined to favor Intel over AMD. This isn't their first "brown paper bag" bug and I doubt it will be their last.

AMD has bugs in their chips too. They're vulnerable to Spectre as well.

If only a 3 year warranty is even offered on some of the highest-end chips they made at the time, when some new cars are warrantied for 10

You only see a 10 year warranty on powertrains (which seldom break) and even then it isn't a 10 year warranty, It's typically a 10 year OR 100,000 mile warranty, whichever comes first. The comprehensive warranties are 3-5 years OR 30-50K miles.

I think that says something really awful about even Intel's own assessment of whether its products can be supported in the long term.

Find me ANY large chip maker offering support on a ten year old chip. Why would they offer support on chips that by computer industry standards are ancient when none of their competitors do either? AMD certainly isn't offering 10 year warranties.

AMD may or may not be drastically better, but Intel has set a very low bar, and it is going to take them serious time to earn back my business, assuming they ever do.

Sounds to me like you already preferred AMD and were just looking for a reason to bash Intel. If you prefer AMD that's fine. They make good products in general and I'd have no quarrel with someone choosing AMD chips. But if you think AMD is going to be any better on the support front than Intel you are being naive.

Re:Unrealistic expectations

[Joey Vegetables]

I'll admit a certain amount of distrust of Intel right now. They did not behave as I expected them to. AMD may one day prove to be just as bad, or even worse, but, as of right now, I consider them as having by far the better track record, and I will give them the benefit of the doubt for as long as there is doubt to give them the benefit of.

and the funny naming is more BS

[swschrad]

processors do not identify to an operating system as "FurTongue Hyper," they identify with some alphanumeric code. so it does no good to say FurTongue45 is supported and DirtyTail6 is not. the whole thing is a load of nonsense that hides what's under the hood. a pox on all chipmakers' houses.

Baby I'm Amazed

[jonesy16]

The sheer number of insults being thrown at Intel over this issue is pure amazement. Comparisons to cars (#causeSlashdot) and of course to AMD (#flameon), but it seems to me that there are far too great of expectations for the level of support a company should provide, especially given the sheer complexity of a processor and how it relates to security threats. To expect the design of something like a general purpose CPU to be perfect out of the door and error-free for the next several decades seems ridiculous to me. The claims that people now have to throw away their hardware because of this seem equally ridiculous.

At some point, ANY for-profit company is going to stop supporting an old product, especially in a low-margin environment. The sheer rate of technological advancement almost necessitates that. Let's stop blaming Intel for what is effectively an industry-normal rate of support. Consider that 10 years ago:

We were on the 2.4 Linux Kernel (no longer supported with updates)
Intel Processors were running on LGA775 sockets (NewEgg sells only 2 compatible motherboards directly, both from ASRock. ASUS/Gigabyte/ETC all don't sell compatible motherboards anymore)
We were running RHEL 2/3/4, all of which are no longer supported

But I don't see anyone griping that these other entities are engaged in the practice of forced upgrades, leaving their trusted and loyal customers hanging in the face of growing security concerns. So maybe all the Intel bashing should either subside or should be expanded to the entire industry, but I think the latter is a bit naive. Security threats evolve, new ones are created, old ones forgotten or mitigated. If it were easy, there wouldn't be a dozen new packages to update my OS every day. Remember that Intel can't just push all updates to these older architectures by themselves either, some require BIOS updates and now you're expecting motherboard companies to update a product they haven't touched in a decade as well.

Re:Baby I'm Amazed

[dmpot]

Consider that 10 years ago:

We were on the 2.4 Linux Kernel (no longer supported with updates)

Linux 2.6 was released in December 2003.

Re:Baby I'm Amazed

[thegarbz]

We were on the 2.4 Linux Kernel (no longer supported with updates)

And the absurdity of that is if you did apply the microcode update, and did enable KPTI you would still get a net increase in speed simply by upgrading the kernel to something more modern.

Re:Baby I'm Amazed

[iggymanz]

you talk like an Intel shill, do you own stock?

The flaws have existed for 2 decades.

Intel's first reaction was to say the OS vendors would have to make software fixes for their garbage design.

Re:Baby I'm Amazed

[jonesy16]

Seems irrelevant, but yes, I do own Intel stock (it has more than doubled the performance of AMD's stock over 10 years, but again I fail the see the relevance of that to this conversation). I also own Intel processors and have owned processors from Apple (iPhone), Digital (DEC Alpha), AMD (Opteron), IBM (PowerPC), and I'm sure others I can't remember right now. And the funny thing is ... they all worked and probably would still today if all of the supporting hardware was still around. I'm also pretty sure that if we found a flaw (and I'm sure we could) in any of those processors, the manufacturer would tell me where I could put it if the product was more than 10 years old.

Flaws have existed in nearly every product ever released since the beginning of time, there is little expectation that anything is perfect and companies that support their products well are rewarded, but there is a limit to the amount of support people should expect or demand, in my opinion. This is not a situation unique to Intel, and AMD is nearly as culpable for the same activities, just like the performance hit they took with the Phenom when their "flaw" was patched through a BIOS modification that affected performance (https://www.anandtech.com/show/2477/2).

Intel's design was not garbage, it just swung farther toward optimizing for performance than it did for security (and they weren't alone as most chip designers did the same thing). This is a learning curve that everyone is going through and at some point we will have to decided whether we value an extra 5% performance or protection against specific forms of security threats. As a home user you may opt for the security protection, an airgapped data center may prefer the extra performance shortcuts that sacrifice some security.

We, as consumers, drove the market to this place, by constantly demanding additional performance from hardware vendors. Now we're realizing maybe we went too far and we'll see that probably scale back and be rethought as a result. But let's stop pretending that Intel has to be the scapegoat and let's stop blaming them for not supporting 10-year-old hardware when nobody else is doing that either.

Re:Baby I'm Amazed

[iggymanz]

These flaws make the manufacturer's specs and claims of security lies.

No, the consumers did not demand bad design. That was Intel's doing.

Intels design is garbage, done with complete and reckless disregard for security. The flaws were pointed out two decades ago and they never ever bothered to fix it.

Re:Please join class action lawsuits

[xxxLCxxx]

We could add a few more:

• CEO - illegally - selling all his shares after he received notice that their "bugs" were going to come afloat
• CEO being caught lying about it
• paid "journalists" and a surreal smear campaign against the main adversary
• "rewarding" shops for kicking out the adversary (past, lost in courts and it doesn't seem to have changed much)

• ...

Re:CPU identification is a mess

[Teun]

Using Kinfocenter I saw my CPU is listed as an i7-2760QM
The search for i7-2 brought it up, they call it a Sandy Bridge.

Re:Old CPU's...and does it matter?

[kalpol]

Correct me if I am wrong but I don't think Windows applies microcode.

Those damned users should buy new hardware!

[gweihir]

How else is Intel going to get even richer? Users that run old hardware, simply because it is still good enough are a plague in Intel's profits! This is a perfectly fine opportunity to force them to upgrade and should not be missed.

In completely unrelated news, I am currently planning to get a nice new Ryzen 2 system when they become available.

And I thought my server's CPU wasn't even affected

[demon driver]

So that's just a few weeks from (an of course premature and ill-conceived) "oh, my server's CPU doesn't seem to be affected" (because in the beginning of the spectre/meltdown aftermath it wasn't even on Intel's official list) to "oh, my server's CPU not only is very much affected indeed, it won't even get the necessary microcode anymore". And no, that server is definitely not being used in a closed environment. And no, it is neither uncommon nor unreasonable to use ten-year-old servers for purposes which need limited horsepower, while still profiting from all the bells and whistles of a server like a lights-out feature with its own network interface and a full-fledged RAID controller.

Thank you, Intel, for giving me such a determining reason for future purchase decisions, the next of which seems to be closer than I thought until a few minutes ago (or wanted, for that matter).

Re:Old CPU's...and does it matter?

[freeze128]

You're wrong.

Interesting what's on the list and what's not

[rlk]

In the first generation mobile Core i processors (i7-xxx and i5-xxx), the low end ones (i7-6xx, i5-4xx, i3-3xx) are fixed, but the higher end ones (i7-7xx, i7-8xx, i7-9xx) are being stopped. Same is true with the desktop processors.

I suspect that's a matter of what's architecturally viable to fix as opposed to *ahem* marketing considerations. Perhaps the processor in question has more aggressive speculative execution baked into the hardware that's difficult (if possible at all) to mitigate.

Examine your expectations

[sjbe]

I'll admit a certain amount of distrust of Intel right now. They did not behave as I expected them to.

Seriously not meaning to sound snide but perhaps your expectations are unrealistic? I think there is no reasonable basis to expect AMD would have behaved any differently than Intel in the same situation. Intel has done pretty much exactly what I expected them or any rational profit seeking company to do.

Re:TRUMP's FAULT!!

[OneAhead]

* The second reason can be summed up as "...maybe it's time to for you to buy some new gear...", which is still pretty much in Intel's favor (of course there's always going to be folks who get pissy enough about it to buy AMD CPU gear, but I'm betting that since most folks only see these fixes as a hindrance, the number of people going to AMD over this is not much more than statistical noise...)

To me, the "customers said they don't need it" part (when applied to Bloomfield and Gulftown) sounds like "the crowd who's spent hundreds of dollars for a few % speed increase would wilfully opt out of the performance-crippling patches anyway". Though I've seen a few posts here contradicting that line of reasoning.

Woo Hoo! I'm on the List!

[xanthos]

Running a old Dell T5400 with the dual Harpertowns that I picked up used. No microcode patch to slow me down, no sir!

Dual quad cores running at 3Ghz. That's like 24Ghz right?

Not too bad

[viperidaenz]

These are the Core 2 and very first Core I series processors from 8 to 10 years ago.

Hour long are they expected to keep updating microcode? Especially when apparently their customers that pretty for support don't want too bother with these old CPUs

Re:Not too bad

[iggymanz]

10 year old computers are useful for all mainstream serious activities: word processing, spreadsheets, email, browsing

also I7 no ecc less pci-e less ram channels lower

[Joe_Dragon]

also I7 no ecc less pci-e less ram channels lower ram cap.

Re:PDF ends with "Intel - Experience what's inside

[bongey]

"Intel- Experience when it's inside you with no lube"

Re:Old CPU's...and does it matter?

[short]

> apply the microcode on every boot

Only after a powercycle, reboot keeps the updated firmware in CPU.

Re:CPU identification is a mess

[Zontar The Mindless]

Looks like I'm already covered:

#~> cat /proc/cpuinfo | grep -e model -e bugs | head -3 | tail -2
model name : Intel(R) Core(TM) i7-4771 CPU @ 3.50GHz
bugs : cpu_meltdown spectre_v1 spectre_v2

Re: TRUMP's FAULT!!

[Miamicanes]

I miss the golden days of "Socket 7", when I went for what seemed like almost 10 years by just swapping CPUs (at one point, keeping the current cpu & replacing the mobo with another socket 7 mATX board for some reason I can't remember. No matter how hard Intel tried to kill it, everyone else treated it like a de-facto standard & it just became even MORE entrenched until PC-100 ram finally became too limiting (and expensive... from what I recall, 128mb of pc100 cost about 2-3x as much as 128mb of pc133 or DDR-1, to the point where you could pay for a new mobo with the ram savings alone).

Microcode is not the same as code

[Vektuz]

They're not kidding when they say "sometimes its impossible". Microcode is NOT general purpose code. There's only so much you can do with microcode, and it often involves just messing with voltage timings and gates that are already part of the silicon. Granted, I'm sure some supply-demand / cost/benefit analysis is going on, but please challenge the assumption that they can just 'fix the bug' with microcode updates.

You largely can't reprogram what the CPU's underlying silicon actually does, using microcode. People keep talking about it like its some complete programming language. It is not.

a better analogy would be that it is similar to a program that is running the system for controlling railroad track switching. You can make the trains do a lot by making them switch tracks and change direction and so forth, but there's only so much you can do - the tracks they go on and the location of the switches are pre-set.

Re:TRUMP's FAULT!!

[OneAhead]

Oh never mind, the 'customers said they don't need it' was paraphrased from the following sentence in TFA: 'Based on customer inputs, most of these products are implemented as “closed systems” and therefore are expected to have a lower likelihood of exposure to these vulnerabilities.' So that makes it more likely they were actually referring to the 'SoFIA 3GR': a low-powered Atom part.