Yesterday AMD's CTO Mark Papermaster penned a security blog update describing Spectre mitigations delivered to Microsoft Windows users via Patch Tuesday downloads. The updates which started to roll out yesterday from Microsoft deliver code containing Google Project Zero (GPZ) Variant 2 (Spectre) mitigations at an operating system level. If you are a Linux user, AMD recommended mitigations for GPZ Variant 2 were made available earlier in 2018.
To make things clear, AMD reminds readers that it already delivered GPZ Variant 1 (Spectre) mitigations through operating system updates earlier this year. Furthermore, Papermaster re-stated the assertion that the GPZ Variant 3 (Meltdown) does not apply to AMD because of its processor design.
GPZ Variant 2 (Spectre) mitigations aren't as simple to deliver as those for Spectre 1, they need both OS patches and firmware (microcode) patches to be delivered and work in concert. In other words, yesterday's Windows 10 (version 1709) updates including the AMD supplied patches have to be partnered with updates from AMD hardware partners such as motherboard and systems makers.
On the topic of the scope of the microcode updates, Papermaster wrote that "our recommended mitigations addressing Variant 2 (Spectre) have been released to our customers and ecosystem partners for AMD processors dating back to the first 'Bulldozer' core products introduced in 2011". While that may be the case, we would expect modern Ryzen era motherboards / systems to get microcode updates first with some older boards and systems likely to be neglected. That is the way this business works, as borne out by the experience people have had with the distribution of Intel Spectre 2 fixing BIOS updates.
