☰

Spectre 变体 2 不受硬件支持

tag-icon • tag-icon cpu vmware intel
Spectre 变体 2 不受硬件支持

我已经安装了最新的英特尔微代码更新以使用 Spectre 变体 #2 修复程序，但是Spectre&Meltdown 检查器仍然显示不能使用 IBRS/IBPB。

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  YES
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO
    * IBRS enabled for User space:  NO
    * IBPB enabled:  NO
* Mitigation 2
  * Kernel has branch predictor hardening (arm):  NO
  * Kernel compiled with retpoline option:  NO
  * Kernel compiled with a retpoline-aware compiler:  NO
> STATUS:  VULNERABLE  (Your kernel is compiled with IBRS but your CPU microcode is lacking support to successfully mitigate the vulnerability)

dmesg 显示已安装最新版本。

# dmesg | grep microcode
[    1.199842] microcode: CPU0 sig=0x206d7, pf=0x1, revision=0x713
[    1.199860] microcode: CPU1 sig=0x206d7, pf=0x1, revision=0x713
[    1.199877] microcode: CPU2 sig=0x206d7, pf=0x1, revision=0x713
[    1.199898] microcode: CPU3 sig=0x206d7, pf=0x1, revision=0x713
[    1.199966] microcode: Microcode Update Driver: v2.01 <[email protected]>, Peter Oruba

CPU 是Intel(R) Xeon(R) CPU E5-2420 0 @ 1.90GHz，主机类型是ESXi-5.1.0-20130402001-standard

答案1

5.5 之前的 ESXi 版本不支持 IBPB 和 IBRS 虚拟机管理程序直通所需的功能。看VMware 知识库条目了解详情。

要缓解 Spectre 变体 2 的影响，您需要升级 ESXi，或切换到启用 retpoline 的内核。

相关内容