硬體不支持 Spectre 變體 2

我已安裝最新的英特爾微碼更新以使用 Spectre 變體 #2 修復，但Spectre&Meltdown 檢查器仍顯示無法使用 IBRS/IBPB。

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
 * Kernel is compiled with IBRS/IBPB support:  YES
 * Currently enabled features
   * IBRS enabled for Kernel space:  NO
   * IBRS enabled for User space:  NO
   * IBPB enabled:  NO
* Mitigation 2
 * Kernel has branch predictor hardening (arm):  NO
 * Kernel compiled with retpoline option:  NO
 * Kernel compiled with a retpoline-aware compiler:  NO
> STATUS:  VULNERABLE  (Your kernel is compiled with IBRS but your CPU microcode is lacking support to successfully mitigate the vulnerability)

dmesg 顯示已安裝最新版本。

# dmesg | grep microcode
[    1.199842] microcode: CPU0 sig=0x206d7, pf=0x1, revision=0x713
[    1.199860] microcode: CPU1 sig=0x206d7, pf=0x1, revision=0x713
[    1.199877] microcode: CPU2 sig=0x206d7, pf=0x1, revision=0x713
[    1.199898] microcode: CPU3 sig=0x206d7, pf=0x1, revision=0x713
[    1.199966] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba

CPU 是Intel(R) Xeon(R) CPU E5-2420 0 @ 1.90GHz，主機類型是ESXi-5.1.0-20130402001-standard

早於 5.5 的 ESXi 版本不支持 IBPB 和 IBRS 的管理程序直通所需的功能。有關詳細資訊，請參閱VMware KB 條目。

要緩解 Spectre 變體 2，您需要升級 ESXi，或切換到啟用 retpoline 的核心。

引用自：https://unix.stackexchange.com/questions/436007