Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

How to hide the speculative-execution control mechanism for virtual machines in a VMware Cloud Foundation environment (52381)

Last Updated: 2/16/2018Categories: How toTotal Views: 3173Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

This article provides instructions for hiding the speculative-execution control mechanism for virtual machines in a VMware Cloud Foundation environment.

Resolution

Note: Using the following steps will employ the resolution noted in Intel Sightings in ESXi Bundled Microcode Patches for VMSA-2018-0004.

Download and extract the appropriate attached file:

​52381_213-sos-esx-microcode-patch.zip for VMware Cloud Foundation 2.1.3 environments
52381_22_23-sos-esx-microcode-patch.zip for VMware Cloud Foundation 2.2 or 2.3 environments.

Copy the extracted sos-fix folder to the /tmp folder on the SDDC Manager Controller virtual machine.

SSH to the SDDC Manager Controller virtual machine (or the VRM virtual machine if a 2.1.3 environment) as the root user.

Issue the following commands to patch the sos executable:

cd /tmp/sos-fix
sh patch.sh

Note: You see output similar to:

SOS Version :  2.3.0-7506102
Backup all existing files which we are going to update under /opt/vmware/sddc-support
Patch /opt/vmware/sddc-support with new binaries
Patch completed successfully.
Execute /opt/vmware/sddc-support/sos --help to see Intel Sightings remediate options

Issue the following command to query the management workload domain:

/opt/vmware/sddc-support/sos --verify-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.2 or 2.3

/opt/vmware/evosddc-support/sos --verify-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.1.3

Note: You see output similar to:

Welcome to Supportability and Serviceability(SoS) utility!
NOTE : SoS may fail if workflow is undergoing password rotation operation, run SoS when no workflows are in flight.

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-28-03-2222
Verify ESXi Microcode update has been applied as stated per https://kb.vmware.com/s/article/52085
ESXi Status :
-------------

+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
| SL# | NODE |              CPU               | Microcode  | IBRPresent | IBPBPresent | STIBPresent | HypervisorAssistedGuestAffected | IntelSighting |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
|  1  | R1N8 | Intel(R) Xeon(R) Gold 6130 CPU | 0x0200003a |    True    |     True    |     True    |              False              |      True     |
|     |      |           @ 2.10GHz            |            |            |             |             |                                 |               |
|  2  | R1N6 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  3  | R1N5 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  4  | R1N3 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+

Virtual Machine Status :
------------------------

+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+
| SL# |         NODE         |                       VM Name                       | IBRPresent | IBPBPresent | STIBPresent |  vHW   | HypervisorAssistedGuestAffected |
+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+
|  1  | r1n8.vcf.vmware.corp |                   vRealize-Edge-0                   |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      |                    vrops-replica                    |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                  vrops-data-node-1                  |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                        psc-2                        |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      | NSX_Controller_ba6de5ba-444e-4210-82a1-6ffef2a58501 |    True    |     True    |     True    | vmx-10 |              False              |
|  2  | r1n6.vcf.vmware.corp |                   loginsight-vm-1                   |    True    |     True    |     True    | vmx-09 |              False              |
|     |                      |                        psc-1                        |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      | NSX_Controller_d7fcbc0d-01db-41db-8fae-afb4eb3f7559 |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      |               SDDC Manager Controller               |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      |                   vRealize-Edge-1                   |    True    |     True    |     True    | vmx-10 |              False              |
|  3  | r1n5.vcf.vmware.corp |                   loginsight-vm-2                   |    True    |     True    |     True    | vmx-09 |              False              |
|     |                      |                 SDDC Manager Utility                |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      | NSX_Controller_d4508e19-33d5-409c-80ac-0063f520c173 |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      |                        vrslcm                       |    True    |     True    |     True    | vmx-10 |              False              |
|     |                      |                      vcenter-1                      |    True    |     True    |     True    | vmx-10 |              False              |
|  4  | r1n3.vcf.vmware.corp |                   loginsight-vm-3                   |    True    |     True    |     True    | vmx-09 |              False              |
|     |                      |                    nsx-manager-1                    |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                     vrops-master                    |   False    |    False    |    False    | vmx-08 |               N/A               |
+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+

The value of IntelSighting can contain four potential values:
--------------------------------------------------------------

*      True = ESXi host contains microcode update is affected by Intel Sighting, you
will need to apply the workaround as outlined in
https://kb.vmware.com/s/article/52345
*      False = CPU not affected by Intel Sighting it is currently recommended to only
apply one of the ESXi patches (until Intel provides a microcode update fix),
please refer to https://kb.vmware.com/s/article/52345 for full details
*      AffectedOncePatched = CPU is affected by Intel Sighting, but does not , need the
work around unless it is patched or has a BIOS update
*      N/A = CPU is not Intel

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-28-03-2222
Log file : /var/tmp/intel-sightings-Patch-2018-01-18-16-28-03-2222/sos.log​

Note: Make a note of any virtual machines that have a False status under the HypervisorAssistedGuestAffected column as they will need to be power cycled in a subsequent step.

If any hosts are affected as noted in the previous command, issue the following command to enable the Hypervisor-Assisted Guest Mitigation fix on those hosts:

/opt/vmware/sddc-support/sos --apply-esxi-microcode-patch --domain-name MGMT - for 2.2 or 2.3
/opt/vmware/evosddc-support/sos --apply-esxi-microcode-patch --domain-name MGMT - for 2.1.3

Note: You see output similar to:

Welcome to Supportability and Serviceability(SoS) utility!
NOTE : SoS may fail if workflow is undergoing password rotation operation, run SoS when no workflows are in flight.

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-47-07-16969

Patch Intel Sightings workaround on ESXi as outlined by https://kb.vmware.com/s/article/52345
ESXi Status :
-------------

+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
| SL# | NODE |              CPU               | Microcode  | IBRPresent | IBPBPresent | STIBPresent | HypervisorAssistedGuestAffected | IntelSighting |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
|  1  | R1N8 | Intel(R) Xeon(R) Gold 6130 CPU | 0x0200003a |    True    |     True    |     True    |              False              |      True     |
|     |      |           @ 2.10GHz            |            |            |             |             |                                 |               |
|  2  | R1N6 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  3  | R1N5 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  4  | R1N3 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+

Patching Intel Sightings workaround on above affected ESXi..

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-47-07-16969
Log file : /var/tmp/intel-sightings-Patch-2018-01-18-16-47-07-16969/sos.log

In the vSphere Web client, power off and back on any virtual machines with a False status under the HypervisorAssistedGuestAffected column in Step 3.

8. Issue the following command to verify the status of the ESXi hosts and virtual machines in the management workload domain:

/opt/vmware/sddc-support/sos --verify-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.2 or 2.3
/opt/vmware/evosddc-support/sos --verify-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.1.3

Note: You see output similar to:

Welcome to Supportability and Serviceability(SoS) utility!
NOTE : SoS may fail if workflow is undergoing password rotation operation, run SoS when no workflows are in flight.

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-55-04-2867
Verify ESXi Microcode update has been applied as stated per https://kb.vmware.com/s/article/52085
ESXi Status :
-------------

+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
| SL# | NODE |              CPU               | Microcode  | IBRPresent | IBPBPresent | STIBPresent | HypervisorAssistedGuestAffected | IntelSighting |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+
|  1  | R1N8 | Intel(R) Xeon(R) Gold 6130 CPU | 0x0200003a |    True    |     True    |     True    |              False              |      True     |
|     |      |           @ 2.10GHz            |            |            |             |             |                                 |               |
|  2  | R1N6 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  3  | R1N5 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
|  4  | R1N3 |  Intel(R) Xeon(R) CPU E5-2660  | 0x0b000025 |    True    |     True    |     True    |              False              |      True     |
|     |      |          v4 @ 2.00GHz          |            |            |             |             |                                 |               |
+-----+------+--------------------------------+------------+------------+-------------+-------------+---------------------------------+---------------+

Virtual Machine Status :
------------------------

+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+
| SL# |         NODE         |                       VM Name                       | IBRPresent | IBPBPresent | STIBPresent |  vHW   | HypervisorAssistedGuestAffected |
+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+
|  1  | r1n8.vcf.vmware.corp |                   vRealize-Edge-0                   |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      |                    vrops-replica                    |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                  vrops-data-node-1                  |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                        psc-2                        |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      | NSX_Controller_ba6de5ba-444e-4210-82a1-6ffef2a58501 |   False    |    False    |    False    | vmx-10 |              True               |
|  2  | r1n6.vcf.vmware.corp |                   loginsight-vm-1                   |   False    |    False    |    False    | vmx-09 |              True               |
|     |                      |                        psc-1                        |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      | NSX_Controller_d7fcbc0d-01db-41db-8fae-afb4eb3f7559 |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      |               SDDC Manager Controller               |   False    |    False    |    False    | vmx-10 |               True              |
|     |                      |                   vRealize-Edge-1                   |   False    |    False    |    False    | vmx-10 |              True               |
|  3  | r1n5.vcf.vmware.corp |                   loginsight-vm-2                   |   False    |    False    |    False    | vmx-09 |              True               |
|     |                      |                 SDDC Manager Utility                |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      | NSX_Controller_d4508e19-33d5-409c-80ac-0063f520c173 |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      |                        vrslcm                       |   False    |    False    |    False    | vmx-10 |              True               |
|     |                      |                      vcenter-1                      |   False    |    False    |    False    | vmx-10 |              True               |
|  4  | r1n3.vcf.vmware.corp |                   loginsight-vm-3                   |   False    |    False    |    False    | vmx-09 |              True               |
|     |                      |                    nsx-manager-1                    |   False    |    False    |    False    | vmx-08 |               N/A               |
|     |                      |                     vrops-master                    |   False    |    False    |    False    | vmx-08 |               N/A               |
+-----+----------------------+-----------------------------------------------------+------------+-------------+-------------+--------+---------------------------------+

The value of IntelSighting can contain four potential values:
--------------------------------------------------------------

*      True = ESXi host contains microcode update is affected by Intel Sighting, you
will need to apply the workaround as outlined in
https://kb.vmware.com/s/article/52345
*      False = CPU not affected by Intel Sighting it is currently recommended to only
apply one of the ESXi patches (until Intel provides a microcode update fix),
please refer to https://kb.vmware.com/s/article/52345 for full details
*      AffectedOncePatched = CPU is affected by Intel Sighting, but does not , need the
work around unless it is patched or has a BIOS update
*      N/A = CPU is not Intel

Logs : /var/tmp/intel-sightings-Patch-2018-01-18-16-55-04-2867
Log file : /var/tmp/intel-sightings-Patch-2018-01-18-16-55-04-2867/sos.log

Repeat Steps 5 through 8 against any other workload domains in the VMware Cloud Foundation environment by replacing MGMT with the other workload domain names in the previous commands.

If there are any hosts that are not part of a workload domain, issue the following command to enable the Hypervisor-Assisted Guest Mitigation fix on them:

/opt/vmware/sddc-support/sos --apply-esxi-microcode-patch --unassigned-hosts - for 2.2 or 2.3
/opt/vmware/evosddc-support/sos --apply-esxi-microcode-patch --unassigned-hosts - for 2.1.3

Notes:

If the environment in question is a mutli-rack, 2.1.3 environment, the previous steps will need to be performed on all VRM virtual machines.

Once a proper microcode patch is released by Intel and applied to the affected hosts, the following command can be run to revert the change made in Step 4:

/opt/vmware/sddc-support/sos --revert-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.2 or 2.3
/opt/vmware/evosddc-support/sos --revert-esxi-microcode-patch --domain-name MGMT --get-vms-status - for 2.1.3

The preceding command should also be run against any additional workload domains that were addressed in Step 9.

After reverting the change, Virtual Machines will need to be power cycled again, per Step 5.

Related Information

For more information, see:

Hypervisor-Assisted Guest Mitigation for branch target injection
Intel Sightings in ESXi Bundled Microcode Patches for VMSA-2018-0004

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

52381_22_23-sos-esx-microcode-patch.zip

52381_213-sos-esx-microcode-patch.zip

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
将 VMware Cloud Foundation 升级到版本 2.3 后，“VDI 工作流：配置 Horizon View Cloud Pod 架构”的任务挂起 (52397)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Cloud Foundation

Related Versions:

Take Our Survey

Support Assistant