The following command queries the current tunable settings for the next boot, as well as the current runtime. This command also indicates whether there is hardware support for Variant #2/Spectre.
sys smcvemgt --query
Command for enabling patches with default settings
The following command enables patches for Variant #2/Spectre and Variant #3/Meltdown, where Variant #2/Spectre is configured for default mode. In default mode, the kernel selects the Variant #2/Spectre mitigation mechanism based on the CPU architecture of the host machine.
sys smcvemgt --set enabled
Commands for enabling patches with specific settings
The following command enables patches for Variant #2/Spectre and Variant #3/Meltdown, where Variant #2/Spectre is set to kernel space only.
sys smcvemgt --set v2=kernel v3=enabled
The following command enables patches for Variant #2/Spectre, which are configured for user space with Retpoline, or return trampoline. Variant#3/Meltdown retains its current settings.
sys smcvemgt --set v2=user+retp
Command for disabling patches
The following command disables patches for Variant #2/Spectre and Variant #3/Meltdown.
sys smcvemgt --set disabled
Command for disabling patches for a specific vulnerability
The following command disables patches for Variant #3/Meltdown. Variant #2/Spectre retains its current settings.
