On Wed, 2018-01-10 at 12:54 +0100, Andrea Arcangeli wrote: > On Wed, Jan 10, 2018 at 09:27:59AM +0000, David Woodhouse wrote: > > I don't know why you're calling that 'IBRS=2'; are you getting > confused > > by Andrea's distro horridness? > > Eh, yes he's got confused. ibrs_enabled 2 simply means to leave IBRS > set in SPEC_CTLR 100% of the time, except in guest mode.
On all current hardware, if you only set IBRS when you exit a guest, then you are not protecting yourself from userspace at all. IBRS acts as a *barrier* in all current hardware. Future CPUs will have a new feature where you *can* do something like this, but this is not available yet.
smime.p7s
Description: S/MIME cryptographic signature
