On Wed, 2018-01-10 at 16:56 +0100, Paolo Bonzini wrote: > On 10/01/2018 16:48, Woodhouse, David wrote: > >> > >> And what is the point of this "always set IBRS=1" then? Are there > >> some other things lurking in the shadows? > > Yes. *FUTURE* CPUs will have a mode where you can just set IBRS and > > leave it set for ever and not worry about any of this, and the > > performance won't even suck. > > > > Quite why it's still an option you have to set in an MSR, and not just > > a feature bit that they advertise and do it unconditionally, I have no > > idea. But apparently that's the plan. > > And again---why you still need IBPBs. That also escapes me. I wouldn't > be surprised if that's just a trick to sneak it in a generation earlier... There was some suggestion in early development that guests/processes with a different CR3 or different VMCS would be considered "mutually less privileged". It got dropped, and I'm sure we'll have clarification before IBRS_ATT actually gets released. I think the current docs do suggest that you need IBPB on context switch (and vmptrld) still. But I expect that *might* go away if we're lucky. And really, we have other things to work on for now before we support hypothetical future hardware :)
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
