On Tue, 20 Nov 2018, Tim Chen wrote: > According to software guidance: > > "Setting ... STIBP ... on a logical processor prevents the predicted > targets of indirect branches on any logical processor of that core > from being controlled by software that executes (or executed > previously) on another logical processor of the same core." > > https://software.intel.com/security-software-guidance/insights/deep-dive-single-thread-indirect-branch-predictors > > Hence setting STIBP on a sandboxed task will prevent the task > from attacking other sibling threads or getting attacked. That's not sufficient, because you need an IBPB when the sandboxed task is switched out. Thanks, tglx
