On Wed, 2018-01-10 at 13:01 +0100, Andrea Arcangeli wrote: > > > On all current hardware, if you only set IBRS when you exit a guest, > > then you are not protecting yourself from userspace at all. IBRS acts > > as a *barrier* in all current hardware. > > Kernel memory is 100% protected if you set only IBRS at vmexit. > > Once IBRS is set, there's no way any userland (nor host nor guest) can > attack the kernel memory through spectre variant#2.
That is not consistent with the documentation I've seen, which Intel have so far utterly failed to publish AFAICT. "a near indirect jump/call/return may be affected by code in a less privileged prediction mode that executed AFTER IBRS mode was last written with a value of 1" The kernel is only protected from branch targets set in userspace *BEFORE* the IBRS mode was last set to 1. If you set it to 1, then leave it like that while you run userspace and then kernel code again, you are not protected.
smime.p7s
Description: S/MIME cryptographic signature
