21 Nov
2018
21 Nov
'18
1:52 p.m.
On Tue, 20 Nov 2018, Tim Chen wrote:
According to software guidance:
"Setting ... STIBP ... on a logical processor prevents the predicted targets of indirect branches on any logical processor of that core from being controlled by software that executes (or executed previously) on another logical processor of the same core."
https://software.intel.com/security-software-guidance/insights/deep-dive-sin...
Hence setting STIBP on a sandboxed task will prevent the task from attacking other sibling threads or getting attacked.
That's not sufficient, because you need an IBPB when the sandboxed task is switched out.
Thanks,
tglx