RE: [PATCH 23/35] x86/speculation: Add basic speculation control code

[Van De Ven, Arjan]

> Enabling IBRS does not prevent software from controlling the predicted
> targets of indirect branches of unrelated software executed later at
> the same predictor mode (for example, between two different user
> applications, or two different virtual machines). Such isolation can
> be ensured through use of the IBPB command, described in Section
> 2.5.3, âIndirect Branch Predictor Barrier (IBPB)â.
> 
> So maybe it's poorly written, but I see nothing in that language that
> suggests that IBRS=1 (on a CPU without enhanced IBRS) provides any
> guarantees at all about who can or cannot control speculation of
> indirect branches in user mode.

there is no such guarantee. Some of the IBRS implementations will actually flush rather than disable, or flush parts and disable other parts.

yes the wording is a bit cryptic, but it's also very explicit about what it covers (and the rest is not covered!) and had to allow a few different implementations unfortunately.