The vulnerabilities (MDS etc) were published in early 2019. There were some mitigations, in both kernels and browsers, but they were and are not 100%, the only 100% mitigation is still to disable SMT. Do you really want to do that? Most people it seems aren't willing to give up SMT.
This patchset for Linux was originally proposed over 20 months ago:
After refining and optimizing this patch set for quite a while, it's just about as fast as ... just disabling SMT completely (which is a lot simpler). The complexity this adds to the scheduler costs that much.
People/companies really love the _idea_ of getting _all_ the performance of SMT and _all_ the security of mitigations, and don't care as much that you actually still can't have both, so this will be merged eventually.
https://www.mail-archive.com/[email protected]/msg9...
The vulnerabilities (MDS etc) were published in early 2019. There were some mitigations, in both kernels and browsers, but they were and are not 100%, the only 100% mitigation is still to disable SMT. Do you really want to do that? Most people it seems aren't willing to give up SMT.
This patchset for Linux was originally proposed over 20 months ago:
https://lwn.net/Articles/780703/
After refining and optimizing this patch set for quite a while, it's just about as fast as ... just disabling SMT completely (which is a lot simpler). The complexity this adds to the scheduler costs that much.
People/companies really love the _idea_ of getting _all_ the performance of SMT and _all_ the security of mitigations, and don't care as much that you actually still can't have both, so this will be merged eventually.