But can you drop it on a per-thread or per-process or per-core basis? That would help, no?
Just looking for a way out of the mitigation quagmire for people/orgs who own the hardware and don't share it with external untrusted parties. For all the talk about threat modelling, everyone seems to think we all want -20% perf on the whole machine, while only one or two processes do net I/O...