The protection here is to ensure the vms are isolated. Without doing this there is the potential you can leak data via speculative execution across guests.

If the community is up for merging this (which is a genuine question - the complexity hit is significant) I expect it to become the default everywhere and for most people it should be a performance win Vs the current default.

But, yes. Not there right now, which is annoying. I'm hoping the community is willing to start merging this anyway with the trust we can get it to be really fast later. But they might say "no, we need a full prototype that's super fast right now", which would be fair.

What kind of workloads have noticeably lower performance with VBS?

The RISC-V ISA has an effort to standardize a timing fence[1][2], to take care of this once and for all.

0. https://tomchothia.gitlab.io/Papers/EuroSys19.pdf

1. https://lf-riscv.atlassian.net/wiki/spaces/TFXX/pages/538379...

2. https://sel4.org/Summit/2024/slides/hardware-support.pdf

So I should probably post something more realistic, and compare against the old mitigations. This will make ASI look a LOT better. But I'm being very careful not to avoid looking like a salesman here. It's better that I risk making things look worse than they are, than risk having people worry I'm hiding issues.

Before doing this though, you need to be sure that ASI actually protects all the memory you care about. The version that currently exists protects all user memory but if the kernel copies something into its own memory it's now unprotected. So that needs to be addressed first (or some users might tolerate this risk).