Yes, it's certainly easier to mitigate at a boundary that's already as costly as switching between VMs. The paper documents that disabling SMT does not entirel

Yes, it's certainly easier to mitigate at a boundary that's already as costly as switching between VMs. The paper documents that disabling SMT does not entirely mitigate the problem (In 9.1). They briefly mention trying instructions to avoid the microarchitectural leaks, but don't go into more detail than mentioning verw isn't sufficient. They state that a switch to/from SGX, with SMT disabled, doesn't prevent the attacks. See 8.1. That's not the same as a cross-vm switch, but it's certainly interesting that the attempts at flushing microarchitectural state when exiting SGX don't provide protection.