Spectre Mitigations Being Worked On For BPF Programs
A "request for comments" patch series sent out on Monday is working on Spectre mitigations for BPF programs using speculation barriers.
Luis Gerhorst sent out the set of nine patches this week that provides for inserting speculation barriers for mitigating Spectre Variant One. Currently such BPF programs are rejected while this new kernel code would automatically insert speculation barriers as needed.
The RFC patches are currently out for review on the Linux kernel mailing list. There still is additional work needed for implementing speculation barriers on ARM64 (AArch64) and other fixes.
Luis presented last year at Linux Plumbers Conference on the concept of using speculation barriers for (e)BPF for mitigating Spectre. The overhead was presented as between 0% and 62% for eBPF execution with this technique depending upon the BPF program / workload.
Luis Gerhorst sent out the set of nine patches this week that provides for inserting speculation barriers for mitigating Spectre Variant One. Currently such BPF programs are rejected while this new kernel code would automatically insert speculation barriers as needed.
The RFC patches are currently out for review on the Linux kernel mailing list. There still is additional work needed for implementing speculation barriers on ARM64 (AArch64) and other fixes.
👁 BPF Spectre speculation barrier slide
Luis presented last year at Linux Plumbers Conference on the concept of using speculation barriers for (e)BPF for mitigating Spectre. The overhead was presented as between 0% and 62% for eBPF execution with this technique depending upon the BPF program / workload.