Mitigating Spectre-PHT using Speculation Barriers in Linux BPF

arXiv:2405.00078v1 Announce Type: new
Abstract: High-performance IO demands low-overhead communication between user- and kernel space. This demand can no longer be fulfilled by traditional system calls. Linux's extended Berkeley Packet Filter (BPF) avoids user-/kernel transitions by just-in-time compiling user-provided bytecode and executing it in kernel mode with near-native speed. To still isolate BPF programs from the kernel, they are statically analyzed for memory- and type-safety, which imposes some restrictions but allows for good expressiveness and high performance. However, to mitigate …

arxiv berkeley berkeley packet filter bpf bytecode can communication cs.cr csos demand demands extended berkeley packet filter filter high just-in-time kernel linux low mode near packet performance space spectre speed system transitions