Retpoline – Google’s fix for Spectre
Linux 4.15 has been released with an implementation of Google’s “retpoline” fix.
The fix addresses the Spectre security vulnerability.
Spectre, and its related vulnerability Meltdown, allow a feature in all modern CPUs called speculative execution to be exploited to gain access to sensitive data.
“Retpoline” is a portmanteau of “return” and “trampoline”, and refers to a software construct that allows indirect branches of a program to be isolated from speculative execution.
Google said its fix aims to address only the second variant of Spectre, which its Project Zero team described as branch target injection.
“Naturally, protecting an indirect branch means that no prediction can occur,” said Google, suggesting a performance impact.
The performance impact was insignificant, however.
“There has been speculation that the deployment of kernel page table isolation (KPTI) causes significant performance slowdowns,” said Google.
“Performance can vary, as the impact of the KPTI mitigations depends on the rate of system calls made by an application. On most of our workloads, including our cloud infrastructure, we see negligible impact on performance.”
Benchmarks by Phoronix corroborate Google’s statement.
Now read: Intel patch for Spectre and Meltdown causing problems
Loading ...