JumpSwitches: Restoring the Performance of Indirect Branches In the Era of Spectre
Talkat USENIX ATC '19 · on Thursday, 2019-07-11· at 17:10· USENIX ATC Track II: Grand Ballroom VII–IX·
summary
JumpSwitches implement just-in-time promotion of indirect calls by runtime learning, an efficient patching worker thread, and on-the-fly binary rewriting integrated into Linux v4.18. They convert frequent indirect targets into direct calls, use index-mapped syscall trees and per-process kernel code pages to handle syscall diversity, and fall back to retpoline when uncertain. Evaluation shows up to 20% better performance than retpolines, occasional wins over unmitigated kernels by reducing mispredictions, and submitted patches upstream.
AI-written summary · about
chapters (7)
- 0:00Understanding spectre v2
- 1:43Retpoline limitations
- 2:49Indirect branch promotion
- 5:57Handling complex branches
- 9:37Optimizing call chains
- 11:27Performance results
- 14:40Q&A and discussion
related talks
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
14mBranch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...
16mPatchlings: Enabling A/B-Equivalent OTA Updates for Deeply Embedded...
21mASC-Hook: Efficient System Call Interception for ARM
34mDynamic mitigations
27mMitigating speculative execution attacks with ASI - follow up
34mXOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
36mStore-to-Leak Forwarding: There and Back Again