Efficiently mitigating transient execution attacks using the unmapped speculation contract
© 2020 Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020. All rights reserved. Today's kernels pay a performance penalty for mitigations-such as KPTI, retpoline, return stack stuffing, speculation barriers-to protect against transient execution s...
| Main Authors: | , , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
2021
|
| Online Access: | https://hdl.handle.net/1721.1/137797 |
| _version_ | 1826196026991575040 |
|---|---|
| author | Behrens, J Cao, A Skeggs, C Belay, A Frans Kaashoek, M Zeldovich, N |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Behrens, J Cao, A Skeggs, C Belay, A Frans Kaashoek, M Zeldovich, N |
| author_sort | Behrens, J |
| collection | MIT |
| description | © 2020 Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020. All rights reserved. Today's kernels pay a performance penalty for mitigations-such as KPTI, retpoline, return stack stuffing, speculation barriers-to protect against transient execution side-channel attacks such as Meltdown [21] and Spectre [16]. To address this performance penalty, this paper articulates the unmapped speculation contract, an observation that memory that isn't mapped in a page table cannot be leaked through transient execution. To demonstrate the value of this contract, the paper presents WARD, a new kernel design that maintains a separate kernel page table for every process. This page table contains mappings for kernel memory that is safe to expose to that process. Because a process doesn't map data of other processes, this design allows for many system calls to execute without any mitigation overhead. When a process needs access to sensitive data, WARD switches to a kernel page table that provides access to all of memory and executes with all mitigations. An evaluation of the WARD design implemented in the sv6 research kernel [8] shows that LEBench [24] can execute many system calls without mitigations. For some hardware generations, this results in performance improvement ranging from a few percent (huge page fault) to several factors (getpid), compared to a standard design with mitigations. |
| first_indexed | 2024-09-23T10:19:39Z |
| format | Article |
| id | mit-1721.1/137797 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T10:19:39Z |
| publishDate | 2021 |
| record_format | dspace |
| spelling | mit-1721.1/1377972023-04-14T15:15:01Z Efficiently mitigating transient execution attacks using the unmapped speculation contract Behrens, J Cao, A Skeggs, C Belay, A Frans Kaashoek, M Zeldovich, N Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory © 2020 Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020. All rights reserved. Today's kernels pay a performance penalty for mitigations-such as KPTI, retpoline, return stack stuffing, speculation barriers-to protect against transient execution side-channel attacks such as Meltdown [21] and Spectre [16]. To address this performance penalty, this paper articulates the unmapped speculation contract, an observation that memory that isn't mapped in a page table cannot be leaked through transient execution. To demonstrate the value of this contract, the paper presents WARD, a new kernel design that maintains a separate kernel page table for every process. This page table contains mappings for kernel memory that is safe to expose to that process. Because a process doesn't map data of other processes, this design allows for many system calls to execute without any mitigation overhead. When a process needs access to sensitive data, WARD switches to a kernel page table that provides access to all of memory and executes with all mitigations. An evaluation of the WARD design implemented in the sv6 research kernel [8] shows that LEBench [24] can execute many system calls without mitigations. For some hardware generations, this results in performance improvement ranging from a few percent (huge page fault) to several factors (getpid), compared to a standard design with mitigations. 2021-11-08T19:34:23Z 2021-11-08T19:34:23Z 2020 2021-01-25T18:58:19Z Article http://purl.org/eprint/type/ConferencePaper https://hdl.handle.net/1721.1/137797 Behrens, J, Cao, A, Skeggs, C, Belay, A, Frans Kaashoek, M et al. 2020. "Efficiently mitigating transient execution attacks using the unmapped speculation contract." Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020. en Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020 Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf MIT web domain |
| spellingShingle | Behrens, J Cao, A Skeggs, C Belay, A Frans Kaashoek, M Zeldovich, N Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title | Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title_full | Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title_fullStr | Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title_full_unstemmed | Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title_short | Efficiently mitigating transient execution attacks using the unmapped speculation contract |
| title_sort | efficiently mitigating transient execution attacks using the unmapped speculation contract |
| url | https://hdl.handle.net/1721.1/137797 |
| work_keys_str_mv | AT behrensj efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract AT caoa efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract AT skeggsc efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract AT belaya efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract AT franskaashoekm efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract AT zeldovichn efficientlymitigatingtransientexecutionattacksusingtheunmappedspeculationcontract |