Target injection safe method for inlining instance-dependent calls
A method for redirecting indirect calls to direct calls on a per-process basis includes accessing a memory code region of an operating system kernel that has a different mapping for each of one or more user processes running on the operating system kernel. The memory code region stores a first trampoline that refers directly to a second trampoline, which is an inline or outline trampoline that is correlated with a particular user process. Executing the first trampoline invokes the second trampoline, as a result of which the indirect calls are redirected to direct calls.
1. A method for redirecting indirect calls to direct calls on a per-process basis, the method comprising:
accessing a memory code region of an operating system kernel that has a different mapping for each of one or more user processes running on the operating system kernel, the memory code region including a first trampoline residing at a virtual address and a second trampoline, the second trampoline being an inline trampoline that is correlated with a particular one of the one or more user processes, wherein the second trampoline resides at a physical address to which the virtual address is mapped, and contains one or more direct calls which are made in place of indirect calls; and
executing the first trampoline at the virtual address to invoke the second trampoline at the physical address.
2. The method of claim 1 , wherein the first trampoline resides at a fixed virtual address in the memory code region, the fixed virtual address being mapped to a process-specific physical address.
3. The method of claim 1 , wherein the second trampoline has fallback code which allows the second trampoline to operate as an indirect call.
4. The method of claim 1 , wherein the second trampoline has fallback code which allows the second trampoline to operate as a retpoline, which is a return trampoline containing an indirect call, the retpoline preventing speculative execution until a destination branch address of the indirect call is determined.
5. The method of claim 1 , wherein the second trampoline has an expansion mode which allows the second trampoline to access a list of destination branch addresses as possible branch addresses.
6. The method of claim 1 , wherein a template for the second trampoline is installed in the operating system kernel at compile time.
7. The method of claim 1 , wherein the second trampoline has a learning phase and an update phase.
8. The method of claim 7 , further comprising, in the update phase, updating the direct call in the second trampoline template by updating the second trampoline template while the operating system kernel is running.
9. A system for redirecting indirect calls to direct calls on a per-process basis, the system comprising:
a memory containing one or more user processes, and an operating system kernel having a memory code region that has a different mapping for each user process; and
one or more CPUs coupled to the memory, the one or more CPUs running the operating system kernel and the one or more user processes, wherein the operating system kernel is configured to access the memory code region, the memory code region including a first trampoline residing at a virtual address and a second trampoline, the second trampoline being an inline trampoline that is correlated with a particular one of the one or more user processes, wherein the second trampoline resides at a physical address to which the virtual address is mapped, and contains one or more direct calls which are made in place of indirect calls, and
wherein the operating system kernel executes the first trampoline at the virtual address to invoke the second trampoline at the physical address.
10. The system of claim 9 , wherein the first trampoline resides at a fixed virtual address in the memory code region, the fixed virtual address being mapped to a process-specific physical address.
11. The system of claim 9 , wherein the second trampoline has fallback code which allows the second trampoline to operate as an indirect call.
12. The system of claim 9 , wherein the second trampoline has fallback code which allows the second trampoline to operate as a retpoline, which is a return trampoline containing an indirect call, the retpoline preventing speculative execution until a destination branch address of the indirect call is determined.
13. The system of claim 9 , wherein the second trampoline has an expansion mode which allows the second trampoline to access a list of destination branch addresses as possible branch addresses.
14. The system of claim 9 , wherein the second trampoline has a learning phase and an update phase, and the operating system kernel is further configured to, in the update phase, update the direct call in the second trampoline template by updating the second trampoline template while the operating system kernel is running.
15. A non-transitory computer-readable medium comprising instructions executable in a computer system, wherein the instructions when executed in the computer system cause the computer system to carry out a method of redirecting indirect calls to direct calls on a per-process basis, the method comprising:
accessing a memory code region of an operating system kernel that has a different mapping for each of one or more user processes running on the operating system kernel, the memory code region including a first trampoline residing at a virtual address and a second trampoline, the second trampoline being an inline trampoline that is correlated with a particular one of the one or more user processes, wherein the second trampoline resides at a physical address to which the virtual address is mapped, and contains one or more direct calls which are made in place of indirect calls; and
executing the first trampoline at the virtual address to invoke the second trampoline at the physical address.
16. The non-transitory computer-readable medium of claim 15 , wherein the first trampoline resides at a fixed virtual address in the memory code region, the fixed virtual address being mapped to a process-specific physical address.
17. The non-transitory computer-readable medium of claim 15 , wherein the second trampoline has fallback code which allows the second trampoline to operate as an indirect call.
18. The non-transitory computer-readable medium of claim 15 , wherein the second trampoline has fallback code which allows the second trampoline to operate as a retpoline, which is a return trampoline containing an indirect call, the retpoline preventing speculative execution until a destination branch address of the indirect call is determined.
19. The non-transitory computer-readable medium of claim 15 , wherein the second trampoline has an expansion mode which allows the second trampoline to access a list of destination branch addresses as possible branch addresses.
20. The non-transitory computer-readable medium of claim 15 , wherein the second trampoline has a learning phase and an update phase, and the method further comprises, in the update phase, updating the direct call in the second trampoline template by updating the second trampoline template while the operating system kernel is running.