On Abnormal Execution Timing of Conditional Jump Instructions

TL;DR

The paper investigates abnormal execution timing of conditional jumps caused by their placement in binaries, revealing that macro-op fusion and μop-cache behavior drive slow paths independent of jump operands or speculation. It systematically measures this effect across architectures, validates prevalence in 666 real-world libraries, and demonstrates a practical 32-byte alignment mitigation that yields an average speedup of around $2.15\%$, with higher gains in some cryptographic libraries. It also shows a covert-channel capability of up to $16.14\text{ Mbps}$, underscoring security implications. The work provides concrete mitigation guidance (compiler/assembly options) and supplies open-source artifacts to enable reproducibility and broader adoption across systems.

Abstract

An extensive line of work on modern computing architectures has shown that the execution time of instructions can (i) depend on the operand of the instruction or (ii) be influenced by system optimizations, e.g., branch prediction and speculative execution paradigms. In this paper, we systematically measure and analyze timing variabilities in conditional jump instructions that can be macro-fused with a preceding instruction, depending on their placement within the binary. Our measurements indicate that these timing variations stem from the micro-op cache placement and the jump's offset in the L1 instruction cache of modern processors. We demonstrate that this behavior is consistent across multiple microarchitectures, including Skylake, Coffee Lake, and Kaby Lake, as well as various real-world implementations. We confirm the prevalence of this variability through extensive experiments on a large-scale set of popular binaries, including libraries from Ubuntu 24.04, Windows 10 Pro, and several open-source cryptographic libraries. We also show that one can easily avoid this timing variability by ensuring that macro-fusible instructions are 32-byte aligned - an approach initially suggested in 2019 by Intel in an overlooked short report. We quantify the performance impact of this approach across the cryptographic libraries, showing a speedup of 2.15% on average (and up to 10.54%) when avoiding the timing variability. As a by-product, we show that this variability can be exploited as a covert channel, achieving a maximum throughput of 16.14 Mbps.

Figures (10)

• Figure 1: Overview of the x86 microarchitecture.
• Figure 2: Overview of the micro-op cache of Intel's Skylake microarchitecture. Gray fields represent used $\mu$op slots, indicating that the cache holds valid $\mu$op s ready to be streamed to the IDQ. White fields represent empty or skipped slots due to the cache’s placement policy or alignment restrictions.
• Figure 3: Overview of the x86 fetch paths in the front-end explored in related work (a-c) and this paper (d-e). Green arrows indicate the fast path, whereas red arrows denote the slow path. Two red arrows on the same path denote an additional cycle required for fetching. An orange arrow from the $\mu$op cache represents a scenario in which the IDQ receives some $\mu$op s from the $\mu$op cache while others originate from the decoding pipeline, introducing delays for refilling the decoding pipeline.
• Figure 4: Different placement of a macro-fusible sub and jnz instruction within a 64-byte block. The 32/64B-aligned boundary is marked in red. Those instructions not crossing this boundary are marked in blue, those preventing macro-op fusion (noMFuse) are highlighted in orange, and the other ones (no$\mu$Cache) are marked in gray.
• Figure 5: Example of a loop that decrements a counter by one and jumps to the loop start if the counter is not zero. The loop is instrumented to measure the execution time and different hardware events. The position of the loop in the binary is changed by modifying the number B of NOP instructions.