Summarize this in key points:
for modern superscalar processors. Among the attack variants, Spectre-BTB and Spectre-RSB are the
most threatening because they allow adversaries to execute arbitrary code in the transient execution
context. However, there are few mitigation techniques for these Spectre variants due to the high degree
of implementation difficulty. In this paper, we propose MicroCFI, a hardware/software co-design approach
to mitigate Spectre-BTB and Spectre-RSB. The main idea of MicroCFI is to enforce control-flow integrity
(CFI) in microarchitectural level of a program’s execution. Specifically, MicroCFI strictly limits possible
forward and backward indirect branch targets predicted by BTB and RSB by imposing CFI properties on
all potential targets. As indirect branches only have destinations to valid targets that satisfy these properties,
MicroCFI significantly reduces the chance of arbitrary code execution in Spectre attacks. We implemented
a prototype of MicroCFI using an LLVM compiler and performed an evaluation on MARSSx86, a simulator
for x86 microarchitectures. The security evaluation shows that MicroCFI reduces the number of available
Spectre gadgets by more than 90%, significantly increasing the complexity of the attack. The performance
evaluation using the SPEC CPU 2017 benchmarks shows that MicroCFI introduces negligible performance
overhead.

I. INTRODUCTION
MODERN processors employ various optimization
techniques such as out-of-order and speculative execution
to maximize instruction-level parallelism. Unfortunately,
these optimization techniques are prone to microarchitectural
attacks [1]–[8]. Spectre [1] is one of the attacks
that exploit a vulnerability in speculative execution, allowing
attackers to leak secret from a victim across a protectiondomain
boundary. The vulnerability arises from the fact that
although misspeculation cause no changes in the architecture,
it can leave a trace in microarchitectural components such as
the cache. An attacker exploits this weakness by intentionally
inducing misspeculation in a victim’s domain, thus encoding
confidential data to the cache. The attacker then uses a cache
covert channel [9]–[11] to decode the data. The Spectre
attack has several variants, including Spectre-PHT, Spectre-
BTB, and Spectre-RSB, which differ in the branch prediction
units they exploit [1], [12]–[17]
Spectre-BTB and Spectre-RSB attacks differ from
Spectre-PHT in their use of indirect branches instead of
directional branch instructions. Since indirect branches have
no target restrictions, these attacks can result in speculative
arbitrary code execution, causing a more significant security
risk than Spectre-PHT. Despite this higher threat level,
most studies have mainly concentrated on Spectre-PHT [18]–
[27], with less attention paid to mitigating Spectre-BTB and
Spectre-RSB attacks. This is primarily due to the high complexity
in implementing mitigation techniques. Spectre-BTB
(RSB) attack uses multiple branch targets, making it more
difficult to block potential gadgets compared to Spectre-PHT
attacks, which only utilize direct conditional branches with
two branch targets.
Several security measures are available to prevent Spectre-
BTB and Spectre-RSB attacks. Retpoline [28] and microcode