Context-Sensitive Decoding: Exploiting Translated ISAs for Security, Safety, Energy, and Performance

上下文相关解码允许具有翻译的指令集体系结构(例如x86，通常是ARM)的处理器根据例如操作系统设置的条件，将给定指令解码成不同的微操作集。这允许系统透明地添加功能(安全性、性能、能效、调试等)。不更改代码或访问原始源代码即可执行代码。它可以用来以显著降低的成本向未知代码添加安全功能，从而更接近可以始终启用此类安全的点。上下文相关解码可用于为通用处理器(一个由美国公司主导的行业)添加一定程度的专门化，使其能够更好地与特定领域的专门化解决方案竞争，而不会对当前的流水线进行重大更改。许多现代处理器将程序员可见的指令集体系结构(ISA)转换为单独的、更简单的内部ISA。这项研究使传统的静态翻译成为动态的，其中指令可以根据上下文进行不同的解码/翻译。例如，我们可以通过在处理器中设置单个标志，从执行(传统)转换无缝过渡到现在包括数据地址随机化的安全转换。除了安全之外，其他应用程序在编程语言(例如，按需类型安全、范围检查等)、软件工程(全性能调试模式)、剖析和性能编程(比硬件本机支持的性能计数器种类更多、无缝启用或禁用)等领域中大量存在。

Context-Sensitive Decoding allows a processor with a translated instruction set architecture (such as x86, and often ARM) to decode a given instruction into a different set of micro-ops, depending on conditions set, for example, by the operating system. This allows the system to transparently add features (for security, performance, energy efficiency, debugging, etc.) to executing code with no changes to the code or access to the original sources. It could be used to add security features to unknown code with significantly reduced cost, and thus move closer to the point where such security can be always turned on. Context-sensitive decoding can be used to add a level of specialization to general-purpose processors (an industry dominated by US-based companies) that better enables them to compete with domain-specific specialized solutions, with no significant changes to current pipelines.Many modern processors translate the programmer-visible instruction set architecture (ISA) to a separate, simpler internal ISA. This research makes that traditionally static translation dynamic, where instructions can be decoded/translated differently based on context. For example, we can seamlessly transition from a performant (traditional) translation to a secure translation that now includes data address randomization by setting a single flag in the processor. In addition to security, other applications abound in areas such as programming languages (e.g., on demand type safety, range checking, etc.), software engineering (full-performance debug mode), profiling and performance programming (performance counters of much greater variety than supported natively in hardware, seamlessly enabled or disabled), etc.