一句话：提出微码级上下文敏感栅栏，按动态条件选择性注入 fence，抵御多种 Spectre 攻击并显著降低开销。
本文面向 Spectre 及其多种变体，研究如何在处理器微码层面以低开销阻断投机执行导致的侧信道泄漏。现有基于软件的 fencing 机制往往保守地插入栅栏，严重损害投机执行等关键性能特性。为此作者提出上下文敏感栅栏（CSF）：利用动态改写指令流解码的能力，仅在动态条件表明需要时无缝注入新的微操作（包括 fence），使处理器在保持攻击防护的同时尽量不影响投机执行。论文还考察了多种替代 fence 实现，并引入三类新型 fence，允许大多数动态 load/store 重排序，但阻止投机访存改变可见 cache 状态。评估表明，这些优化将防御机制的性能开销相比最先进的软件 fencing 机制降低六倍。
This paper describes context-sensitive fencing (CSF), a microcode-level defense against multiple variants of Spectre. CSF leverages the ability to dynamically alter the decoding of the instruction stream, to seamlessly inject new micro-ops, including fences, only when dynamic conditions indicate they are needed. This enables the processor to protect against the attack, but with minimal impact on the efficacy of key performance features such as speculative execution. This research also examines several alternative fence implementations, and introduces three new types of fences which allow most dynamic reorderings of loads and stores, but in a way that prevents speculative accesses from changing visible cache state. These optimizations reduce the performance overhead of the defense mechanism, compared to state-of-the-art software-based fencing mechanisms by a factor of six.