Contract J · )seq Sample Clauses

Contract J · )seq. This contract exposes the program counter and the locations of memory accesses on sequential, non-speculative paths; see Figure 2. J · )seq is a fundamental baseline that is often implicitly assumed in practice, and that has also been formalized in [17], [21]. ct ct In Section VI-A we show that J·)seq is satisfied by a simple in-order processor without speculation. However, modern out- of-order processors do not satisfy J · )seq, as shown below. LOAD p(a(pc)) = load x, e ⟨m, a⟩−→⟨m′, a′⟩ LOAD rule from Figure 2 as follows: Load p(a(pc)) = load x, e ⟨m, a⟩−→⟨m′, a′⟩ load (|e|)(a) ′ ′ ⟨m, a⟩ −⇀ct ⟨m , a ⟩ (a) =m((|e|)(a)) seq ′ ′ Store ⟨m, a⟩ −⇀arch⟨m , a ⟩ arch p(a(pc)) = store x, e ⟨m, a⟩−→⟨m′, a′⟩ As we assume that register values are zeroed in the ini- (a) seq tial state, the J · )seq trace effectively exposes the contents ⟨m, a⟩ −⇀ct ⟨m′, a′⟩ of registers during execution. While this does not seem to arch guarantee any kind of security, J · )seq does guarantee the Beqz-Sat arch p(a(pc)) = beqz x, ℓ ⟨m, a⟩−→⟨m′, a′⟩ confidentiality of data that is only transiently loaded, thus effectively preventing speculative disclosure gadgets. In that pc a′(pc) seq ′ ′ sense, the contract J · )seq is a simple and clean formulation ⟨m, a⟩ −⇀ct ⟨m , a ⟩ of the idea behind transient noninterference [5], making it comparable to the guarantees offered by other contracts, and ct