Contract seq. This contract exposes the program counter and the locations of memory accesses on sequential, {| · |} € ¢ · ¢ if, for all programs p and all initial architectural
Contract seq. This contract exposes the program counter, the location of all loads and stores, and the values of all data loaded from memory on standard, i.e., non-speculative, program paths. The contract is obtained by modifying the Note that if · 1 exposes only a subset of the labels of · 2, then 1 is stronger than 2 according to Definition 2. For example, the instructions explored by spec are also explored by seq, and the observations of ct are contained in the observations of arch. This enables us to arrange all contracts defined in §III-B in the lattice [23] shown in Figure 4. ¢ Finally, as expected, a hardware platform that satisfies a contract · ¢1 also satisfies all weaker contracts ¢ · ¢2. STEP ROLLBACK BARRIER p(σ (pc)) =ƒ beqz x, A σ ~− ct σj s = (σj, ωj) · sj p(σ (pc)) = spbarr σ ~− ct σj (σ, ω + 1) · s τ spec σj, ω)· s σ 0 s pc σj(pc) specs (σ, ω + 1) · s τ spec σj, 0) · s BRANCH ~− ct (
Contract seq. This contract exposes the program counter and the locations of memory accesses on sequential, non-speculative paths; see Figure 2. ¢ · ¢seq is a fundamental baseline that is often implicitly assumed in practice, and that has also been formalized in [17], [21]. ct ct In Section VI-A we show that ¢·¢seq is satisfied by a simple in-order processor without speculation. However, modern out- of-order processors do not satisfy ¢ · ¢seq, as shown below. LOAD p(a(pc)) = load x, e (m, a)−→(m′, a′) LOAD rule from Figure 2 as follows: LOAD p(a(pc)) = load x, e (m, a)−→(m′, a′) load (|e|)(a) ′ ′ (m, a) − − −⇀ct (m , a ) STORE arch p(a(pc)) = store x, e (m, a)−→(m′, a′)
(a) =m((|e|)(a)) seq ′ ′ (m, a)− − − − − − −⇀arch(m , a ) As we assume that register values are zeroed in the ini-
(a) seq tial state, the ¢ · ¢seq trace effectively exposes the contents (m, a)− − − −⇀ct (m′, a′) of registers during execution. While this does not seem to arch guarantee any kind of security, ¢ · ¢seq does guarantee the BEQZ-SAT arch p(a(pc)) = beqz x, ℓ (m, a)−→(m′, a′) confidentiality of data that is only transiently loaded, thus effectively preventing speculative disclosure gadgets. In that pc a′(pc) seq ′ ′ sense, the contract ¢ · ¢seq is a simple and clean formulation (m, a)− − −⇀ct (m , a ) ct
Contract seq. This contract exposes the program counter, the location of all loads and stores, and the values of all data loaded from memory on standard, i.e., non-speculative, program paths. The contract is obtained by modifying the • ¢ · ¢⊥ exposes all architectural state and corresponds to a hypothetical processor that provides no confidentiality guar- antees whatsoever.
