Supporting taint tracking Sample Clauses

Supporting taint tracking. To support taint tracking, we label entries in the reorder buffer with sets of reorder buffer’s indexes. A labeled command is of the form i@T L where i@T is a reorder buffer entry and L N is a label, i.e., the set of indexes of the entries i@T depends on. potentially transient loads have a non-empty label. In contrast, newly fetched assignments x e are labelled with the union of the labels associated with the registers occurring in e. That is, assignments that depend only on non-transient values are labelled with 0/ , whereas those depending on potentially unlbl(buf , fetch) = mask(buf ) unlbl(buf , retire) = drop(buf ) .mask(buf ) if transmit(buf | ) Consider two configurations σ and σj that agree on the values of A, B, y, and size_A and for which σ (y) > σ (size_A), i.e., the array A is speculatively accessed out ¢ (ct ¢ct ¢ of bounds. Furthermore, assume that σ (A + y) = 0 and unlbl(buf , execute i) = drop(buf ) otherwise σj(A + y) = 1. Then, pc ⊥ p seq σ ) = ¢p seq(σj) = load A+y · drop(ε) := ε drop((i@T)L · buf ) := i@T · drop(buf ) mask(ε) := ε . However, the hardware semantics can potentially leak information through the data cache if the hardware specula- tively executes the load on line 5. Indeed, the load on line 1 is labeled with 0/ since it is not transient. Hence, the load mask((i@T)L · buf ) := x ← ⊥@T · mask(buf ) if L = 0/ ∧ i = x ← e i@T · mask(buf ) otherwise operation on line 5, which depends on the result of line 1, is not delayed (even though transient operations relying on its result would be delayed since line 5 is labeled with the index corresponding to the unresolved branch in line 3). By probing the state of the cache an attacker can determine whether