Zkt: explicitely consider timing dependences across several instructions

[ronan-lashermes]

The Concern

The Public Review raised the concern that
Data dependent optimizations are possible at the level of a block of instructions, but the Zkt extension does not mention what is authorized in this case; or if it is out of scope.
Made-up example:

mul a3, a2, a1
mul a6, a5, a4
add a7, a3, a6

At runtime, the processor observes that a5 = a2, and that a3, a6 are overwritten just after. It can replace the instructions with

add a3, a1, a4
mul a7, a3, a5

The instructions are compliant with Zkt, but timing leakage still occurs.
This particular optimization may not exist, but similar data dependent optimizations are often performed in OoO cores.

The recommendation

Explicitly state what is in scope of the extension concerning blocks of instructions. If in scope, decide what is authorized.

[ben-marshall]

Hi @ronan-lashermes

Good catch, the spec could certainly be clearer here. The intent with Zkt is that it only the core functionality of the instructions is in scope. Everything outside of that from branch target buffers to caches to the kinds of fusion / substitution and OoO optimisations you describe here are out of scope. I figure we can add some text to the spec which makes it clear the example you describe is not considered.

@mjosaarinen - Have I got that right?

Cheers,
Ben

[ben-marshall]

Closed with the merge of #137