  Outsourced computation presents a risk to the confidentiality of clients'
sensitive data since they have to trust that the service providers will not
mishandle this data. Blinded Memory (BliMe) is a set of hardware extensions
that addresses this problem by using hardware-based taint tracking to keep
track of sensitive client data and enforce a security policy that prevents
software from leaking this data, either directly or through side channels.
Since programs can leak sensitive data through timing channels and memory
access patterns when this data is used in control-flow or memory access
instructions, BliMe prohibits such unsafe operations and only allows
constant-time code to operate on sensitive data. The question is how a
developer can confirm that their code will run correctly on BliMe. While a
program can be manually checked to see if it is constant-time, this process is
tedious and error-prone.
  In this paper, we introduce the BliMe linter, a set of compiler extensions
built on top of SVF that analyze LLVM bitcode to identify possible BliMe
violations. We evaluate the BliMe linter analytically and empirically and show
that it is sound.
