add IFT options

9 files changed, 58 insertions, 39 deletions

diff --git a/configs/common/CpuConfig.py b/configs/common/CpuConfig.py
index 43539ee4d..21dabdfa9 100644
--- a/configs/common/CpuConfig.py
+++ b/configs/common/CpuConfig.py
@@ -122,6 +122,12 @@ def config_scheme(cpu_cls, cpu_list, options):
                 cpu.allowSpecBuffHit = True
             else:
                 cpu.allowSpecBuffHit = False
+
+            if options.useIFT:
+                cpu.useIFT = True
+            else:
+                cpu.useIFT = False
+
             if len(options.scheme)!=0:
                 cpu.simulateScheme = options.scheme
     else:
diff --git a/configs/common/Options.py b/configs/common/Options.py
index 5d92b446d..89a8eda04 100644
--- a/configs/common/Options.py
+++ b/configs/common/Options.py
@@ -317,6 +317,8 @@ def addCommonOptions(parser):
             "SpectreSafeFence", "FuturisticSafeInvisibleSpec",
             "SpectreSafeInvisibleSpec"],
             help="choose baseline or defense designs to evaluate")
+    parser.add_option("--useIFT", default=None, action="store", type="int",
+            help="Use information flow tracking.")
     parser.add_option("--needsTSO", default=None, action="store", type="int",
                         help="Select TSO or RC. Set unzero to use TSO.")
     parser.add_option("--allowSpecBuffHit", default=None, action="store",
diff --git a/src/cpu/base_dyn_inst.hh b/src/cpu/base_dyn_inst.hh
index d533ad9bf..6301864b7 100644
--- a/src/cpu/base_dyn_inst.hh
+++ b/src/cpu/base_dyn_inst.hh
@@ -478,28 +478,6 @@ class BaseDynInst : public ExecContext, public RefCounted
         _prevDestRegIdx[idx] = previous_rename;
     }
 
-    void taintDestRegs(bool istaint)
-    {
-        for (size_t i = 0; i < numDestRegs(); i++) {
-            auto dstreg = _destRegIdx[i];
-            if (istaint) {
-                cpu->setTaint(dstreg);
-            } else {
-                cpu->clearTaint(dstreg);
-            }
-        }
-    }
-
-    bool srcTainted(void)
-    {
-        bool result = false;
-        for (size_t i = 0; i < numSrcRegs(); i++) {
-            auto src = _srcRegIdx[i];
-            result |= cpu->regTainted(src);
-        }
-        return result;
-    }
-
     /** Renames a source logical register to the physical register which
      *  has/will produce that logical register's result.
      *  @todo: add in whether or not the source register is ready.
diff --git a/src/cpu/o3/O3CPU.py b/src/cpu/o3/O3CPU.py
index 371433eef..1a97faced 100644
--- a/src/cpu/o3/O3CPU.py
+++ b/src/cpu/o3/O3CPU.py
@@ -169,6 +169,7 @@ class DerivO3CPU(BaseCPU):
                                    "The scheme specificed for simulation")
     needsTSO = Param.Bool(False, "Enable TSO Memory model")
     allowSpecBuffHit = Param.Bool(True, "Enable hit/reuse spec buffer entries")
+    useIFT = Param.Bool(False, "use IFT to filter")
 
     def addCheckerCpu(self):
         if buildEnv['TARGET_ISA'] in ['arm']:
diff --git a/src/cpu/o3/dyn_inst.hh b/src/cpu/o3/dyn_inst.hh
index 47dc830e0..d3c67c4cb 100644
--- a/src/cpu/o3/dyn_inst.hh
+++ b/src/cpu/o3/dyn_inst.hh
@@ -81,6 +81,7 @@ class BaseO3DynInst : public BaseDynInst<Impl>
         MaxInstSrcRegs = TheISA::MaxInstSrcRegs,        //< Max source regs
         MaxInstDestRegs = TheISA::MaxInstDestRegs       //< Max dest regs
     };
+    bool isTainted;
 
   public:
     /** BaseDynInst constructor given a binary instruction. */
@@ -415,6 +416,29 @@ class BaseO3DynInst : public BaseDynInst<Impl>
         BaseDynInst<Impl>::setCCRegOperand(si, idx, val);
     }
 
+    void taintDestRegs(bool istaint)
+    {
+        isTainted = istaint;
+        for (size_t i = 0; i < this->numDestRegs(); i++) {
+            auto dstreg = _destRegIdx[i];
+            if (istaint) {
+                cpu->setTaint(dstreg);
+            } else {
+                cpu->clearTaint(dstreg);
+            }
+        }
+    }
+
+    bool srcTainted(void)
+    {
+        bool result = false;
+        for (size_t i = 0; i < this->numSrcRegs(); i++) {
+            auto src = _srcRegIdx[i];
+            result |= cpu->regTainted(src);
+        }
+        return result;
+    }
+
 #if THE_ISA == MIPS_ISA
     MiscReg readRegOtherThread(const RegId& misc_reg, ThreadID tid)
     {
diff --git a/src/cpu/o3/dyn_inst_impl.hh b/src/cpu/o3/dyn_inst_impl.hh
index 03437a5ae..03721d848 100644
--- a/src/cpu/o3/dyn_inst_impl.hh
+++ b/src/cpu/o3/dyn_inst_impl.hh
@@ -109,6 +109,7 @@ BaseO3DynInst<Impl>::initVars()
     this->_readySrcRegIdx.reset();
 
     _numDestMiscRegs = 0;
+    isTainted = false;
 
 #if TRACING_ON
     // Value -1 indicates that particular phase
diff --git a/src/cpu/o3/lsq_unit.hh b/src/cpu/o3/lsq_unit.hh
index 16095ed46..c512ef819 100644
--- a/src/cpu/o3/lsq_unit.hh
+++ b/src/cpu/o3/lsq_unit.hh
@@ -528,6 +528,7 @@ class LSQUnit {
     // Flag for whether defending against spectre attack or future attacks
     bool isFuturistic;
     bool allowSpecBuffHit;
+    bool useIFT;
     /* [mengjia] different schemes determine values of 4 variables. */
 
     // Will also need how many read/write ports the Dcache has.  Or keep track
diff --git a/src/cpu/o3/lsq_unit_impl.hh b/src/cpu/o3/lsq_unit_impl.hh
index e31532d48..7ac85654e 100644
--- a/src/cpu/o3/lsq_unit_impl.hh
+++ b/src/cpu/o3/lsq_unit_impl.hh
@@ -231,9 +231,10 @@ LSQUnit<Impl>::init(O3CPU *cpu_ptr, IEW *iew_ptr, DerivO3CPUParams *params,
     }
     needsTSO = params->needsTSO;
     allowSpecBuffHit = params->allowSpecBuffHit;
+    useIFT = params->useIFT;
     cprintf("Info: simulation uses scheme: %s; "
-                "needsTSO=%d; allowSpecBuffHit=%d\n",
-                scheme, needsTSO, allowSpecBuffHit);
+            "needsTSO=%d; allowSpecBuffHit=%d; useIFT=%d\n",
+            scheme, needsTSO, allowSpecBuffHit, useIFT);
     // [mengjia] end of setting configuration variables
 
     resetState();
@@ -1042,30 +1043,33 @@ LSQUnit<Impl>::updateVisibleState()
                     }
                 }
                 inst->readyToExpose(true);
-            }else {
-#if 0 /* now an untainted USL can be safe */
-                if (inst->readyToExpose()){
+            } else {
+                if (!useIFT) {
+                  if (inst->readyToExpose()){
                     DPRINTF(LSQUnit, "The load can not be validated "
                             "[sn:%lli] PC %s\n",
-                        inst->seqNum, inst->pcState());
+                            inst->seqNum, inst->pcState());
                     assert(0);
                     //--loadsToVLD;
-                }
-#endif
-                /* set taint for dst registers */
-                inst->taintDestRegs(true);
-                /* if the load depends on tainted registers, set
-                   readyToExpose to false, otherwise set it to true
-                */
-                if (inst->srcTainted()) {
+                  }
+                  inst->readyToExpose(false);
+                } else {
+                  /* set taint for dst registers */
+                  inst->taintDestRegs(true);
+                  inst->isTainted = true;
+                  /* if the load depends on tainted registers, set
+                     readyToExpose to false, otherwise set it to true
+                  */
+                  if (inst->srcTainted()) {
                     DPRINTF(LSQUnit, "load inst [sn:%lli] %s not safe, set readyToExpose to false\n", inst->seqNum, inst->pcState());
                     inst->readyToExpose(false);
-                } else {
+                  } else {
                     DPRINTF(LSQUnit, "load inst [sn:%lli] %s is an unsafe speculated load, but source registers are not tainted.\n", inst->seqNum, inst->pcState());
                     if (!inst->readyToExpose() && inst->needPostFetch()) {
-                        ++loadsToVLD;
+                      ++loadsToVLD;
                     }
                     inst->readyToExpose(true);
+                  }
                 }
             }
             inst->fenceDelay(false);
diff --git a/src/cpu/o3/rob_impl.hh b/src/cpu/o3/rob_impl.hh
index 7c39985a2..5705b32e8 100644
--- a/src/cpu/o3/rob_impl.hh
+++ b/src/cpu/o3/rob_impl.hh
@@ -435,8 +435,10 @@ ROB<Impl>::updateVisibleState()
 
             assert(inst!=0);
 
-            if (prevBrsResolved) {
+            if (inst->isTainted) {
+              if (prevBrsResolved) {
                 inst->taintDestRegs(false);
+              }
             }
 
             if (!prevInstsComplete &&