track instruction after tainted branches

4 files changed, 28 insertions, 2 deletions

diff --git a/src/cpu/o3/dyn_inst.hh b/src/cpu/o3/dyn_inst.hh
index 22b4bb12a..4530e00cf 100644
--- a/src/cpu/o3/dyn_inst.hh
+++ b/src/cpu/o3/dyn_inst.hh
@@ -83,6 +83,7 @@ class BaseO3DynInst : public BaseDynInst<Impl>
         MaxInstDestRegs = TheISA::MaxInstDestRegs       //< Max dest regs
     };
     bool isTainted;
+    bool afterTaintedBranch;
 
   public:
     /** BaseDynInst constructor given a binary instruction. */
diff --git a/src/cpu/o3/dyn_inst_impl.hh b/src/cpu/o3/dyn_inst_impl.hh
index 03721d848..c5c18debf 100644
--- a/src/cpu/o3/dyn_inst_impl.hh
+++ b/src/cpu/o3/dyn_inst_impl.hh
@@ -110,6 +110,7 @@ BaseO3DynInst<Impl>::initVars()
 
     _numDestMiscRegs = 0;
     isTainted = false;
+    afterTaintedBranch = true;
 
 #if TRACING_ON
     // Value -1 indicates that particular phase
diff --git a/src/cpu/o3/lsq_unit_impl.hh b/src/cpu/o3/lsq_unit_impl.hh
index 79d913175..a45048ff9 100644
--- a/src/cpu/o3/lsq_unit_impl.hh
+++ b/src/cpu/o3/lsq_unit_impl.hh
@@ -1059,7 +1059,17 @@ LSQUnit<Impl>::updateVisibleState()
                   /* if the load depends on tainted registers, set
                      readyToExpose to false, otherwise set it to true
                   */
-                  bool doSpecLoad = inst->needPostFetch() || inst->srcTainted();
+                  bool doSpecLoad = false;
+                  if (inst->needPostFetch()) {
+                      doSpecLoad = true;
+                      DPRINTF(LSQUnit, "load inst [sn:%lli] %s needs post fetch.\n", inst->seqNum, inst->pcState());
+                  } else if (inst->afterTaintedBranch) {
+                      doSpecLoad = true;
+                      DPRINTF(LSQUnit, "load inst [sn:%lli] %s is after a tainted branch.\n", inst->seqNum, inst->pcState());
+                  } else if (inst->srcTainted()) {
+                      doSpecLoad = true;
+                      DPRINTF(LSQUnit, "source registers of load inst [sn:%lli] %s is tainted.\n", inst->seqNum, inst->pcState());
+                  }
                   if (doSpecLoad) {
                     DPRINTF(LSQUnit, "load inst [sn:%lli] %s not safe, set readyToExpose to false\n", inst->seqNum, inst->pcState());
                     inst->readyToExpose(false);
diff --git a/src/cpu/o3/rob_impl.hh b/src/cpu/o3/rob_impl.hh
index 093dd2840..b729a9d00 100644
--- a/src/cpu/o3/rob_impl.hh
+++ b/src/cpu/o3/rob_impl.hh
@@ -51,6 +51,7 @@
 #include "debug/Fetch.hh"
 #include "debug/ROB.hh"
 #include "params/DerivO3CPU.hh"
+#include "debug/IFT.hh"
 
 using namespace std;
 
@@ -429,6 +430,7 @@ ROB<Impl>::updateVisibleState()
         bool prevBrsResolved=true;
         bool prevInstsCommitted=true;
         bool prevBrsCommitted=true;
+        bool prevBrsNotTainted=true;
 
         while (inst_it != tail_inst_it) {
             DynInstPtr inst = *inst_it++;
@@ -441,8 +443,15 @@ ROB<Impl>::updateVisibleState()
               }
             }
 
+            if (prevBrsNotTainted) {
+                inst->afterTaintedBranch = false;
+                DPRINTF(IFT, "Instruction PC: %s [sn:%lli] is not after a tainted branch.\n",
+                        inst->pcState(), inst->seqNum);
+            }
+
             if (!prevInstsComplete &&
-                    !prevBrsResolved) {
+                    !prevBrsResolved &&
+                    !prevBrsNotTainted) {
                 break;
             }
 
@@ -468,6 +477,11 @@ ROB<Impl>::updateVisibleState()
                         || inst->isSquashed()){
                     prevBrsResolved = false;
                 }
+                if (inst->isTainted) {
+                    prevBrsNotTainted = false;
+                    DPRINTF(IFT, "Instruction PC: %s [sn:%lli] is a tainted branch.\n",
+                            inst->pcState(), inst->seqNum);
+                }
             } 
             
             prevInstsCommitted = false;