From 8fe7e974ee5ca80885b9231ec397e5681d67d3ae Mon Sep 17 00:00:00 2001 From: Iru Cai Date: Thu, 11 Apr 2019 23:31:41 +0800 Subject: add IFT options --- configs/common/CpuConfig.py | 6 ++++++ configs/common/Options.py | 2 ++ src/cpu/base_dyn_inst.hh | 22 ---------------------- src/cpu/o3/O3CPU.py | 1 + src/cpu/o3/dyn_inst.hh | 24 ++++++++++++++++++++++++ src/cpu/o3/dyn_inst_impl.hh | 1 + src/cpu/o3/lsq_unit.hh | 1 + src/cpu/o3/lsq_unit_impl.hh | 36 ++++++++++++++++++++---------------- src/cpu/o3/rob_impl.hh | 4 +++- 9 files changed, 58 insertions(+), 39 deletions(-) diff --git a/configs/common/CpuConfig.py b/configs/common/CpuConfig.py index 43539ee4d..21dabdfa9 100644 --- a/configs/common/CpuConfig.py +++ b/configs/common/CpuConfig.py @@ -122,6 +122,12 @@ def config_scheme(cpu_cls, cpu_list, options): cpu.allowSpecBuffHit = True else: cpu.allowSpecBuffHit = False + + if options.useIFT: + cpu.useIFT = True + else: + cpu.useIFT = False + if len(options.scheme)!=0: cpu.simulateScheme = options.scheme else: diff --git a/configs/common/Options.py b/configs/common/Options.py index 5d92b446d..89a8eda04 100644 --- a/configs/common/Options.py +++ b/configs/common/Options.py @@ -317,6 +317,8 @@ def addCommonOptions(parser): "SpectreSafeFence", "FuturisticSafeInvisibleSpec", "SpectreSafeInvisibleSpec"], help="choose baseline or defense designs to evaluate") + parser.add_option("--useIFT", default=None, action="store", type="int", + help="Use information flow tracking.") parser.add_option("--needsTSO", default=None, action="store", type="int", help="Select TSO or RC. Set unzero to use TSO.") parser.add_option("--allowSpecBuffHit", default=None, action="store", diff --git a/src/cpu/base_dyn_inst.hh b/src/cpu/base_dyn_inst.hh index d533ad9bf..6301864b7 100644 --- a/src/cpu/base_dyn_inst.hh +++ b/src/cpu/base_dyn_inst.hh @@ -478,28 +478,6 @@ class BaseDynInst : public ExecContext, public RefCounted _prevDestRegIdx[idx] = previous_rename; } - void taintDestRegs(bool istaint) - { - for (size_t i = 0; i < numDestRegs(); i++) { - auto dstreg = _destRegIdx[i]; - if (istaint) { - cpu->setTaint(dstreg); - } else { - cpu->clearTaint(dstreg); - } - } - } - - bool srcTainted(void) - { - bool result = false; - for (size_t i = 0; i < numSrcRegs(); i++) { - auto src = _srcRegIdx[i]; - result |= cpu->regTainted(src); - } - return result; - } - /** Renames a source logical register to the physical register which * has/will produce that logical register's result. * @todo: add in whether or not the source register is ready. diff --git a/src/cpu/o3/O3CPU.py b/src/cpu/o3/O3CPU.py index 371433eef..1a97faced 100644 --- a/src/cpu/o3/O3CPU.py +++ b/src/cpu/o3/O3CPU.py @@ -169,6 +169,7 @@ class DerivO3CPU(BaseCPU): "The scheme specificed for simulation") needsTSO = Param.Bool(False, "Enable TSO Memory model") allowSpecBuffHit = Param.Bool(True, "Enable hit/reuse spec buffer entries") + useIFT = Param.Bool(False, "use IFT to filter") def addCheckerCpu(self): if buildEnv['TARGET_ISA'] in ['arm']: diff --git a/src/cpu/o3/dyn_inst.hh b/src/cpu/o3/dyn_inst.hh index 47dc830e0..d3c67c4cb 100644 --- a/src/cpu/o3/dyn_inst.hh +++ b/src/cpu/o3/dyn_inst.hh @@ -81,6 +81,7 @@ class BaseO3DynInst : public BaseDynInst MaxInstSrcRegs = TheISA::MaxInstSrcRegs, //< Max source regs MaxInstDestRegs = TheISA::MaxInstDestRegs //< Max dest regs }; + bool isTainted; public: /** BaseDynInst constructor given a binary instruction. */ @@ -415,6 +416,29 @@ class BaseO3DynInst : public BaseDynInst BaseDynInst::setCCRegOperand(si, idx, val); } + void taintDestRegs(bool istaint) + { + isTainted = istaint; + for (size_t i = 0; i < this->numDestRegs(); i++) { + auto dstreg = _destRegIdx[i]; + if (istaint) { + cpu->setTaint(dstreg); + } else { + cpu->clearTaint(dstreg); + } + } + } + + bool srcTainted(void) + { + bool result = false; + for (size_t i = 0; i < this->numSrcRegs(); i++) { + auto src = _srcRegIdx[i]; + result |= cpu->regTainted(src); + } + return result; + } + #if THE_ISA == MIPS_ISA MiscReg readRegOtherThread(const RegId& misc_reg, ThreadID tid) { diff --git a/src/cpu/o3/dyn_inst_impl.hh b/src/cpu/o3/dyn_inst_impl.hh index 03437a5ae..03721d848 100644 --- a/src/cpu/o3/dyn_inst_impl.hh +++ b/src/cpu/o3/dyn_inst_impl.hh @@ -109,6 +109,7 @@ BaseO3DynInst::initVars() this->_readySrcRegIdx.reset(); _numDestMiscRegs = 0; + isTainted = false; #if TRACING_ON // Value -1 indicates that particular phase diff --git a/src/cpu/o3/lsq_unit.hh b/src/cpu/o3/lsq_unit.hh index 16095ed46..c512ef819 100644 --- a/src/cpu/o3/lsq_unit.hh +++ b/src/cpu/o3/lsq_unit.hh @@ -528,6 +528,7 @@ class LSQUnit { // Flag for whether defending against spectre attack or future attacks bool isFuturistic; bool allowSpecBuffHit; + bool useIFT; /* [mengjia] different schemes determine values of 4 variables. */ // Will also need how many read/write ports the Dcache has. Or keep track diff --git a/src/cpu/o3/lsq_unit_impl.hh b/src/cpu/o3/lsq_unit_impl.hh index e31532d48..7ac85654e 100644 --- a/src/cpu/o3/lsq_unit_impl.hh +++ b/src/cpu/o3/lsq_unit_impl.hh @@ -231,9 +231,10 @@ LSQUnit::init(O3CPU *cpu_ptr, IEW *iew_ptr, DerivO3CPUParams *params, } needsTSO = params->needsTSO; allowSpecBuffHit = params->allowSpecBuffHit; + useIFT = params->useIFT; cprintf("Info: simulation uses scheme: %s; " - "needsTSO=%d; allowSpecBuffHit=%d\n", - scheme, needsTSO, allowSpecBuffHit); + "needsTSO=%d; allowSpecBuffHit=%d; useIFT=%d\n", + scheme, needsTSO, allowSpecBuffHit, useIFT); // [mengjia] end of setting configuration variables resetState(); @@ -1042,30 +1043,33 @@ LSQUnit::updateVisibleState() } } inst->readyToExpose(true); - }else { -#if 0 /* now an untainted USL can be safe */ - if (inst->readyToExpose()){ + } else { + if (!useIFT) { + if (inst->readyToExpose()){ DPRINTF(LSQUnit, "The load can not be validated " "[sn:%lli] PC %s\n", - inst->seqNum, inst->pcState()); + inst->seqNum, inst->pcState()); assert(0); //--loadsToVLD; - } -#endif - /* set taint for dst registers */ - inst->taintDestRegs(true); - /* if the load depends on tainted registers, set - readyToExpose to false, otherwise set it to true - */ - if (inst->srcTainted()) { + } + inst->readyToExpose(false); + } else { + /* set taint for dst registers */ + inst->taintDestRegs(true); + inst->isTainted = true; + /* if the load depends on tainted registers, set + readyToExpose to false, otherwise set it to true + */ + if (inst->srcTainted()) { DPRINTF(LSQUnit, "load inst [sn:%lli] %s not safe, set readyToExpose to false\n", inst->seqNum, inst->pcState()); inst->readyToExpose(false); - } else { + } else { DPRINTF(LSQUnit, "load inst [sn:%lli] %s is an unsafe speculated load, but source registers are not tainted.\n", inst->seqNum, inst->pcState()); if (!inst->readyToExpose() && inst->needPostFetch()) { - ++loadsToVLD; + ++loadsToVLD; } inst->readyToExpose(true); + } } } inst->fenceDelay(false); diff --git a/src/cpu/o3/rob_impl.hh b/src/cpu/o3/rob_impl.hh index 7c39985a2..5705b32e8 100644 --- a/src/cpu/o3/rob_impl.hh +++ b/src/cpu/o3/rob_impl.hh @@ -435,8 +435,10 @@ ROB::updateVisibleState() assert(inst!=0); - if (prevBrsResolved) { + if (inst->isTainted) { + if (prevBrsResolved) { inst->taintDestRegs(false); + } } if (!prevInstsComplete && -- cgit v1.2.3