secsep-changes.patch

diff --git a/.clang-format b/.clang-format
new file mode 100644
index 0000000000..eebb026d11
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,25 @@
+# Run manually to reformat a file:
+# clang-format -i --style=file <file>
+# find . -iname '*.c' -o -iname '*.cpp' -o -iname '*.h' -o -iname '*.hpp' | xargs clang-format -i --style=file
+---
+BasedOnStyle: LLVM
+AlwaysBreakAfterReturnType: AllDefinitions
+ColumnLimit: '79'
+IndentCaseLabels: 'true'
+IndentWidth: '4'
+NamespaceIndentation: None
+PointerAlignment: Right
+UseTab: Never
+
+# gem5 specified include sorting rules
+IncludeCategories:
+  - Regex:           '<Python.h>'
+    Priority:        -1
+  - Regex:           '<gem5/>'
+    Priority:        3
+  - Regex:           '^<.+\.h>'
+    Priority:        1
+  - Regex:           '^<'
+    Priority:        2
+  - Regex:           '"[^"]+"'
+    Priority:        4
diff --git a/.gitignore b/.gitignore
index 229a0d5ae9..8347c6ca7c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,6 @@ configs/example/memcheck.cfg
 configs/dram/lowp_sweep.cfg
 .pyenv
 .vscode
+.idea
+cmake-build-debug
+results
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 0000000000..53c221dd2f
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,6 @@
+cmake_minimum_required(VERSION 3.5)
+project(gem5)
+file(GLOB_RECURSE SOURCE_FILES "src/**/*.hh" "src/**/*.cc")
+include_directories(src)
+include_directories(include)
+add_executable(gem5 ${SOURCE_FILES})
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000000..3725434311
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,58 @@
+# Copyright (c) 2022 The Regents of the University of California
+# All Rights Reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met: redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer;
+# redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in the
+# documentation and/or other materials provided with the distribution;
+# neither the name of the copyright holders nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt -y update && apt -y upgrade && \
+    apt -y install build-essential git m4 scons zlib1g zlib1g-dev \
+    libprotobuf-dev protobuf-compiler libprotoc-dev libgoogle-perftools-dev \
+    python3-dev doxygen libboost-all-dev libhdf5-serial-dev python3-pydot \
+    libpng-dev libelf-dev pkg-config pip python3-venv black gdb vim \
+    golang-go cmake
+
+RUN pip install mypy pre-commit
+
+RUN --mount=type=cache,target=/var/cache/apt \
+    apt-get update && \
+    rm -rf /var/cache/apt/archives/lock && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    zsh \
+    curl vim \
+    language-pack-en
+RUN curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh > install.sh && \
+    sh install.sh && \
+    rm install.sh
+ENV THEME="agnoster"
+RUN sed -i s/^ZSH_THEME=".\+"$/ZSH_THEME=\"$THEME\"/g ~/.zshrc
+
+RUN echo "zsh" >> ~/.bashrc
+
+WORKDIR /root/gem5
+
+# Resolve directory's dubious ownership, so that the git repo is available
+RUN git config --global --add safe.directory /root/gem5
+# RUN pre-commit install
diff --git a/README b/README
index 5803372a98..81c06f56dc 100644
--- a/README
+++ b/README
@@ -41,3 +41,48 @@ https://gem5.googlesource.com/public/gem5-resources/
 If you have questions, please send mail to gem5-users@gem5.org
 
 Enjoy using gem5 and please share your modifications and extensions.
+
+Problems:
+
+
+When judging whether a squash should be delayed:
+```
+if (( fromIEW->instCausingSquash[tid]->isArgsTainted() && !fromIEW->instCausingSquash[tid]->isUnsquashable() ) ||
+    ( fromIEW->instCausingSquash[tid]->isLoad() && !cpu->isSTLPublic(fromIEW->instCausingSquash[tid]) ))
+```
+
+When retrieving delayed squash instruction:
+Old:
+```
+template <class Impl>
+typename Impl::DynInstPtr
+ROB<Impl>::getResolvedPendingSquashInst(ThreadID tid)
+{
+    for (auto instIt = instList[tid].begin(); instIt != instList[tid].end(); instIt++) {
+        auto inst = (*instIt);
+        if (inst->hasPendingSquash()
+            && inst->isUnsquashable()   // SPT: a delayed branch wait until it reaches VP
+            && !inst->isSquashed()  // if it's already squashed, we ignore it
+            ) {
+            return inst;
+        }
+        if (inst->hasPendingSquash()
+            && !inst->isSquashed()
+            ) {
+            ++totalSquashDelayCycles;
+        }
+    }
+    return NULL;
+}
+```
+
+Not symmetric conditions
+
+Problems:
+1. standalone_l1_test: no difference in numCycles between insecure and securebaseline
+2. standalone_variable_base: load failed (securebaseline
+3. standalone_int32loop/uint64loop: sanity problem
+
+
+scons build/X86_MESI_Two_Level/gem5.fast -j 7
+python3 scripts/run.py --apps=generic --bench-regex="bench_stl" --sim-mode=fast
diff --git a/configs/common/CpuConfig.py b/configs/common/CpuConfig.py
index 1672d43343..a5e70c1ea1 100644
--- a/configs/common/CpuConfig.py
+++ b/configs/common/CpuConfig.py
@@ -64,3 +64,23 @@ def config_etrace(cpu_cls, cpu_list, options):
             " type or inherited from DerivO3CPU.",
             cpu_cls,
         )
+
+
+def config_scheme(cpu_cls, cpu_list, options):
+    if not issubclass(cpu_cls, m5.objects.DerivO3CPU):
+        fatal("config_scheme encountered non DeriveO3CPU")
+
+    for cpu in cpu_list:
+        if options.attack_model:
+            cpu.attackModel = options.attack_model
+        if options.defense_scheme:
+            cpu.defenseScheme = options.defense_scheme
+        if options.private_stack_offset:
+            cpu.privStackOff = int(options.private_stack_offset, 0)
+        if options.stack_default_public:
+            if options.private_stack_offset:
+                fatal(
+                    "Cannot set both private stack offset and public stack"
+                    " offset. Please choose one.",
+                )
+            cpu.stackDefaultPublic = True
diff --git a/configs/common/Options.py b/configs/common/Options.py
index 81d7791285..684bf7ff7d 100644
--- a/configs/common/Options.py
+++ b/configs/common/Options.py
@@ -678,6 +678,34 @@ def addCommonOptions(parser):
         help="Override vendor string returned by CPUID instruction in X86.",
     )
 
+    parser.add_argument(
+        "--attack-model",
+        type=str,
+        default="None",
+        help="Specify attack model for the CPU",
+    )
+
+    parser.add_argument(
+        "--defense-scheme",
+        type=str,
+        default="None",
+        help="Specify defense scheme for the CPU",
+    )
+
+    parser.add_argument(
+        "--private-stack-offset",
+        type=str,
+        default=None,
+        help="Offset from private stack's base to public stack's base",
+    )
+
+    parser.add_argument(
+        "--stack-default-public",
+        default=False,
+        action="store_true",
+        help="The stack is private by default. By setting this, the stack becomes public by default. Cannot be used with --private-stack-offset",
+    )
+
 
 def addSEOptions(parser):
     # Benchmark options
diff --git a/configs/example/se.py b/configs/example/se.py
index 2372cf0efe..8834973560 100644
--- a/configs/example/se.py
+++ b/configs/example/se.py
@@ -279,6 +279,9 @@ else:
     MemConfig.config_mem(args, system)
     config_filesystem(system, args)
 
+if CPUClass == DerivO3CPU:
+    CpuConfig.config_scheme(CPUClass, system.cpu, args)
+
 system.workload = SEWorkload.init_compatible(mp0_path)
 
 if args.wait_gdb:
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000000..92129b2fd2
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,14 @@
+version: "3.4"
+services:
+  gem5:
+    build:
+      context: .
+      network: host
+      dockerfile: Dockerfile
+    image: gem5-dev
+    container_name: octal-gem5  # BE CAREFUL! Don't override other's container
+    volumes:
+      - ./:/root/gem5/:rw
+      - ../octal-benchmark/:/root/benchmarks/:rw
+    stdin_open: true
+    tty: true
diff --git a/poetry.lock b/poetry.lock
new file mode 100644
index 0000000000..0aba5227c0
--- /dev/null
+++ b/poetry.lock
@@ -0,0 +1,199 @@
+# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
+
+[[package]]
+name = "cfgv"
+version = "3.3.1"
+description = "Validate configuration and produce human readable error messages."
+category = "main"
+optional = false
+python-versions = ">=3.6.1"
+files = [
+    {file = "cfgv-3.3.1-py2.py3-none-any.whl", hash = "sha256:c6a0883f3917a037485059700b9e75da2464e6c27051014ad85ba6aaa5884426"},
+    {file = "cfgv-3.3.1.tar.gz", hash = "sha256:f5a830efb9ce7a445376bb66ec94c638a9787422f96264c98edc6bdeed8ab736"},
+]
+
+[[package]]
+name = "distlib"
+version = "0.3.7"
+description = "Distribution utilities"
+category = "main"
+optional = false
+python-versions = "*"
+files = [
+    {file = "distlib-0.3.7-py2.py3-none-any.whl", hash = "sha256:2e24928bc811348f0feb63014e97aaae3037f2cf48712d51ae61df7fd6075057"},
+    {file = "distlib-0.3.7.tar.gz", hash = "sha256:9dafe54b34a028eafd95039d5e5d4851a13734540f1331060d31c9916e7147a8"},
+]
+
+[[package]]
+name = "filelock"
+version = "3.12.2"
+description = "A platform independent file lock."
+category = "main"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "filelock-3.12.2-py3-none-any.whl", hash = "sha256:cbb791cdea2a72f23da6ac5b5269ab0a0d161e9ef0100e653b69049a7706d1ec"},
+    {file = "filelock-3.12.2.tar.gz", hash = "sha256:002740518d8aa59a26b0c76e10fb8c6e15eae825d34b6fdf670333fd7b938d81"},
+]
+
+[package.extras]
+docs = ["furo (>=2023.5.20)", "sphinx (>=7.0.1)", "sphinx-autodoc-typehints (>=1.23,!=1.23.4)"]
+testing = ["covdefaults (>=2.3)", "coverage (>=7.2.7)", "diff-cover (>=7.5)", "pytest (>=7.3.1)", "pytest-cov (>=4.1)", "pytest-mock (>=3.10)", "pytest-timeout (>=2.1)"]
+
+[[package]]
+name = "identify"
+version = "2.5.25"
+description = "File identification library for Python"
+category = "main"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "identify-2.5.25-py2.py3-none-any.whl", hash = "sha256:9df2489842707d431b38ce3410ef8df40da5b10a3e28a3fcac1a42523e956409"},
+    {file = "identify-2.5.25.tar.gz", hash = "sha256:db4de0e758c0db8f81996816cd2f3f2f8c5c8d49a7fd02f3b4109aac6fd80e29"},
+]
+
+[package.extras]
+license = ["ukkonen"]
+
+[[package]]
+name = "nodeenv"
+version = "1.8.0"
+description = "Node.js virtual environment builder"
+category = "main"
+optional = false
+python-versions = ">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*"
+files = [
+    {file = "nodeenv-1.8.0-py2.py3-none-any.whl", hash = "sha256:df865724bb3c3adc86b3876fa209771517b0cfe596beff01a92700e0e8be4cec"},
+    {file = "nodeenv-1.8.0.tar.gz", hash = "sha256:d51e0c37e64fbf47d017feac3145cdbb58836d7eee8c6f6d3b6880c5456227d2"},
+]
+
+[package.dependencies]
+setuptools = "*"
+
+[[package]]
+name = "platformdirs"
+version = "3.9.1"
+description = "A small Python package for determining appropriate platform-specific dirs, e.g. a \"user data dir\"."
+category = "main"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "platformdirs-3.9.1-py3-none-any.whl", hash = "sha256:ad8291ae0ae5072f66c16945166cb11c63394c7a3ad1b1bc9828ca3162da8c2f"},
+    {file = "platformdirs-3.9.1.tar.gz", hash = "sha256:1b42b450ad933e981d56e59f1b97495428c9bd60698baab9f3eb3d00d5822421"},
+]
+
+[package.extras]
+docs = ["furo (>=2023.5.20)", "proselint (>=0.13)", "sphinx (>=7.0.1)", "sphinx-autodoc-typehints (>=1.23,!=1.23.4)"]
+test = ["appdirs (==1.4.4)", "covdefaults (>=2.3)", "pytest (>=7.3.1)", "pytest-cov (>=4.1)", "pytest-mock (>=3.10)"]
+
+[[package]]
+name = "pre-commit"
+version = "3.3.3"
+description = "A framework for managing and maintaining multi-language pre-commit hooks."
+category = "main"
+optional = false
+python-versions = ">=3.8"
+files = [
+    {file = "pre_commit-3.3.3-py2.py3-none-any.whl", hash = "sha256:10badb65d6a38caff29703362271d7dca483d01da88f9d7e05d0b97171c136cb"},
+    {file = "pre_commit-3.3.3.tar.gz", hash = "sha256:a2256f489cd913d575c145132ae196fe335da32d91a8294b7afe6622335dd023"},
+]
+
+[package.dependencies]
+cfgv = ">=2.0.0"
+identify = ">=1.0.0"
+nodeenv = ">=0.11.1"
+pyyaml = ">=5.1"
+virtualenv = ">=20.10.0"
+
+[[package]]
+name = "pyyaml"
+version = "6.0.1"
+description = "YAML parser and emitter for Python"
+category = "main"
+optional = false
+python-versions = ">=3.6"
+files = [
+    {file = "PyYAML-6.0.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d858aa552c999bc8a8d57426ed01e40bef403cd8ccdd0fc5f6f04a00414cac2a"},
+    {file = "PyYAML-6.0.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:fd66fc5d0da6d9815ba2cebeb4205f95818ff4b79c3ebe268e75d961704af52f"},
+    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:69b023b2b4daa7548bcfbd4aa3da05b3a74b772db9e23b982788168117739938"},
+    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:81e0b275a9ecc9c0c0c07b4b90ba548307583c125f54d5b6946cfee6360c733d"},
+    {file = "PyYAML-6.0.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515"},
+    {file = "PyYAML-6.0.1-cp310-cp310-win32.whl", hash = "sha256:bd4af7373a854424dabd882decdc5579653d7868b8fb26dc7d0e99f823aa5924"},
+    {file = "PyYAML-6.0.1-cp310-cp310-win_amd64.whl", hash = "sha256:fd1592b3fdf65fff2ad0004b5e363300ef59ced41c2e6b3a99d4089fa8c5435d"},
+    {file = "PyYAML-6.0.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6965a7bc3cf88e5a1c3bd2e0b5c22f8d677dc88a455344035f03399034eb3007"},
+    {file = "PyYAML-6.0.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f003ed9ad21d6a4713f0a9b5a7a0a79e08dd0f221aff4525a2be4c346ee60aab"},
+    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:42f8152b8dbc4fe7d96729ec2b99c7097d656dc1213a3229ca5383f973a5ed6d"},
+    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:062582fca9fabdd2c8b54a3ef1c978d786e0f6b3a1510e0ac93ef59e0ddae2bc"},
+    {file = "PyYAML-6.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673"},
+    {file = "PyYAML-6.0.1-cp311-cp311-win32.whl", hash = "sha256:1635fd110e8d85d55237ab316b5b011de701ea0f29d07611174a1b42f1444741"},
+    {file = "PyYAML-6.0.1-cp311-cp311-win_amd64.whl", hash = "sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:50550eb667afee136e9a77d6dc71ae76a44df8b3e51e41b77f6de2932bfe0f47"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1fe35611261b29bd1de0070f0b2f47cb6ff71fa6595c077e42bd0c419fa27b98"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:704219a11b772aea0d8ecd7058d0082713c3562b4e271b849ad7dc4a5c90c13c"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:afd7e57eddb1a54f0f1a974bc4391af8bcce0b444685d936840f125cf046d5bd"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-win32.whl", hash = "sha256:fca0e3a251908a499833aa292323f32437106001d436eca0e6e7833256674585"},
+    {file = "PyYAML-6.0.1-cp36-cp36m-win_amd64.whl", hash = "sha256:f22ac1c3cac4dbc50079e965eba2c1058622631e526bd9afd45fedd49ba781fa"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:b1275ad35a5d18c62a7220633c913e1b42d44b46ee12554e5fd39c70a243d6a3"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:18aeb1bf9a78867dc38b259769503436b7c72f7a1f1f4c93ff9a17de54319b27"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:596106435fa6ad000c2991a98fa58eeb8656ef2325d7e158344fb33864ed87e3"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:baa90d3f661d43131ca170712d903e6295d1f7a0f595074f151c0aed377c9b9c"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-win32.whl", hash = "sha256:9046c58c4395dff28dd494285c82ba00b546adfc7ef001486fbf0324bc174fba"},
+    {file = "PyYAML-6.0.1-cp37-cp37m-win_amd64.whl", hash = "sha256:4fb147e7a67ef577a588a0e2c17b6db51dda102c71de36f8549b6816a96e1867"},
+    {file = "PyYAML-6.0.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:1d4c7e777c441b20e32f52bd377e0c409713e8bb1386e1099c2415f26e479595"},
+    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a0cd17c15d3bb3fa06978b4e8958dcdc6e0174ccea823003a106c7d4d7899ac5"},
+    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:28c119d996beec18c05208a8bd78cbe4007878c6dd15091efb73a30e90539696"},
+    {file = "PyYAML-6.0.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e07cbde391ba96ab58e532ff4803f79c4129397514e1413a7dc761ccd755735"},
+    {file = "PyYAML-6.0.1-cp38-cp38-win32.whl", hash = "sha256:184c5108a2aca3c5b3d3bf9395d50893a7ab82a38004c8f61c258d4428e80206"},
+    {file = "PyYAML-6.0.1-cp38-cp38-win_amd64.whl", hash = "sha256:1e2722cc9fbb45d9b87631ac70924c11d3a401b2d7f410cc0e3bbf249f2dca62"},
+    {file = "PyYAML-6.0.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:9eb6caa9a297fc2c2fb8862bc5370d0303ddba53ba97e71f08023b6cd73d16a8"},
+    {file = "PyYAML-6.0.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c8098ddcc2a85b61647b2590f825f3db38891662cfc2fc776415143f599bb859"},
+    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5773183b6446b2c99bb77e77595dd486303b4faab2b086e7b17bc6bef28865f6"},
+    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b786eecbdf8499b9ca1d697215862083bd6d2a99965554781d0d8d1ad31e13a0"},
+    {file = "PyYAML-6.0.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc1bf2925a1ecd43da378f4db9e4f799775d6367bdb94671027b73b393a7c42c"},
+    {file = "PyYAML-6.0.1-cp39-cp39-win32.whl", hash = "sha256:faca3bdcf85b2fc05d06ff3fbc1f83e1391b3e724afa3feba7d13eeab355484c"},
+    {file = "PyYAML-6.0.1-cp39-cp39-win_amd64.whl", hash = "sha256:510c9deebc5c0225e8c96813043e62b680ba2f9c50a08d3724c7f28a747d1486"},
+    {file = "PyYAML-6.0.1.tar.gz", hash = "sha256:bfdf460b1736c775f2ba9f6a92bca30bc2095067b8a9d77876d1fad6cc3b4a43"},
+]
+
+[[package]]
+name = "setuptools"
+version = "68.0.0"
+description = "Easily download, build, install, upgrade, and uninstall Python packages"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "setuptools-68.0.0-py3-none-any.whl", hash = "sha256:11e52c67415a381d10d6b462ced9cfb97066179f0e871399e006c4ab101fc85f"},
+    {file = "setuptools-68.0.0.tar.gz", hash = "sha256:baf1fdb41c6da4cd2eae722e135500da913332ab3f2f5c7d33af9b492acb5235"},
+]
+
+[package.extras]
+docs = ["furo", "jaraco.packaging (>=9)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-hoverxref (<2)", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (==0.8.3)", "sphinx-reredirects", "sphinxcontrib-towncrier"]
+testing = ["build[virtualenv]", "filelock (>=3.4.0)", "flake8-2020", "ini2toml[lite] (>=0.9)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "pip (>=19.1)", "pip-run (>=8.8)", "pytest (>=6)", "pytest-black (>=0.3.7)", "pytest-checkdocs (>=2.4)", "pytest-cov", "pytest-enabler (>=1.3)", "pytest-mypy (>=0.9.1)", "pytest-perf", "pytest-ruff", "pytest-timeout", "pytest-xdist", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel"]
+testing-integration = ["build[virtualenv]", "filelock (>=3.4.0)", "jaraco.envs (>=2.2)", "jaraco.path (>=3.2.0)", "pytest", "pytest-enabler", "pytest-xdist", "tomli", "virtualenv (>=13.0.0)", "wheel"]
+
+[[package]]
+name = "virtualenv"
+version = "20.24.1"
+description = "Virtual Python Environment builder"
+category = "main"
+optional = false
+python-versions = ">=3.7"
+files = [
+    {file = "virtualenv-20.24.1-py3-none-any.whl", hash = "sha256:01aacf8decd346cf9a865ae85c0cdc7f64c8caa07ff0d8b1dfc1733d10677442"},
+    {file = "virtualenv-20.24.1.tar.gz", hash = "sha256:2ef6a237c31629da6442b0bcaa3999748108c7166318d1f55cc9f8d7294e97bd"},
+]
+
+[package.dependencies]
+distlib = ">=0.3.6,<1"
+filelock = ">=3.12,<4"
+platformdirs = ">=3.5.1,<4"
+
+[package.extras]
+docs = ["furo (>=2023.5.20)", "proselint (>=0.13)", "sphinx (>=7.0.1)", "sphinx-argparse (>=0.4)", "sphinxcontrib-towncrier (>=0.2.1a0)", "towncrier (>=23.6)"]
+test = ["covdefaults (>=2.3)", "coverage (>=7.2.7)", "coverage-enable-subprocess (>=1)", "flaky (>=3.7)", "packaging (>=23.1)", "pytest (>=7.3.1)", "pytest-env (>=0.8.1)", "pytest-freezer (>=0.4.6)", "pytest-mock (>=3.10)", "pytest-randomly (>=3.12)", "pytest-timeout (>=2.1)", "setuptools (>=67.8)", "time-machine (>=2.9)"]
+
+[metadata]
+lock-version = "2.0"
+python-versions = ">=3.9"
+content-hash = "7f350d1531dfd4a55dc25943e00b16b1ea8d019aadf7c36d6c0bb1caf4a25efd"
diff --git a/pyproject.toml b/pyproject.toml
index a06d464de7..60f0369010 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,3 +1,20 @@
 [tool.black]
 line-length = 79
 include = '\.pyi?$'
+
+[tool.poetry]
+name = "sechw-gem5"
+version = "0.1.0"
+description = ""
+authors = ["octal authors"]
+readme = "README.md"
+packages = [{include = "sechw_gem5"}]
+
+[tool.poetry.dependencies]
+python = ">=3.9"
+pre-commit = "^3.3.3"
+
+
+[build-system]
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
diff --git a/scripts/calc_overhead.py b/scripts/calc_overhead.py
new file mode 100755
index 0000000000..a8df45fdee
--- /dev/null
+++ b/scripts/calc_overhead.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+from pathlib import Path
+
+import sys
+
+
+def get_metrics(filename: str) -> dict:
+    metrics = {}
+
+    with open(filename, "r") as f:
+        lines = f.readlines()
+
+    for line in lines:
+        if line.find("-----") != -1:
+            continue
+        tokens = line.strip().split()
+        if len(tokens) == 0:
+            continue
+        metrics[tokens[0]] = tokens[1:]
+
+    return metrics
+
+
+def examine_overhead(
+    name: str, metrics_orig: dict, metrics_tf: dict, metrics_tf_prot: dict
+):
+    a = int(metrics_orig[name][0])
+    b = int(metrics_tf[name][0])
+    c = int(metrics_tf_prot[name][0])
+
+    o1 = (b - a) / a * 100
+    o2 = (c - a) / a * 100
+
+    print(
+        f"  overhead on {name}: {a}(base) -> {b}(tf:{o1:.2f}%) -> {c}(def:{o2-o1:.2f}%, total:{o2:.2f}%)"
+    )
+
+
+def calc(app_name: str, bench_name: str):
+    print(f"{bench_name}:")
+    dir_orig = Path(f"results/raw_data/{app_name}-{bench_name}/NoDefense")
+    dir_tf = Path(f"results/raw_data/{app_name}-{bench_name}_tf/NoDefense")
+    dir_tf_prot = Path(
+        f"results/raw_data/{app_name}-{bench_name}_tf/OurDefense"
+    )
+
+    metrics_orig = get_metrics(dir_orig / "stats.txt")
+    metrics_tf = get_metrics(dir_tf / "stats.txt")
+    metrics_tf_prot = get_metrics(dir_tf_prot / "stats.txt")
+
+    examine_overhead(
+        "system.cpu.numCycles", metrics_orig, metrics_tf, metrics_tf_prot
+    )
+
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1:
+        app_name, bench_name = sys.argv[1], sys.argv[2]
+        calc(app_name, bench_name)
+    else:
+        calc("salsa20", "bench_salsa20")
+        calc("boringssl_sha512", "bench_sha512_plain")
+        calc("boringssl_ed25519", "bench_ed25519_plain_noinline")
diff --git a/scripts/get_decl.py b/scripts/get_decl.py
new file mode 100755
index 0000000000..cd47fea39e
--- /dev/null
+++ b/scripts/get_decl.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+
+import sys
+import re
+
+
+# Get declassify instructions from the log file
+
+
+def summarize(app_name, bench_name, config):
+    out_file = f"results/raw_data/{app_name}-{bench_name}/{config}/logout"
+    seg_file = f"../benchmarks/out/{app_name}/asm/{bench_name}.seg"
+    result_file = (
+        f"results/raw_data/{app_name}-{bench_name}/{config}/declassify_inst"
+    )
+
+    pat = re.compile(
+        r"^.*pc:\((0x[0-9a-f]+)=>(0x[0-9a-f]+)\).*Declassifying.*$"
+    )
+    with open(out_file, "r") as f:
+        lines = f.readlines()
+    declassify = []
+    for line in lines:
+        m = pat.match(line)
+        if m:
+            declassify.append(m.group(1))
+    # unify the declassify list
+    declassify = list(set(declassify))
+    declassify.sort()
+
+    with open(seg_file, "r") as f:
+        lines = f.readlines()
+    seg = []
+    for line in lines:
+        tokens = line.strip().split()
+        addr_l = int(tokens[0], 16)
+        if tokens[-2].find("hidden") != -1:
+            size = int(tokens[-3], 16)
+        else:
+            size = int(tokens[-2], 16)
+        addr_r = size + addr_l
+        func_name = tokens[-1]
+        seg.append((addr_l, addr_r, func_name))
+    seg.sort(key=lambda x: x[0])
+
+    addr_dict = {}
+    for func_seg in seg:
+        addr_l, addr_r, func_name = func_seg
+        addr_dict[func_name] = []
+        for addr in declassify:
+            addr = int(addr, 16)
+            if addr_l <= addr < addr_r:
+                addr_dict[func_name].append(addr)
+
+    with open(result_file, "w") as f:
+        for func_name, addr_list in addr_dict.items():
+            if len(addr_list) > 0:
+                f.write(f"{func_name}: {len(addr_list)}\n")
+                first = True
+                for addr in addr_list:
+                    if first:
+                        first = False
+                    else:
+                        f.write(", ")
+                    f.write(f"{hex(addr)}")
+                f.write("\n")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1:
+        app_name = sys.argv[1]
+        bench_name = sys.argv[2]
+        config = sys.argv[3]
+        summarize(app_name, bench_name, config)
+    else:
+        summarize("salsa20", "bench_salsa20", "OurDefense")
+        summarize("salsa20", "bench_salsa20_tf", "OurDefense")
+        summarize("boringssl_sha512", "bench_sha512_plain", "OurDefense")
+        summarize("boringssl_sha512", "bench_sha512_plain_tf", "OurDefense")
+        summarize(
+            "boringssl_ed25519", "bench_ed25519_plain_noinline", "OurDefense"
+        )
+        summarize(
+            "boringssl_ed25519",
+            "bench_ed25519_plain_noinline_tf",
+            "OurDefense",
+        )
diff --git a/scripts/run.py b/scripts/run.py
new file mode 100644
index 0000000000..46fc002055
--- /dev/null
+++ b/scripts/run.py
@@ -0,0 +1,252 @@
+import click
+import multiprocessing
+import re
+import subprocess
+
+from pathlib import Path
+
+
+script_dir = Path(__file__).resolve().parent
+project_dir = script_dir.parent
+bench_dir = project_dir.parent / "benchmarks" / "out"
+
+CONFIG_NONE = "NoDefense"
+CONFIG_CHECKEDTARGET = "NaiveSecureBaseline"
+CONFIG_SECUREBASELINE = "SecureBaseline"
+CONFIG_OURDEFENSE = "OurDefense"
+
+configs = {
+    CONFIG_NONE: ["--attack-model=Futuristic", "--defense-scheme=None"],
+    CONFIG_CHECKEDTARGET: [
+        "--attack-model=Futuristic",
+        "--defense-scheme=NaiveSecureBaseline",
+    ],
+    # CONFIG_SECUREBASELINE: [
+    #     "--attack-model=Futuristic",
+    #     "--defense-scheme=SecureBaseline",
+    # ],
+    CONFIG_OURDEFENSE: [
+        "--attack-model=Futuristic",
+        "--defense-scheme=OurDefense",
+        # "--private-stack-offset=0x100000", # specify this through argument --delta
+    ],
+}
+
+
+def add_threat_model(paras: list, threat_model: str):
+    if paras:
+        paras.extend(["--threat-model", threat_model])
+    return paras
+
+
+def run_cmd(cmd, setup, stats_file, log_file):
+    cmd_str = " ".join([str(item) for item in cmd])
+    with open(log_file, "w") as f:
+        completed_process = subprocess.run(
+            cmd_str, shell=True, stdout=f, stderr=f
+        )
+
+    failed = False
+    failed_reason = []
+
+    if completed_process.returncode != 0:
+        failed = True
+        failed_reason.append(
+            f"return code = {str(completed_process.returncode)}"
+        )
+
+    with open(stats_file, "r") as f:
+        stats_content = f.read()
+        if stats_content.find("Begin Simulation Statistics") == -1:
+            failed = True
+            failed_reason.append("cannot read stats")
+
+    return (setup, failed, failed_reason)
+
+
+def construct_cmd(
+    app,
+    bench,
+    config_name,
+    bench_result_dir,
+    sim_mode,
+    debug_flags,
+    config_args,
+):
+    workspace = bench_result_dir / config_name
+    workspace.mkdir(exist_ok=True)
+
+    cmd = []
+    cmd.extend(
+        [project_dir / "build" / "X86_MESI_Two_Level" / f"gem5.{sim_mode}"]
+    )
+    cmd.extend([f"--outdir={workspace}"])
+    if debug_flags and len(debug_flags) > 0:
+        cmd.extend(
+            [
+                f"--debug-flags={debug_flags}",
+                f"--debug-start=0",
+                f"--debug-file={workspace / f'{config_name}.out'}",
+            ]
+        )
+    cmd.extend([project_dir / "configs" / "example" / "se.py"])
+    cmd.extend(
+        [
+            "--num-cpus=1",
+            "--mem-size=4GB",
+            "--num-l2caches=1",
+            "--l1d_assoc=8",
+            "--l2_assoc=16",
+            "--l1i_assoc=4",
+            "--cpu-type=DerivO3CPU",
+            "--num-dirs=1",
+            "--ruby",
+            "--network=simple",
+            "--topology=Mesh_XY",
+            "--mesh-rows=1",
+        ]
+    )
+    cmd.extend(config_args)
+    cmd.extend(["-c", bench])
+
+    setup = (app, bench.name, config_name)
+    stats_file = workspace / "stats.txt"
+    log_file = workspace / "logout"
+    return (cmd, setup, stats_file, log_file)
+
+
+def gen_commands(sim_mode, apps, bench_regex, debug_flags, delta, result_dir):
+    cmds = []
+    # iterate apps
+    for app in apps:
+        app_bench_dir = bench_dir / app / "bin"
+        if not app_bench_dir.is_dir():
+            print(f"Warning: {app_bench_dir} is not a directory.")
+            continue
+        # iterate benchs
+        for bench in app_bench_dir.glob("*"):
+            if bench.suffix:
+                continue
+            if not re.match(bench_regex, bench.name):
+                continue
+            bench_result_dir = result_dir / f"{app}-{bench.name}"
+            bench_result_dir.mkdir(exist_ok=True)
+            # iterate configs
+            for config_name, config_args in configs.items():
+                config_args_ext = config_args.copy()
+                if config_name == CONFIG_OURDEFENSE:
+                    if bench.name.find("_pub_stack") != -1:
+                        config_args_ext.append("--stack-default-public")
+                    elif bench.name.find("_sec_stack") != -1:
+                        config_args_ext.append("--private-stack-offset=0")
+                    else:
+                        config_args_ext.append(
+                            f"--private-stack-offset={delta}"
+                        )
+                cmds.append(
+                    construct_cmd(
+                        app,
+                        bench,
+                        config_name,
+                        bench_result_dir,
+                        sim_mode,
+                        debug_flags,
+                        config_args_ext,
+                    )
+                )
+    return cmds
+
+
+def get_sanity_stats(stats_file):
+    with open(stats_file, "r") as f:
+        lines = [line for line in f.readlines()[1:-1] if len(line) > 0]
+    stats = {}
+    for line in lines:
+        if line.find("system.cpu.committedInsts") != -1:
+            stats["committedInsts"] = int(line.strip().split()[1])
+    return stats
+
+
+def sanity_check(apps, bench_regex, result_dir):
+    check_pass = True
+
+    for app in apps:
+        app_bench_dir = bench_dir / app / "bin"
+        if not app_bench_dir.is_dir():
+            print(f"Warning: {app_bench_dir} is not a directory.")
+            continue
+        for bench in app_bench_dir.glob("*"):
+            if bench.suffix:
+                continue
+            if not re.match(bench_regex, bench.name):
+                continue
+            bench_result_dir = result_dir / f"{app}-{bench.name}"
+            stats_none = get_sanity_stats(
+                bench_result_dir / CONFIG_NONE / "stats.txt"
+            )
+            stats_secure_baseline = get_sanity_stats(
+                bench_result_dir / CONFIG_CHECKEDTARGET / "stats.txt"
+            )
+            if stats_none != stats_secure_baseline:
+                print(f"!!! Sanity check failed for {bench.name} !!!")
+                print(f"    Expected: {stats_none}")
+                print(f"    Got     : {stats_secure_baseline}")
+                check_pass = False
+
+    return check_pass
+
+
+@click.command()
+@click.option("--sim-mode", type=click.Choice(["opt", "fast"]), default="opt")
+@click.option("--apps", type=click.STRING, default="")
+@click.option("--bench-regex", type=click.STRING, default=".*")
+@click.option("--debug-flags", type=click.STRING, default="")
+@click.option("--delta", type=click.STRING, default="0x100000")
+def main(sim_mode, apps, bench_regex, debug_flags, delta):
+    if len(apps) == 0:
+        print("Please specify apps")
+        exit(1)
+
+    result_dir = project_dir / "results" / "raw_data"
+    result_dir.mkdir(parents=True, exist_ok=True)
+
+    apps = apps.strip().split(",")
+    bench_regex = re.compile(bench_regex)
+
+    cmds = gen_commands(
+        sim_mode, apps, bench_regex, debug_flags, delta, result_dir
+    )
+    print(">>> {:02} RUN(S) SCHEDULED <<<".format(len(cmds)))
+    with multiprocessing.Pool(16) as p:
+        results = p.starmap(run_cmd, cmds)
+
+    good_run_cnt = 0
+    for (setup, run_failed, run_failed_reason) in results:
+        if run_failed:
+            print(f"Error: {setup} failed: {'; '.join(run_failed_reason)}")
+        else:
+            good_run_cnt += 1
+    run_successful = good_run_cnt == len(results)
+    if run_successful:
+        print(">>> {:02} RUN(S) SUCCESS <<<".format(len(results)))
+    else:
+        print(
+            f"!!! {len(results) - good_run_cnt} OF {len(results)} RUN(S) FAILED !!!"
+        )
+        exit(1)
+
+    # sanity check initiates when configs include no defense & secure baseline
+    if (
+        CONFIG_NONE in configs.keys()
+        and CONFIG_CHECKEDTARGET
+        and CONFIG_CHECKEDTARGET in configs.keys()
+    ):
+        if sanity_check(apps, bench_regex, result_dir):
+            print(">>> SANITY CHECK PASS <<<")
+        else:
+            print("!!! SANITY CHECK FAIL !!!")
+            exit(1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/test-run.sh b/scripts/test-run.sh
new file mode 100644
index 0000000000..39b8f6e9fc
--- /dev/null
+++ b/scripts/test-run.sh
@@ -0,0 +1,23 @@
+/root/gem5/build/X86_MESI_Two_Level/gem5.opt \
+--outdir=/root/gem5/results/testdir \
+/root/gem5/configs/example/se.py \
+--num-cpus=1 \
+--mem-size=4GB \
+--num-l2caches=1 \
+--l1d_assoc=8 \
+--l2_assoc=16 \
+--l1i_assoc=4 \
+--cpu-type=DerivO3CPU \
+--num-dirs=1 \
+--ruby \
+--network=simple \
+--topology=Mesh_XY \
+--mesh-rows=1 \
+--attack-model=Futuristic \
+--defense-scheme=None \
+1>/root/gem5/results/testdir/logout \
+-c /root/benchmarks/djbsort/bin/standalone_variable_base
+
+# --debug-flags=IEW \
+# --debug-start=0 \
+# --debug-file=/root/gem5/results/testdir/debug.out \
diff --git a/scripts/trivial-inst-filter.py b/scripts/trivial-inst-filter.py
new file mode 100644
index 0000000000..c31f6f89e4
--- /dev/null
+++ b/scripts/trivial-inst-filter.py
@@ -0,0 +1,20 @@
+import re
+
+rexp = re.compile(r".*\s(\w+)\s+%(\w+)\s*,\s*%\2\s?.*")
+
+mnes = []
+examples = []
+
+with open("tmp.asm", "r") as f:
+    for line in f.readlines():
+        match = re.match(rexp, line)
+        if match is not None:
+            mne = match.group(1)
+            if mne not in mnes:
+                mnes.append(mne)
+                examples.append(line)
+
+rexp = re.compile(r".+:\t[\w ]+\w  +\t(\w+)\s+(.*)$")
+for mne, line in zip(mnes, examples):
+    match = re.match(rexp, line)
+    print(match.group(1), "\t", match.group(2))
diff --git a/src/arch/isa_parser/isa_parser.py b/src/arch/isa_parser/isa_parser.py
index 62f33828a1..83d9756f1a 100755
--- a/src/arch/isa_parser/isa_parser.py
+++ b/src/arch/isa_parser/isa_parser.py
@@ -426,7 +426,8 @@ class InstObjParams(object):
         compositeCode = " ".join(list(map(str, snippets.values())))
         self.snippets = snippets
 
-        self.operands = OperandList(parser, compositeCode)
+        # [Octal] Pass class_name for accurate taint tracking
+        self.operands = OperandList(parser, compositeCode, class_name)
 
         self.srcRegIdxPadding = 0
         self.destRegIdxPadding = 0
diff --git a/src/arch/isa_parser/operand_list.py b/src/arch/isa_parser/operand_list.py
index 8df36c711b..caf29ec7e7 100755
--- a/src/arch/isa_parser/operand_list.py
+++ b/src/arch/isa_parser/operand_list.py
@@ -40,12 +40,67 @@
 from .util import assignRE, commentRE, stringRE
 from .util import error
 
+# [Octal] Some inst just use SrcReg1 to fill bits that are remained unchanged
+#       In these cases, SrcReg1 is not a real src, and
+#       should be considered as "dest as src"
+int_src1_fake_src_list = [
+    "Mulel",
+    "Muleh",
+    "Divq",
+    "Divr",
+    "Mov",
+    "MovFlags",
+    "MovImm",
+    "MovFlagsImm",
+]
+
+# [Octal] A stupid way to mark special class which use DestReg as src
+int_dest_real_src_list = [
+    "Ror",
+    "RorFlags",
+    "RorImm",
+    "RorFlagsImm",
+    "Rcr",
+    "RcrFlags",
+    "RcrImm",
+    "RcrFlagsImm",
+    "Rol",
+    "RolFlags",
+    "RolImm",
+    "RolFlagsImm",
+    "Rcl",
+    "RclFlags",
+    "RclImm",
+    "RclFlagsImm",
+    "MovFlags",
+    "MovFlagsImm",
+    "Mov2int",
+    "Movsign",
+    "SllFlags",
+    "SllFlagsImm",
+    "SrlFlags",
+    "SrlFlagsImm",
+    "SraFlags",
+    "SraFlagsImm",
+    "SldFlags",
+    "SldFlagsImm",
+    "SrdFlags",
+    "SrdFlagsImm",
+]
+
+float_dest_fake_src_list = [
+    "MovfpTopTag",
+    "MovfpTop",
+    "Movfp",
+]
+
 
 class OperandList(object):
     """Find all the operands in the given code block.  Returns an operand
     descriptor list (instance of class OperandList)."""
 
-    def __init__(self, parser, code):
+    def __init__(self, parser, code, class_name=""):
+        # [Octal] Pass class_name for accurate taint tracking
         self.items = []
         self.bases = {}
         # delete strings and comments so we don't match on operands inside
@@ -116,6 +171,30 @@ class OperandList(object):
         srcs = list(filter(lambda r: r.is_src, regs))
         dests = list(filter(lambda r: r.is_dest, regs))
 
+        # [Octal] Pick dest that are unnecessarily considered as src
+        # This filter is only used when the term is used as both dest and src
+        # If an inst does not have such term, the filter should not be applied to the inst
+        is_int_src1_fake_src_list = class_name in int_src1_fake_src_list
+        is_int_dest_real_src = class_name in int_dest_real_src_list
+        is_float_dest_fake_src = class_name in float_dest_fake_src_list
+        for x in srcs:
+            if not x.is_dest:
+                # [Octal] A special case:
+                if x.full_name == "SrcReg1":
+                    x.ignore_taint = is_int_src1_fake_src_list
+                continue
+            # x.ignore_taint = True if x is a dest considered as a "fake src" which is either
+            # 1. only used to fill not updated bits
+            # 2. only used on false unreachable branches
+            if x.reg_class == "intRegClass":
+                if x.full_name == "DestReg":
+                    x.ignore_taint = not is_int_dest_real_src
+                elif x.full_name in ["ProdLow", "ProdHi", "Data"]:
+                    x.ignore_taint = True
+            elif x.reg_class == "floatRegClass":
+                assert x.full_name == "FpDestReg_uqw"
+                x.ignore_taint = is_float_dest_fake_src
+
         for idx, reg in enumerate(srcs):
             reg.src_reg_idx = idx
         for idx, reg in enumerate(dests):
diff --git a/src/arch/isa_parser/operand_types.py b/src/arch/isa_parser/operand_types.py
index 63ca765a09..2365a4d460 100755
--- a/src/arch/isa_parser/operand_types.py
+++ b/src/arch/isa_parser/operand_types.py
@@ -122,6 +122,8 @@ class Operand(object):
     src_reg_constructor = "\n\tsetSrcRegIdx(_numSrcRegs++, %s);"
     dst_reg_constructor = "\n\tsetDestRegIdx(_numDestRegs++, %s);"
 
+    ignore_taint_constructor = "\n\tsetIgnoreSrcTaint(_numSrcRegs - 1, %s);"
+
     def regId(self):
         return f"{self.reg_class}[{self.reg_spec}]"
 
@@ -137,6 +139,10 @@ class Operand(object):
         self.ext = ext
         self.is_src = is_src
         self.is_dest = is_dest
+
+        # [Octal] Detailed labelling accurate taint tracking
+        self.ignore_taint = False
+
         # The 'effective extension' (eff_ext) is either the actual
         # extension, if one was explicitly provided, or the default.
         if ext:
@@ -208,6 +214,10 @@ class RegOperand(Operand):
 
         if self.is_src:
             c_src = self.src_reg_constructor % self.srcRegId()
+            if self.ignore_taint:
+                c_src += self.ignore_taint_constructor % "true"
+            else:
+                c_src += self.ignore_taint_constructor % "false"
 
         if self.is_dest:
             c_dest = self.dst_reg_constructor % self.destRegId()
diff --git a/src/arch/x86/insts/microfpop.hh b/src/arch/x86/insts/microfpop.hh
index 3c9f5b8aa2..95fb090127 100644
--- a/src/arch/x86/insts/microfpop.hh
+++ b/src/arch/x86/insts/microfpop.hh
@@ -63,6 +63,10 @@ class FpOp : public X86MicroopBase
   public:
     const uint8_t dataSize;
     const RegIndex foldOBit;
+
+    uint8_t getSrcSize() const override { return dataSize; }
+    uint8_t getDestSize() const override { return dataSize; }
+    RegIndex getFoldOBit() const override { return foldOBit; }
 };
 
 } // namespace X86ISA
diff --git a/src/arch/x86/insts/microldstop.hh b/src/arch/x86/insts/microldstop.hh
index e38341b294..9975f623db 100644
--- a/src/arch/x86/insts/microldstop.hh
+++ b/src/arch/x86/insts/microldstop.hh
@@ -78,6 +78,21 @@ class MemOp : public X86MicroopBase
     const uint8_t dataSize;
     const uint8_t addressSize;
     const RegIndex foldOBit, foldABit;
+
+    uint8_t getSrcSize() const override {
+        // Lea is the only MemOp where src's size is queried
+        assert(opClass() == IntAluOp);
+        return dataSize;
+    }
+    uint8_t getDestSize() const override {
+        // Lea is the only MemOp where dest's size is queried
+        assert(opClass() == IntAluOp);
+        return dataSize;
+    }
+    uint8_t getDataSize() const override { return dataSize; }
+    uint8_t getAddressSize() const override { return addressSize; }
+    RegIndex getFoldOBit() const override { return foldOBit; }
+    RegIndex getFoldABit() const override { return foldABit; }
 };
 
 /**
diff --git a/src/arch/x86/insts/micromediaop.hh b/src/arch/x86/insts/micromediaop.hh
index bd897f90e2..ed7941df9a 100644
--- a/src/arch/x86/insts/micromediaop.hh
+++ b/src/arch/x86/insts/micromediaop.hh
@@ -84,8 +84,8 @@ class MediaOpBase : public X86MicroopBase
     }
 
   public:
-    uint8_t getSrcSize() const { return srcSize; }
-    uint8_t getDestSize() const { return destSize; }
+    uint8_t getSrcSize() const override { return srcSize; }
+    uint8_t getDestSize() const override { return destSize; }
 };
 
 } // namespace X86ISA
diff --git a/src/arch/x86/insts/microregop.hh b/src/arch/x86/insts/microregop.hh
index 979fd20fa0..4ca71bc09d 100644
--- a/src/arch/x86/insts/microregop.hh
+++ b/src/arch/x86/insts/microregop.hh
@@ -68,6 +68,10 @@ class RegOpBase : public X86MicroopBase
   public:
     const uint8_t dataSize;
     const RegIndex foldOBit;
+
+    uint8_t getSrcSize() const override { return dataSize; }
+    uint8_t getDestSize() const override { return dataSize; }
+    RegIndex getFoldOBit() const override { return foldOBit; }
 };
 
 template <typename ...Operands>
diff --git a/src/arch/x86/insts/static_inst.cc b/src/arch/x86/insts/static_inst.cc
index 1f3df36a10..aa66f3425a 100644
--- a/src/arch/x86/insts/static_inst.cc
+++ b/src/arch/x86/insts/static_inst.cc
@@ -38,6 +38,8 @@
 
 #include "arch/x86/insts/static_inst.hh"
 
+#include "arch/x86/insts/microop.hh"
+#include "arch/x86/regs/misc.hh"
 #include "arch/x86/regs/segment.hh"
 #include "cpu/reg_class.hh"
 
@@ -301,5 +303,83 @@ X86StaticInst::generateDisassembly(
     return ss.str();
 }
 
+uint32_t
+X86StaticInst::flagsInCond(uint16_t condition)
+{
+    switch(condition)
+    {
+      case condition_tests::True:
+        return 0;
+      case condition_tests::ECF:
+        return ECFBit;
+      case condition_tests::EZF:
+        return EZFBit;
+      case condition_tests::SZnZF:
+        return EZFBit | ZFBit;
+      case condition_tests::MSTRZ:
+        panic("This condition is not implemented!");
+      case condition_tests::STRZ:
+        panic("This condition is not implemented!");
+      case condition_tests::MSTRC:
+        panic("This condition is not implemented!");
+      case condition_tests::STRZnEZF:
+        return EZFBit | ZFBit;
+      case condition_tests::OF:
+        return OFBit;
+      case condition_tests::CF:
+        return CFBit;
+      case condition_tests::ZF:
+        return ZFBit;
+      case condition_tests::CvZF:
+        return CFBit | ZFBit;
+      case condition_tests::SF:
+        return SFBit;
+      case condition_tests::PF:
+        return PFBit;
+      case condition_tests::SxOF:
+        return SFBit | OFBit;
+      case condition_tests::SxOvZF:
+        return SFBit | OFBit | ZFBit;
+      case condition_tests::False:
+        return 0;
+      case condition_tests::NotECF:
+        return ECFBit;
+      case condition_tests::NotEZF:
+        return EZFBit;
+      case condition_tests::NotSZnZF:
+        return EZFBit | ZFBit;
+      case condition_tests::NotMSTRZ:
+        panic("This condition is not implemented!");
+      case condition_tests::NotSTRZ:
+        panic("This condition is not implemented!");
+      case condition_tests::NotMSTRC:
+        panic("This condition is not implemented!");
+      case condition_tests::STRnZnEZF:
+        return EZFBit | ZFBit;
+      case condition_tests::NotOF:
+        return OFBit;
+      case condition_tests::NotCF:
+        return CFBit;
+      case condition_tests::NotZF:
+        return ZFBit;
+      case condition_tests::NotCvZF:
+        return CFBit | ZFBit;
+      case condition_tests::NotSF:
+        return SFBit;
+      case condition_tests::NotPF:
+        return PFBit;
+      case condition_tests::NotSxOF:
+        return SFBit | OFBit;
+      case condition_tests::NotSxOvZF:
+        return SFBit | OFBit | ZFBit;
+    }
+    panic("Unknown condition: %d\n", condition);
+    return 0;
+}
+
+std::set<std::string> X86StaticInst::getSizeMnes;
+std::set<std::pair<std::string, uint16_t>> X86StaticInst::getAccFlagMnes;
+std::set<std::pair<std::string, uint16_t>> X86StaticInst::getWrFlagMnes;
+
 } // namespace X86ISA
 } // namespace gem5
diff --git a/src/arch/x86/insts/static_inst.hh b/src/arch/x86/insts/static_inst.hh
index 03ee1be19a..d5315ff237 100644
--- a/src/arch/x86/insts/static_inst.hh
+++ b/src/arch/x86/insts/static_inst.hh
@@ -40,12 +40,15 @@
 
 #include "arch/x86/pcstate.hh"
 #include "arch/x86/regs/int.hh"
+#include "arch/x86/regs/misc.hh"
 #include "arch/x86/types.hh"
 #include "base/trace.hh"
 #include "cpu/static_inst.hh"
 #include "cpu/thread_context.hh"
 #include "debug/X86.hh"
 
+#include <set>
+
 namespace gem5
 {
 
@@ -222,6 +225,66 @@ class X86StaticInst : public StaticInst
         ret_pc_ptr->as<PCState>().uEnd();
         return std::unique_ptr<PCStateBase>{ret_pc_ptr};
     }
+
+  private:
+    static std::set<std::string> getSizeMnes;
+    static std::set<std::pair<std::string, uint16_t>> getAccFlagMnes;
+    static std::set<std::pair<std::string, uint16_t>> getWrFlagMnes;
+
+    void emitGetSizeWarnings() const {
+        if (!getSizeMnes.count(mnemonic)) {
+            warn("getSrc/DestSize for %s, using default reg size", mnemonic);
+            getSizeMnes.insert(mnemonic);
+        }
+    }
+
+  protected:
+    uint16_t flagsAccessed = UINT16_MAX;
+    uint16_t flagsWritten = UINT16_MAX;
+    bool trivialWhenSrc1EqSrc2 = false;
+
+    static uint32_t flagsInCond(uint16_t condition);
+
+  public:
+    // insts like CPUID directly inherits this class
+    // we expect them to operate on full register
+    uint8_t getSrcSize() const override {
+        emitGetSizeWarnings();
+        return sizeof(RegVal);
+    }
+    uint8_t getDestSize() const override {
+        emitGetSizeWarnings();
+        return sizeof(RegVal);
+    }
+    uint16_t getAccessedFlags() const override {
+        assert(flagsAccessed != UINT16_MAX);
+        auto pr = std::make_pair(mnemonic, flagsAccessed);
+        if (!getAccFlagMnes.count(pr)) {
+            inform("%s accesses EFLAG: %s", mnemonic, strOfEflagMask(flagsAccessed));
+            getAccFlagMnes.insert(pr);
+        }
+        return flagsAccessed;
+    }
+    uint16_t getWrittenFlags() const override {
+        assert(flagsWritten != UINT16_MAX);
+        uint16_t mask = flagsWritten & CondFlagMask;
+        auto pr = std::make_pair(mnemonic, mask);
+        if (!getWrFlagMnes.count(pr)) {
+            inform("%s writes EFLAG: %s", mnemonic, strOfEflagMask(mask));
+            getWrFlagMnes.insert(pr);
+        }
+        return mask;
+    }
+    bool isCsvtOvertainting() const override {
+        if (flagsWritten == UINT16_MAX)
+            return false;
+        if (flagsWritten & TaintAllMagicNum) {
+            assert(flagsWritten == TaintAllMagicNum);
+            return true;
+        }
+        return false;
+    }
+    bool isTrivialWhenSrc1EqSrc2() const override { return trivialWhenSrc1EqSrc2; }
 };
 
 } // namespace X86ISA
diff --git a/src/arch/x86/isa/microops/debug.isa b/src/arch/x86/isa/microops/debug.isa
index 44ccfbb0f9..c9c2183163 100644
--- a/src/arch/x86/isa/microops/debug.isa
+++ b/src/arch/x86/isa/microops/debug.isa
@@ -81,6 +81,7 @@ def template MicroDebugFlagsConstructor {{
     {
         %(set_reg_idx_arr)s;
         %(constructor)s;
+        %(acc_eflags_init)s;
     }
 }};
 
@@ -88,7 +89,8 @@ let {{
     iop = InstObjParams("", "MicroDebugFlags", "X86ISA::MicroDebug",
             {"code": "",
              "cond_test": "checkCondition(ccFlagBits | cfofBits | \
-                                              dfBit | ecfBit | ezfBit, cc)"})
+                                              dfBit | ecfBit | ezfBit, cc)",
+             "acc_eflags_init": "flagsAccessed = flagsInCond(cc)"})
 
     header_output = MicroDebugFlagsDeclare.subst(iop)
     exec_output = MicroDebugFlagsExecute.subst(iop)
diff --git a/src/arch/x86/isa/microops/fpop.isa b/src/arch/x86/isa/microops/fpop.isa
index 5365c587ec..201098b1bb 100644
--- a/src/arch/x86/isa/microops/fpop.isa
+++ b/src/arch/x86/isa/microops/fpop.isa
@@ -96,6 +96,9 @@ def template MicroFpOpConstructor {{
     {
         %(set_reg_idx_arr)s;
         %(constructor)s;
+        %(acc_eflags_init)s;
+        %(wr_eflags_init)s;
+        %(trivial_init)s;
     }
 }};
 
@@ -109,7 +112,8 @@ let {{
 
     class FpOpMeta(type):
         def buildCppClasses(self, name, Name, suffix, code, flag_code,
-                cond_check, else_code, op_class, operand_types):
+                cond_check, else_code, acc_eflags_init, wr_eflags_init,
+                op_class, operand_types):
 
             # Globals to stick the output in
             global header_output
@@ -123,13 +127,19 @@ let {{
             # a version without it and fix up this version to use it.
             if flag_code != "" or cond_check != "true":
                 self.buildCppClasses(name, Name, suffix,
-                        code, "", "true", else_code, op_class, operand_types)
+                        code, "", "true", else_code,
+                        acc_eflags_init,
+                        "", # suppose no-flag version does not update flags
+                        op_class, operand_types)
                 suffix = "Flags" + suffix
 
             base = "X86ISA::InstOperands<" + \
                 ", ".join(["X86ISA::FpOp"] +
                           [op.cxx_class() for op in operand_types]) + ">"
 
+            trivial_pattern = re.compile(r"\s(\w*SrcReg)1(\w*) [\^-] \1[2]\2;")
+            trivial_init = "trivialWhenSrc1EqSrc2 = true"
+
             # Get everything ready for the substitution
             iop_tag = InstObjParams(name, Name + suffix + "TopTag", base,
                     {"code" : code,
@@ -138,6 +148,9 @@ let {{
                      "else_code" : else_code,
                      "tag_code" : "FTW = genX87Tags(FTW, TOP, spm);",
                      "top_code" : "TOP = (TOP + spm + 8) % 8;",
+                     "acc_eflags_init": acc_eflags_init,
+                     "wr_eflags_init": wr_eflags_init,
+                     "trivial_init" : trivial_init if trivial_pattern.search(allCode) else "",
                      "op_class" : op_class})
             iop_top = InstObjParams(name, Name + suffix + "Top", base,
                     {"code" : code,
@@ -146,6 +159,9 @@ let {{
                      "else_code" : else_code,
                      "tag_code" : ";",
                      "top_code" : "TOP = (TOP + spm + 8) % 8;",
+                     "acc_eflags_init": acc_eflags_init,
+                     "wr_eflags_init": wr_eflags_init,
+                     "trivial_init" : trivial_init if trivial_pattern.search(allCode) else "",
                      "op_class" : op_class})
             iop = InstObjParams(name, Name + suffix, base,
                     {"code" : code,
@@ -154,6 +170,9 @@ let {{
                      "else_code" : else_code,
                      "tag_code" : ";",
                      "top_code" : ";",
+                     "acc_eflags_init": acc_eflags_init,
+                     "wr_eflags_init": wr_eflags_init,
+                     "trivial_init" : trivial_init if trivial_pattern.search(allCode) else "",
                      "op_class" : op_class})
 
             # Generate the actual code (finally!)
@@ -183,12 +202,16 @@ let {{
                 flag_code = cls.flag_code
                 cond_check = cls.cond_check
                 else_code = cls.else_code
+                acc_eflags_init = cls.acc_eflags_init
+                wr_eflags_init = cls.wr_eflags_init
                 op_class = cls.op_class
                 operand_types = cls.operand_types
 
                 # Set up the C++ classes
                 mcls.buildCppClasses(cls, name, Name, "",
-                        code, flag_code, cond_check, else_code, op_class,
+                        code, flag_code, cond_check, else_code,
+                        acc_eflags_init, wr_eflags_init,
+                        op_class,
                         operand_types)
 
                 # Hook into the microassembler dict
@@ -205,6 +228,8 @@ let {{
         flag_code = ""
         cond_check = "true"
         else_code = ";"
+        acc_eflags_init = ""
+        wr_eflags_init = ""
         op_class = "FloatAddOp"
 
         def __init__(self, *ops, spm=0,
@@ -418,6 +443,8 @@ let {{
                 ccFlagBits = ccFlagBits | ZFBit;
         '''
         op_class = 'FloatCmpOp'
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = CcFlagMask | CfofMask"
 
     class absfp(Fp2Op):
         code = 'FpDestReg = fabs(FpSrcReg1);'
diff --git a/src/arch/x86/isa/microops/mediaop.isa b/src/arch/x86/isa/microops/mediaop.isa
index 5fcf1d378b..c819531089 100644
--- a/src/arch/x86/isa/microops/mediaop.isa
+++ b/src/arch/x86/isa/microops/mediaop.isa
@@ -62,6 +62,9 @@ def template MediaOpDeclare {{
         {
             %(set_reg_idx_arr)s;
             %(constructor)s;
+            %(acc_eflags_init)s;
+            %(wr_eflags_init)s;
+            %(trivial_init)s;
         }
 
         Fault execute(ExecContext *, trace::InstRecord *) const override;
@@ -76,7 +79,8 @@ let {{
     exec_output = ""
 
     class MediaOpMeta(type):
-        def buildCppClasses(self, name, Name, suffix, code, operand_types):
+        def buildCppClasses(self, name, Name, suffix, code,
+                acc_eflags_init, wr_eflags_init, operand_types):
 
             # Globals to stick the output in
             global header_output
@@ -98,21 +102,34 @@ let {{
                     typeQual = match.group("typeQual")
                 src2_name = "%sFpSrcReg2%s" % (match.group("prefix"), typeQual)
                 self.buildCppClasses(name, Name, suffix,
-                        matcher.sub(src2_name, code), operand_types)
+                        matcher.sub(src2_name, code),
+                        matcher.sub(src2_name, acc_eflags_init),
+                        matcher.sub(src2_name, wr_eflags_init),
+                        operand_types)
                 self.buildCppClasses(name + "i", Name, suffix + "Imm",
-                        matcher.sub("imm8", code), imm_operand_types)
+                        matcher.sub("imm8", code),
+                        matcher.sub("imm8", acc_eflags_init),
+                        matcher.sub("imm8", wr_eflags_init),
+                        imm_operand_types)
                 return
 
             base = "X86ISA::InstOperands<" + \
                     ", ".join(["X86ISA::MediaOpBase"] +
                               [op.cxx_class() for op in operand_types]) + ">"
 
+            trivial_pattern = re.compile(r"\s(\w*SrcReg)1(\w*) [\^-] \1[2]\2;")
+            trivial_init = "trivialWhenSrc1EqSrc2 = true"
+
             # Get everything ready for the substitution
             opt_args = []
             if self.op_class:
                 opt_args.append(self.op_class)
-            iop = InstObjParams(name, Name + suffix, base, {"code" : code},
-                                opt_args)
+            iop = InstObjParams(name, Name + suffix, base, {
+                    "code" : code,
+                    "acc_eflags_init" : acc_eflags_init,
+                    "wr_eflags_init" : wr_eflags_init,
+                    "trivial_init" : trivial_init if trivial_pattern.search(code) else "",
+                }, opt_args)
 
             # Generate the actual code (finally!)
             header_output += MediaOpDeclare.subst(iop)
@@ -133,10 +150,12 @@ let {{
                 cls.className = Name
                 cls.base_mnemonic = name
                 code = cls.code
+                acc_eflags_init = cls.acc_eflags_init
+                wr_eflags_init = cls.wr_eflags_init
                 operand_types = cls.operand_types
 
                 # Set up the C++ classes
-                mcls.buildCppClasses(cls, name, Name, "", code, operand_types)
+                mcls.buildCppClasses(cls, name, Name, "", code, acc_eflags_init, wr_eflags_init, operand_types)
 
                 # Hook into the microassembler dict
                 global microopClasses
@@ -154,6 +173,9 @@ let {{
         # This class itself doesn't act as a microop
         abstract = True
 
+        acc_eflags_init = ""
+        wr_eflags_init = ""
+
         def __init__(self, *args, size=None, destSize=None, srcSize=None,
                 ext=None):
             self.args = list(map(str, args))
@@ -1548,6 +1570,8 @@ let {{
             else if(arg1 == arg2)
                 ccFlagBits = ccFlagBits | ZFBit;
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = CcFlagMask | CfofMask"
 
     class Emms(Media0Op):
         def __init__(self):
diff --git a/src/arch/x86/isa/microops/regop.isa b/src/arch/x86/isa/microops/regop.isa
index c7e9f46f10..5f4dd11c61 100644
--- a/src/arch/x86/isa/microops/regop.isa
+++ b/src/arch/x86/isa/microops/regop.isa
@@ -84,6 +84,9 @@ def template MicroRegOpDeclare {{
             %(set_reg_idx_arr)s;
             %(constructor)s;
             %(cond_control_flag_init)s;
+            %(acc_eflags_init)s;
+            %(wr_eflags_init)s;
+            %(trivial_init)s;
         }
 
         Fault execute(ExecContext *, trace::InstRecord *) const override;
@@ -107,6 +110,9 @@ def template MicroRegOpBranchDeclare {{
             %(set_reg_idx_arr)s;
             %(constructor)s;
             %(cond_control_flag_init)s;
+            %(acc_eflags_init)s;
+            %(wr_eflags_init)s;
+            %(trivial_init)s;
         }
 
         Fault execute(ExecContext *, trace::InstRecord *) const override;
@@ -182,7 +188,7 @@ let {{
     class RegOpMeta(type):
         def buildCppClasses(self, name, Name, suffix, code, big_code, \
                 flag_code, cond_check, else_code, cond_control_flag_init,
-                op_class, operand_types):
+                acc_eflags_init, wr_eflags_init, op_class, operand_types):
 
             # Globals to stick the output in
             global header_output
@@ -191,9 +197,9 @@ let {{
 
             # Stick all the code together so it can be searched at once
             allCode = "|".join((code, flag_code, cond_check, else_code,
-                                cond_control_flag_init))
+                                cond_control_flag_init, acc_eflags_init, wr_eflags_init))
             allBigCode = "|".join((big_code, flag_code, cond_check, else_code,
-                                   cond_control_flag_init))
+                                   cond_control_flag_init, acc_eflags_init, wr_eflags_init))
 
             # If op2 is used anywhere, make register and immediate versions
             # of this code.
@@ -219,6 +225,8 @@ let {{
                         matcher.sub(src2_name, cond_check),
                         matcher.sub(src2_name, else_code),
                         matcher.sub(src2_name, cond_control_flag_init),
+                        matcher.sub(src2_name, acc_eflags_init),
+                        matcher.sub(src2_name, wr_eflags_init),
                         op_class, operand_types)
                 imm_name = '(int8_t)imm8' if match.group("prefix") else 'imm8'
                 self.buildCppClasses(name + "i", Name, suffix + "Imm",
@@ -228,6 +236,8 @@ let {{
                         matcher.sub(imm_name, cond_check),
                         matcher.sub(imm_name, else_code),
                         matcher.sub(imm_name, cond_control_flag_init),
+                        matcher.sub(imm_name, acc_eflags_init),
+                        matcher.sub(imm_name, wr_eflags_init),
                         op_class, imm_operand_types)
                 return
 
@@ -236,7 +246,10 @@ let {{
             if flag_code != "" or cond_check != "true":
                 self.buildCppClasses(name, Name, suffix,
                         code, big_code, "", "true", else_code,
-                        "flags[IsUncondControl] = flags[IsControl];", op_class,
+                        "flags[IsUncondControl] = flags[IsControl];",
+                        acc_eflags_init,
+                        "", # suppose no-flag version does not update flags
+                        op_class,
                         operand_types)
                 suffix = "Flags" + suffix
 
@@ -247,6 +260,9 @@ let {{
                 templates = branchTemplates
             else:
                 templates = normalTemplates
+            
+            trivial_pattern = re.compile(r"(\w*SrcReg)1(\w*) [\^-] \1[2]\2[;)]")
+            trivial_init = "trivialWhenSrc1EqSrc2 = true"
 
             # Get everything ready for the substitution
             iops = [InstObjParams(name, Name + suffix, base,
@@ -255,6 +271,9 @@ let {{
                      "cond_check" : cond_check,
                      "else_code" : else_code,
                      "cond_control_flag_init" : cond_control_flag_init,
+                     "acc_eflags_init" : acc_eflags_init,
+                     "wr_eflags_init" : wr_eflags_init,
+                     "trivial_init" : trivial_init if trivial_pattern.search(allCode) else "",
                      "op_class" : op_class})]
             if big_code != "":
                 iops += [InstObjParams(name, Name + suffix + "Big", base,
@@ -263,6 +282,9 @@ let {{
                           "cond_check" : cond_check,
                           "else_code" : else_code,
                           "cond_control_flag_init" : cond_control_flag_init,
+                          "acc_eflags_init": acc_eflags_init,
+                          "wr_eflags_init": wr_eflags_init,
+                          "trivial_init" : trivial_init if trivial_pattern.search(allBigCode) else "",
                           "op_class" : op_class})]
 
             # Generate the actual code (finally!)
@@ -292,20 +314,22 @@ let {{
             cond_check = cls.cond_check
             else_code = cls.else_code
             cond_control_flag_init = cls.cond_control_flag_init
+            acc_eflags_init = cls.acc_eflags_init
+            wr_eflags_init = cls.wr_eflags_init
             op_class = cls.op_class
             operand_types = cls.operand_types
 
             # Set up the C++ classes
             mcls.buildCppClasses(cls, name, Name, "", code, big_code,
                     flag_code, cond_check, else_code,
-                    cond_control_flag_init, op_class, operand_types)
+                    cond_control_flag_init, acc_eflags_init, wr_eflags_init, op_class, operand_types)
 
             # Hook into the microassembler dict
             global microopClasses
             microopClasses[name] = cls
 
             allCode = "|".join((code, flag_code, cond_check, else_code,
-                                cond_control_flag_init))
+                                cond_control_flag_init, acc_eflags_init, wr_eflags_init))
 
             # If op2 is used anywhere, make register and immediate versions
             # of this code.
@@ -326,6 +350,8 @@ let {{
         cond_check = "true"
         else_code = ";"
         cond_control_flag_init = ""
+        acc_eflags_init = ""
+        wr_eflags_init = ""
         op_class = "IntAluOp"
 
         def __init__(self, *ops, flags=None, dataSize="env.dataSize"):
@@ -410,6 +436,8 @@ let {{
             PredcfofBits = PredcfofBits & ~((CFBit | OFBit) & ext);
             PredecfBit = PredecfBit & ~(ECFBit & ext);
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class FlagRegOp(BasicRegOp):
         abstract = True
@@ -424,6 +452,8 @@ let {{
             PreddfBit = newFlags & DFBit;
             PredccFlagBits = newFlags & CcFlagMask;
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class SubRegOp(BasicRegOp):
         abstract = True
@@ -438,12 +468,15 @@ let {{
             PreddfBit = newFlags & DFBit;
             PredccFlagBits = newFlags & CcFlagMask;
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class CondRegOp(RegOp):
         abstract = True
         cond_check = "checkCondition(ccFlagBits | cfofBits | dfBit | ecfBit | \
                                      ezfBit, ext)"
         cond_control_flag_init = "flags[IsCondControl] = flags[IsControl];"
+        acc_eflags_init = "flagsAccessed = flagsInCond(ext)"
 
     class RdRegOp(RegOp):
         operand_types = (FoldedDestOp, FoldedSrc1Op)
@@ -485,6 +518,7 @@ let {{
             DestReg = result =
                 (PSrcReg1 + op2 + flags.cf) & mask(dataSize * 8);
             '''
+        acc_eflags_init = "flagsAccessed = CFBit"
 
     class Sbb(SubRegOp):
         code = '''
@@ -497,6 +531,7 @@ let {{
             DestReg = result =
                 (PSrcReg1 - op2 - flags.cf) & mask(dataSize * 8);
             '''
+        acc_eflags_init = "flagsAccessed = CFBit"
 
     class And(LogicRegOp):
         code = '''
@@ -552,6 +587,8 @@ let {{
                 PredecfBit = PredecfBit & ~(ext & ECFBit);
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext & (CFBit | OFBit | ECFBit)"
 
     class Mul1u(WrRegOp):
         op_class = 'IntMultOp'
@@ -586,6 +623,8 @@ let {{
                 PredecfBit = PredecfBit & ~(ext & ECFBit);
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext & (CFBit | OFBit | ECFBit)"
 
     class Mulel(RdRegOp):
         code = 'DestReg = merge(SrcReg1, dest, ProdLow, dataSize);'
@@ -690,6 +729,8 @@ let {{
             else
                 PredezfBit = PredezfBit & ~(ext & EZFBit);
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext & EZFBit"
 
     class Divq(RdRegOp):
         code = 'DestReg = merge(SrcReg1, dest, Quotient, dataSize);'
@@ -751,6 +792,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Srl(BasicRegOp):
         # Because what happens to the bits shift -in- on a right shift
@@ -797,6 +840,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Sra(BasicRegOp):
         # Because what happens to the bits shift -in- on a right shift
@@ -843,6 +888,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Ror(BasicRegOp):
         code = '''
@@ -887,6 +934,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Rcr(BasicRegOp):
         code = '''
@@ -937,6 +986,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = CFBit"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Rol(BasicRegOp):
         code = '''
@@ -982,6 +1033,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Rcl(BasicRegOp):
         code = '''
@@ -1032,6 +1085,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = CFBit"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Sld(BasicRegOp):
         sldCode = '''
@@ -1092,6 +1147,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Srd(BasicRegOp):
         srdCode = '''
@@ -1158,6 +1215,8 @@ let {{
                 PredccFlagBits = newFlags & CcFlagMask;
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext"
 
     class Mdb(WrRegOp):
         code = 'DoubleBits = PSrcReg1 ^ op2;'
@@ -1175,6 +1234,7 @@ let {{
             dfBit = newFlags & DFBit;
             ccFlagBits = newFlags & CcFlagMask;
         '''
+        wr_eflags_init = "flagsWritten = TaintAllMagicNum"
 
     class Wrflags(WrRegOp):
         code = '''
@@ -1194,18 +1254,21 @@ let {{
                 ACBit | VIFBit | VIPBit | IDBit;
             nccFlagBits = new_flags & SysFlagMask;
         '''
+        wr_eflags_init = "flagsWritten = TaintAllMagicNum"
 
     class Rdip(RdRegOp):
         code = 'DestReg = NRIP - CSBase;'
 
     class Ruflags(RdRegOp):
         code = 'DestReg = ccFlagBits | cfofBits | dfBit | ecfBit | ezfBit;'
+        acc_eflags_init = "flagsAccessed = CondFlagMask"
 
     class Rflags(RdRegOp):
         code = '''
             DestReg = ccFlagBits | cfofBits | dfBit |
                       ecfBit | ezfBit | nccFlagBits | (1 << 1);
             '''
+        acc_eflags_init = "flagsAccessed = CondFlagMask"
 
     class Ruflag(RegOp):
         code = '''
@@ -1222,6 +1285,9 @@ let {{
             ezfBit = (flag == 0) ? EZFBit : 0;
             '''
 
+        acc_eflags_init = "assert(CondFlagMask & (1 << imm8)); flagsAccessed = 1 << imm8"
+        wr_eflags_init = "flagsWritten = EZFBit"
+
         operand_types = (FoldedDestOp, Imm8Op)
 
         def __init__(self, dest, imm, flags=None, dataSize="env.dataSize"):
@@ -1248,6 +1314,9 @@ let {{
             ezfBit = (flag == 0) ? EZFBit : 0;
             '''
 
+        acc_eflags_init = "assert(0x3F7FDD5 & CondFlagMask & (1 << imm8)); flagsAccessed = 1 << imm8"
+        wr_eflags_init = "flagsWritten = EZFBit"
+
         operand_types = (FoldedDestOp, Imm8Op)
         def __init__(self, dest, imm, flags=None, dataSize="env.dataSize"):
             super().__init__(dest, imm, flags=flags, dataSize=dataSize)
@@ -1287,6 +1356,9 @@ let {{
             }
             '''
 
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext & (ZFBit | CFBit | ECFBit | EZFBit)"
+
     class Zext(BasicRegOp):
         code = '''
             DestReg = merge(DestReg, dest, bits(PSrcReg1, op2, 0), dataSize);
@@ -1583,6 +1655,8 @@ let {{
                 PredezfBit = PredezfBit | (ext & EZFBit);
             }
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = ext & (ZFBit | EZFBit)"
 
     class Wrdh(BasicRegOp):
         code = '''
@@ -1709,4 +1783,6 @@ let {{
             }
             cfofBits = cfofBits & ~(X86ISA::OFBit | X86ISA::CFBit);
         '''
+        acc_eflags_init = "flagsAccessed = 0"
+        wr_eflags_init = "flagsWritten = CcFlagMask | CfofMask"
 }};
diff --git a/src/arch/x86/isa/microops/seqop.isa b/src/arch/x86/isa/microops/seqop.isa
index b24ef9eede..1c0ad8cc15 100644
--- a/src/arch/x86/isa/microops/seqop.isa
+++ b/src/arch/x86/isa/microops/seqop.isa
@@ -47,6 +47,7 @@ def template BrDeclare {{
         {
             %(set_reg_idx_arr)s;
             %(constructor)s;
+            %(acc_eflags_init)s;
         }
 
         Fault execute(ExecContext *, trace::InstRecord *) const override;
@@ -82,6 +83,7 @@ def template EretDeclare {{
         {
             %(set_reg_idx_arr)s;
             %(constructor)s;
+            %(acc_eflags_init)s;
         }
 
         Fault execute(ExecContext *, trace::InstRecord *) const override;
@@ -158,20 +160,21 @@ let {{
 
     cond_code = "checkCondition(ccFlagBits | cfofBits | dfBit |" \
                  "ecfBit | ezfBit, cc)"
-    for suffix, cond, flags in \
-            ("Flags", cond_code, ["IsDirectControl", "IsCondControl"]), \
-            ("", "true", []):
+    for suffix, cond, flags, acc_eflags_init in \
+            ("Flags", cond_code, ["IsDirectControl", "IsCondControl"], "flagsAccessed = flagsInCond(cc)"), \
+            ("", "true", [], ""):
         iop = InstObjParams("br", "Br" + suffix,
                 "X86ISA::InstOperands<X86ISA::MicroCondBase, X86ISA::UpcOp>",
                 {"code": "nuIP = target;", "else_code": "nuIP = nuIP;",
-                 "cond_test": cond},
+                 "cond_test": cond,
+                 "acc_eflags_init": acc_eflags_init},
                  flags)
         exec_output += SeqOpExecute.subst(iop)
         header_output += BrDeclare.subst(iop)
 
         iop = InstObjParams("eret", "Eret" + suffix,
                 "X86ISA::InstOperands<X86ISA::MicroCondBase>",
-                {"code": "", "else_code": "", "cond_test": cond}, flags)
+                {"code": "", "else_code": "", "cond_test": cond, "acc_eflags_init": acc_eflags_init}, flags)
         exec_output += SeqOpExecute.subst(iop)
         header_output += EretDeclare.subst(iop)
 }};
diff --git a/src/arch/x86/isa/microops/specop.isa b/src/arch/x86/isa/microops/specop.isa
index da2f340a27..a0a5d6b904 100644
--- a/src/arch/x86/isa/microops/specop.isa
+++ b/src/arch/x86/isa/microops/specop.isa
@@ -79,6 +79,7 @@ def template MicroFaultConstructor {{
     {
         %(set_reg_idx_arr)s;
         %(constructor)s;
+        %(acc_eflags_init)s;
     }
 }};
 
@@ -108,14 +109,15 @@ let {{
             "X86ISA::InstOperands<X86ISA::MicroCondBase, X86ISA::FaultOp>",
             {"code": "",
              "cond_test": "checkCondition(ccFlagBits | cfofBits | dfBit | \
-                                          ecfBit | ezfBit, cc)"})
+                                          ecfBit | ezfBit, cc)",
+             "acc_eflags_init": "flagsAccessed = flagsInCond(cc)"})
     exec_output = MicroFaultExecute.subst(iop)
     header_output = MicroFaultDeclare.subst(iop)
     decoder_output = MicroFaultConstructor.subst(iop)
     iop = InstObjParams("fault", "MicroFault",
             "X86ISA::InstOperands<X86ISA::MicroCondBase, X86ISA::FaultOp>",
             {"code": "",
-             "cond_test": "true"})
+             "cond_test": "true", "acc_eflags_init": ""})
     exec_output += MicroFaultExecute.subst(iop)
     header_output += MicroFaultDeclare.subst(iop)
     decoder_output += MicroFaultConstructor.subst(iop)
diff --git a/src/arch/x86/process.cc b/src/arch/x86/process.cc
index a195fdf888..4d3ae2bc32 100644
--- a/src/arch/x86/process.cc
+++ b/src/arch/x86/process.cc
@@ -56,6 +56,7 @@
 #include "base/logging.hh"
 #include "base/trace.hh"
 #include "cpu/thread_context.hh"
+#include "debug/Process.hh"
 #include "debug/Stack.hh"
 #include "mem/multi_level_page_table.hh"
 #include "mem/page_table.hh"
@@ -112,7 +113,7 @@ X86_64Process::X86_64Process(const ProcessParams &params,
 
     Addr brk_point = roundUp(image.maxAddr(), PageBytes);
     Addr stack_base = 0x7FFFFFFFF000ULL;
-    Addr max_stack_size = 8 * 1024 * 1024;
+    Addr max_stack_size = 16 * 1024 * 1024;
     Addr next_thread_stack_base = stack_base - max_stack_size;
     Addr mmap_end = 0x7FFFF7FFF000ULL;
 
@@ -961,6 +962,26 @@ X86Process::argsInit(int pageSize,
     DPRINTF(Stack, "0x%x - argc \n", argc_base);
     DPRINTF(Stack, "0x%x - stack min\n", stack_min);
 
+    std::clog << "Process's max stack size = 0x" << std::hex
+        << memState->getMaxStackSize() << std::endl;
+
+    // [Octal] Get public segments
+    if (elfObject) {
+        // 1. public section
+        std::string pub_sec_name = "public";
+        if (!elfObject->sectionInfo.size())
+            elfObject->getSections();
+        auto it = elfObject->sectionInfo.find(pub_sec_name);
+        if (it != elfObject->sectionInfo.end()) {
+            publicSegments.push_back(it->second);
+            std::clog << "Found public section " << pub_sec_name
+                      << std::hex
+                      << " " << it->second.first
+                      << " " << it->second.second << std::endl;
+        }
+    }
+
+
     // write contents to stack
 
     // figure out argc
diff --git a/src/arch/x86/regs/ccr.hh b/src/arch/x86/regs/ccr.hh
index 8433ade44a..b1faa187d0 100644
--- a/src/arch/x86/regs/ccr.hh
+++ b/src/arch/x86/regs/ccr.hh
@@ -68,11 +68,11 @@ namespace cc_reg
 {
 
 inline constexpr RegId
-    Zaps = ccRegClass[_ZapsIdx],
-    Cfof = ccRegClass[_CfofIdx],
-    Df = ccRegClass[_DfIdx],
-    Ecf = ccRegClass[_EcfIdx],
-    Ezf = ccRegClass[_EzfIdx];
+    Zaps = ccRegClass[_ZapsIdx], // CcFlagMask
+    Cfof = ccRegClass[_CfofIdx], // CfofMask
+    Df = ccRegClass[_DfIdx],     // DFBit
+    Ecf = ccRegClass[_EcfIdx],   // ECFBit
+    Ezf = ccRegClass[_EzfIdx];   // EZFBit
 
 } // namespace cc_reg
 
diff --git a/src/arch/x86/regs/misc.hh b/src/arch/x86/regs/misc.hh
index 1784142dbe..e67ddc2980 100644
--- a/src/arch/x86/regs/misc.hh
+++ b/src/arch/x86/regs/misc.hh
@@ -71,6 +71,24 @@ enum CondFlagBit
 
 constexpr uint32_t CfofMask = CFBit | OFBit;
 constexpr uint32_t CcFlagMask = PFBit | AFBit | ZFBit | SFBit;
+constexpr uint32_t CondFlagMask = CFBit | PFBit | ECFBit | AFBit | EZFBit | ZFBit | SFBit | DFBit | OFBit;
+constexpr uint32_t TaintAllMagicNum = 0x9 << 12;
+
+inline std::string strOfEflagMask(uint32_t mask) {
+    assert(!(mask & ~CondFlagMask));
+    if (!mask) return "";
+    std::string res = "";
+    if (mask & CFBit) res += ",CF";
+    if (mask & PFBit) res += ",PF";
+    if (mask & ECFBit) res += ",ECF";
+    if (mask & AFBit) res += ",AF";
+    if (mask & EZFBit) res += ",EZF";
+    if (mask & ZFBit) res += ",ZF";
+    if (mask & SFBit) res += ",SF";
+    if (mask & DFBit) res += ",DF";
+    if (mask & OFBit) res += ",OF";
+    return res.substr(1);
+}
 
 enum RFLAGBit
 {
diff --git a/src/base/loader/elf_object.cc b/src/base/loader/elf_object.cc
index dc2abb8dfc..9719a1d301 100644
--- a/src/base/loader/elf_object.cc
+++ b/src/base/loader/elf_object.cc
@@ -414,6 +414,10 @@ ElfObject::getSections()
         GElf_Shdr shdr;
         gelf_getshdr(section, &shdr);
         sectionNames.insert(elf_strptr(elf, ehdr.e_shstrndx, shdr.sh_name));
+
+        // [Octal] Get section start and end address
+        sectionInfo.emplace(elf_strptr(elf, ehdr.e_shstrndx, shdr.sh_name), std::make_pair(shdr.sh_addr, shdr.sh_size));
+
         section = elf_getscn(elf, ++sec_idx);
     } // while sections
 
diff --git a/src/base/loader/elf_object.hh b/src/base/loader/elf_object.hh
index 6159b35a7b..0600d007e0 100644
--- a/src/base/loader/elf_object.hh
+++ b/src/base/loader/elf_object.hh
@@ -43,6 +43,7 @@
 
 #include <set>
 #include <vector>
+#include <unordered_map>
 
 #include "base/compiler.hh"
 #include "base/loader/object_file.hh"
@@ -101,7 +102,6 @@ class ElfObject : public ObjectFile
     bool loadSomeSymbols(SymbolTable *symtab, int binding, Addr mask,
                          Addr base, Addr offset);
 
-    void getSections();
     bool sectionExists(std::string sec);
 
     MemoryImage image;
@@ -125,6 +125,10 @@ class ElfObject : public ObjectFile
     Addr programHeaderTable() {return _programHeaderTable;}
     uint16_t programHeaderSize() {return _programHeaderSize;}
     uint16_t programHeaderCount() {return _programHeaderCount;}
+
+    // [Octal]
+    void getSections();
+    std::unordered_map<std::string, std::pair<Addr, Addr> > sectionInfo;
 };
 
 /**
diff --git a/src/base/logging.cc b/src/base/logging.cc
index b871fcfa39..3f457e8460 100644
--- a/src/base/logging.cc
+++ b/src/base/logging.cc
@@ -73,6 +73,30 @@ class FatalLogger : public ExitLogger
     void exit() override { ::exit(1); }
 };
 
+class SCTLogger : public Logger
+{
+  public:
+    using Logger::Logger;
+
+  protected:
+    void
+    log(const Loc &loc, std::string s) override
+    {
+        std::string file = loc.file;
+        const auto lastSlashPos = file.find_last_of("/\\");
+        if (lastSlashPos != std::string::npos) {
+            file = file.substr(lastSlashPos + 1);
+        }
+        if (s.back() == '\n' || s.back() == '\r') {
+            s.pop_back();
+        }
+        if (s.back() != ' ') {
+            s.push_back(' ');
+        }
+        std::cout << s << "(" << file << ":" << loc.line << ")\n";
+    }
+};
+
 } // anonymous namespace
 
 // We intentionally put all the loggers on the heap to prevent them from being
@@ -111,4 +135,10 @@ Logger::getHack() {
     return *hack_logger;
 }
 
+Logger&
+Logger::getSCT() {
+    static SCTLogger* sct_logger = new SCTLogger("sct: ");
+    return *sct_logger;
+}
+
 } // namespace gem5
diff --git a/src/base/logging.hh b/src/base/logging.hh
index 8949b0cced..01f1d34ddf 100644
--- a/src/base/logging.hh
+++ b/src/base/logging.hh
@@ -64,6 +64,7 @@ class Logger
     static Logger &getWarn();
     static Logger &getInfo();
     static Logger &getHack();
+    static Logger &getSCT();
 
     enum LogLevel
     {
@@ -239,6 +240,7 @@ class Logger
  * \def warn_once(...)
  * \def inform_once(...)
  * \def hack_once(...)
+ * \def sct_log(...)
  *
  * @ingroup api_logger
  * @{
@@ -246,6 +248,7 @@ class Logger
 #define warn(...) base_message(::gem5::Logger::getWarn(), __VA_ARGS__)
 #define inform(...) base_message(::gem5::Logger::getInfo(), __VA_ARGS__)
 #define hack(...) base_message(::gem5::Logger::getHack(), __VA_ARGS__)
+#define sct_log(...) base_message(::gem5::Logger::getSCT(), __VA_ARGS__)
 
 #define warn_once(...) \
     base_message_once(::gem5::Logger::getWarn(), __VA_ARGS__)
diff --git a/src/cpu/o3/BaseO3CPU.py b/src/cpu/o3/BaseO3CPU.py
index 79bd884b87..37ba4f1533 100644
--- a/src/cpu/o3/BaseO3CPU.py
+++ b/src/cpu/o3/BaseO3CPU.py
@@ -197,3 +197,12 @@ class BaseO3CPU(BaseCPU):
         TournamentBP(numThreads=Parent.numThreads), "Branch Predictor"
     )
     needsTSO = Param.Bool(False, "Enable TSO Memory model")
+
+    attackModel = Param.String("None", "Attack model used in simulation")
+    defenseScheme = Param.String("None", "Defense scheme used in simulation")
+    privStackOff = Param.Int(
+        0, "Private stack's (negative) offset to the public stack"
+    )
+    stackDefaultPublic = Param.Bool(
+        False, "Is the stack public by default (instead of private)?"
+    )
diff --git a/src/cpu/o3/commit.cc b/src/cpu/o3/commit.cc
index 38dce831b1..01d2348d8a 100644
--- a/src/cpu/o3/commit.cc
+++ b/src/cpu/o3/commit.cc
@@ -663,6 +663,8 @@ Commit::tick()
 
     markCompletedInsts();
 
+    rob->updateInstructionVisibility();
+
     threads = activeThreads->begin();
 
     while (threads != end) {
@@ -835,6 +837,16 @@ Commit::commit()
                     tid,
                     fromIEW->mispredictInst[tid]->pcState().instAddr(),
                     fromIEW->squashedSeqNum[tid]);
+
+                auto inst = fromIEW->mispredictInst[tid];
+                if (inst->pendingSquash()) {
+                    inst->setPendingSquash(false);
+                    DPRINTF(Commit, "[tid:%i] Instruction [sn:%llu, pc:%s]'s pending "
+                        "squash is now squashed\n",
+                        inst->threadNumber,
+                        inst->seqNum,
+                        inst->pcState());
+                }
             } else {
                 DPRINTF(Commit,
                     "[tid:%i] Squashing due to order violation [sn:%llu]\n",
@@ -1003,6 +1015,29 @@ Commit::commitInsts()
             DPRINTF(Commit, "Retiring squashed instruction from "
                     "ROB.\n");
 
+            // Most delayed instructions will eventually be squashed.
+            // There are rare cases like declassification,
+            // where such instruction reaches VP and resumes.
+            if (head_inst->cycleOfDelay && !head_inst->cycleOfResume) {
+                const char *txName;
+                if (head_inst->delayedNonMemNonBrTx())
+                    txName = "non-mem non-br";
+                else if (head_inst->delayedMemTx())
+                    txName = "memory";
+                else if (head_inst->delayedBrTx())
+                    txName = "cond br";
+                else
+                    panic("Expect to be delayed in at least one form");
+
+                DPRINTF(Commit, "A %s transmitter [sn:%lli, pc:%s] previously "
+                    "delayed at %llu is eventually squashed.\n",
+                    txName,
+                    head_inst->seqNum,
+                    head_inst->pcState(),
+                    head_inst->cycleOfDelay
+                );
+            }
+
             rob->retireHead(commit_thread);
 
             ++stats.commitSquashedInsts;
@@ -1022,6 +1057,46 @@ Commit::commitInsts()
                 stats.committedInstType[tid][head_inst->opClass()]++;
                 ppCommit->notify(head_inst);
 
+                // Store gives warning when taint of data and memory mismatch
+                if (head_inst->isStore() || head_inst->isAtomic()) {
+                    assert(head_inst->effAddrValid());
+
+                    Taint memTaint = cpu->getMemTaint(head_inst->threadNumber,
+                            head_inst->effAddr, head_inst->effSize);
+                    assert(memTaint != Taint::Unknown);
+
+                    Taint dataTaint = Taint::Untainted;
+                    const std::vector<Taint> *dataTaintVec = head_inst->sqIt->dataTaint();
+                    for (auto taint : *dataTaintVec) {
+                        assert(taint != Taint::Unknown);
+                        if (taint == Taint::Tainted) {
+                            dataTaint = Taint::Tainted;
+                            break;
+                        }
+                    }
+
+                    if (memTaint != dataTaint) {
+                        if (memTaint == Taint::Tainted) {
+                            // dataTaint == Taint::Untainted
+                            // Storing public value into private region, possible overtainting
+                            // Uncomment this if warnings are needed
+
+                            // warn("[sn:%llu, pc:%s] Overtainting, addr=0x%llx, size=%u",
+                            //     head_inst->seqNum,
+                            //     head_inst->pcState(),
+                            //     head_inst->effAddr, head_inst->effSize);
+                        } else {
+                            // dataTaint == Taint::Tainted
+                            // Declassification
+                            assert(cpu->defenseScheme() == CPU::DefenseScheme::OurDefense);
+                            warn("[sn:%llu, pc:%s] Declassifying, addr=0x%llx, size=%u",
+                                head_inst->seqNum,
+                                head_inst->pcState(),
+                                head_inst->effAddr, head_inst->effSize);
+                        }
+                    }
+                }
+
                 // hardware transactional memory
 
                 // update nesting depth
@@ -1345,6 +1420,13 @@ Commit::getInsts()
             DPRINTF(Commit, "[tid:%i] [sn:%llu] Inserting PC %s into ROB.\n",
                     tid, inst->seqNum, inst->pcState());
 
+            /**
+             * Set taint as Unknown.
+             * Using Unknown for taint judgmenet will cause a panic.
+             * This will be overidden once the real taint is ready.
+             */
+            inst->setDestTaint(Taint::Unknown);
+
             rob->insertInst(inst);
 
             assert(rob->getThreadEntries(tid) <= rob->getMaxEntries(tid));
diff --git a/src/cpu/o3/cpu.cc b/src/cpu/o3/cpu.cc
index 48ccd94b54..75652b1fe5 100644
--- a/src/cpu/o3/cpu.cc
+++ b/src/cpu/o3/cpu.cc
@@ -113,7 +113,9 @@ CPU::CPU(const BaseO3CPUParams &params)
       globalSeqNum(1),
       system(params.system),
       lastRunningCycle(curCycle()),
-      cpuStats(this)
+      cpuStats(this),
+      _attackModel(AttackModel::None),
+      _defenseScheme(DefenseScheme::None)
 {
     fatal_if(FullSystem && params.numThreads > 1,
             "SMT is not supported in O3 in full system mode currently.");
@@ -296,6 +298,47 @@ CPU::CPU(const BaseO3CPUParams &params)
         fatal("O3CPU %s has no interrupt controller.\n"
               "Ensure createInterruptController() is called.\n", name());
     }
+
+    if (params.attackModel == "None") {
+        _attackModel = AttackModel::None;
+        sct_log("Attack model set to: None");
+    } else if (params.attackModel == "Spectre") {
+        _attackModel = AttackModel::Spectre;
+        sct_log("Attack model set to: Spectre");
+    } else if (params.attackModel == "Futuristic") {
+        _attackModel = AttackModel::Futuristic;
+        sct_log("Attack model set to: Futuristic");
+    } else {
+        fatal("O3CPU initialization: unrecognized attack model: %s",
+              params.attackModel.c_str());
+    }
+
+    if (params.defenseScheme == "None") {
+        _defenseScheme = DefenseScheme::None;
+        sct_log("Defense scheme set to: None");
+    } else if (params.defenseScheme == "NaiveSecureBaseline") {
+        _defenseScheme = DefenseScheme::NaiveSecureBaseline;
+        sct_log("Defense scheme set to: NaiveSecureBaseline");
+    } else if (params.defenseScheme == "SecureBaseline") {
+        _defenseScheme = DefenseScheme::SecureBaseline;
+        sct_log("Defense scheme set to: SecureBaseline");
+    } else if (params.defenseScheme == "OurDefense") {
+        _defenseScheme = DefenseScheme::OurDefense;
+        sct_log("Defense scheme set to: OurDefense");
+    } else {
+        fatal("O3CPU initialization: unrecognized defense scheme: %s",
+              params.attackModel.c_str());
+    }
+
+    privStackOff = params.privStackOff;
+
+    stackDefaultPublic = params.stackDefaultPublic;
+    if (stackDefaultPublic) {
+        sct_log("Stack's default secrecy level: public");
+    } else {
+        sct_log("Stack's default secrecy level: private");
+        sct_log("Private Stack Offset: 0x%llx", privStackOff);
+    }
 }
 
 void
diff --git a/src/cpu/o3/cpu.hh b/src/cpu/o3/cpu.hh
index 08a1312e73..a0f5cf3e5b 100644
--- a/src/cpu/o3/cpu.hh
+++ b/src/cpu/o3/cpu.hh
@@ -51,6 +51,8 @@
 
 #include "arch/generic/pcstate.hh"
 #include "base/statistics.hh"
+#include "cpu/activity.hh"
+#include "cpu/base.hh"
 #include "cpu/o3/comm.hh"
 #include "cpu/o3/commit.hh"
 #include "cpu/o3/decode.hh"
@@ -63,8 +65,6 @@
 #include "cpu/o3/rob.hh"
 #include "cpu/o3/scoreboard.hh"
 #include "cpu/o3/thread_state.hh"
-#include "cpu/activity.hh"
-#include "cpu/base.hh"
 #include "cpu/simple_thread.hh"
 #include "cpu/timebuf.hh"
 #include "params/BaseO3CPU.hh"
@@ -292,6 +292,83 @@ class CPU : public BaseCPU
     /** Halts the CPU. */
     void halt() { panic("Halt not implemented!\n"); }
 
+    const std::vector<Taint> *
+    getTaintVec(PhysRegIdPtr phys_reg)
+    {
+        return regFile.getTaint(phys_reg);
+    }
+
+    Taint getPartialTaint(PhysRegIdPtr phys_reg,
+                         uint8_t size, uint8_t offset = 0)
+    {
+        auto bitVec = getTaintVec(phys_reg);
+        if (!bitVec)
+            return Taint::Untainted;
+        assert(size + offset <= bitVec->size());
+
+        if (std::any_of(
+            bitVec->begin() + offset,
+            bitVec->begin() + offset + size,
+            [](Taint t){ return t == Taint::Unknown; }))
+            return Taint::Unknown;
+
+        if (std::any_of(
+            bitVec->begin() + offset,
+            bitVec->begin() + offset + size,
+            [](Taint t){ return t == Taint::Tainted; }))
+            return Taint::Tainted;
+
+        return Taint::Untainted;
+    }
+
+    Taint getPartialTaint(PhysRegIdPtr phys_reg,
+        std::vector<bool>& enableVec)
+    {
+        auto bitVec = getTaintVec(phys_reg);
+        if (!bitVec)
+            return Taint::Untainted;
+        assert(bitVec->size() == enableVec.size());
+
+        bool tainted = false;
+        for (size_t i = 0; i < bitVec->size(); i++) {
+            if (enableVec[i]) {
+                if (bitVec->at(i) == Taint::Unknown)
+                    return Taint::Unknown;
+                if (bitVec->at(i) == Taint::Tainted)
+                    tainted = true;
+            }
+        }
+        return tainted ? Taint::Tainted : Taint::Untainted;
+    }
+
+    void
+    setTaint(PhysRegIdPtr phys_reg, Taint taint)
+    {
+        regFile.setTaint(phys_reg, taint);
+    }
+
+    void
+    setPartialTaint(PhysRegIdPtr phys_reg, Taint taint,
+                    uint8_t size, uint8_t offset = 0)
+    {
+        regFile.setPartialTaint(phys_reg, taint, size, offset);
+    }
+
+    void
+    setPartialTaint(PhysRegIdPtr phys_reg, Taint taint,
+                    std::vector<bool>& updateVec)
+    {
+        regFile.setPartialTaint(phys_reg, taint, updateVec);
+    }
+
+    void
+    setPartialTaintVec(PhysRegIdPtr phys_reg,
+                       const std::vector<Taint>& taintVec,
+                       uint8_t size, uint8_t offset = 0)
+    {
+        regFile.setPartialTaintVec(phys_reg, taintVec, size, offset);
+    }
+
     /** Register accessors.  Index refers to the physical register index. */
 
     /** Reads a miscellaneous register. */
@@ -619,6 +696,73 @@ class CPU : public BaseCPU
     // hardware transactional memory
     void htmSendAbortSignal(ThreadID tid, uint64_t htm_uid,
                             HtmFailureFaultCause cause) override;
+
+  public:
+    /**
+     * Attack model defines the reasons creating transient instructions.
+     * See InvisiSpec paper's table for further details.
+     */
+    enum class AttackModel : unsigned int
+    {
+        None, Spectre, Futuristic, NumModels
+    };
+
+    /**
+     * Defense scheme adopted by the CPU against speculative execution attack.
+     * None: No defense at all
+     * NaiveSecureBaseline: Delay every transmitter instruction
+     * SecureBaseline: Consider data being read as tainted. Has basic taint
+     *                 forward propagation. Delay transmitter instruction
+     *                 that involves tainted register.
+     * OurDefense: The binary is processed by our static analysis.
+     *             Using minimum hardware mechanisms to cooperate with it.
+     *             (TODO: replace it with the official name of our tool
+     */
+    enum class DefenseScheme : unsigned int
+    {
+        None,
+        NaiveSecureBaseline,
+        SecureBaseline,
+        OurDefense
+    };
+
+    AttackModel attackModel() const { return _attackModel; }
+
+    DefenseScheme defenseScheme() const { return _defenseScheme; }
+
+  private:
+    AttackModel _attackModel;
+
+    DefenseScheme _defenseScheme;
+
+    uint64_t privStackOff = 0;
+
+    bool stackDefaultPublic = false;
+
+  public:
+    /**
+     * [Octal] Get memory region taint status
+     */
+    Taint getMemTaint(ThreadID tid, Addr loadAddr, unsigned loadSize) const {
+        switch (defenseScheme()) {
+            case CPU::DefenseScheme::None:
+            case CPU::DefenseScheme::NaiveSecureBaseline:
+            case CPU::DefenseScheme::SecureBaseline:
+                // All memory is considered tainted
+                // (giving up memory tracking).
+                return Taint::Tainted;
+            case CPU::DefenseScheme::OurDefense: {
+                Addr loadEnd = loadAddr + loadSize;
+                auto processPtr = thread[tid]->getProcessPtr();
+                return processPtr->isAddrPublic(loadAddr, loadEnd, privStackOff, stackDefaultPublic) ?
+                    Taint::Untainted : Taint::Tainted;
+            }
+            default:
+                assert(0 && "Unreachable");
+                return Taint::Unknown;
+        }
+    }
+
 };
 
 } // namespace o3
diff --git a/src/cpu/o3/dyn_inst.cc b/src/cpu/o3/dyn_inst.cc
index 0b9a900446..dfbfd8940a 100644
--- a/src/cpu/o3/dyn_inst.cc
+++ b/src/cpu/o3/dyn_inst.cc
@@ -42,6 +42,7 @@
 
 #include <algorithm>
 
+#include "arch/x86/regs/int.hh"
 #include "base/intmath.hh"
 #include "debug/DynInst.hh"
 #include "debug/IQ.hh"
@@ -59,7 +60,8 @@ DynInst::DynInst(const Arrays &arrays, const StaticInstPtr &static_inst,
       _numSrcs(arrays.numSrcs), _numDests(arrays.numDests),
       _flatDestIdx(arrays.flatDestIdx), _destIdx(arrays.destIdx),
       _prevDestIdx(arrays.prevDestIdx), _srcIdx(arrays.srcIdx),
-      _readySrcIdx(arrays.readySrcIdx), macroop(_macroop)
+      _readySrcIdx(arrays.readySrcIdx), macroop(_macroop),
+      cycleOfDelay(0), cycleOfResume(0)
 {
     std::fill(_readySrcIdx, _readySrcIdx + (numSrcs() + 7) / 8, 0);
 
@@ -309,6 +311,21 @@ DynInst::markSrcRegReady(RegIndex src_idx)
     markSrcRegReady();
 }
 
+bool
+DynInst::readyToCommit() const
+{
+    switch (cpu->defenseScheme()) {
+        case CPU::DefenseScheme::None:
+            return status[CanCommit];
+        case CPU::DefenseScheme::NaiveSecureBaseline:
+        case CPU::DefenseScheme::SecureBaseline:
+        case CPU::DefenseScheme::OurDefense:
+            return status[CanCommit] && !pendingSquash();
+        default:
+            assert(0 && "Unreachable");
+            return false;
+    }
+}
 
 void
 DynInst::setSquashed()
@@ -412,6 +429,7 @@ DynInst::initiateMemRead(Addr addr, unsigned size, Request::Flags flags,
 Fault
 DynInst::initiateMemMgmtCmd(Request::Flags flags)
 {
+    panic("initiateMemMgmtCmd not supported!!!\n");
     const unsigned int size = 8;
     return cpu->pushRequest(
             dynamic_cast<DynInstPtr::PtrType>(this),
@@ -446,5 +464,382 @@ DynInst::initiateMemAMO(Addr addr, unsigned size, Request::Flags flags,
             std::move(amo_op), std::vector<bool>(size, true));
 }
 
+std::set<std::pair<Addr, MicroPC>> DynInst::trivialWarns;
+
+bool
+DynInst::isTrivial() const {
+    if (!staticInst->isTrivialWhenSrc1EqSrc2())
+        return false;
+
+    assert(numSrcRegs() >= 2);
+    const auto srcReg1 = srcRegIdx(0);
+    const auto srcReg2 = srcRegIdx(1);
+    const auto renamedSrcReg1 = renamedSrcIdx(0);
+    const auto renamedSrcReg2 = renamedSrcIdx(1);
+
+    if (srcReg1.is(InvalidRegClass) || srcReg2.is(InvalidRegClass))
+        return false;
+    assert(srcReg1.classValue() == srcReg2.classValue());
+    assert(renamedSrcReg1->classValue() == renamedSrcReg2->classValue());
+    bool same1 = srcReg1.index() == srcReg2.index();
+    bool same2 = renamedSrcReg1->index() == renamedSrcReg2->index();
+
+    assert(!(same1 ^ same2));
+    if (same1 && same2) {
+        auto pr = std::make_pair(pc->instAddr(), pc->microPC());
+        if (!trivialWarns.count(pr)) {
+            inform("[sn:%llu, pc:%s] trivial inst detected: %s",
+                seqNum, pcState(), staticInst->disassemble(pc->instAddr()));
+            trivialWarns.insert(pr);
+        }
+        return true;
+    }
+    return false;
+}
+
+void
+DynInst::setDelayedMemTx(bool flag)
+{
+    // We add sanity check to exclude redundant logics.
+    assert(!(flag && cpu->defenseScheme() == CPU::DefenseScheme::None) &&
+           "With defense scheme set to None, a memory transmitter is however "
+           "delayed.");
+
+    if (flag) {
+        assert(!cycleOfDelay);
+        cycleOfDelay = cpu->curCycle();
+    } else {
+        assert(cycleOfDelay);
+        cycleOfResume = cpu->curCycle();
+    }
+
+    instFlags[DelayedMemTx] = flag;
+}
+
+void
+DynInst::setDelayedNonMemNonBrTx(bool flag)
+{
+    // We add sanity check to exclude redundant logics.
+    assert(
+        !(flag && cpu->defenseScheme() == CPU::DefenseScheme::None) &&
+        "With defense scheme set to None, a non-mem non-br transmitter "
+        "is however delayed.");
+
+    if (flag) {
+        assert(!cycleOfDelay);
+        cycleOfDelay = cpu->curCycle();
+    } else {
+        assert(cycleOfDelay);
+        cycleOfResume = cpu->curCycle();
+    }
+
+    instFlags[DelayedNonMemNonBrTx] = flag;
+}
+
+void
+DynInst::setDelayedBrTx(bool flag)
+{
+    assert(
+        !(flag && cpu->defenseScheme() == CPU::DefenseScheme::None) &&
+        "With defense scheme set to None, a branch transmitter "
+        "is however delayed.");
+
+    if (flag) {
+        assert(!cycleOfDelay);
+        cycleOfDelay = cpu->curCycle();
+    } else {
+        assert(cycleOfDelay);
+        cycleOfResume = cpu->curCycle();
+    }
+
+    instFlags[DelayedBrTx] = flag;
+}
+
+std::vector<bool>
+DynInst::getRegTaintEnabledVec(bool isSrc, int i) const
+{
+    auto archReg = isSrc ? srcRegIdx(i) : destRegIdx(i);
+    switch (archReg.classValue()) {
+        case IntRegClass: {
+            auto szAndOffs = isSrc ?
+                getSrcRegSizeAndOffs(i) :
+                getDestRegSizeAndOffs(i);
+            auto size = szAndOffs.first;
+            auto offs = szAndOffs.second;
+
+            auto enabledVec = std::vector<bool>(
+                archReg.regClass().regBytes(), false);
+            assert(size + offs <= enabledVec.size());
+            for (int i = 0; i < size; i++)
+                enabledVec[offs + i] = true;
+            return enabledVec;
+        }
+        case CCRegClass: {
+            // Figure out what flags are being accessed / changed
+            // For inst accessing flags, ext is one of condition_tests
+            // For inst changing flags, ext is simply the flag mask
+            uint32_t enabledFlags = -1;
+            if (isSrc)
+                enabledFlags = staticInst->getAccessedFlags();
+            else
+                enabledFlags = staticInst->getWrittenFlags();
+            assert(enabledFlags != -1 && !(enabledFlags & ~X86ISA::CondFlagMask));
+
+            auto ccMask = getCCMask(archReg);
+            auto enabledVec = std::vector<bool>(
+                archReg.regClass().regBits(), false);
+            assert(enabledVec.size() >= sizeof(enabledFlags) * 8);
+            for (size_t i = 0; i < enabledVec.size(); i++) {
+                enabledVec[i] = enabledFlags & ccMask & 1;
+                enabledFlags >>= 1;
+                ccMask >>= 1;
+            }
+            return enabledVec;
+        }
+        case InvalidRegClass:
+            panic("Tried to get register IDs for the invalid class.");
+        default:
+            return std::vector<bool>(archReg.regClass().regBytes(), true);
+    }
+}
+
+bool
+DynInst::taintedArg(int i) const
+{
+    auto phys_reg = renamedSrcIdx(i);
+    assert(phys_reg);
+
+    if (phys_reg->is(InvalidRegClass))
+        return false;
+
+    auto enabledVec = getRegTaintEnabledVec(true, i);
+    Taint taint = cpu->getPartialTaint(phys_reg, enabledVec);
+
+    DPRINTF(DynInst, "[sn:%llu] examining taint of src %d, "
+        "phys_reg=(%s:%d), enabledVec=0x%llx, taint=%s\n",
+        seqNum, i,
+        phys_reg->className(),
+        static_cast<int>(phys_reg->flatIndex()),
+        bitVec2Num(&enabledVec),
+        taint2Str(taint));
+
+    if (taint == Taint::Unknown) {
+        panic("[sn:%llu, pc:%s] %s Examining unknown taint",
+            seqNum, pcState(),
+            staticInst->disassemble(pc->instAddr()));
+    }
+    return taint == Taint::Tainted;
+}
+
+bool
+DynInst::taintedAddr() const
+{
+    assert(isMemRef() && "Should be invoked only for memory instruction");
+
+    if (isLoad()) {
+        assert(numSrcRegs() == 3 || numSrcRegs() == 4);
+        // X86: src[2] is a fake src (same as dest) when # of src is 4
+        bool src2IsDest = numSrcRegs() == 4;
+        bool addrTainted = false;
+        for (int i = 0; i < numSrcRegs(); i++) {
+            if (!src2IsDest || i != 2)
+                addrTainted |= taintedArg(i);
+        }
+        return addrTainted;
+    } else if (isStore()) {
+        bool addrTainted = false;
+        for (int i = 0; i < numSrcRegs(); i++) {
+            // X86: src[2] is always the data being stored
+            if (i != 2)
+                addrTainted |= taintedArg(i);
+        }
+        return addrTainted;
+    } else {
+        panic("Unexpected memory instruction. Possibly because "
+            "atomic instruction is not supported.");
+    }
+}
+
+bool
+DynInst::taintedArgs() const
+{
+    assert(!isMemRef() && "Should not be invoked for memory instruction");
+
+    // [Octal] TODO: Check every CORRECT src's taint status
+    // Details to pay attention to:
+    // 1. Redundant srcs (not matter if we do not do bwd untaint)
+    // 2. Unused srcs (e.g. CCRegs of normal add)
+    // 3. Dest considered as src
+    //    (e.g. mov %eax, %ebx: update %rbx taint status with setPartialTaint,
+    //    but don't consider it as a src)
+    for (int i = 0; i < numSrcRegs(); i++) {
+        if (taintedArg(i)) {
+            // Some insts actually do not use CCReg but gem5 mark CC as its src
+            // if (srcRegIdx(i).is(CCRegClass) && ignoreCCSrcTaint()) {
+                // TODO: Here is a mismatch before my previous fixed version
+                //  and new fixed version
+                //   1. In old impl, only int registers can ignore CCSrcTaint
+                //      when necessary
+                //   2. But CCReg are usually partially updated, but which
+                //      bits are kept with old value is unknown. This makes
+                //      our code consider CCReg as wholely updated by the
+                //      instruction. If we do not include CCReg in the taint
+                //      src, we may miss tracking taint status of some CC bits
+                //      and make the impl insecure.
+                //   3. Since we only accurately track intReg size, other reg
+                //      classes (FPReg) have the same problem to CCReg.
+                //   Check whether setDestTaintInt is still needed.
+                // continue;
+            // }
+            // Some insts only use DestReg to fill unmodified bytes,
+            // should not be considered as taint src that taint whole result
+            if (ignoreSrcTaint(i)) {
+                // So far we only specially deal with int,
+                // float and cc reg here the src is actually a dest
+                // considered as fake src by gem5 execute code generator
+                assert(srcRegIdx(i).is(IntRegClass) ||
+                        srcRegIdx(i).is(FloatRegClass));
+                continue;
+            }
+            return true;
+        }
+    }
+    return false;
+}
+
+std::pair<uint8_t, uint8_t>
+DynInst::getDestRegSizeAndOffs(int i) const
+{
+    auto archReg = destRegIdx(i);
+    assert(!archReg.is(CCRegClass) &&
+        "Should not attempt to get CC reg's size and offset");
+    assert(!isStore() && !isAtomic() &&
+        "Not expecting any stores");
+
+    uint8_t size = -1, offs = -1;
+
+    if (archReg.is(IntRegClass) &&
+        (archReg.index() & gem5::X86ISA::IntFoldBit)) {
+        size = 1;
+        offs = 1;
+        assert(
+            (isLoad() && staticInst->getDataSize() == 1) ||
+            (!isLoad() && staticInst->getDestSize() == 1));
+    } else {
+        size = isLoad() ?
+            staticInst->getDataSize() : staticInst->getDestSize();
+        offs = 0;
+    }
+    assert(size != -1 && offs != -1);
+
+    return std::make_pair(size, offs);
+}
+
+std::pair<uint8_t, uint8_t>
+DynInst::getSrcRegSizeAndOffs(int i) const
+{
+    auto archReg = srcRegIdx(i);
+    assert(!archReg.is(CCRegClass) &&
+        "Should not attempt to get CC reg's size and offset");
+
+    uint8_t size = -1, offs = -1;
+    if (archReg.is(IntRegClass) &&
+        (archReg.index() & gem5::X86ISA::IntFoldBit)) {
+        size = 1;
+        offs = 1;
+        assert(
+            (isMemRef() && staticInst->getDataSize() == 1) ||
+            (!isMemRef() && staticInst->getSrcSize() == 1));
+    } else {
+        if (isLoad()) {
+            // For srcs other than data, use the full size (addr's size)
+            size = (numSrcRegs() == 4 && i == 2) ?
+                staticInst->getDataSize() : staticInst->getAddressSize();
+            offs = 0;
+        } else if (isStore()) {
+            // For srcs other than data, use the full size (addr's size)
+            size = (i == 2) ?
+                staticInst->getDataSize() : staticInst->getAddressSize();
+            offs = 0;
+        } else {
+            assert(!isMemRef() &&
+                "Unexpected memory instruction. Possibly because "
+                "atomic instruction is not supported.");
+            size = staticInst->getSrcSize();
+            offs = 0;
+        }
+    }
+    assert(size != -1 && offs != -1);
+
+    return std::make_pair(size, offs);
+}
+
+void
+DynInst::setDestTaint(Taint taint)
+{
+    for (int i = 0; i < numDestRegs(); i++) {
+        if (destRegIdx(i).is(InvalidRegClass))
+            continue;
+
+        if (destRegIdx(i).is(CCRegClass)) {
+            // Init with old taint
+            // Note: I keep this since CCRegClass indeed need to read
+            //  previous taint status and partially update it.
+            //  I am not sure about other reg classes
+            auto oldTaintVec = cpu->getTaintVec(prevDestIdx(i));
+            assert(oldTaintVec);
+            cpu->setPartialTaintVec(renamedDestIdx(i), *oldTaintVec,
+                                    oldTaintVec->size());
+        } else {
+            cpu->setTaint(renamedDestIdx(i), Taint::Untainted);
+        }
+
+        // Update with new taint if corresponding data byte/bit is updated
+        auto enabledVec = getRegTaintEnabledVec(false, i);
+
+        DPRINTF(DynInst, "[sn:%llu] setting taint of dest %d, "
+            "phys_reg=(%s:%d), enabledVec=0x%llx, taint=%s\n",
+            seqNum, i,
+            renamedDestIdx(i)->className(),
+            static_cast<int>(renamedDestIdx(i)->flatIndex()),
+            bitVec2Num(&enabledVec),
+            taint2Str(taint));
+
+        cpu->setPartialTaint(renamedDestIdx(i), taint, enabledVec);
+    }
+}
+
+void
+DynInst::setDestIdxTaintVec(int i, const std::vector<Taint> &taintVec)
+{
+    // TODO: Double check this!
+    cpu->setPartialTaintVec(renamedDestIdx(i), taintVec, taintVec.size());
+}
+
+void
+DynInst::propagateTaint()
+{
+    assert(!isMemRef());
+
+    Taint taint = Taint::Tainted;
+
+    if (isCsvtOvertainting()) {
+        // Wr(u)flags is conservatively handled
+        taint = Taint::Tainted;
+        warn("[sn:%llu, pc:%s] Conservatively tainting all EFLAGS (%s)",
+            seqNum, pcState(), staticInst->disassemble(pc->instAddr()));
+    } else if (isTrivial()) {
+        taint = Taint::Untainted;
+    } else if (!taintedArgs()) {
+        taint = Taint::Untainted;
+    }
+
+    // DPRINTF(DynInst,
+    //     "DynInst: [sn:%lli] Propagating taint. result is %s\n",
+    //     seqNum, taint == Taint::Untainted ? "U" : "T");
+
+    setDestTaint(taint);
+}
+
 } // namespace o3
 } // namespace gem5
diff --git a/src/cpu/o3/dyn_inst.hh b/src/cpu/o3/dyn_inst.hh
index ab165bbcd5..d22e8a26fb 100644
--- a/src/cpu/o3/dyn_inst.hh
+++ b/src/cpu/o3/dyn_inst.hh
@@ -48,6 +48,8 @@
 #include <list>
 #include <string>
 
+#include "arch/x86/regs/ccr.hh"
+#include "arch/x86/regs/misc.hh"
 #include "base/refcnt.hh"
 #include "base/trace.hh"
 #include "cpu/checker/cpu.hh"
@@ -148,6 +150,7 @@ class DynInst : public ExecContext, public RefCounted
         Completed,               /// Instruction has completed
         ResultReady,             /// Instruction has its result
         CanIssue,                /// Instruction can issue and execute
+        RegsReady,
         Issued,                  /// Instruction has issued
         Executed,                /// Instruction has executed
         CanCommit,               /// Instruction can commit
@@ -186,6 +189,13 @@ class DynInst : public ExecContext, public RefCounted
         ReqMade,
         MemOpDone,
         HtmFromTransaction,
+
+        Unsquashable,
+        DelayedMemTx,
+        DelayedNonMemNonBrTx,
+        DelayedBrTx,
+        PendingSquash,
+
         MaxFlags
     };
 
@@ -328,6 +338,10 @@ class DynInst : public ExecContext, public RefCounted
     /** How many source registers are ready. */
     uint8_t readyRegs = 0;
 
+    /** The moment when schedule / squash is delayed / resumed. */
+    Cycles cycleOfDelay;
+    Cycles cycleOfResume;
+
   public:
     /////////////////////// Load Store Data //////////////////////
     /** The effective virtual address (lds & stores only). */
@@ -345,6 +359,9 @@ class DynInst : public ExecContext, public RefCounted
     /** Pointer to the data for the memory access. */
     uint8_t *memData = nullptr;
 
+    /** For a load, whether it gets data through store-to-load forwarding */
+    bool forwardedFromStore = false;
+
     /** Load queue index. */
     ssize_t lqIdx = -1;
     typename LSQUnit::LQIterator lqIt;
@@ -584,6 +601,11 @@ class DynInst : public ExecContext, public RefCounted
     bool isHtmCancel() const { return staticInst->isHtmCancel(); }
     bool isHtmCmd() const { return staticInst->isHtmCmd(); }
 
+    bool isCsvtOvertainting() const { return staticInst->isCsvtOvertainting(); }
+
+    static std::set<std::pair<Addr, MicroPC>> trivialWarns;
+    bool isTrivial() const;
+
     uint64_t
     getHtmTransactionUid() const override
     {
@@ -691,6 +713,11 @@ class DynInst : public ExecContext, public RefCounted
     /** Returns the logical register index of the i'th source register. */
     const RegId& srcRegIdx(int i) const { return staticInst->srcRegIdx(i); }
 
+    /**
+     * Check if the src is actually a dest used as src
+     */
+    bool ignoreSrcTaint(int i) const { return staticInst->ignoreSrcTaint(i); }
+
     /** Return the size of the instResult queue. */
     uint8_t resultSize() { return instResult.size(); }
 
@@ -726,6 +753,8 @@ class DynInst : public ExecContext, public RefCounted
     /** Marks a specific register as ready. */
     void markSrcRegReady(RegIndex src_idx);
 
+    bool srcRegReady() const { return status[RegsReady]; }
+
     /** Sets this instruction as completed. */
     void setCompleted() { status.set(Completed); }
 
@@ -739,7 +768,13 @@ class DynInst : public ExecContext, public RefCounted
     bool isResultReady() const { return status[ResultReady]; }
 
     /** Sets this instruction as ready to issue. */
-    void setCanIssue() { status.set(CanIssue); }
+    void setCanIssue() {
+        // CanIssue is cleared by MemDepUnit because it wants to control
+        // when to schedule
+        status.set(CanIssue);
+        // RegsReady marks if registers are ready. This is not cleared.
+        status.set(RegsReady);
+    }
 
     /** Returns whether or not this instruction is ready to issue. */
     bool readyToIssue() const { return status[CanIssue]; }
@@ -769,7 +804,7 @@ class DynInst : public ExecContext, public RefCounted
     void clearCanCommit() { status.reset(CanCommit); }
 
     /** Returns whether or not this instruction is ready to commit. */
-    bool readyToCommit() const { return status[CanCommit]; }
+    bool readyToCommit() const;
 
     void setAtCommit() { status.set(AtCommit); }
 
@@ -843,6 +878,28 @@ class DynInst : public ExecContext, public RefCounted
     /** Returns whether pinned registers are renamed */
     bool isPinnedRegsRenamed() const { return status[PinnedRegsRenamed]; }
 
+    //Flags related to our defense
+    //-----------------------
+    bool isUnsquashable() const { return instFlags[Unsquashable]; }
+
+    void setUnsquashable(bool flag) { instFlags[Unsquashable] = flag; }
+
+    bool delayedMemTx() const { return instFlags[DelayedMemTx]; }
+
+    void setDelayedMemTx(bool flag);
+
+    bool delayedNonMemNonBrTx() const { return instFlags[DelayedNonMemNonBrTx]; }
+
+    void setDelayedNonMemNonBrTx(bool flag);
+
+    bool delayedBrTx() const { return instFlags[DelayedBrTx]; }
+
+    void setDelayedBrTx(bool flag);
+
+    bool pendingSquash() const { return instFlags[PendingSquash]; }
+
+    void setPendingSquash(bool flag) { instFlags[PendingSquash] = flag; }
+
     /** Sets the destination registers as renamed */
     void
     setPinnedRegsRenamed()
@@ -886,6 +943,12 @@ class DynInst : public ExecContext, public RefCounted
         return *pc;
     }
 
+    std::unique_ptr<PCStateBase>
+    clonePCState() const
+    {
+        return std::unique_ptr<PCStateBase>(pc->clone());
+    }
+
     /** Set the PC state of this instruction. */
     void pcState(const PCStateBase &val) override { set(pc, val); }
 
@@ -1155,6 +1218,168 @@ class DynInst : public ExecContext, public RefCounted
         cpu->setReg(reg, val);
         setResult(reg->regClass(), val);
     }
+
+    // =================== Transmitter Predicates ===================
+
+  public:
+    bool isMemTx() const { return isMemRef(); }
+
+    bool
+    isNonMemNonBrTx() const
+    {
+        // [TODO] Add options to configure definition of non-mem non-br transmitter
+        return opClass() == IntDivOp || opClass() == FloatDivOp ||
+               opClass() == FloatSqrtOp;
+    }
+
+    bool isBrTx() const { return isControl() && isCondCtrl(); }
+
+    bool
+    activeNonMemNonBrTx() const
+    {
+        assert(isNonMemNonBrTx() &&
+            "Should be examined on a non-mem non-br transmitter");
+        assert(srcRegReady() &&
+            "Should be examined after sources are ready");
+
+        switch (cpu->defenseScheme()) {
+            case CPU::DefenseScheme::None:
+                return false;
+            case CPU::DefenseScheme::NaiveSecureBaseline:
+                return !isUnsquashable();
+            case CPU::DefenseScheme::SecureBaseline:
+            case CPU::DefenseScheme::OurDefense:
+                return !isUnsquashable() && taintedArgs();
+            default:
+                panic("Unreachable\n");
+                return false;
+        }
+    }
+
+    bool
+    activeBrTx() const
+    {
+        assert(isBrTx() &&
+            "Should be examined on a branch transmitter");
+        assert(srcRegReady() &&
+            "Should be examined after sources are ready");
+        assert(isExecuted() &&
+            "Should be examined after condition is resolved");
+
+        switch (cpu->defenseScheme()) {
+            case CPU::DefenseScheme::None:
+                return false;
+            case CPU::DefenseScheme::NaiveSecureBaseline:
+                return !isUnsquashable();
+            case CPU::DefenseScheme::SecureBaseline:
+            case CPU::DefenseScheme::OurDefense:
+                return !isUnsquashable() && taintedArgs();
+            default:
+                panic("Unreachable\n");
+                return false;
+        }
+    }
+
+    bool
+    activeMemTx() const
+    {
+        assert(isMemTx() &&
+            "Should be examined on a memory transmitter");
+        assert(srcRegReady() &&
+            "Should be examined after sources are ready");
+
+        switch (cpu->defenseScheme()) {
+            case CPU::DefenseScheme::None:
+                return false;
+            case CPU::DefenseScheme::NaiveSecureBaseline:
+                return !isUnsquashable();
+            case CPU::DefenseScheme::SecureBaseline:
+            case CPU::DefenseScheme::OurDefense:
+                return !isUnsquashable() && taintedAddr();
+            default:
+                panic("Unreachable\n");
+                return false;
+        }
+    }
+
+  private:
+    std::vector<bool> getRegTaintEnabledVec(bool isSrc, int i) const;
+
+    /**
+     * Check if the i-th argument is tainted
+     */
+    bool taintedArg(int i) const;
+
+    /**
+     * Check if address is tainted for a memory instruction
+     */
+    bool taintedAddr() const;
+
+    /**
+    * Check if any of the arguments is tainted
+    */
+    bool taintedArgs() const;
+
+    /**
+     * Get CCMask for each arch CC reg
+     */
+    uint32_t
+    getCCMask(const RegId& archReg) const
+    {
+        assert(archReg.is(CCRegClass) &&
+            "Try to get CCMask with a NonCCRegClass\n");
+
+        switch (archReg.index()) {
+            case X86ISA::cc_reg::Zaps:
+                return X86ISA::CcFlagMask;
+            case X86ISA::cc_reg::Cfof:
+                return X86ISA::CfofMask;
+            case X86ISA::cc_reg::Df:
+                return X86ISA::DFBit;
+            case X86ISA::cc_reg::Ecf:
+                return X86ISA::ECFBit;
+            case X86ISA::cc_reg::Ezf:
+                return X86ISA::EZFBit;
+            default:
+                panic("Invalid CC RegId\n");
+                return 0;
+        }
+    }
+
+  public:
+    std::pair<uint8_t, uint8_t> getDestRegSizeAndOffs(int i) const;
+    std::pair<uint8_t, uint8_t> getSrcRegSizeAndOffs(int i) const;
+
+    const std::vector<Taint> *
+    argIdxTaintVec(int i) const
+    {
+        return cpu->getTaintVec(renamedSrcIdx(i));
+    }
+
+    const std::vector<Taint> *
+    destIdxTaintVec(int i) const
+    {
+        return cpu->getTaintVec(renamedDestIdx(i));
+    }
+
+    void setDestTaint(Taint taint);
+    void setDestIdxTaintVec(int i, const std::vector<Taint> &taintVec);
+
+    // Propagate taint for a non-mem instruction
+    void propagateTaint();
+
+  private:
+    uint64_t bitVec2Num(const std::vector<bool> *vec) const {
+        if (vec->size() > 64) {
+            std::cerr << "Vector size too large " << vec->size() << std::endl;
+        }
+        uint64_t x = 0;
+        for (auto it = vec->rbegin(); it != vec->rend(); it++) {
+            x = (x << 1) | *it;
+        }
+        return x;
+    }
+
 };
 
 } // namespace o3
diff --git a/src/cpu/o3/iew.cc b/src/cpu/o3/iew.cc
index 7cf6c54542..fd0fcb90ab 100644
--- a/src/cpu/o3/iew.cc
+++ b/src/cpu/o3/iew.cc
@@ -452,30 +452,39 @@ IEW::squash(ThreadID tid)
 void
 IEW::squashDueToBranch(const DynInstPtr& inst, ThreadID tid)
 {
+    assert(inst->threadNumber == tid);
+
     DPRINTF(IEW, "[tid:%i] [sn:%llu] Squashing from a specific instruction,"
             " PC: %s "
-            "\n", tid, inst->seqNum, inst->pcState() );
+            "\n", tid, inst->seqNum, inst->pcState());
 
-    if (!toCommit->squash[tid] ||
-            inst->seqNum < toCommit->squashedSeqNum[tid]) {
-        toCommit->squash[tid] = true;
-        toCommit->squashedSeqNum[tid] = inst->seqNum;
-        toCommit->branchTaken[tid] = inst->pcState().branching();
+    if (!inst->isBrTx() || !inst->activeBrTx()) {
+        if (!toCommit->squash[tid] ||
+                inst->seqNum < toCommit->squashedSeqNum[tid]) {
+            toCommit->squash[tid] = true;
+            toCommit->squashedSeqNum[tid] = inst->seqNum;
+            toCommit->branchTaken[tid] = inst->pcState().branching();
 
-        set(toCommit->pc[tid], inst->pcState());
-        inst->staticInst->advancePC(*toCommit->pc[tid]);
+            set(toCommit->pc[tid], inst->pcState());
+            inst->staticInst->advancePC(*toCommit->pc[tid]);
 
-        toCommit->mispredictInst[tid] = inst;
-        toCommit->includeSquashInst[tid] = false;
+            toCommit->mispredictInst[tid] = inst;
+            toCommit->includeSquashInst[tid] = false;
 
-        wroteToTimeBuffer = true;
+            wroteToTimeBuffer = true;
+        }
+    } else {
+        assert(inst->threadNumber == tid);
+        instQueue.delaySquashOfTx(inst);
     }
-
 }
 
 void
 IEW::squashDueToMemOrder(const DynInstPtr& inst, ThreadID tid)
 {
+    assert(inst->threadNumber == tid);
+    assert(!inst->isControl());
+
     DPRINTF(IEW, "[tid:%i] Memory violation, squashing violator and younger "
             "insts, PC: %s [sn:%llu].\n", tid, inst->pcState(), inst->seqNum);
     // Need to include inst->seqNum in the following comparison to cover the
@@ -487,11 +496,11 @@ IEW::squashDueToMemOrder(const DynInstPtr& inst, ThreadID tid)
     if (!toCommit->squash[tid] ||
             inst->seqNum <= toCommit->squashedSeqNum[tid]) {
         toCommit->squash[tid] = true;
-
         toCommit->squashedSeqNum[tid] = inst->seqNum;
+
         set(toCommit->pc[tid], inst->pcState());
-        toCommit->mispredictInst[tid] = NULL;
 
+        toCommit->mispredictInst[tid] = NULL;
         // Must include the memory violator in the squash.
         toCommit->includeSquashInst[tid] = true;
 
@@ -1131,6 +1140,23 @@ IEW::printAvailableInsts()
     std::cout << "\n";
 }
 
+void
+IEW::wakeSquashDelayedTx()
+{
+    std::list<ThreadID>::iterator threads = activeThreads->begin();
+    std::list<ThreadID>::iterator end = activeThreads->end();
+
+    while (threads != end) {
+        ThreadID tid = *threads++;
+
+        assert(!toCommit->squash[tid] &&
+            "Should be the first place that finds squash in current tick");
+        auto delayedSquashInst = instQueue.wakeSquashDelayedTx(tid);
+        if (delayedSquashInst)
+            squashDueToBranch(delayedSquashInst, tid);
+    }
+}
+
 void
 IEW::executeInsts()
 {
@@ -1457,10 +1483,16 @@ IEW::tick()
     }
 
     if (exeStatus != Squashing) {
+        wakeSquashDelayedTx();        
+
         executeInsts();
 
         writebackInsts();
 
+        // Iterate through delayed non-mem non-br transmitter list to see if any
+        // delayed instruction can now be issued.
+        instQueue.wakeScheduleDelayedTx();
+
         // Have the instruction queue try to schedule any ready instructions.
         // (In actuality, this scheduling is for instructions that will
         // be executed next cycle.)
diff --git a/src/cpu/o3/iew.hh b/src/cpu/o3/iew.hh
index 80fed295df..bfc9abc89b 100644
--- a/src/cpu/o3/iew.hh
+++ b/src/cpu/o3/iew.hh
@@ -261,6 +261,9 @@ class IEW
     /** Dispatches instructions to IQ and LSQ. */
     void dispatchInsts(ThreadID tid);
 
+    /** Wake delayed squash that are now secure to handle. */
+    void wakeSquashDelayedTx();
+
     /** Executes instructions. In the case of memory operations, it informs the
      * LSQ to execute the instructions. Also handles any redirects that occur
      * due to the executed instructions.
diff --git a/src/cpu/o3/inst_queue.cc b/src/cpu/o3/inst_queue.cc
index 72cb7356ef..0bc2b61206 100644
--- a/src/cpu/o3/inst_queue.cc
+++ b/src/cpu/o3/inst_queue.cc
@@ -396,6 +396,8 @@ InstructionQueue::resetState()
     for (ThreadID tid = 0; tid < MaxThreads; tid++) {
         count[tid] = 0;
         instList[tid].clear();
+        scheduleDelayedTxList[tid].clear();
+        squashDelayedTxList[tid].clear();
     }
 
     // Initialize the number of free IQ entries.
@@ -1320,6 +1322,8 @@ InstructionQueue::doSquash(ThreadID tid)
         instList[tid].erase(squash_it--);
         ++iqStats.squashedInstsExamined;
     }
+
+    squashTxLists(tid);
 }
 
 bool
@@ -1430,22 +1434,31 @@ InstructionQueue::addIfReady(const DynInstPtr &inst)
             return;
         }
 
-        OpClass op_class = inst->opClass();
+        if (!inst->isNonMemNonBrTx() || !inst->activeNonMemNonBrTx()) {
+            // Securely schedule a non-mem instruction
+
+            // Taint propagation happens upon schedule
+            inst->propagateTaint();
 
-        DPRINTF(IQ, "Instruction is ready to issue, putting it onto "
-                "the ready list, PC %s opclass:%i [sn:%llu].\n",
-                inst->pcState(), op_class, inst->seqNum);
+            OpClass op_class = inst->opClass();
 
-        readyInsts[op_class].push(inst);
+            DPRINTF(IQ, "Instruction is ready to issue, putting it onto "
+                    "the ready list, PC %s opclass:%i [sn:%llu].\n",
+                    inst->pcState(), op_class, inst->seqNum);
 
-        // Will need to reorder the list if either a queue is not on the list,
-        // or it has an older instruction than last time.
-        if (!queueOnList[op_class]) {
-            addToOrderList(op_class);
-        } else if (readyInsts[op_class].top()->seqNum  <
-                   (*readyIt[op_class]).oldestInst) {
-            listOrder.erase(readyIt[op_class]);
-            addToOrderList(op_class);
+            readyInsts[op_class].push(inst);
+
+            // Will need to reorder the list if either a queue is not on the list,
+            // or it has an older instruction than last time.
+            if (!queueOnList[op_class]) {
+                addToOrderList(op_class);
+            } else if (readyInsts[op_class].top()->seqNum  <
+                       (*readyIt[op_class]).oldestInst) {
+                listOrder.erase(readyIt[op_class]);
+                addToOrderList(op_class);
+            }
+        } else {
+            delayScheduleOfTx(inst);
         }
     }
 }
@@ -1582,5 +1595,181 @@ InstructionQueue::dumpInsts()
     }
 }
 
+void
+InstructionQueue::delayScheduleOfTx(DynInstPtr inst)
+{
+    assert(inst->isNonMemNonBrTx() ^ inst->isMemTx());
+    const char *txName = "";
+
+    if (inst->isNonMemNonBrTx() && inst->activeNonMemNonBrTx()) {
+        // Delay scheduling of a non-mem non-br TX
+        assert(!inst->delayedNonMemNonBrTx() && "Already in the delay list");
+
+        inst->setDelayedNonMemNonBrTx(true);
+        scheduleDelayedTxList[inst->threadNumber].push_back(inst);
+        txName = "non-mem non-br";
+    } else if (inst->isMemTx() && inst->activeMemTx()) {
+        // Delay scheduling of a memory TX
+        assert(!inst->delayedMemTx() && "Already in the delay list");
+
+        inst->setDelayedMemTx(true);
+        scheduleDelayedTxList[inst->threadNumber].push_back(inst);
+        txName = "memory";
+    } else {
+        panic("Unreachable");
+    }
+
+    DPRINTF(IQ, "Delaying schedule of inst [sn:%llu, pc:%s] for "
+        "being an active %s transmitter (cycle:%llu)\n",
+        inst->seqNum, inst->pcState(),
+        txName,
+        cpu->curCycle()
+    );
+}
+
+void
+InstructionQueue::delaySquashOfTx(DynInstPtr inst)
+{
+    assert(inst->isBrTx() && inst->activeBrTx());
+    assert(!inst->delayedBrTx() && "Already in the delay list");
+
+    inst->setPendingSquash(true);
+    inst->setDelayedBrTx(true);
+    squashDelayedTxList[inst->threadNumber].push_back(inst);
+
+    DPRINTF(IQ, "Delaying squash of inst [sn:%llu, pc:%s] for "
+        "being an active branch transmitter (cycle:%llu)\n",
+        inst->seqNum, inst->pcState(),
+        cpu->curCycle()
+    );
+}
+
+void
+InstructionQueue::wakeScheduleDelayedTx()
+{
+    list<ThreadID>::iterator threads = activeThreads->begin();
+    list<ThreadID>::iterator end = activeThreads->end();
+
+    while (threads != end) {
+        ThreadID tid = *threads++;
+        auto& list = scheduleDelayedTxList[tid];
+        for (auto it = list.begin(); it != list.end();) {
+            auto inst = *it;
+            assert(!inst->isSquashed() && !inst->isSquashedInIQ());
+
+            assert(inst->delayedNonMemNonBrTx() ^ inst->delayedMemTx());
+            if (inst->delayedNonMemNonBrTx() && !inst->activeNonMemNonBrTx()) {
+                inst->setDelayedNonMemNonBrTx(false);
+                it = list.erase(it);
+                // Schedule the non-mem non-br instruction
+                addIfReady(inst);
+
+                DPRINTF(IQ,
+                    "Non-mem Non-br instruction [sn:%llu, pc:%s]'s "
+                    "schedule was delayed for %llu cycles "
+                    "(%llu ~ %llu), now resume\n",
+                    inst->seqNum, inst->pcState(),
+                    inst->cycleOfResume - inst->cycleOfDelay,
+                    inst->cycleOfDelay, inst->cycleOfResume
+                );
+            } else if (inst->delayedMemTx() && !inst->activeMemTx()) {
+                inst->setDelayedMemTx(false);
+                it = list.erase(it);
+                // Schedule the memory instruction
+                addReadyMemInst(inst);
+
+                DPRINTF(IQ,
+                    "Memory instruction [sn:%llu, pc:%s]'s "
+                    "schedule was delayed for %llu cycles "
+                    "(%llu ~ %llu), now resume\n",
+                    inst->seqNum, inst->pcState(),
+                    inst->cycleOfResume - inst->cycleOfDelay,
+                    inst->cycleOfDelay, inst->cycleOfResume
+                );
+            } else {
+                it++;
+            }
+        }
+    }
+}
+
+DynInstPtr
+InstructionQueue::wakeSquashDelayedTx(ThreadID tid)
+{
+    DynInstPtr oldest = nullptr;
+
+    auto& list = squashDelayedTxList[tid];
+    for (auto it = list.begin(); it != list.end();) {
+        auto inst = *it;
+        assert(inst->delayedBrTx());
+        assert(!inst->isSquashedInIQ());
+
+        // Already squashed (by an older squash)
+        if (inst->isSquashed()) {
+            it = list.erase(it);
+            continue;
+        }
+
+        if (!inst->activeBrTx()) {
+            inst->setDelayedBrTx(false);
+            it = list.erase(it);
+
+            if (!oldest || oldest->seqNum > inst->seqNum)
+                oldest = inst;
+
+            DPRINTF(IQ,
+                "Conditional branch [sn:%llu, pc:%s]'s "
+                "squash was delayed for %llu cycles "
+                "(%llu ~ %llu), now resume\n",
+                inst->seqNum, inst->pcState(),
+                inst->cycleOfResume - inst->cycleOfDelay,
+                inst->cycleOfDelay, inst->cycleOfResume
+            );
+        } else {
+            it++;
+        }
+    }
+
+    return oldest;
+}
+
+void
+InstructionQueue::squashTxLists(ThreadID tid)
+{
+    {
+        auto& list = scheduleDelayedTxList[tid];
+        for (auto it = list.begin(); it != list.end();) {
+            auto inst = *it;
+            assert(
+                (inst->isNonMemNonBrTx() && inst->delayedNonMemNonBrTx()) ||
+                (inst->isMemTx() && inst->delayedMemTx()));
+
+            if (inst->seqNum > squashedSeqNum[tid]) {
+                assert(inst->isSquashedInIQ());
+                inst->setDelayedNonMemNonBrTx(false);
+                inst->setDelayedMemTx(false);
+                it = list.erase(it);
+            } else {
+                it++;
+            }
+        }
+    }
+    {
+        auto& list = squashDelayedTxList[tid];
+        for (auto it = list.begin(); it != list.end();) {
+            auto inst = *it;
+            assert(inst->isBrTx() && inst->delayedBrTx());
+
+            if (inst->seqNum > squashedSeqNum[tid]) {
+                assert(!inst->isSquashedInIQ());
+                inst->setDelayedBrTx(false);
+                it = list.erase(it);
+            } else {
+                it++;
+            }
+        }
+    }
+}
+
 } // namespace o3
 } // namespace gem5
diff --git a/src/cpu/o3/inst_queue.hh b/src/cpu/o3/inst_queue.hh
index 57928e7478..37ee169739 100644
--- a/src/cpu/o3/inst_queue.hh
+++ b/src/cpu/o3/inst_queue.hh
@@ -561,6 +561,39 @@ class InstructionQueue
         statistics::Scalar fpAluAccesses;
         statistics::Scalar vecAluAccesses;
     } iqIOStats;
+
+  public:
+    /** * List of non-branch transmitters who are ready-to-schedule,
+     * but the schedule is delayed since it is an active TX.
+     * ready-to-schedue:
+     *   - Non-memory inst: regs ready.
+     *   - Memory inst: regs ready and memory dependency ready
+     */
+    std::list<DynInstPtr> scheduleDelayedTxList[MaxThreads];
+
+    /** List of branch transmitters (conditional branch) who is
+     * mispredicted, but the squash is delayed
+     * since it is an active TX
+     */
+     std::list<DynInstPtr> squashDelayedTxList[MaxThreads];
+
+
+    /** Delay the schedule of an active non-branch transmitter */
+    void delayScheduleOfTx(DynInstPtr inst);
+
+    /** Delay the squash of an active branch transmitter */
+    void delaySquashOfTx(DynInstPtr inst);
+
+    /** Wake up schedule-delayed transmitters that is not active now */
+    void wakeScheduleDelayedTx();
+
+    /** Wake up squash-delayed transmitters that is not active now */
+    DynInstPtr wakeSquashDelayedTx(ThreadID tid);
+
+
+  private:
+    void squashTxLists(ThreadID tid);
+
 };
 
 } // namespace o3
diff --git a/src/cpu/o3/lsq_unit.cc b/src/cpu/o3/lsq_unit.cc
index 139e0de337..e8b7534226 100644
--- a/src/cpu/o3/lsq_unit.cc
+++ b/src/cpu/o3/lsq_unit.cc
@@ -181,6 +181,64 @@ LSQUnit::completeDataAccess(PacketPtr pkt)
                 request->writebackDone();
                 completeStore(request->instruction()->sqIt);
             }
+
+            // [TODO] Figure out the way store conditionals & atomics are
+            // handled. Is our modification here compatiable with it?
+
+            // If load is not forwarded from a store,
+            // set the data taint to memory's taint
+            if (inst->isLoad() && !inst->forwardedFromStore) {
+                auto instLoadAddr = inst->effAddr;
+                auto instLoadSize = inst->effSize;
+                auto loadAddr = pkt->getAddr(); // This is physical address!!!
+                auto loadSize = pkt->getSize();
+
+                if (instLoadAddr % 0x1000 != loadAddr % 0x1000 ||
+                    instLoadSize != loadSize) {
+                    std::clog << std::hex
+                        << inst->staticInst->getName()
+                        << " " << inst->pcState()
+                        << " inst id " << inst->seqNum
+                        << " instLoadAddr " << instLoadAddr
+                        << " instLoadSize " << instLoadSize
+                        << " loadAddr " << loadAddr
+                        << " loadSize " << loadSize << std::endl;
+                    if (pkt->isHtmTransactional()) {
+                        std::clog << "pkt is Htm transactional" << std::endl;
+                    } else {
+                        std::clog << "pkt is NOT Htm transactional" << std::endl;
+                    }
+                    auto req = pkt->req;
+                    std::clog << "reqID " << std::hex << req->requestorId() << std::endl;
+                    if (req->hasPaddr()) {
+                        std::clog << "req has pAddr " << req->getPaddr() << std::endl;
+                    } else {
+                        std::clog << "req has no pAddr" << std::endl;
+                    }
+                    if (req->hasVaddr()) {
+                        std::clog << "req has vAddr " << req->getVaddr() << std::endl;
+                    } else {
+                        std::clog << "req has no vAddr" << std::endl;
+                    }
+                    std::clog << "Unmatch paddr, skip untaint!\n" << std::endl;
+                    if (loadAddr != 0) {
+                        panic("I expect this case only happen when paddr = 0\n");
+                    }
+                    // TODO: Figure out why this happens!
+                }
+
+                // TODO: Check whether this handles split load correctly!!!
+                // NOTE: I do not specify which bit to update since
+                //  1. I assume I do not have mix taint status update (either all tainted or all untainted)
+                //  2. Which bit should be updated is included in the function setDestTaint
+                Taint memoryTaint = cpu->getMemTaint(inst->threadNumber, instLoadAddr, instLoadSize);
+                inst->setDestTaint(memoryTaint);
+
+                DPRINTF(LSQUnit, "[pc=0x%llx]: finishing loading [0x%llx, 0x%llx), taint=%s\n",
+                    inst->pcState().instAddr(),
+                    instLoadAddr, instLoadAddr + instLoadSize,
+                    taint2Str(memoryTaint));
+            }
         } else if (inst->isStore()) {
             // This is a regular store (i.e., not store conditionals and
             // atomics), so it can complete without writing back
@@ -327,6 +385,7 @@ LSQUnit::insertLoad(const DynInstPtr &load_inst)
     /* Grow the queue. */
     loadQueue.advance_tail();
 
+    load_inst->sqIdx = storeQueue.tail();
     load_inst->sqIt = storeQueue.end();
 
     assert(!loadQueue.back().valid());
@@ -671,6 +730,7 @@ LSQUnit::executeStore(const DynInstPtr &store_inst)
     typename LoadQueue::iterator loadIt = store_inst->lqIt;
 
     Fault store_fault = store_inst->initiateAcc();
+    storeQueue[store_idx].setDataTaint(store_inst->argIdxTaintVec(2));
 
     if (store_inst->isTranslationDelayed() &&
         store_fault == NoFault)
@@ -1470,6 +1530,39 @@ LSQUnit::read(LSQRequest *request, ssize_t load_idx)
                         "addr %#x\n", store_it._idx,
                         request->mainReq()->getVaddr());
 
+                auto store_inst = store_it->instruction();
+                load_inst->forwardedFromStore = true;
+
+                auto stSrcTaintVec = store_it->dataTaint();
+                if (stSrcTaintVec == nullptr) {
+                    panic("PC %s stSrcTaintVec == nullptr\n", store_inst->pcState());
+                }
+                auto stSrcOffs = store_inst->getSrcRegSizeAndOffs(2).second;
+                if (shift_amt + stSrcOffs + load_inst->effSize > stSrcTaintVec->size()) {
+                    panic("PC %s shift_amt + stSrcOffs + load_inst->effSize > stSrcTaintVec->size()\n",
+                          store_inst->pcState());
+                }
+
+                auto ldDestTaintVec = load_inst->destIdxTaintVec(0);
+                if (ldDestTaintVec == nullptr) {
+                    panic("PC %s ldDestTaintVec == nullptr\n", load_inst->pcState());
+                }
+                auto ldDestOffs = load_inst->getDestRegSizeAndOffs(0).second;
+                if (ldDestOffs + load_inst->effSize > stSrcTaintVec->size()) {
+                    panic("PC %s ldDestOffs + load_inst->effSize > stSrcTaintVec->size()\n",
+                          load_inst->pcState());
+                }
+
+                std::vector<Taint> newLdDestTaintVec(*ldDestTaintVec);
+                Taint memoryTaint = cpu->getMemTaint(store_inst->threadNumber, st_s, store_size);
+                bool storeReachedVP = store_inst->isUnsquashable();
+                for (int i = 0; i < load_inst->effSize; i++) {
+                    Taint dataTaint = stSrcTaintVec->at(shift_amt + stSrcOffs + i);
+                    newLdDestTaintVec.at(i + ldDestOffs) = storeReachedVP ?
+                        minTaint(memoryTaint, dataTaint) : dataTaint;
+                }
+                load_inst->setDestIdxTaintVec(0, newLdDestTaintVec);
+
                 PacketPtr data_pkt = new Packet(request->mainReq(),
                         MemCmd::ReadReq);
                 data_pkt->dataStatic(load_inst->memData);
@@ -1491,6 +1584,7 @@ LSQUnit::read(LSQRequest *request, ssize_t load_idx)
                         load_inst->getHtmTransactionUid() ==
                         storeQueue[store_it._idx].instruction()->
                           getHtmTransactionUid());
+                    // [Octal] TODO: How to handle this?
                     data_pkt->setHtmTransactional(
                         load_inst->getHtmTransactionUid());
                     DPRINTF(HtmCpu, "HTM LD (ST2LDF) "
diff --git a/src/cpu/o3/lsq_unit.hh b/src/cpu/o3/lsq_unit.hh
index b807179f2d..d7198dda49 100644
--- a/src/cpu/o3/lsq_unit.hh
+++ b/src/cpu/o3/lsq_unit.hh
@@ -163,6 +163,8 @@ class LSQUnit
          */
         bool _isAllZeros = false;
 
+        std::unique_ptr<std::vector<Taint>> _dataTaint = nullptr;
+
       public:
         static constexpr size_t DataSize = sizeof(_data);
         /** Constructs an empty store queue entry. */
@@ -192,6 +194,14 @@ class LSQUnit
         const bool& isAllZeros() const { return _isAllZeros; }
         char* data() { return _data; }
         const char* data() const { return _data; }
+
+        void setDataTaint(const std::vector<Taint>* taintVec) {
+            if (taintVec)
+                _dataTaint = std::make_unique<std::vector<Taint>>(*taintVec);
+            else
+                _dataTaint.reset();
+        }
+        const std::vector<Taint>* dataTaint() { return _dataTaint.get(); }
         /** @} */
     };
     using LQEntry = LSQEntry;
diff --git a/src/cpu/o3/mem_dep_unit.cc b/src/cpu/o3/mem_dep_unit.cc
index bffbf2380d..55cf8d5402 100644
--- a/src/cpu/o3/mem_dep_unit.cc
+++ b/src/cpu/o3/mem_dep_unit.cc
@@ -601,12 +601,22 @@ MemDepUnit::findInHash(const DynInstConstPtr &inst)
 void
 MemDepUnit::moveToReady(MemDepEntryPtr &woken_inst_entry)
 {
+    auto inst = woken_inst_entry->inst;
+    assert(inst->isMemTx());
+    if (inst->activeMemTx()) {
+        DPRINTF(MemDepUnit, "Adding instruction [sn:%lli] "
+            "to the ready list but is delayed.\n",
+            inst->seqNum);
+        iqPtr->delayScheduleOfTx(inst);
+        return;
+    }
+
     DPRINTF(MemDepUnit, "Adding instruction [sn:%lli] "
-            "to the ready list.\n", woken_inst_entry->inst->seqNum);
+            "to the ready list.\n", inst->seqNum);
 
     assert(!woken_inst_entry->squashed);
 
-    iqPtr->addReadyMemInst(woken_inst_entry->inst);
+    iqPtr->addReadyMemInst(inst);
 }
 
 
diff --git a/src/cpu/o3/regfile.hh b/src/cpu/o3/regfile.hh
index 3ddf1a2a79..23cda318df 100644
--- a/src/cpu/o3/regfile.hh
+++ b/src/cpu/o3/regfile.hh
@@ -323,6 +323,123 @@ class PhysRegFile
      * the pointer out of just class and register idx.
      */
     PhysRegIdPtr getTrueId(PhysRegIdPtr reg);
+
+    /** Taint tracking support in regfile */
+  public:
+    /** Rutvik, SPT: Reads taint */
+    const std::vector<Taint> *
+    getTaint(PhysRegIdPtr phys_reg) const
+    {
+        auto regFile = getRegFile(phys_reg->classValue());
+        if (!regFile) {
+            return nullptr;
+        }
+        return regFile->getTaint(phys_reg->index());
+    }
+
+    // [Octal] TODO: New gem5 remove ZeroReg, so I guess this is unused?
+
+    /** Rutvik, SPT: Sets taint */
+    void
+    setTaint(PhysRegIdPtr phys_reg, Taint taint)
+    {
+        auto regFile = getRegFile(phys_reg->classValue());
+        if (!regFile) {
+            // [Octal] TODO: Check whether this is because phys_reg is a misc reg and check
+            //            whether we need taint tracking for misc reg.
+            return;
+        }
+        regFile->setTaint(phys_reg->index(), taint);
+    }
+
+    /** Rutvik, SPT: Sets taint */
+    void
+    setPartialTaint(PhysRegIdPtr phys_reg, Taint taint,
+                    uint8_t size, uint8_t offset = 0)
+    {
+        auto regFile = getRegFile(phys_reg->classValue());
+        if (!regFile) {
+            // [Octal] TODO: Check whether this is because phys_reg
+            //            is a misc reg and check whether we need taint
+            //            tracking for misc reg.
+            return;
+        }
+        regFile->setPartialTaint(phys_reg->index(), taint, size, offset);
+    }
+
+    void
+    setPartialTaint(PhysRegIdPtr phys_reg, Taint taint,
+                    std::vector<bool>& updateVec)
+    {
+        auto regFile = getRegFile(phys_reg->classValue());
+        if (!regFile) {
+            // [Octal] TODO: Check whether this is because phys_reg
+            //            is a misc reg and check whether we need taint
+            //            tracking for misc reg.
+            return;
+        }
+        regFile->setPartialTaint(phys_reg->index(), taint, updateVec);
+    }
+
+    /** Rutvik, SPT: Sets taint */
+    void
+    setPartialTaintVec(PhysRegIdPtr phys_reg,
+                       const std::vector<Taint> &taintVec,
+                       uint8_t size, uint8_t offset = 0)
+    {
+        auto regFile = getRegFile(phys_reg->classValue());
+        if (!regFile) {
+            // [Octal] TODO: Check whether this is because phys_reg is
+            //            a misc reg and check whether we need taint
+            //            tracking for misc reg.
+            return;
+        }
+        regFile->setPartialTaintVec(phys_reg->index(), taintVec, size, offset);
+    }
+
+  private:
+    const RegFile *
+    getRegFile(RegClassType type) const
+    {
+        switch (type) {
+            case IntRegClass:
+                return &intRegFile;
+            case FloatRegClass:
+                return &floatRegFile;
+            case VecRegClass:
+                return &vectorRegFile;
+            case VecElemClass:
+                return &vectorElemRegFile;
+            case VecPredRegClass:
+                return &vecPredRegFile;
+            case CCRegClass:
+                return &ccRegFile;
+            default:
+                return nullptr;
+        }
+    }
+
+    RegFile *
+    getRegFile(RegClassType type)
+    {
+        switch (type) {
+            case IntRegClass:
+                return &intRegFile;
+            case FloatRegClass:
+                return &floatRegFile;
+            case VecRegClass:
+                return &vectorRegFile;
+            case VecElemClass:
+                return &vectorElemRegFile;
+            case VecPredRegClass:
+                return &vecPredRegFile;
+            case CCRegClass:
+                return &ccRegFile;
+            default:
+                return nullptr;
+        }
+    }
+
 };
 
 } // namespace o3
diff --git a/src/cpu/o3/rob.cc b/src/cpu/o3/rob.cc
index 5d0fac9a60..f6127dd14c 100644
--- a/src/cpu/o3/rob.cc
+++ b/src/cpu/o3/rob.cc
@@ -351,6 +351,15 @@ ROB::doSquash(ThreadID tid)
         // it can drain out of the pipeline.
         (*squashIt[tid])->setSquashed();
 
+        if ((*squashIt[tid])->pendingSquash()) {
+            DPRINTF(ROB, "[tid:%i] Instruction [sn:%llu, pc:%s]'s pending "
+                "squash is squashed by an older squash\n",
+                (*squashIt[tid])->threadNumber,
+                (*squashIt[tid])->seqNum,
+                (*squashIt[tid])->pcState());
+            (*squashIt[tid])->setPendingSquash(false);
+        }
+
         (*squashIt[tid])->setCanCommit();
 
 
@@ -541,5 +550,69 @@ ROB::findInst(ThreadID tid, InstSeqNum squash_inst)
     return NULL;
 }
 
+void
+ROB::updateInstructionVisibility()
+{
+    std::list<ThreadID>::iterator threads = activeThreads->begin();
+    std::list<ThreadID>::iterator end = activeThreads->end();
+
+    while (threads != end) {
+        ThreadID tid = *threads++;
+
+        if (instList[tid].empty())
+            continue;
+
+        InstIt inst_it = instList[tid].begin();
+        InstIt tail_inst_it = instList[tid].end();
+
+        bool prevInstsComplete = true;
+        bool prevBranchesResolved = true;
+
+        while (inst_it != tail_inst_it) {
+            DynInstPtr inst = *inst_it++;
+
+            assert(inst);
+
+            if (inst->isSquashed()) {
+                continue;
+            }
+
+            // [Jiyong, Rutvik, SPT] Checking whether instructions
+            // have reached VP
+            if (cpu->attackModel() == CPU::AttackModel::None) {
+                inst->setUnsquashable(true);
+            } else {
+                assert(cpu->attackModel() == CPU::AttackModel::Spectre ||
+                       cpu->attackModel() == CPU::AttackModel::Futuristic);
+                inst->setUnsquashable(
+                    cpu->attackModel() == CPU::AttackModel::Spectre ?
+                    prevBranchesResolved : prevInstsComplete);
+            }
+
+            // Update prev control insts state
+            if (inst->isControl()) {
+                if (!inst->readyToCommit() || inst->getFault() != NoFault) {
+                    prevBranchesResolved = false;
+                }
+            }
+
+            // Update prev insts state
+            if (inst->isNonSpeculative() ||
+                inst->isStoreConditional() ||
+                inst->isReadBarrier() || inst->isWriteBarrier() ||
+                inst->isAtomic() ||
+                (inst->isLoad() && inst->strictlyOrdered())) {
+                // Some special instructions, directly set canCommit
+                // when entering ROB
+                prevInstsComplete = false;
+            }
+
+            if (!inst->readyToCommit() || inst->getFault() != NoFault) {
+                prevInstsComplete = false;
+            }
+        }
+    }
+}
+
 } // namespace o3
 } // namespace gem5
diff --git a/src/cpu/o3/rob.hh b/src/cpu/o3/rob.hh
index b3aa5b3ebb..1793c4fd2d 100644
--- a/src/cpu/o3/rob.hh
+++ b/src/cpu/o3/rob.hh
@@ -339,6 +339,10 @@ class ROB
         // The number of rob_writes
         statistics::Scalar writes;
     } stats;
+
+  public:
+    // [SafeSpec, SPT]
+    void updateInstructionVisibility();
 };
 
 } // namespace o3
diff --git a/src/cpu/reg_class.hh b/src/cpu/reg_class.hh
index 080c758413..1bb598c46d 100644
--- a/src/cpu/reg_class.hh
+++ b/src/cpu/reg_class.hh
@@ -234,6 +234,7 @@ class RegClass
     constexpr const char *name() const { return _name; }
     constexpr size_t numRegs() const { return _numRegs; }
     constexpr size_t regBytes() const { return _regBytes; }
+    constexpr size_t regBits() const { return _regBytes * 8; }
     constexpr size_t regShift() const { return _regShift; }
     constexpr const debug::Flag &debug() const { return debugFlag; }
     constexpr bool isFlat() const { return _flat; }
diff --git a/src/cpu/regfile.hh b/src/cpu/regfile.hh
index a223c0142d..62660ec868 100644
--- a/src/cpu/regfile.hh
+++ b/src/cpu/regfile.hh
@@ -32,12 +32,31 @@
 #include <cassert>
 #include <cstring>
 #include <vector>
+#include <utility>
 
 #include "cpu/reg_class.hh"
 
 namespace gem5
 {
 
+enum class Taint
+{
+    Unknown,
+    Untainted,
+    Tainted
+};
+
+constexpr Taint minTaint(Taint a, Taint b) {
+    if (a == Taint::Unknown || b == Taint::Unknown)
+        panic("Examining unknown taint");
+    return (a == Taint::Tainted && b == Taint::Tainted) ?
+        Taint::Tainted : Taint::Untainted;
+}
+
+constexpr const char *taint2Str(Taint t) {
+    return t == Taint::Unknown ? "X" : t == Taint::Tainted ? "T" : "U";
+}
+
 class RegFile
 {
   private:
@@ -46,12 +65,22 @@ class RegFile
     const size_t _regShift;
     const size_t _regBytes;
 
+    // [Octal] Add taint bit in RegFile
+    std::vector<std::vector<Taint>> taint;
+
   public:
     const RegClass &regClass;
 
     RegFile(const RegClass &info, const size_t new_size) :
         data(new_size << info.regShift()), _size(new_size),
         _regShift(info.regShift()), _regBytes(info.regBytes()),
+        // [Octal] Add taint bit in RegFile
+        taint(new_size, std::vector<Taint>(
+            info.type() == CCRegClass ?
+                info.regBits() : info.regBytes(),
+            Taint::Untainted
+        )),
+        // [Octal]
         regClass(info)
     {}
 
@@ -102,6 +131,63 @@ class RegFile
     }
 
     void clear() { std::fill(data.begin(), data.end(), 0); }
+
+    // [Octal] Read / set taint
+    const std::vector<Taint> *
+    getTaint(size_t idx) const
+    {
+        assert(idx < _size);
+        return &taint.at(idx);
+    }
+
+    void
+    setTaint(size_t idx, Taint newTaint)
+    {
+        // [Octal] TODO: Should we consider zero reg here?
+        assert(idx < _size);
+        auto &bitVec = taint.at(idx);
+        std::fill(bitVec.begin(), bitVec.end(), newTaint);
+    }
+
+    void
+    setPartialTaint(size_t idx, Taint newTaint,
+                         uint8_t taintSize, uint8_t taintOffset = 0)
+    {
+        assert(idx < _size);
+        auto &bitVec = taint.at(idx);
+        assert(taintSize + taintOffset <= bitVec.size());
+        std::fill(bitVec.begin() + taintOffset,
+                  bitVec.begin() + taintOffset + taintSize, newTaint);
+    }
+
+    void
+    setPartialTaint(size_t idx, Taint newTaint,
+                        std::vector<bool>& updateVec)
+    {
+        assert(idx < _size);
+        auto &bitVec = taint.at(idx);
+        assert(updateVec.size() == bitVec.size());
+        for (size_t i = 0; i < bitVec.size(); i++) {
+            if (updateVec[i]) {
+                // NOTE: Should NOT use newTaint && updateVec!!!
+                //  This buggy code may incorrectly clear taint bit.
+                bitVec[i] = newTaint;
+            }
+        }
+    }
+
+    void
+    setPartialTaintVec(size_t idx, const std::vector<Taint> &taintVec,
+                            uint8_t taintSize, uint8_t taintOffset = 0)
+    {
+        assert(idx < _size);
+        auto &bitVec = taint.at(idx);
+        assert(taintVec.size() == bitVec.size());
+        assert(taintSize + taintOffset <= bitVec.size());
+        for (int i = 0; i < taintSize; i++) {
+            bitVec[i + taintOffset] = taintVec.at(i + taintOffset);
+        }
+    }
 };
 
 } // namespace gem5
diff --git a/src/cpu/static_inst.hh b/src/cpu/static_inst.hh
index 21ce2aaf8b..f9dee0a48f 100644
--- a/src/cpu/static_inst.hh
+++ b/src/cpu/static_inst.hh
@@ -97,6 +97,8 @@ class StaticInst : public RefCounted, public StaticInstFlags
     /// See destRegIdx().
     RegIdArrayPtr _destRegIdxPtr = nullptr;
 
+    std::vector<bool> _ignoreSrcTaint = std::vector<bool>(4, false);
+
   protected:
 
     /// Flag values for this instruction.
@@ -214,6 +216,8 @@ class StaticInst : public RefCounted, public StaticInstFlags
     /// Only the entries from 0 through numDestRegs()-1 are valid.
     const RegId &destRegIdx(int i) const { return (this->*_destRegIdxPtr)[i]; }
 
+    RegId &destRegIdx(int i) { return (this->*_destRegIdxPtr)[i]; }
+
     void
     setDestRegIdx(int i, const RegId &val)
     {
@@ -230,6 +234,49 @@ class StaticInst : public RefCounted, public StaticInstFlags
         (this->*_srcRegIdxPtr)[i] = val;
     }
 
+    void
+    setIgnoreSrcTaint(int i, bool f)
+    {
+        if (i >= _ignoreSrcTaint.size()) {
+            _ignoreSrcTaint.resize((i + 1) << 1);
+        }
+        _ignoreSrcTaint[i] = f;
+    }
+
+    bool
+    ignoreSrcTaint(int i) const
+    {
+        assert(i < _ignoreSrcTaint.size() && i < numSrcRegs());
+        return _ignoreSrcTaint[i];
+    }
+
+    virtual uint8_t getSrcSize() const {
+        panic("getSrcSize() not implemented"); return 0;
+    }
+    virtual uint8_t getDestSize() const {
+        panic("getDestSize() not implemented"); return 0;
+    }
+    virtual uint8_t getDataSize() const {
+        panic("getDataSize() not implemented"); return 0;
+    }
+    virtual uint8_t getAddressSize() const {
+        panic("getAddressSize() not implemented"); return 0;
+    }
+    virtual RegIndex getFoldOBit() const {
+        panic("getFoldOBit() not implemented"); return 0;
+    }
+    virtual RegIndex getFoldABit() const {
+        panic("getFoldABit() not implemented"); return 0;
+    }
+    virtual uint16_t getAccessedFlags() const {
+        panic("getAccessedFlags() not implemented"); return 0;
+    }
+    virtual uint16_t getWrittenFlags() const {
+        panic("getWrittenFlags() not implemented"); return 0;
+    }
+    virtual bool isCsvtOvertainting() const { return false; }
+    virtual bool isTrivialWhenSrc1EqSrc2() const { return false; }
+
     /// Pointer to a statically allocated "null" instruction object.
     static StaticInstPtr nullStaticInstPtr;
 
@@ -348,7 +395,7 @@ class StaticInst : public RefCounted, public StaticInstFlags
     void printFlags(std::ostream &outs, const std::string &separator) const;
 
     /// Return name of machine instruction
-    std::string getName() { return mnemonic; }
+    std::string getName() const { return mnemonic; }
 
   protected:
     template<typename T>
diff --git a/src/sim/SConscript b/src/sim/SConscript
index 75b595b8a1..2f13ea9045 100644
--- a/src/sim/SConscript
+++ b/src/sim/SConscript
@@ -140,5 +140,6 @@ DebugFlag('VoltageDomain')
 DebugFlag('DVFS')
 DebugFlag('Vma')
 DebugFlag('PowerDomain')
+DebugFlag('Process')
 
 CompoundFlag('SyscallAll', [ 'SyscallBase', 'SyscallVerbose'])
diff --git a/src/sim/mem_state.cc b/src/sim/mem_state.cc
index 801226cfb1..aff84253d1 100644
--- a/src/sim/mem_state.cc
+++ b/src/sim/mem_state.cc
@@ -440,7 +440,7 @@ MemState::fixupFault(Addr vaddr)
                 fatal("Maximum stack size exceeded\n");
             }
             _ownerProcess->allocateMem(_stackMin, _pageBytes);
-            inform("Increasing stack size by one page.");
+            inform("Increasing stack size by one page, now lowest page is %p\n", _stackMin);
         }
         return true;
     }
diff --git a/src/sim/process.hh b/src/sim/process.hh
index cece212d14..9f1a433733 100644
--- a/src/sim/process.hh
+++ b/src/sim/process.hh
@@ -39,7 +39,9 @@
 
 #include "base/loader/memory_image.hh"
 #include "base/statistics.hh"
+#include "base/trace.hh"
 #include "base/types.hh"
+#include "debug/Process.hh"
 #include "mem/se_translating_port_proxy.hh"
 #include "sim/fd_array.hh"
 #include "sim/fd_entry.hh"
@@ -303,6 +305,95 @@ class Process : public SimObject
 
     // Track how many system calls are executed
     statistics::Scalar numSyscalls;
+
+    // [Octal] Given an address, check whether it is in the public range
+    std::vector<std::pair<Addr, Addr> > publicSegments;
+
+    bool isAddrPublic(Addr start, Addr end, uint64_t privStackOff, bool stackDefaultPublic) {
+        assert(start <= end);
+
+        for (auto &seg : publicSegments) {
+            // DPRINTF(Process, "isAddrPublic: trying segment 0x%llx ~ 0x%llx (size=0x%llx)",
+            //     seg.first,
+            //     seg.first + seg.second,
+            //     seg.second);
+
+            assert(seg.first + seg.second >= seg.first);
+            const auto seg_beg = seg.first;
+            const auto seg_end = seg.first + seg.second;
+
+            if (seg_beg <= start && start < seg_end &&
+                seg_beg < end && end <= seg_end) {
+                DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is in public section\n", start, end);
+                return true;
+            }
+        }
+
+        Addr stackBase = memState->getStackBase();
+        Addr stackMin = memState->getStackMin();
+        bool onStack = (stackMin <= start && start < stackBase &&
+                       stackMin < end && end <= stackBase);
+
+        if (stackDefaultPublic) {
+            // the only public region left to be checked is the stack
+            assert(privStackOff == 0); // should not be set, thus zero is expected
+            if (onStack) {
+                DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on default-public stack\n", start, end);
+                return true;
+            } else {
+                DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on private memory\n", start, end);
+                return false;
+            }
+        }
+
+        // when privStackOff == 0, whole stack is considered private (default)
+        // when privStackOff > 0, private stack starts at stackBase - privStackOff
+        // this offset should be sufficiently large
+        assert(privStackOff == 0 || privStackOff >= 0x100000);
+
+        if (privStackOff == 0) {
+            // no public stack; address falls into private memory
+
+            // just check if it's on stack or not
+            if (onStack) {
+                DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on default-private stack\n", start, end);
+            } else {
+                DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on private memory\n", start, end);
+            }
+
+            return false;
+        }
+
+        inform_once("private stack offset is 0x%llx\n", privStackOff);
+        warn_if_once((privStackOff << 1) > memState->getMaxStackSize(),
+            "private stack (offset=0x%llx) and public stack combined "
+            "are bigger than the maximum stack size (0x%llx)\n",
+            privStackOff, memState->getMaxStackSize());
+
+        assert(stackBase >= (privStackOff << 1));
+        Addr publicStackMin = stackBase - privStackOff;
+        Addr privateStackMin = publicStackMin - privStackOff;
+        inform_once("max stack size is 0x%llx\n", memState->getMaxStackSize());
+        inform_once("public stack is  [0x%llx, 0x%llx)\n", publicStackMin, stackBase);
+        inform_once("private stack is [0x%llx, 0x%llx)\n", privateStackMin, publicStackMin);
+        // panic_if(memState->getStackMin() < publicStackMin,
+        //     "public stack (0x%llx ~ 0x%llx) has grown into private stack; stackBase=0x%llx, publicStackMin=0x%llx\n",
+        //     memState->getStackMin(), memState->getStackBase(), stackBase, publicStackMin);
+        if (publicStackMin <= start && start < stackBase &&
+            publicStackMin < end && end <= stackBase) {
+            DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on public stack\n", start, end);
+            return true;
+        }
+
+        if (privateStackMin <= start && start < publicStackMin &&
+            privateStackMin < end && end <= publicStackMin) {
+            DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on private stack\n", start, end);
+        } else {
+            DPRINTF(Process, "isAddrPublic: [0x%llx, 0x%llx) is on private memory\n", start, end);
+        }
+        return false;
+    }
+    // [Octal]
 };
 
 } // namespace gem5