  Since the advent of Spectre attacks, researchers and practitioners have
developed a range of hardware and software measures to counter transient
execution attacks. A prime example of such mitigation is speculative load
hardening in LLVM, which protects against leaks by tracking the speculation
state and masking values during misspeculation. LLVM relies on static analysis
to harden programs using slh that often results in over-protection, which
incurs performance overhead. We extended an existing side-channel model
validation framework, Scam-V, to check the vulnerability of programs to
Spectre-PHT attacks and optimize the protection of programs using the slh
approach. We illustrate the efficacy of Scam-V by first demonstrating that it
can automatically identify Spectre vulnerabilities in real programs, e.g.,
fragments of crypto-libraries. We then develop an optimization mechanism that
validates the necessity of slh hardening w.r.t. the target platform. Our
experiments showed that hardening introduced by LLVM in most cases could be
significantly improved when the underlying microarchitecture properties are
considered.
