  The code generation modules inside modern compilers such as GCC and LLVM,
which use a limited number of CPU registers to store a large number of program
variables, may introduce side-channel leaks even in software equipped with
state-of-the-art countermeasures. We propose a program analysis and
transformation based method to eliminate this side channel. Our method has a
type-based technique for detecting leaks, which leverages Datalog-based
declarative analysis and domain-specific optimizations to achieve high
efficiency and accuracy. It also has a mitigation technique for the compiler's
backend, more specifically the register allocation modules, to ensure that
potentially leaky intermediate computation results are always stored in
different CPU registers or spilled to memory with isolation. We have
implemented and evaluated our method in LLVM for the x86 instruction set
architecture. Our experiments on cryptographic software show that the method is
effective in removing the side channel while being efficient, i.e., our
mitigated code is more compact and runs faster than code mitigated using
state-of-the-art techniques.
