From 61e932a89091db609a6297d3a2c6f69e379b945c Mon Sep 17 00:00:00 2001 From: wraitii Date: Wed, 14 Jun 2023 07:44:23 +0000 Subject: [PATCH] Turn off SPECTRE mitigation in jit code SPECTRE attacks mitigations were added to SpiderMonkey's JIT output in version 57. Turning these off is a very large speedup, around 10-20% wall time (on my computer) depending on the map and the situation. For the most part, from profiling on my machine, this is from memory fences after JIT -> C++ calls. 0 A.D. does a lot of these. The SPECTRE class of attack is a timing attack based on speculative execution to leak sensitive information, and it seems extraordinarily unlikely that something like this could be successfully mounted using 0 A.D. Differential Revision: https://code.wildfiregames.com/D5014 This was SVN commit r27699. --- source/scriptinterface/ScriptContext.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/source/scriptinterface/ScriptContext.cpp b/source/scriptinterface/ScriptContext.cpp index 1280740792..9e27489ba7 100644 --- a/source/scriptinterface/ScriptContext.cpp +++ b/source/scriptinterface/ScriptContext.cpp @@ -120,6 +120,13 @@ ScriptContext::ScriptContext(int contextSize, int heapGrowthBytesGCTrigger): JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_ION_ENABLE, 1); JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_BASELINE_ENABLE, 1); + // Turn off Spectre mitigations - this is a huge speedup on JS code, particularly JS -> C++ calls. + JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_SPECTRE_JIT_TO_CXX_CALLS, 0); + JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_SPECTRE_INDEX_MASKING, 0); + JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_SPECTRE_VALUE_MASKING, 0); + JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_SPECTRE_STRING_MITIGATIONS, 0); + JS_SetGlobalJitCompilerOption(m_cx, JSJITCOMPILER_SPECTRE_OBJECT_MITIGATIONS, 0); + JS::ContextOptionsRef(m_cx).setStrictMode(true); ScriptEngine::GetSingleton().RegisterContext(m_cx);