1442217 - [MIPS] Spectre mitigations

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P5)

Comment 1

[Jan de Mooij [:jandem]]

Just curious, do MIPS CPUs actually do speculative execution?

Comment 2

[Dragan Mladjenovic]

(In reply to Jan de Mooij [:jandem] from comment #1)
> Just curious, do MIPS CPUs actually do speculative execution?

There are designs that do in the wild. Unfortunately I don't have enough data at this point which ones that do are vulnerable if any (except these [0]). This issue is more to evaluate of performance impact of Spectre mitigation primitives if they are enabled by default.

[0] https://www.mips.com/blog/mips-response-on-speculative-execution-and-side-channel-vulnerabilities/

Comment 3

[Dragan Mladjenovic]

Attachment: poc.patch

Patch contains current primitives w/o MacroAssembler::spectreMovePtr which can't be implemented on MIPS with its current API surface. If we want or need all of these mitigations usages of this method have to be refactored to not relay on presence of comparation flags. For now I'm interested on overhead of these mitigations on Loongson in Octane benchmark suite.

Comment 4

[yuyin]

just have a quick test after apply this patch:

[loongson@localhost octane]$ ../build_release/dist/bin/js run.js
Richards: 4257
DeltaBlue: 10638
Crypto: 4787
RayTrace: 14711
EarleyBoyer: 6092
RegExp: 702
Splay: 1815
SplayLatency: 1147
NavierStokes: 7990
PdfJS: 2626
Mandreel: 2950
MandreelLatency: 3382
Gameboy: 7529
CodeLoad: 4926
Box2D: 6407
zlib: 11125
Typescript: 6223
----
Score (version 9): 4431
[loongson@localhost octane]$ ../build_release/dist/bin/js run.js
Richards: 4264
DeltaBlue: 10685
Crypto: 4776
RayTrace: 15066
EarleyBoyer: 6048
RegExp: 734
Splay: 4184
SplayLatency: 1244
NavierStokes: 7950
PdfJS: 2670
Mandreel: 2948
MandreelLatency: 3382
Gameboy: 8643
CodeLoad: 4917
Box2D: 6423
zlib: 11148
Typescript: 6041
----
Score (version 9): 4728


--------------------------------


[loongson@localhost octane]$ ../build_release/dist/bin/js --spectre-mitigations=off run.js
Richards: 4293
DeltaBlue: 11220
Crypto: 4898
RayTrace: 15773
EarleyBoyer: 6242
RegExp: 739
Splay: 3423
SplayLatency: 1906
NavierStokes: 8383
PdfJS: 2738
Mandreel: 3074
MandreelLatency: 3353
Gameboy: 11485
CodeLoad: 4940
Box2D: 6336
zlib: 11646
Typescript: 6105
----
Score (version 9): 4965
[loongson@localhost octane]$ ../build_release/dist/bin/js --spectre-mitigations=off run.js
Richards: 4282
DeltaBlue: 10995
Crypto: 4890
RayTrace: 15540
EarleyBoyer: 6221
RegExp: 749
Splay: 3520
SplayLatency: 1913
NavierStokes: 8472
PdfJS: 2763
Mandreel: 3055
MandreelLatency: 3371
Gameboy: 10818
CodeLoad: 4920
Box2D: 6360
zlib: 11651
Typescript: 6052
----
Score (version 9): 4951

Comment 5

[Dragan Mladjenovic]

(In reply to yuyin from comment #4)
> just have a quick test after apply this patch:

Sorry for the late replay.

Those numbers look nice. I tend to get a slightly worse numbers in ballpark of ~5% - 10%.
I'll try to finish this in couple of weeks. There are still some missing peaces
like unboxing on mips32 and spectreMovePtr then I'll do more testing. Not sure for now,
the plan will be to leave this mitigations in but disabled by default at least on mips32.

Comment 6

[yuyin]

hi. you can see with --spectre-mitigations on, lead to performance decline on loongson too, and looks like current loongson cpus are not affected by this vulnerability. so can you also disable it by default on mips64 like mips32. thank you.

(In reply to Dragan Mladjenovic from comment #5)
> (In reply to yuyin from comment #4)
> > just have a quick test after apply this patch:
> 
> Sorry for the late replay.
> 
> Those numbers look nice. I tend to get a slightly worse numbers in ballpark
> of ~5% - 10%.
> I'll try to finish this in couple of weeks. There are still some missing
> peaces
> like unboxing on mips32 and spectreMovePtr then I'll do more testing. Not
> sure for now,
> the plan will be to leave this mitigations in but disabled by default at
> least on mips32.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:sdetar, could you have a look please?
For more information, please visit auto_nag documentation.