4 ms·

I'm super excited about CHERI. ... But the fastest CHERI implementation now or likely in the next couple years is orders of magnitude slower than the offerings

by nullc 11y ago

I'm super excited about CHERI. ... But the fastest CHERI implementation now or likely in the next couple years is orders of magnitude slower than the offerings from AMD and Intel. (Not fundamentally-- but primarily as a product of maturity and development) There are many applications where I'd gladly take a 100 fold performance (or energy efficiency loss) for the kind of security improvement that CHERI gives. But there are also many applications where I (and importantly, other people who care less about security than I do) cannot afford those sorts of reductions. Meanwhile, the fast machines available to us all have opaque, cryptographically locked, and seemingly often vulnerable supervisory code running on them. To make an impact OpenPower solutions need merely be better in some respect (avoiding the secret supervisory code) and not too worse in others. It might be a tougher call if MPX were already a practical reality or if SGX weren't being held back by ridiculous licensing.

nickpsecurity 11y ago
"But the fastest CHERI implementation now or likely in the next couple years is orders of magnitude slower than the offerings from AMD and Intel. (Not fundamentally-- but primarily as a product of maturity and development)" That's due to a lack of demand. The ultimate problem for high security. Gaisler's stuff is already implemented. The RISC-V Rocket core is 1.4Ghz. Basic checks like in SAFE's atomic groups have single-digit, percentage effects on performance. The mods can be tweaked to give desire performance. Worst I've seen was 70-80% loss on a prototype designed for research rather than performance on most memory-intensive stuff. Not 100x or anything. "Meanwhile, the fast machines available to us all have opaque, cryptographically locked, and seemingly often vulnerable supervisory code running on them." Definitely improvements to be had in things with open firmware and such. POWER and SPARC have had that for quite a while via Open Firmware standard. SPARC and MIPS have open implementations with SPARC not requiring an ISA license. Not sure about availability of server-grade POWER implementations or licensing costs. Definitely need more to work with in that area. "To make an impact OpenPower solutions need merely be better in some respect (avoiding the secret supervisory code) and not too worse in others." I hope that's true. What killed it before was legacy effect: key apps or capabilities that worked on x86 didn't on alternatives. Even Apple abandoned PPC. Only one doing it on desktops are the Amiga systems. For common use-cases, we need to port Flash, JS JIT's, ASM-optimized codecs... all sorts of things to POWER to achieve parity. I've always liked POWER better than x86. It's just that users use apps not ISA's. That's why x86 has holding power. So, it's literally gotta be users who don't need games, fast browsers, CAD, etc. It has to be people using native apps written in portable code leveraging components written similarly. Even better if it's multi-threaded or benefits from POWER's accelerated instructions. How many use-cases does that represent for desktop users?
- chei0aiV 11y ago
  Flash is dying, so ignore that. Debian has more than 96% of packages compiled for POWER and IBM is working on porting the reset and optimising things. https://buildd.debian.org/stats/ https://buildd.debian.org/stats/ https://wiki.debian.org/ppc64el https://wiki.debian.org/ppc64el It isn't hard to create new ports, you just have to have the source code, but everyone uses proprietary software so new ports have zero chance outside the open source world.
  - nickpsecurity 11y ago
    So, there's nothing critical for modern desktop use that isn't on POWER? What about graphics and sound cards? Printers? They got it all these days? That would be cool because one of my disposables is an old Mac laptop with G4 CPU. Getting modern Linux distro on it would be cool.
    - dmm 11y ago
      The in kernel, free radeon drivers are good and supported by amd. They should work on little-endian systems, which all of the newer POWER systems are[0]. Unforunately big-endian amd/radeon support seems to have bit rotted. So if that g4 laptop has an amd device accelerated video might not work. I'm not sure how well nouveau works for nvidia devices. There have been some discussions about this problem on the debian-powerpc mailing list so check out the archives if you're interested. Some of us also hang out on OFTC/#debianppc. Sound support should be the same as intel and printers are handled by userland so that shouldn't be a problem with most printers that work with linux. JIT support for ppc64el is good because of IBM support. It has jdk and v8 ports. [0] https://wiki.debian.org/ppc64el https://wiki.debian.org/ppc64el
      - nickpsecurity 11y ago
        The graphics situation sounds rough. Good on printers and sound. And this... "JIT support for ppc64el is good because of IBM support. It has jdk and v8 ports." ...I didn't even think about. Of course IBM's components might be usable for the desktop. ("Doh!") Thanks for the info.

by nullc 11y ago

nickpsecurity 11y ago

"But the fastest CHERI implementation now or likely in the next couple years is orders of magnitude slower than the offerings from AMD and Intel. (Not fundamentally-- but primarily as a product of maturity and development)" That's due to a lack of demand. The ultimate problem for high security. Gaisler's stuff is already implemented. The RISC-V Rocket core is 1.4Ghz. Basic checks like in SAFE's atomic groups have single-digit, percentage effects on performance. The mods can be tweaked to give desire performance. Worst I've seen was 70-80% loss on a prototype designed for research rather than performance on most memory-intensive stuff. Not 100x or anything. "Meanwhile, the fast machines available to us all have opaque, cryptographically locked, and seemingly often vulnerable supervisory code running on them." Definitely improvements to be had in things with open firmware and such. POWER and SPARC have had that for quite a while via Open Firmware standard. SPARC and MIPS have open implementations with SPARC not requiring an ISA license. Not sure about availability of server-grade POWER implementations or licensing costs. Definitely need more to work with in that area. "To make an impact OpenPower solutions need merely be better in some respect (avoiding the secret supervisory code) and not too worse in others." I hope that's true. What killed it before was legacy effect: key apps or capabilities that worked on x86 didn't on alternatives. Even Apple abandoned PPC. Only one doing it on desktops are the Amiga systems. For common use-cases, we need to port Flash, JS JIT's, ASM-optimized codecs... all sorts of things to POWER to achieve parity. I've always liked POWER better than x86. It's just that users use apps not ISA's. That's why x86 has holding power. So, it's literally gotta be users who don't need games, fast browsers, CAD, etc. It has to be people using native apps written in portable code leveraging components written similarly. Even better if it's multi-threaded or benefits from POWER's accelerated instructions. How many use-cases does that represent for desktop users?

chei0aiV 11y ago
Flash is dying, so ignore that. Debian has more than 96% of packages compiled for POWER and IBM is working on porting the reset and optimising things. https://buildd.debian.org/stats/ https://buildd.debian.org/stats/ https://wiki.debian.org/ppc64el https://wiki.debian.org/ppc64el It isn't hard to create new ports, you just have to have the source code, but everyone uses proprietary software so new ports have zero chance outside the open source world.
- nickpsecurity 11y ago
  So, there's nothing critical for modern desktop use that isn't on POWER? What about graphics and sound cards? Printers? They got it all these days? That would be cool because one of my disposables is an old Mac laptop with G4 CPU. Getting modern Linux distro on it would be cool.
  - dmm 11y ago
    The in kernel, free radeon drivers are good and supported by amd. They should work on little-endian systems, which all of the newer POWER systems are[0]. Unforunately big-endian amd/radeon support seems to have bit rotted. So if that g4 laptop has an amd device accelerated video might not work. I'm not sure how well nouveau works for nvidia devices. There have been some discussions about this problem on the debian-powerpc mailing list so check out the archives if you're interested. Some of us also hang out on OFTC/#debianppc. Sound support should be the same as intel and printers are handled by userland so that shouldn't be a problem with most printers that work with linux. JIT support for ppc64el is good because of IBM support. It has jdk and v8 ports. [0] https://wiki.debian.org/ppc64el https://wiki.debian.org/ppc64el
    - nickpsecurity 11y ago
      The graphics situation sounds rough. Good on printers and sound. And this... "JIT support for ppc64el is good because of IBM support. It has jdk and v8 ports." ...I didn't even think about. Of course IBM's components might be usable for the desktop. ("Doh!") Thanks for the info.