5 ms·

Okay, I'm all for RISC-V, but this makes no sense, RISC-V isn't magically immune to spectre for no reason.

jeffdavis 9y ago
Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.
- dmitrygr 9y ago
  That does not change the fact that SUM(security,speed,price /due to Si area/) == CONST
  - garmaine 9y ago
    That equation doesn’t hold, as open source software has demonstrated time and time again.
    - cwyers 9y ago
      http://heartbleed.com/ http://heartbleed.com/
    - dmitrygr 9y ago
      I was talking about hardware For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
      - sitkack 9y ago
        You outline only a single solution of which there are many. The thing RISC-V gets you is the ability to iterate on an implementation while still running the body of existing code. As ridiculous as it seems, this hasn't been possible before. RISC-V didn't technically need to exist but it did politically and legally. I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
        Momquist 9y ago
        I think this equation actually makes sense when only the same people/minds are changing the factors. If the same team is given the task of improving a product, chances are they will be close minded and only able to tweak say security at the expense of the other two. To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.
- UncleEntity 9y ago
  Seems more like jumping on the bandwagon to me... I thought this was all down to an implementation detail and has nothing to do with ISAs.
  - shawnz 9y ago
    If you read the very short article: > the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
    - mlinksva 9y ago
      Alternative short article if RISC-V community is target audience: > [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]
- bobajeff 9y ago
  Being open doesn't gain you much here either. At the end of the day there is no "updating" it once a vulnerability is found.
  - nitrogen 9y ago
    It does make it more likely that a compatible replacement can be found on the market, though.
- Nokinside 9y ago
  High performance microarchitectures for RISCV are still going to be proprietary. Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.
awalton 9y ago
In fact, in this case, it's more probably immune because it's less mature. Only with advanced prefetching and speculative execution do you hit the Spectre of data that could have been. Either way, this is the time everyone and their brother, sister, mother and child will have something to sell you, so it's not surprised the RISC-V people are out to sell their architecture now.
- ansible 9y ago
  Yes. Only when you completely eliminate the conventional kind of speculative execution [0] can you have a hope of being immune to these sorry of problems. [0] https://millcomputing.com/docs/metadata/ https://millcomputing.com/docs/metadata/
  - phkahler 9y ago
    Not really. What nobody has said AFAICT is that the attacks all stem from the problem of running untrusted code on your processor. It's not just apps or websites, we let JS code run our machine for every little ad banner. We allow our cloud infrastructure to share cache with someone else's. These things are all done in the name of convenience. Only when security is considered a top priority will these problems really go away. We must stop running untrusted code. Even. In. A. Sandbox.
    - taf2 9y ago
      We will always have bugs. The amount of money and resource efficiency we gain from sharing is too big to ignore. These issue will be addressed and yes more issues will be uncovered. Our sandboxes will get better, our kernels will harden and our CPU designs will improve. It’s actually not possible to throw our hands in the air and stop as you suggest. From every mistake we grow stronger because we don’t run away. It’s great that these issues have been uncovered. It sucks dealing with the fallout but that is only short term.
      - pjmlp 9y ago
        We would have less of them if companies were liable like in other industries.
topspin 9y ago
>> RISC-V isn't magically immune to spectre for no reason. Indeed. RISC-V is an ISA and says little about how any given implementation may accelerate branches or load cache lines. It's entirely feasible to create a CPU based on the RISC-V ISA that is vulnerable to these attacks. There are proprietary RISC-V implementations in the wild today that may or may not have such properties, and while these deeply embedded implementations are likely to be simple, in-order non-speculative processors we can't really know. Recently the RISC-V ISA was found to have an under specified memory model[1] that could manifest as memory ordering problems in more complex (and as yet hypothetical) implementations. This was discovered by Princeton researchers using a formal verification system. Since then RISC-V developers have been working[2] toward correcting this by fully specifying the RISC-V memory model (including two variants with different degrees of rigor.) To my mind this specific case argues that open design may see real benefits from public scrutiny. [1] https://www.electronicsweekly.com/open-source-engineering/risc-v-bugs-found-princeton-2017-04/ https://www.electronicsweekly.com/open-source-engineering/ri... [2] https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa-dev/hKywNHBkAXM https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...
Nomentatus 9y ago
It isn't well argued, but the point is that if you have two chip designers/ISA shops in the world, both may make the same mistake. If the ISA is open, you (hopefully) have a hundred, and not all will fool themselves the same way. Also, if you do come up with a better way, you've a much greater chance of persuading someone to implement it.

Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.

dmitrygr 9y ago
That does not change the fact that SUM(security,speed,price /due to Si area/) == CONST
- garmaine 9y ago
  That equation doesn’t hold, as open source software has demonstrated time and time again.
  - cwyers 9y ago
    http://heartbleed.com/ http://heartbleed.com/
  - dmitrygr 9y ago
    I was talking about hardware For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
    - sitkack 9y ago
      You outline only a single solution of which there are many. The thing RISC-V gets you is the ability to iterate on an implementation while still running the body of existing code. As ridiculous as it seems, this hasn't been possible before. RISC-V didn't technically need to exist but it did politically and legally. I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
      - Momquist 9y ago
        I think this equation actually makes sense when only the same people/minds are changing the factors. If the same team is given the task of improving a product, chances are they will be close minded and only able to tweak say security at the expense of the other two. To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.
UncleEntity 9y ago
Seems more like jumping on the bandwagon to me... I thought this was all down to an implementation detail and has nothing to do with ISAs.
- shawnz 9y ago
  If you read the very short article: > the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
  - mlinksva 9y ago
    Alternative short article if RISC-V community is target audience: > [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]
bobajeff 9y ago
Being open doesn't gain you much here either. At the end of the day there is no "updating" it once a vulnerability is found.
- nitrogen 9y ago
  It does make it more likely that a compatible replacement can be found on the market, though.
Nokinside 9y ago
High performance microarchitectures for RISCV are still going to be proprietary. Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.

awalton 9y ago

In fact, in this case, it's more probably immune because it's less mature. Only with advanced prefetching and speculative execution do you hit the Spectre of data that could have been. Either way, this is the time everyone and their brother, sister, mother and child will have something to sell you, so it's not surprised the RISC-V people are out to sell their architecture now.

ansible 9y ago
Yes. Only when you completely eliminate the conventional kind of speculative execution [0] can you have a hope of being immune to these sorry of problems. [0] https://millcomputing.com/docs/metadata/ https://millcomputing.com/docs/metadata/
- phkahler 9y ago
  Not really. What nobody has said AFAICT is that the attacks all stem from the problem of running untrusted code on your processor. It's not just apps or websites, we let JS code run our machine for every little ad banner. We allow our cloud infrastructure to share cache with someone else's. These things are all done in the name of convenience. Only when security is considered a top priority will these problems really go away. We must stop running untrusted code. Even. In. A. Sandbox.
  - taf2 9y ago
    We will always have bugs. The amount of money and resource efficiency we gain from sharing is too big to ignore. These issue will be addressed and yes more issues will be uncovered. Our sandboxes will get better, our kernels will harden and our CPU designs will improve. It’s actually not possible to throw our hands in the air and stop as you suggest. From every mistake we grow stronger because we don’t run away. It’s great that these issues have been uncovered. It sucks dealing with the fallout but that is only short term.
    - pjmlp 9y ago
      We would have less of them if companies were liable like in other industries.

topspin 9y ago

>> RISC-V isn't magically immune to spectre for no reason. Indeed. RISC-V is an ISA and says little about how any given implementation may accelerate branches or load cache lines. It's entirely feasible to create a CPU based on the RISC-V ISA that is vulnerable to these attacks. There are proprietary RISC-V implementations in the wild today that may or may not have such properties, and while these deeply embedded implementations are likely to be simple, in-order non-speculative processors we can't really know. Recently the RISC-V ISA was found to have an under specified memory model[1] that could manifest as memory ordering problems in more complex (and as yet hypothetical) implementations. This was discovered by Princeton researchers using a formal verification system. Since then RISC-V developers have been working[2] toward correcting this by fully specifying the RISC-V memory model (including two variants with different degrees of rigor.) To my mind this specific case argues that open design may see real benefits from public scrutiny. [1] https://www.electronicsweekly.com/open-source-engineering/risc-v-bugs-found-princeton-2017-04/ https://www.electronicsweekly.com/open-source-engineering/ri... [2] https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa-dev/hKywNHBkAXM https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...

Nomentatus 9y ago

It isn't well argued, but the point is that if you have two chip designers/ISA shops in the world, both may make the same mistake. If the ISA is open, you (hopefully) have a hundred, and not all will fool themselves the same way. Also, if you do come up with a better way, you've a much greater chance of persuading someone to implement it.