4 ms·

Out-of-order execution is a feature of the microarchitecture, not the ISA. That is, RISC-V is an instruction set - it defines the language you use to describe w

by wk_end 4y ago

Out-of-order execution is a feature of the microarchitecture, not the ISA. That is, RISC-V is an instruction set - it defines the language you use to describe work to the processor. Any given RISC-V processor needs to understand that language, but how it actually does the work is up to it. Out-of-order execution means that the CPU, internally, won't necessarily do the work in the order given, which lets it use its internal resources more efficiently...but externally there should be no observable difference.

pjmlp 4y ago
As we learned back in the Pentium days, there are observable differences anyway, if anything in performance, and unless the out-of-order execution is super clever, Assembly needs to be written in a form that helps the CPU units to work best.
- throwaway4good 4y ago
  As chips grow more and more complex the ISA matters less and less for performance. Of course it still matters for vendor lock-in (ie Windows only running on X86) and politics (license fees and preventing China from using it).
  - pavlov 4y ago
    Windows runs pretty well on ARM64 these days. They even have emulation for x86 plugins loaded into ARM binaries. All it really needs is Qualcomm to come out with ARM chips that could compete with Apple’s. Of course that’s a tall order…
- VLM 4y ago
  > if anything in performance Have to be careful not to leak data in a crypto timing attack. A good analogy of the problem would be: If one compared a long secure password one byte at a time and instantly returned an error upon failure of first match, it looks like a nice long password, but with an oscilloscope you could figure out the long password by repeatedly guessing one byte of the password at a time because each time you get one byte's worth correct, it fails a couple cycles later in the process. It "feels" like a 16 character string should be somewhat less than 2 * 128 bits of security (aside from normal looking text doesn't use all 8 bits per byte) but it would really only require on average 16 * 128 attempts to crack any 16 character password via this timing attack because on average you'd guess the next letter of the password every hundred or so attempts. Obviously real attacks are more obscure, but anything that messes with control flow is worrisome. Its theoretically possible to write code that would be secure on a "dumb" processor but under some kind of branch predicting out of order "smart" processor that might not even exist at the time the code is written, running the code might leak crypto data. This can all be worked around at some effort.
  - speed_spread 4y ago
    Perfect defense against a crypto timing attack on modern CPUs while targetting a generic ISA is so hard that I would simply never trust anything that doesn't run on its own dedicated hardware unit if millions $ depended on it. Fortunately I'm not that rich.

by wk_end 4y ago

pjmlp 4y ago

As we learned back in the Pentium days, there are observable differences anyway, if anything in performance, and unless the out-of-order execution is super clever, Assembly needs to be written in a form that helps the CPU units to work best.

throwaway4good 4y ago
As chips grow more and more complex the ISA matters less and less for performance. Of course it still matters for vendor lock-in (ie Windows only running on X86) and politics (license fees and preventing China from using it).
- pavlov 4y ago
  Windows runs pretty well on ARM64 these days. They even have emulation for x86 plugins loaded into ARM binaries. All it really needs is Qualcomm to come out with ARM chips that could compete with Apple’s. Of course that’s a tall order…
VLM 4y ago
> if anything in performance Have to be careful not to leak data in a crypto timing attack. A good analogy of the problem would be: If one compared a long secure password one byte at a time and instantly returned an error upon failure of first match, it looks like a nice long password, but with an oscilloscope you could figure out the long password by repeatedly guessing one byte of the password at a time because each time you get one byte's worth correct, it fails a couple cycles later in the process. It "feels" like a 16 character string should be somewhat less than 2 * 128 bits of security (aside from normal looking text doesn't use all 8 bits per byte) but it would really only require on average 16 * 128 attempts to crack any 16 character password via this timing attack because on average you'd guess the next letter of the password every hundred or so attempts. Obviously real attacks are more obscure, but anything that messes with control flow is worrisome. Its theoretically possible to write code that would be secure on a "dumb" processor but under some kind of branch predicting out of order "smart" processor that might not even exist at the time the code is written, running the code might leak crypto data. This can all be worked around at some effort.
- speed_spread 4y ago
  Perfect defense against a crypto timing attack on modern CPUs while targetting a generic ISA is so hard that I would simply never trust anything that doesn't run on its own dedicated hardware unit if millions $ depended on it. Fortunately I'm not that rich.