GhostWrite Vulnerability Affects RISC-V CPU, Mitigating Takes A ~77% Performance Hit

[phoronix]

Phoronix: GhostWrite Vulnerability Affects RISC-V CPU, Mitigating Takes A ~77% Performance Hit

Security researchers with the CISPA Helmholtz Center for Information Security have disclosed GhostWrite, a new CPU vulnerability affecting a common RISC-V processor...

https://www.phoronix.com/news/GhostWrite-Vulnerability-RISC-V

[chuckula]

x86 is SO SCREWED.

(Slightly more seriously, I expect a better fix that will have much smaller performance impacts, just like what happened with other chips)

[TemplarGR]

There goes the "x86 is bad" argument......

[and.elf]

It's still an ancient architecture, with many limitations, though battle-worn. Just because this vuln is found for riskv, it doesn't change that fact.
On topic:
This is a double-edged sword with open-source CPUs. I guess it will be like a cat and mouse game (forever), just like for x86, but with shorter iterations (?).

[jindam]

* aha .... GhostWrite is a direct CPU bug.
* will risc-v recheck existing as well as future cpus and try to avoid same mistake

[cynic]

OT: those vulnerability graphics logo are awesome!

[duby229]

I think I should just post this here right now...

EDIT: It's Jim Keller explaining how architectures get more complex.

https://m.youtube.com/watch?v=yTMRGERZrQE&t=245s&pp=2AH1AZACAQ%3D%3D

EDIT: Just keep in mind when you watch this that in modern times you have to consider fabrication nodes and transistor budgets

[schmidtbag]

It's only fair - as many here will tell you, RISC-V is just around the corner of surpassing x86-64 and ARM. Something needed to take it down a peg!

[fintux]

This is really bad, but contrary to some comments here:

• It is not a bug in RISC-V ISA, it is a bug in a specific implementation, namely T-Head XuanTie C910.
• It is not a speculative execution issue, but a bug in the vector unit.
• The discovery wasn't related to the open source nature of RISC-V, but instead by differential fuzz-testing (this could have happened e.g. between AMD and Intel).

This all and more is explained on the vulnerability site, ghostwriteattack.com.

[Drizzt321]

Shouldn't this be more "vulnerability in one RISC-V implementation"? Because that's how it sounds. Not a RISC-V issue, really, but a particular design/implementation of that uArch.