Faulty instructions in Alibaba's T-Head C910 RISC-V CPUs blow away all security
theregister.com
theregister.com
This is a bug specific to a microarchitecture, not the RISC-V spec.
It affects a specific microarchitecture's implementation of a custom Vector extension, not the RISC-V Vector spec.
This custom Vector extension is based in a draft of RISC-V Vector spec with a bunch of THead-specific modifications/additions. It is not based on nor compatible with the ratified RISC-V Vector spec.
There's nothing to suggest there's anything inherently wrong with RISC-V spec, or even that any microarchitectures outside of THead's could be affected.
Additionally, there are no known implementations of THead custom vector extension outside of THead's own microarchitectures.
It is possible that in some future RVV 2.0 or 3.0 this bit pattern might represent `vse128.v` but it is at least equally possible that it won't -- there is no clear pattern
In RVV 0.7.1 / XTHeadVector it is complete nonsense to call it `vse128.v`. There is no room in the width encoding for additional sizes. There isn't even an encoding for 64 bit elements. And the instruction naming style is quite different, with totally different semantics in the event that the load/store element width is different to the `vsetvl` element width:
- `vse.v` Store using the element size from the `vsetvl` (i.e. just a raw bit for bit transfer)
- `vsb.v` truncate elements to 8 bits while storing them
- `vsh.v` truncate elements to 16 bits while storing them
- `vsw.v` truncate elements to 32 bits while storing them
THead has enumerated in their manual the differences from RVV draft 0.7.1. They amount to not implementing the `EDIV` feature (which is optional anyway) and they add the `vlenb` CSR.
If the bit pattern used in this exploit is intended to be some THead extension then it is completely undocumented. More likely, it's just a completely accidental instruction from an undefined encoding that should simply trap.
The same problem could happen equally easily with a mistake in implementation of ratified extension.