Okay, I'm all for RISC-V, but this makes no sense, RISC-V isn't magically immune to spectre for no reason.
Indeed. RISC-V is an ISA and says little about how any given implementation may accelerate branches or load cache lines. It's entirely feasible to create a CPU based on the RISC-V ISA that is vulnerable to these attacks. There are proprietary RISC-V implementations in the wild today that may or may not have such properties, and while these deeply embedded implementations are likely to be simple, in-order non-speculative processors we can't really know.
Recently the RISC-V ISA was found to have an under specified memory model[1] that could manifest as memory ordering problems in more complex (and as yet hypothetical) implementations. This was discovered by Princeton researchers using a formal verification system. Since then RISC-V developers have been working[2] toward correcting this by fully specifying the RISC-V memory model (including two variants with different degrees of rigor.)
To my mind this specific case argues that open design may see real benefits from public scrutiny.
[1] https://www.electronicsweekly.com/open-source-engineering/ri... [2] https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...
For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.
I thought this was all down to an implementation detail and has nothing to do with ISAs.
> the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
> [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]
Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.
Either way, this is the time everyone and their brother, sister, mother and child will have something to sell you, so it's not surprised the RISC-V people are out to sell their architecture now.
Creating IRC clones, UNIX clones, talk clones, FB clones is anything but innovation.
- Can load across protection boundaries Valid data is usable; invalid data cannot be seen
At the very least, this probably makes ASLR pretty easy to defeat across protection boundaries. Are you really willing to bet that there will never be a more clever exploit that can determine more information? In slide 51 of the IPC talk[0] they explicitly say that they put permissions checking after the cache, and that this is essential for their performance and power claims.
[0] https://millcomputing.com/docs/inter-process-communication/
One can only hope! At this point we could stand to have some architectural fragmentation. I'm pretty happy to see RISC-V blatantly capitalizing on this situation.
Also, if you do come up with a better way, you've a much greater chance of persuading someone to implement it.