We don't actually know how to build the CPU that would replace your vulnerable one.
New CPUs are largely immune to the specific attacks that were published before they were designed. But we aren't gonna get a fast CPU without sidechannels and IMO it's not possible in theory to build a branch predictor that never makes potentially exploitable mispredictions.
In a sense this doesn't change your point but I wanted to take the opportunity to point this out. "This CPU is vulnerable to attack X" just means researchers have found an exploit in practice, which we already knew in theory was there.
This wasn't the expectation before Spectre/Meltdown but now we live in a world where you need to assume a degradation in your CPU's effective performance as we learn about its vulnerabilities and need to apply software workarounds.
I am building "one mitigation to rule them all" called Address Space Isolation but this doesn't fundamentally remove that fact, it just means that when we learn about a CPU's vulns we don't have to build a new mitigation we just have to change the settings on the existing one (and it should be more efficient than the bespoke one would be).
> IMO it's not possible in theory to build a branch predictor that never makes potentially exploitable mispredictions.
I believe the Mill hardware design would be immune by design because the hardware is in-order (relying on other trickery for its performance). Of course, it's still vaporware, but the noises made have been fairly competent.
So in some ways, yes, but in other ways, what if you didn't need a branch predictor in the CPU.
New CPUs are largely immune to the specific attacks that were published before they were designed. But we aren't gonna get a fast CPU without sidechannels and IMO it's not possible in theory to build a branch predictor that never makes potentially exploitable mispredictions.
In a sense this doesn't change your point but I wanted to take the opportunity to point this out. "This CPU is vulnerable to attack X" just means researchers have found an exploit in practice, which we already knew in theory was there.
This wasn't the expectation before Spectre/Meltdown but now we live in a world where you need to assume a degradation in your CPU's effective performance as we learn about its vulnerabilities and need to apply software workarounds.
I am building "one mitigation to rule them all" called Address Space Isolation but this doesn't fundamentally remove that fact, it just means that when we learn about a CPU's vulns we don't have to build a new mitigation we just have to change the settings on the existing one (and it should be more efficient than the bespoke one would be).