The Open-Standard Illusion: Why RISC-V is Inheriting the Sins of Speculative Execution

For years, the semiconductor industry has looked toward RISC-V as the great disruptor. The allure is obvious: an open-standard architecture that promises efficiency and a break from the proprietary shackles of the legacy giants. But as a hardware nerd, I've always cautioned that 'open' does not automatically mean 'immune.' If we are simply porting the same high-performance shortcuts—specifically the architectural flaws of speculative execution—to a new set of chips, we aren't innovating; we are just migrating our vulnerabilities.

This is no longer a theoretical concern. As The Register first reported, researchers from academic institutions in Germany and Belgium have revealed that the very performance optimizations that made x86 and ARM powerful are now haunting commercial RISC-V silicon. Specifically, a paper accepted at the 35th Usenix Security Symposium, titled "Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors," confirms that the industry's assumption—that RISC-V was too simple to be affected by Spectre—was dead wrong.

To be clear, the issue isn't with the RISC-V ISA itself, but with how commercial vendors are implementing it to chase performance. Speculative execution is the culprit: a technique where a processor predicts the flow of data before instructions are actually executed. When the prediction is wrong, the system rolls back, but it leaves behind microarchitectural traces. These traces are the open windows that allow attackers to violate memory protections and steal secrets.

According to The Register, the study identified that major Spectre variants affect commercial out-of-order RISC-V chips, specifically the T-Head Xuantie C910/C920 and the SiFive P550. The researchers demonstrated proof-of-concept attacks using Spectre-PHT (mistraining the Pattern History Table), Spectre-BTB (poisoning the Branch Target Buffer), Spectre-RSB (attacking the Return Stack Buffer), and Spectre-STL (exploiting mispredicted store-to-load forwarding). The results were stark: the researchers achieved more than 97 percent precision and up to 100 percent recall. They even demonstrated a proof-of-concept exploit on the Xuantie C910 that leaked arbitrary Linux kernel memory at a rate of 338 B/s.

It is worth noting that in-order processors, such as the SiFive U74 and the Xuantie C906 and C908, do not appear to be vulnerable. This confirms my suspicion: the vulnerability isn't a byproduct of the open standard, but a byproduct of the hunger for out-of-order execution speed. While previous research had flagged academic chips like BOOM, RiscyOO, RSD, Proteus, NaxRiscv, and NutShell, the jump to commercial silicon proves that this is a systemic industry problem.

Here is where the real crisis begins. For x86 and ARM, we spent years developing defenses like Single Thread Indirect Branch Predictor (STIBP), Indirect Branch Prediction Barrier (IBPB), and Indirect Branch Restricted Speculation (IBRS). One might assume we could just port these fixes to RISC-V. However, the researchers cited in The Register argue that these software-based defenses do not necessarily transfer.

Furthermore, the RISC-V ecosystem is suffering from a critical lack of introspection interfaces. Without these, engineers cannot properly observe or reason about microarchitectural features. When you combine this lack of transparency with the sheer diversity of the RISC-V hardware ecosystem, you realize that a single, universal mitigation strategy is likely impossible.

In my view, this is the defining challenge for RISC-V. The authors of the Usenix paper put it bluntly: RISC-V has inherited the software and threat models of mature architectures but lacks their "accumulated hardening." We are essentially building a new house using the same flawed blueprints that let the burglars in eight years ago.

To the credit of the involved parties, the researchers—Lukas Gerlach and Daniel Weber and Michael Schwarz from the CISPA Helmholtz Center for Information Security, along with Marton Bognar and Jo Van Bulck from DistriNet, KU Leuven—disclosed their findings responsibly in December. The Register reports that three of their patches have already been merged into mainline Linux, with two more under review. Reports indicate that SiFive has addressed the findings regarding the P550, while T-Head (Alibaba) has pledged to release ad-hoc speculation barriers for its chips in the future.

But patches are a band-aid, not a cure. As the researchers argue, closing the security gap isn't about porting individual mitigations. It requires a fundamental shift toward building architectural primitives, hardware transparency, and ecosystem-wide tooling.

If RISC-V is to truly disrupt the semiconductor landscape, it cannot just be a cheaper or more open version of the status quo. It must be a more secure version. If the industry continues to prioritize raw out-of-order performance over architectural integrity, RISC-V will not be the savior of the chip world—it will simply be the latest victim of a decade-old ghost.