3 ms·

> No announced RISC-V silicon is susceptible Wasn't the BOOM CPU (https://github.com/ucb-bar/riscv-boom https://github.com/ucb-bar/riscv-boom) fabricated? It d

> No announced RISC-V silicon is susceptible Wasn't the BOOM CPU (https://github.com/ucb-bar/riscv-boom https://github.com/ucb-bar/riscv-boom) fabricated? It definitely seems vulnerable to Spectre.

topspin 9y ago
>> Wasn't the BOOM CPU fabricated? No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. >> It definitely seems vulnerable to Spectre. The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other.
- cwzwarich 9y ago
  > No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. This slide deck says that BOOMv2 was taped out in August for TSMC 28nm HPM: https://content.riscv.org/wp-content/uploads/2017/12/Wed0936-BOOM-v2-An-Open-Source-Out-of-Order-RISC-V-Core-Celio.pdf https://content.riscv.org/wp-content/uploads/2017/12/Wed0936... > The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other. It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning "As BOOM will send speculative load instructions to the cache…" How would such a design not be vulnerable to Spectre?
  - jabl 9y ago
    > It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load instructions to the cache…" > How would such a design not be vulnerable to Spectre? Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like if (x < array1_size) y = array2[array1[x] * 256]; So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved? Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.
    - cwzwarich 9y ago
      That would only be true for a microarchitecture like BOOM if the load queue had a depth of 1, but then there's no point in having a load queue at all.
- bogomipz 9y ago
  >"It's a synthesizable core that runs on FPGA." What does "synthesizable core" mean here? Does it simply mean that someone has written the Verilog that could actually produce a working core and made it available?
  - cwzwarich 9y ago
    Verilog has some constructs that can't actually be synthesized (i.e. converted into configurations of gates) by tools, as well as coding patterns that can result in problems for synthesis. Unsynthesizable code is still used for things like test harnesses.
  - _chris_ 9y ago
    > synthesizable core That means two things. One, that the design description ("RTL code") can be pushed through synthesis and place-and-route tools and turned into gates. This is useful for putting the design onto an FPGA or getting a piece of silicon (ASIC chip). But it also means "not custom", as in, the gates are not auto-generated from "synthesizable RTL" but rather than laid out by hand. Full custom can eke out some improvements over synthesizable logic, but it's also more expensive and can preclude testing out designs on FPGAs before manufacture. Most modern chips are mostly synthesized with some of the more critical components (and more "regular" structures) handled using custom or semi-custom methodologies.
jabl 9y ago
Perhaps they meant "announced RISC-V silicon" as in something you can buy (if not right away, at least at some specified time in the future)? AFAIU the BOOM tapeout was a test run, with no intention if giving or selling the chips to outsiders. If we take this stricter definition, is there any RISC-V hardware out there except the SiFive ones, which are apparently simple enough that they are indeed not susceptible to these issues?

> No announced RISC-V silicon is susceptible Wasn't the BOOM CPU (https://github.com/ucb-bar/riscv-boom https://github.com/ucb-bar/riscv-boom) fabricated? It definitely seems vulnerable to Spectre.

topspin 9y ago

>> Wasn't the BOOM CPU fabricated? No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. >> It definitely seems vulnerable to Spectre. The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other.

cwzwarich 9y ago
> No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. This slide deck says that BOOMv2 was taped out in August for TSMC 28nm HPM: https://content.riscv.org/wp-content/uploads/2017/12/Wed0936-BOOM-v2-An-Open-Source-Out-of-Order-RISC-V-Core-Celio.pdf https://content.riscv.org/wp-content/uploads/2017/12/Wed0936... > The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other. It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning "As BOOM will send speculative load instructions to the cache…" How would such a design not be vulnerable to Spectre?
- jabl 9y ago
  > It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load instructions to the cache…" > How would such a design not be vulnerable to Spectre? Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like if (x < array1_size) y = array2[array1[x] * 256]; So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved? Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.
  - cwzwarich 9y ago
    That would only be true for a microarchitecture like BOOM if the load queue had a depth of 1, but then there's no point in having a load queue at all.
bogomipz 9y ago
>"It's a synthesizable core that runs on FPGA." What does "synthesizable core" mean here? Does it simply mean that someone has written the Verilog that could actually produce a working core and made it available?
- cwzwarich 9y ago
  Verilog has some constructs that can't actually be synthesized (i.e. converted into configurations of gates) by tools, as well as coding patterns that can result in problems for synthesis. Unsynthesizable code is still used for things like test harnesses.
- _chris_ 9y ago
  > synthesizable core That means two things. One, that the design description ("RTL code") can be pushed through synthesis and place-and-route tools and turned into gates. This is useful for putting the design onto an FPGA or getting a piece of silicon (ASIC chip). But it also means "not custom", as in, the gates are not auto-generated from "synthesizable RTL" but rather than laid out by hand. Full custom can eke out some improvements over synthesizable logic, but it's also more expensive and can preclude testing out designs on FPGAs before manufacture. Most modern chips are mostly synthesized with some of the more critical components (and more "regular" structures) handled using custom or semi-custom methodologies.

jabl 9y ago

Perhaps they meant "announced RISC-V silicon" as in something you can buy (if not right away, at least at some specified time in the future)? AFAIU the BOOM tapeout was a test run, with no intention if giving or selling the chips to outsiders. If we take this stricter definition, is there any RISC-V hardware out there except the SiFive ones, which are apparently simple enough that they are indeed not susceptible to these issues?