3 ms·

> No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. This slide deck says that BOOMv2 was taped out in August for TSMC 28nm H

> No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA. This slide deck says that BOOMv2 was taped out in August for TSMC 28nm HPM: https://content.riscv.org/wp-content/uploads/2017/12/Wed0936-BOOM-v2-An-Open-Source-Out-of-Order-RISC-V-Core-Celio.pdf https://content.riscv.org/wp-content/uploads/2017/12/Wed0936... > The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other. It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning "As BOOM will send speculative load instructions to the cache…" How would such a design not be vulnerable to Spectre?

jabl 9y ago
> It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load instructions to the cache…" > How would such a design not be vulnerable to Spectre? Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like if (x < array1_size) y = array2[array1[x] * 256]; So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved? Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.
- cwzwarich 9y ago
  That would only be true for a microarchitecture like BOOM if the load queue had a depth of 1, but then there's no point in having a load queue at all.

jabl 9y ago

> It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning > "As BOOM will send speculative load instructions to the cache…" > How would such a design not be vulnerable to Spectre? Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like if (x < array1_size) y = array2[array1[x] * 256]; So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved? Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.

cwzwarich 9y ago
That would only be true for a microarchitecture like BOOM if the load queue had a depth of 1, but then there's no point in having a load queue at all.