No one has fabricated a BOOM processor. It's a synthesizable core that runs on FPGA.

>> It definitely seems vulnerable to Spectre.

The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other.

This slide deck says that BOOMv2 was taped out in August for TSMC 28nm HPM:

https://content.riscv.org/wp-content/uploads/2017/12/Wed0936...

> The question has been asked but there is no answer yet; it depends on the details of BOOM branch prediction and no one has made any claims yet about BOOM one way or the other.

It's a pretty standard out-of-order design that executes loads speculatively. The BOOM spec has a sentence beginning

"As BOOM will send speculative load instructions to the cache…"

How would such a design not be vulnerable to Spectre?

> "As BOOM will send speculative load instructions to the cache…"

> How would such a design not be vulnerable to Spectre?

Hypothetically (I'm not familiar enough with BOOM to say whether this applies in this case or not), if the "speculation load depth" is limited to 1, then it seems it could be invulnerable? From the spectre paper, the exploit uses code like

if (x < array1_size) y = array2[array1[x] * 256];

So if the speculation load depth would be limited to 1, the cpu could speculatively load array1[x], compute "array1[x] * 256", but not load "array2[array1[x] * 256]" until the branch has been resolved?

Now, I don't know enough about micro-architecture to say whether such an idea makes any sense in general. Secondly, it seems Spectre is only the first on a long series of side channel attacks that target speculation, so it might be that the hypothetical "speculation load depth limited" design I envisioned above is vulnerable to some other variation of the attack.

What does "synthesizable core" mean here? Does it simply mean that someone has written the Verilog that could actually produce a working core and made it available?

That means two things. One, that the design description ("RTL code") can be pushed through synthesis and place-and-route tools and turned into gates. This is useful for putting the design onto an FPGA or getting a piece of silicon (ASIC chip).

But it also means "not custom", as in, the gates are not auto-generated from "synthesizable RTL" but rather than laid out by hand. Full custom can eke out some improvements over synthesizable logic, but it's also more expensive and can preclude testing out designs on FPGAs before manufacture.

Most modern chips are mostly synthesized with some of the more critical components (and more "regular" structures) handled using custom or semi-custom methodologies.

If we take this stricter definition, is there any RISC-V hardware out there except the SiFive ones, which are apparently simple enough that they are indeed not susceptible to these issues?