Question bank — Speculative execution

False — a wrong guess only pollutes microarchitectural state; squashing discards ROB entries before they commit, so the official registers never saw the bad value.

False — they are separate ideas. You can speculate past a branch in an in-order pipeline; out-of-order just makes speculation more profitable because more independent work is available to fill the window.

True in the misprediction sense — but you'd still pay the pipeline-fill cost on the very first branch and on cold code, since a predictor with no history still has to make (and verify) a first guess.

True — that is the whole basis of Spectre: the squash undoes the architectural effect but the cache line stays warm, leaking a measurable timing footprint.

False — it is roughly pipeline depth plus refetch latency (getting the correct instructions back into fetch), so it is a few cycles more than the depth alone.

False — average accuracy hides data-dependent branches (parsing, rand()%2) near 50%, where the penalty paid can exceed the cost of simply stalling.

True for correctness of computed values — speculation is designed to be invisible to results; disabling it only removes the timing side effects and the speedup.

False — the ROB is ordered by program order precisely so it can commit oldest-first; execution finishing order (out-of-order) is decoupled from commit order.

The error is "written to the register": speculative results go to the ROB, not architectural registers, so there is nothing to overwrite — the wrong entry is simply dropped without ever touching the official register.

The branch instruction is correct and is what resolved the mispredict; only the wrong-path instructions after it are squashed, and the branch commits normally.

The leak comes from hardware leaving cache traces during speculation; the vulnerable behaviour is in the microarchitecture, so it is fundamentally a hardware design issue that software mitigations only work around.

A saturating counter has hysteresis — one wrong outcome moves it only one step (e.g. strongly-taken to weakly-taken), so it takes two consecutive misses to flip the actual prediction, which is exactly why loop exits cost only one miss.

Renaming exists to remove false data dependencies so instructions can run out-of-order; the undo mechanism is the ROB discarding uncommitted entries — related machinery, but a different job.

Backwards — commit is the last step (result already computed, moving it to architectural state); execution happened earlier and its result was waiting in the ROB.

Even a single mispredicted path can transiently touch secret memory and leave a cache imprint before the squash, which is precisely the attack surface Spectre exploits.

Because if the guess is wrong it must restore the exact pre-branch situation; a checkpoint taken after speculation would already be contaminated by wrong-path work.

A deep pipeline creates long branch-resolution delays (the bubble speculation fills), but it also means many in-flight wrong-path instructions to flush on a miss — the same depth is both the motivation and the penalty.

A confidence estimator can detect a near-50/50 branch, where speculating loses more on average than the short wait for resolution — so stalling is the cheaper bet.

Sorting groups like outcomes together, turning an unpredictable data-dependent branch into long runs of same-direction outcomes the predictor learns easily — cutting the misprediction rate.

It removes the branch entirely, so there is nothing to mispredict and no penalty — trading a possible flush for a guaranteed small computation.

A wrong-path store could otherwise write bytes that the correct program never intended, corrupting memory that software can see — so stores are held until commit.

With multiple issue slots and ILP to exploit, a wider superscalar core has far more independent work ready to fill the speculated window, so each correct guess pays off more.

An attacker can train it by feeding it patterns, forcing a chosen misprediction that steers the victim down a wrong path touching secret data — the predictor becomes a lever the attacker controls.

It falls back to a default (e.g. weakly-taken) initial state, so early branches may mispredict until the counter warms up — a "cold predictor" cost distinct from steady-state accuracy.

The predictor has learned "taken" from 99 taken outcomes, so it confidently predicts taken again exactly when the loop must exit (not taken) — one guaranteed miss at the boundary.

No — faults on speculative instructions are held pending in the ROB and only raised if that instruction reaches commit; a squashed faulting instruction is discarded silently.

After warm-up the predictor is right 100% of the time, so it contributes essentially zero misprediction penalty — the ideal case for speculation.

Every branch stalls until resolved, so throughput drops toward that of a non-speculative machine — correct results, but the pipeline sits idle through each branch delay.

About 50% — no predictor can beat coin-flip data, so extra history bits or perceptrons cannot help, and this is the case where stalling may win.

Everything after the outer branch — including the inner speculation and its ROB entries — is squashed together, since the entire path was on wrong ground.