Question bank — Speculative execution

Galat — ek galat guess sirf microarchitectural state ko pollute karta hai; squashing ROB entries ko commit se pehle discard kar deta hai, isliye official registers ne kabhi bhi woh galat value dekhi hi nahi.

Galat — ye dono alag ideas hain. Tum ek in-order pipeline mein bhi branch ke aage speculate kar sakte ho; out-of-order sirf speculation ko zyada profitable banata hai kyunki window fill karne ke liye zyada independent kaam available hota hai.

Misprediction ke sense mein sahi — lekin tum pehli branch par aur cold code par phir bhi pipeline-fill cost bharoge, kyunki bina history ke predictor ko phir bhi pehla guess banana (aur verify karna) padta hai.

Sahi — yahi Spectre ka poora basis hai: squash architectural effect ko undo kar deta hai lekin cache line warm rehti hai, ek measurable timing footprint leak karti hai.

Galat — ye roughly pipeline depth plus refetch latency hoti hai (correct instructions ko wapas fetch mein laana), isliye ye depth akele se kuch cycles zyada hoti hai.

Galat — average accuracy data-dependent branches (parsing, rand()%2) ko hide kar leti hai jo 50% ke aas paas hote hain, jahan bhari penalty sirf stalling ki cost se zyada ho sakti hai.

Computed values ki correctness ke liye sahi — speculation ko results ke liye invisible rehne ke liye design kiya gaya hai; isse disable karna sirf timing side effects aur speedup ko hata deta hai.

Galat — ROB program order ke hisaab se ordered hota hai bilkul isliye taaki woh oldest-first commit kar sake; execution finishing order (out-of-order) commit order se decoupled hota hai.

Error "register mein likha jaata hai" mein hai: speculative results ROB mein jaate hain, architectural registers mein nahi, isliye overwrite karne ke liye kuch hota hi nahi — galat entry official register ko kabhi touch kiye bina simply drop ho jaati hai.

Branch instruction correct hai aur wahi hai jo mispredict resolve karti hai; sirf uske baad ki wrong-path instructions squash hoti hain, aur branch normally commit karti hai.

Leak hardware ke speculation ke dauran cache traces chhodne se aata hai; vulnerable behaviour microarchitecture mein hai, isliye ye fundamentally ek hardware design issue hai jiske around software mitigations sirf kaam karte hain.

Ek saturating counter mein hysteresis hoti hai — ek galat outcome ise sirf ek step (jaise strongly-taken se weakly-taken) move karta hai, isliye actual prediction flip karne ke liye do consecutive misses chahiye, yahi reason hai ki loop exits par sirf ek miss lagti hai.

Renaming false data dependencies hatane ke liye exist karta hai taaki instructions out-of-order run kar sakein; undo mechanism ROB hai jo uncommitted entries discard karta hai — related machinery hai, lekin alag kaam hai.

Ulta hai — commit aakhri step hai (result pehle se compute ho chuka hai, use architectural state mein move karna); execution pehle hua tha aur uska result ROB mein wait kar raha tha.

Ek akela mispredicted path bhi transiently secret memory ko touch kar sakta hai aur squash se pehle cache imprint chhod sakta hai, jo bilkul wahi attack surface hai jo Spectre exploit karta hai.

Kyunki agar guess galat ho toh use exact pre-branch situation restore karni hogi; speculation ke baad liya gaya checkpoint pehle se wrong-path work se contaminated hoga.

Deep pipeline lambi branch-resolution delays create karta hai (woh bubble jo speculation fill karti hai), lekin iska matlab hai flush karne ke liye bahut saari in-flight wrong-path instructions bhi hain — wahi depth motivation bhi hai aur penalty bhi.

Ek confidence estimator near-50/50 branch detect kar sakta hai, jahan speculate karna resolution ke short wait se average mein zyada cost karta hai — isliye stalling sasta bet hai.

Sorting same outcomes ko group karta hai, ek unpredictable data-dependent branch ko same-direction outcomes ki lambi runs mein badal deta hai jo predictor aasaani se seekh leta hai — misprediction rate cut ho jaati hai.

Branch ko poora remove kar deta hai, isliye mispredict karne ke liye kuch hota nahi aur koi penalty nahi — possible flush ko guaranteed chhoti computation se trade kar lena.

Wrong-path store otherwise woh bytes likh deta jo correct program ne kabhi intended nahi kiye, software-visible memory corrupt kar deta — isliye stores commit tak hold kiye jaate hain.

Multiple issue slots aur exploit karne ke liye ILP ke saath, ek wider superscalar core ke paas speculated window fill karne ke liye bahut zyada independent kaam ready hota hai, isliye har correct guess zyada pay off karta hai.

Attacker ise patterns feed karke train kar sakta hai, ek chosen misprediction force karta hai jo victim ko secret data touch karne wale wrong path par steer karta hai — predictor ek lever ban jaata hai jo attacker control karta hai.

Woh ek default (jaise weakly-taken) initial state par fall back karta hai, isliye early branches tab tak mispredict ho sakti hain jab tak counter warm up nahi ho jaata — steady-state accuracy se alag "cold predictor" cost.

Predictor ne 99 taken outcomes se "taken" seekh liya hai, isliye woh confidently taken predict karta hai bilkul tab jab loop ko exit karna hota hai (not taken) — boundary par ek guaranteed miss.

Nahi — speculative instructions par faults ROB mein pending rakhe jaate hain aur sirf tab raise kiye jaate hain jab woh instruction commit reach kare; squashed faulting instruction silently discard ho jaati hai.

Warm-up ke baad predictor 100% sahi hota hai, isliye ye essentially zero misprediction penalty contribute karta hai — speculation ke liye ideal case.

Har branch resolve hone tak stall kar deta hai, isliye throughput non-speculative machine ki taraf drop ho jaata hai — correct results, lekin pipeline har branch delay mein idle baihi rehti hai.

Lagbhag 50% — koi bhi predictor coin-flip data ko beat nahi kar sakta, isliye extra history bits ya perceptrons help nahi kar sakte, aur yahi woh case hai jahan stalling win kar sakta hai.

Outer branch ke baad ki sab cheezein — inner speculation aur uski ROB entries sameti — saath mein squash ho jaati hain, kyunki poora path galat ground par tha.