Parent note ki ek bhi line samajhne se pehle, tumhe ek chhota sa toolbox chahiye. Yeh page us toolbox ka har piece bilkul zero se banata hai. Isse upar se neeche padho — har idea ek eent hai jis par agli wali tikti hai.
Poori story ek uncomfortable fact se shuru hoti hai: CPU fast hai, memory slow hai.
Figure dekho. CPU lagbhag 200 chhote steps kar sakta hai (hum har ek ko cycle kehte hain) us waqt mein jitna memory ko ek request ka answer dene mein lagta hai. Yahi hai "the memory wall." Agar CPU har baar data ki zaroorat par ruk jaata, toh woh apni zindagi ka zyaadatar hissa wait karne mein barbaad kar deta.
Yeh topic kyun yeh jaanta hai: Spectre aur Meltdown ke har trick ka wajood isliye hai kyunki CPU baithkar wait karne se mana kar deta hai. Memory ki slowness hatao aur attacks gaayab ho jaate hain.
Seedhe tarike se CPU instruction 1 karta hai, phir 2, phir 3. Lekin agar instruction 2 memory ke liye 200 cycles wait kar rahi hai, toh CPU bored ho jaata hai. Toh woh aage jhaankta hai: "Instruction 5 ko us data ki zaroorat nahi — chaliye ise abhi karte hain wait karte waqt."
Yahi hai Out-of-Order Execution: stall hone ki jagah independent kaam pehle khatam karo.
Us aakhri sentence mein poori vulnerability chhipi hai. CPU apni life do stages mein baant leta hai:
Execute stage — actual kaam yahan hota hai, shayad pehle, shayad out of order.
Retire stage — results yahan "official" hote hain, strictly program order mein.
Yeh topic kyun yeh jaanta hai: kernel memory ke liye permission check retire par hota hai, lekin data pehle hi execute par fetch ho chuka hota hai. Woh gap — figure mein pink strip — exactly wahin Meltdown rehta hai.
Yeh poore page ka sabse important distinction hai. Ise do baar padho.
CPU ek promise karta hai: "Agar mera guess galat nikla, toh main architectural state rollback kar dunga taaki kisi ko pata na chale." Registers restore ho jaate hain, galat memory writes cancel ho jaati hain. Public record saaf hai.
Bug yeh hai: woh sirf public record saaf karta hai. Private notebook apni scribbles rakhti hai.
Yeh topic kyun yeh jaanta hai: Spectre aur Meltdown secrets ko galat guess ke dauran microarchitectural notebook (cache) mein likh kar leak karte hain. Rollback register mitaata hai lekin cache line nahi — aur woh surviving footprint hi leak hai.
Woh aakhri clause — "agli baar ke liye store karo" — ek side effect hai. Ek value padhna cache ko badal deta hai. Aur woh change measurable hai, kyunki usi value ki baad ki read ab fast hai.
Yeh topic kyun yeh jaanta hai: cache leak channel hai. Fast = "yeh value touch hua tha", slow = "nahi hua tha". Woh do-way answer hi poora side channel hai.
Agar Δt chhota hai toh data cached tha (hit); agar bada hai toh RAM se aaya (miss). Hit vs. miss decide karne ke liye Δt ko ek threshold — ek middle value, maan lo 100 cycles — se compare karo.
Yeh topic kyun yeh jaanta hai: cache footprint rakhta hai, lekin tumhe phir bhi use padhne ke liye ek ruler chahiye. rdtsc woh ruler hai.
Asli problem yeh hai: yeh decide karna ki branch kis taraf jaayega khud slow data ki zaroorat ho sakti hai (kya size memory mein tha?). CPU afford nahi kar sakta wait karne ka. Toh woh Branch Prediction use karke guess karta hai — ek chhoti si machine jo yaad rakhti hai "pichli baar yeh branch is taraf gayi, toh shayad phir."
Yeh topic kyun yeh jaanta hai: Spectre predictor se jhooth bolta hai. Use "taken" expect karne ki training do, phir aisa case do jo "not taken" hona chahiye — CPU speculatively forbidden path chalata hai galti pakadne se pehle. Meltdown bhi aisi if (0) par rely karta hai jisme predictor ko trick karke enter karaya jaata hai.
Speculation = out-of-order execution (§2) guided by branch prediction (§6), cache (§4) mein footprints chodta hai jo ek timer (§5) padhh sakta hai architectural rollback (§3) ke baad jo sab kuch chhipaane ki koshish karta hai.
Yeh topic kyun yeh jaanta hai: Meltdown execute–retire gap ke dauran ek kernel byte padhta hai, use cache mein stash karta hai, aur tab page fault leta hai. Rollback register undo karta hai lekin cache footprint bachta hai.
Ise upar se neeche padho: speed gap out-of-order aur caching force karta hai; woh plus branch prediction speculation dete hain; speculation plus cache-timing channel plus retire-time fault, sab architectural/microarchitectural split par sawaar hokar, attacks produce karte hain.
Execute actual kaam pehle aur possibly out of order karta hai; retire results ko strict program order mein official banata hai aur wahin permission checks aur faults land hote hain.
Architectural vs. microarchitectural distinction ek line mein batao.
Architectural = registers + memory jo program dekh sakta hai (misspeculation par rollback hota hai); microarchitectural = cache, predictors, TLB (hidden, rollback nahi hota).
Memory se ek value padhna cache ko kyun badalta hai, aur yeh kyun matter karta hai?
Ek miss agli baar ke liye copy store karta hai, toh baad ki access fast hoti hai — woh fast/slow difference leak karta hai ki kaun sa value touch hua tha.
clflush kya karta hai aur attacker ise kyun use karta hai?
Ek cache line evict karta hai taaki next access guaranteed slow ho, attack se pehle cache ko ek jaane-maane "cold" baseline par reset karne ke liye.
rdtsc cache se secret kaise recover karta hai?
Woh har candidate access ko time karta hai; jo wala fast aaye (threshold se neeche) woh reveal karta hai ki kaun sa byte value speculatively touch hua tha.
Branch training aur misprediction kya hai?
Training ek path repeat karke predictor mein aadat daalti hai; misprediction tab hota hai jab CPU us aadat ko follow karta hai lekin reality alag nikli, toh usne speculatively galat path chalaya.
Condition ka data flush karne se speculation window kyun wider hoti hai?
Cache-missed condition compute karne mein zyaada time lagta hai, isliye CPU zyaada cycles speculate karta hai galat guess pakadne se pehle.
Page fault kya hai aur yeh kis stage par deliver hota hai?
Ek forbidden memory access abort karne wala exception, retire par deliver hota hai — execute ke baad jo shayad pehle hi forbidden byte cache kar chuka hota hai.
SMT/hyperthreading in attacks ke liye kyun matter karta hai?
Do threads ek core ka cache aur predictors share karte hain, isliye ek thread doosra thread ke microarchitectural footprints ek trust boundary ke paare observe kar sakta hai.
