Advanced Microarchitecture
Level 2 — Recall & Standard Problems Time limit: 30 minutes Total marks: 50
Answer all questions. Show working where relevant.
Q1. Define superscalar execution and state how it differs from a scalar pipelined processor in terms of instructions completed per cycle (IPC). (4 marks)
Q2. In an out-of-order processor, distinguish between the three data hazards: RAW, WAR, and WAW. State which of these are true (real) dependences and which are false (name) dependences that register renaming can eliminate. (6 marks)
Q3. A 2-bit saturating counter predictor has four states: Strongly Not Taken (00), Weakly Not Taken (01), Weakly Taken (10), Strongly Taken (11). Starting in state 00, trace the state after each outcome for the sequence:
Give the predicted direction before each branch and mark whether the prediction was correct. Report the total number of mispredictions. (6 marks)
Q4. State the two main functions of a Branch Target Buffer (BTB) and explain why it is needed in the fetch stage rather than the execute stage. (4 marks)
Q5. List the three key components of Tomasulo's algorithm and give the one-line role of each. (6 marks)
Q6. Explain the purpose of the Reorder Buffer (ROB). Why must instructions commit (retire) in program order even though they execute out of order? (5 marks)
Q7. A loop contains a call/return pair repeatedly. Explain how a Return Address Stack (RAS) predicts return targets, and give one situation where a RAS mispredicts. (5 marks)
Q8. Compare VLIW and superscalar architectures with respect to who schedules instructions (hardware vs compiler) and one advantage of each approach. (5 marks)
Q9. A tournament branch predictor uses a local predictor, a global predictor, and a meta-predictor (chooser). State in one sentence the role of the meta-predictor. Then, in one sentence, describe what a TAGE predictor adds beyond a simple tournament scheme. (4 marks)
Q10. Briefly explain the mechanism of the Spectre vulnerability: name the microarchitectural feature it abuses and the side channel used to leak the speculatively accessed data. (5 marks)
End of paper.
Answer keyMark scheme & solutions
Q1. (4 marks)
- Superscalar execution = a processor that can fetch, decode, issue and complete more than one instruction per clock cycle by having multiple parallel execution units / pipelines. (2)
- A scalar pipelined CPU has an ideal IPC of at most 1; a superscalar of width w has an ideal IPC of up to (>1). (2)
Q2. (6 marks)
- RAW (Read After Write): an instruction reads a register that an earlier instruction writes — must wait for the value. (1)
- WAR (Write After Read): later instruction writes a register that an earlier instruction still needs to read. (1)
- WAW (Write After Write): two instructions write the same register; the final value must be the later one. (1)
- RAW is a true (real) data dependence — cannot be removed. (1.5)
- WAR and WAW are false (name) dependences, caused by reuse of register names; register renaming eliminates them. (1.5)
Q3. (6 marks)
Start state 00 (predict N).
| Step | State before | Predict | Actual | Correct? | New state |
|---|---|---|---|---|---|
| 1 | 00 | N | T | ✗ | 01 |
| 2 | 01 | N | T | ✗ | 10 |
| 3 | 10 | T | N | ✗ | 01 |
| 4 | 01 | N | T | ✗ | 10 |
| 5 | 10 | T | T | ✓ | 11 |
| 6 | 11 | T | T | ✓ | 11 |
- Correct trace of states. (3)
- Correct predict/actual marking. (2)
- Total mispredictions = 4. (1)
Q4. (4 marks)
- Function 1: stores the (predicted) target address of a taken branch, indexed by branch instruction address. (1.5)
- Function 2: identifies that a fetched instruction is a branch (and often supplies the direction), enabling redirect of fetch. (1.5)
- Needed in fetch because the target must be known before decode/execute to keep fetching the correct path without stalling; waiting until execute would cause bubbles. (1)
Q5. (6 marks) (2 marks each)
- Reservation stations: buffer instructions waiting for operands and functional units; enable out-of-order issue.
- Common Data Bus (CDB): broadcasts computed results to all reservation stations/registers that are waiting for them.
- Register status / tags (renaming via RS tags): track which reservation station will produce each register's value, resolving WAR/WAW hazards. (Accept "load/store buffers" as a valid component for partial credit.)
Q6. (5 marks)
- ROB is a FIFO buffer holding instruction results in program order until they are safely committed to architectural state. (2)
- In-order commit is required to:
- support precise exceptions/interrupts (architectural state reflects a clean program point), (1.5)
- allow speculative results to be squashed on mispredict without corrupting registers/memory. (1.5)
Q7. (5 marks)
- On a
call, the return address is pushed onto the RAS (a hardware LIFO stack). (1.5) - On a
return, the predictor pops the top of the RAS to get the predicted return target. (1.5) - This exploits the LIFO nature of call/return nesting → very accurate. (1)
- Misprediction case: RAS overflow/underflow with deep recursion (stack exceeds its fixed depth), or mismatched/non-standard call-return (e.g., setjmp/longjmp, tail calls). (1)
Q8. (5 marks)
- Superscalar: the hardware dynamically schedules instructions at runtime. (1.5)
- VLIW: the compiler statically schedules independent operations into a wide instruction word; hardware issues them without dependency-checking. (1.5)
- Advantage of superscalar: adapts to runtime info / binary compatibility across implementations. (1)
- Advantage of VLIW: simpler, lower-power hardware (no complex dynamic scheduling logic). (1)
Q9. (4 marks)
- Meta-predictor: learns/selects which of the local or global predictor is more accurate for a given branch and uses that one's prediction. (2)
- TAGE: adds multiple tagged tables indexed by different (geometrically increasing) history lengths, choosing the longest-matching history component — capturing long correlations far better. (2)
Q10. (5 marks)
- Spectre abuses speculative (branch-predicted) execution: the CPU speculatively executes instructions past a mispredicted branch/bounds check. (2)
- During speculation it may access out-of-bounds/secret data and use it to index a memory array, leaving a footprint in the cache. (1.5)
- Even though speculative results are architecturally squashed, the cache-timing side channel (e.g., Flush+Reload) reveals which line was touched → leaking the secret. (1.5)
[
{"claim":"Q3: 2-bit counter starting at 0 over T,T,N,T,T,T gives 4 mispredictions",
"code":"seq=[1,1,0,1,1,1]\nstate=0\nmis=0\nfor a in seq:\n pred=1 if state>=2 else 0\n if pred!=a: mis+=1\n if a==1: state=min(3,state+1)\n else: state=max(0,state-1)\nresult=(mis==4)"},
{"claim":"Q3: final state after sequence is 3 (Strongly Taken)",
"code":"seq=[1,1,0,1,1,1]\nstate=0\nfor a in seq:\n if a==1: state=min(3,state+1)\n else: state=max(0,state-1)\nresult=(state==3)"},
{"claim":"Q1: superscalar width-w ideal IPC exceeds scalar ideal IPC of 1 for w=4",
"code":"w=4\nscalar_ipc=1\nresult=(w>scalar_ipc)"}
]