branch-prediction-and-speculation skill by mohitmishra786

Branch Prediction and Speculation

Purpose

Explain how modern CPUs predict branches, execute speculatively, recover on mispredict, and why speculation created side channels (Spectre/Meltdown) — linking performance tuning with security-aware low-level coding.

When to Use

Hot loop branchy code underperforms expectations
Evaluating likely/unlikely or branchless refactors
Understanding kernel retpoline, IBRS, and similar mitigations
Secure coding around secret-dependent branches

Workflow

1. Branch predictor basics

Fetch sees conditional branch
├── Predict direction (taken / not-taken)
├── Speculatively execute predicted path
└── On resolve:
    ├── Correct → commit, ~0 penalty (deep pipelines still cost on mispredict)
    └── Wrong → squash, refill from correct PC (10–20+ cycles typical)

Patterns: backward branches often predicted taken (loops); forward not-taken.

2. Performance patterns

/* Predictable — tight loop backward branch */
for (int i

Techniques: branchless cmov/select, lookup tables, sorting data to reduce branches, splitting hot/cold paths.

3. Compiler hints (use sparingly)

Measure with perf — hints are not magic on modern predictors.

4. Speculative execution and side channels

CPUs may execute instructions before branch outcome is known. If speculated path touches secret-dependent memory, cache state can leak (Spectre variant 1).

Mitigations (high level):

Kernel: retpoline, IBRS/IBPB, STIBP (see kernel cpu_show_mitigations)
Compiler: speculative load hardening (-mspeculative-load-hardening on Clang)
Code: constant-time crypto — no secret-dependent branches or indices

Meltdown (Intel): user load from kernel mapping — fixed by KPTI (separate page tables).

5. Measurement

High branch-misses ratio → investigate hot branches.

6. Agent usage

Common Problems

Symptom	Cause	Fix
Loop slower than expected	Mispredicted exit	Peel iterations; branchless tail
`likely` no help	Predictor already good	Profile first
Secret leak in crypto	Branches on secret bytes	Constant-time algorithms
Mitigation regression	KPTI/retpoline overhead	Accept or isolate secrets
"Branchless" slower	CMOV still executes both	Benchmark on target CPU

skills/computer-architecture/cpu-pipelines-and-hazards — control hazards
skills/security/kernel-security — KPTI, CET, speculation mitigations
skills/low-level-programming/cpu-cache-opt — cache timing channels
skills/profilers/hardware-counters — branch-misses event
skills/runtimes/binary-hardening — userspace hardening overlap