branch-prediction-and-speculation

name	branch-prediction-and-speculation
description	Branch prediction and speculation skill for CPU security and performance. Use when explaining branch predictors, mispredict penalties, speculative execution, Spectre/Meltdown mitigations, or branchless patterns. Activates on queries about branch prediction, speculative execution, Spectre, Meltdown, mispredict, or branchless code.

Branch Prediction and Speculation

Purpose

Explain how modern CPUs predict branches, execute speculatively, recover on mispredict, and why speculation created side channels (Spectre/Meltdown) — linking performance tuning with security-aware low-level coding.

When to Use

• Hot loop branchy code underperforms expectations
• Evaluating likely/unlikely or branchless refactors
• Understanding kernel retpoline, IBRS, and similar mitigations
• Secure coding around secret-dependent branches

Workflow

1. Branch predictor basics

Fetch sees conditional branch
├── Predict direction (taken / not-taken)
├── Speculatively execute predicted path
└── On resolve:
    ├── Correct → commit, ~0 penalty (deep pipelines still cost on mispredict)
    └── Wrong → squash, refill from correct PC (10–20+ cycles typical)

Patterns: backward branches often predicted taken (loops); forward not-taken.

2. Performance patterns

/* Predictable — tight loop backward branch */
for (int i = 0; i < n; i++)
    sum += a[i];

/* Unpredictable — data-dependent */
if (data[i] > threshold)  /* hard to predict */
    rare_path();

Techniques: branchless cmov/select, lookup tables, sorting data to reduce branches, splitting hot/cold paths.

/* Branchless min (integer) */
int m = a < b ? a : b;  /* compiler may lower to cmov */

3. Compiler hints (use sparingly)

#define likely(x)   __builtin_expect(!!(x), 1)
#define unlikely(x) __builtin_expect(!!(x), 0)

if (unlikely(ptr == NULL))
    return -EINVAL;

Measure with perf — hints are not magic on modern predictors.

4. Speculative execution and side channels

CPUs may execute instructions before branch outcome is known. If speculated path touches secret-dependent memory, cache state can leak (Spectre variant 1).

Mitigations (high level):

• Kernel: retpoline, IBRS/IBPB, STIBP (see kernel cpu_show_mitigations)
• Compiler: speculative load hardening (-mspeculative-load-hardening on Clang)
• Code: constant-time crypto — no secret-dependent branches or indices

Meltdown (Intel): user load from kernel mapping — fixed by KPTI (separate page tables).

5. Measurement

perf stat -e branches,branch-misses ./app

High branch-misses ratio → investigate hot branches.

6. Agent usage

/branch-prediction-and-speculation Make this comparison function constant-time against Spectre-style leakage

Common Problems

Symptom	Cause	Fix
Loop slower than expected	Mispredicted exit	Peel iterations; branchless tail
likely no help	Predictor already good	Profile first
Secret leak in crypto	Branches on secret bytes	Constant-time algorithms
Mitigation regression	KPTI/retpoline overhead	Accept or isolate secrets
"Branchless" slower	CMOV still executes both	Benchmark on target CPU

Related Skills

• skills/computer-architecture/cpu-pipelines-and-hazards — control hazards
• skills/security/kernel-security — KPTI, CET, speculation mitigations
• skills/low-level-programming/cpu-cache-opt — cache timing channels
• skills/profilers/hardware-counters — branch-misses event
• skills/runtimes/binary-hardening — userspace hardening overlap