360 Secure SkillHub
360 安全技能中心

branch-prediction-and-speculation

该 Skill 以概念讲解和示例代码说明 CPU 分支预测、推测执行、误预测代价、编译器提示、无分支写法及 Spectre/Meltdown 缓解思路，并给出 perf 测量与安全编码建议，面向性能调优与底层安全学习。

mohitmishra786
热度 0.00
最近更新 2026-10-19 04:15:01
分类：知识依赖：纯提示词应用场景：概念解释 / 教学辅导

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add mohitmishra786/low-level-dev-skills/branch-prediction-and-speculation
Metadata
name
branch-prediction-and-speculation
description
Branch prediction and speculation skill for CPU security and performance. Use when explaining branch predictors, mispredict penalties, speculative execution, Spectre/Meltdown mitigations, or branchless patterns. Activates on queries about branch prediction, speculative execution, Spectre, Meltdown, mispredict, or branchless code.

Branch Prediction and Speculation

Purpose

Explain how modern CPUs predict branches, execute speculatively, recover on mispredict, and why speculation created side channels (Spectre/Meltdown) — linking performance tuning with security-aware low-level coding.

When to Use

  • Hot loop branchy code underperforms expectations
  • Evaluating likely/unlikely or branchless refactors
  • Understanding kernel retpoline, IBRS, and similar mitigations
  • Secure coding around secret-dependent branches

Workflow

1. Branch predictor basics

Fetch sees conditional branch
├── Predict direction (taken / not-taken)
├── Speculatively execute predicted path
└── On resolve:
    ├── Correct → commit, ~0 penalty (deep pipelines still cost on mispredict)
    └── Wrong → squash, refill from correct PC (10–20+ cycles typical)

Patterns: backward branches often predicted taken (loops); forward not-taken.

2. Performance patterns

/* Predictable — tight loop backward branch */
for (int i = 0; i < n; i++)
    sum += a[i];

/* Unpredictable — data-dependent */
if (data[i] > threshold)  /* hard to predict */
    rare_path();

Techniques: branchless cmov/select, lookup tables, sorting data to reduce branches, splitting hot/cold paths.

/* Branchless min (integer) */
int m = a < b ? a : b;  /* compiler may lower to cmov */

3. Compiler hints (use sparingly)

#define likely(x)   __builtin_expect(!!(x), 1)
#define unlikely(x) __builtin_expect(!!(x), 0)

if (unlikely(ptr == NULL))
    return -EINVAL;

Measure with perf — hints are not magic on modern predictors.

4. Speculative execution and side channels

CPUs may execute instructions before branch outcome is known. If speculated path touches secret-dependent memory, cache state can leak (Spectre variant 1).

Mitigations (high level):

  • Kernel: retpoline, IBRS/IBPB, STIBP (see kernel cpu_show_mitigations)
  • Compiler: speculative load hardening (-mspeculative-load-hardening on Clang)
  • Code: constant-time crypto — no secret-dependent branches or indices

Meltdown (Intel): user load from kernel mapping — fixed by KPTI (separate page tables).

5. Measurement

perf stat -e branches,branch-misses ./app

High branch-misses ratio → investigate hot branches.

6. Agent usage

/branch-prediction-and-speculation Make this comparison function constant-time against Spectre-style leakage

Common Problems

Symptom Cause Fix
Loop slower than expected Mispredicted exit Peel iterations; branchless tail
likely no help Predictor already good Profile first
Secret leak in crypto Branches on secret bytes Constant-time algorithms
Mitigation regression KPTI/retpoline overhead Accept or isolate secrets
"Branchless" slower CMOV still executes both Benchmark on target CPU

Related Skills

  • skills/computer-architecture/cpu-pipelines-and-hazards — control hazards
  • skills/security/kernel-security — KPTI, CET, speculation mitigations
  • skills/low-level-programming/cpu-cache-opt — cache timing channels
  • skills/profilers/hardware-counters — branch-misses event
  • skills/runtimes/binary-hardening — userspace hardening overlap