Interview Prep Zoneby CuriouserLabs

Question 4 of 5 · staff level

Branch prediction and speculative execution — how they work, why they're worth it, and what Spectre changed.

🎤 Say this first

Rather than stall at every branch, the CPU predicts the outcome (modern TAGE-class predictors learn patterns and correlations, >95–99% accurate) and speculatively executes down the guessed path; a wrong guess squashes the un-committed work (~15–20 cycle penalty). This is a massive net win — but 2018's Spectre showed the discarded speculative work leaves microarchitectural footprints (cache lines loaded), which attackers can read via timing — leaking data that 'never happened' architecturally. Consequences: kernel/hypervisor mitigations with real performance costs, and a permanent lesson — the ISA hid state that security models assumed didn't exist.

The full picture

  • Predictor anatomy in one breath: BTB (where does this branch go), direction predictor (taken?), pattern/history tables (it alternates! it correlates with that other branch!), return-address stack for call/return — hardware learning your code's habits at run time.
  • The software-visible corollary — predictable beats clever: the famous 'why is processing a sorted array faster' (random branch = 50% mispredict; sorted = near-perfect prediction). Branchless tricks (cmov, arithmetic masks) and JIT profile-guided layout exist for exactly the unpredictable cases.
  • Spectre's mechanism, precisely: v1 — train the predictor past a bounds check, speculatively read out-of-bounds, encode the secret into which cache line got loaded, measure timings after the squash. Nothing architectural ever 'executed wrong'; the side channel leaked. Meltdown was the eviler cousin (speculating past privilege checks) fixed by KPTI.
  • What a platform engineer inherited: KPTI/retpoline/IBRS costs (syscall-heavy workloads lost measurable %), cloud vendors' scramble, per-kernel mitigation toggles (mitigations=off in trusted single-tenant niches), and browser-level timer coarsening — security now shows up in your latency budget.

🔄 Likely follow-up questions

  • Explain the sorted-array branch-prediction effect and when you'd act on it.
  • What made Meltdown different from Spectre, and why was it easier to fix?
  • Where else do timing side channels appear in ordinary backend systems?