Questions tagged [branch-prediction]

In computer architecture, a branch predictor is a digital circuit that tries to guess which way a branch (e.g. an if-then-else structure) will go before this is known for sure. The purpose of the branch predictor is to improve the flow in the instruction pipeline. Branch predictors play a critical role in achieving high effective performance in many modern pipelined microprocessor architectures such as x86.

Why is it faster to process a sorted array than an unsorted array? Stack Overflow's highest-voted question and answer is a good introduction to the subject.


In computer architecture, a branch predictor is a digital circuit that tries to guess which way a branch (e.g. an if-then-else structure) will go before this is known for sure. The purpose of the branch predictor is to improve the flow in the instruction pipeline.

Branch predictors play a critical role in achieving high effective performance in many modern pipelined microprocessor architectures such as x86.

Two-way branching is usually implemented with a conditional jump instruction. A conditional jump can either be "not taken" and continue execution with the first branch of code which follows immediately after the conditional jump - or it can be "taken" and jump to a different place in program memory where the second branch of code is stored.

It is not known for certain whether a conditional jump will be taken or not taken until the condition has been calculated and the conditional jump has passed the execution stage in the instruction pipeline.

Without branch prediction, the processor would have to wait until the conditional jump instruction has passed the execute stage before the next instruction can enter the fetch stage in the pipeline. The branch predictor attempts to avoid this waste of time by trying to guess whether the conditional jump is most likely to be taken or not taken. The branch that is guessed to be the most likely is then fetched and speculatively executed. If it is later detected that the guess was wrong then the speculatively executed or partially executed instructions are discarded and the pipeline starts over with the correct branch, incurring a delay.

The time that is wasted in case of a branch misprediction is equal to the number of stages in the pipeline from the fetch stage to the execute stage. Modern microprocessors tend to have quite long pipelines so that the misprediction delay is between 10 and 20 clock cycles. The longer the pipeline the greater the need for a good branch predictor.

Source: http://en.wikipedia.org/wiki/Branch_predictor


The Spectre security vulnerability revolves around branch prediction:


Other resources

Special-purpose predictors: Return Address Stack for call/ret. ret is effectively an indirect branch, setting program-counter = return address. This would be hard to predict on its own, but calls are normally made with a special instruction so modern CPUs can match call/ret pairs with an internal stack.

Computer architecture details about branch prediction / speculative execution, and its effects on pipelined CPUs

  • Why is it faster to process a sorted array than an unsorted array?
  • Branch prediction - Dan Luu's article on branch prediction, adapted from a talk. With diagrams. Good introduction to why it's needed, and some basic implementations used in early CPUs, building up to more complicated predictors. And at the end, a link to TAGE branch predictors used on modern Intel CPUs. (Too complicated for that article to explain, though!)
  • Slow jmp-instruction - even unconditional direct jumps (like x86's jmp) need to be predicted, to avoid stalls in the very first stage of the pipeline: fetching blocks of machine code from I-cache. After fetching one block, you need to know which block to fetch next, before (or at best in parallel with) decoding the block you just fetched. A large sequence of jmp next_instruction will overwhelm branch prediction and expose the cost of misprediction in this part of the pipeline. (Many high-end modern CPUs have a queue after fetch before decode, to hide bubbles, so some blocks of non-branchy code can allow the queue to refill.)
  • Branch target prediction in conjunction with branch prediction?
  • What branch misprediction does the Branch Target Buffer detect?

Cost of a branch miss


Modern TAGE predictors (in Intel CPUs for example) can "learn" amazingly long patterns, because they index based on past branch history. (So the same branch can get different predictions depending on the path leading up to it. A single branch can have its prediction data scattered over many bits in the branch predictor table). This goes a long way to solving the problem of indirect branches in an interpreter almost always mispredicting (X86 prefetching optimizations: "computed goto" threaded code and Branch prediction and the performance of interpreters — Don't trust folklore), or for example a binary search on the same data with the same input can be really efficient.

Static branch prediction on newer Intel processors - according to experimental evidence, it appears Nehalem and earlier do sometimes use static prediction at some point in the pipeline (backwards branches default to predicted-taken, forward to not-taken.) But Sandybridge and newer seem to be always dynamic based on some history, whether it's from this branch or one that aliases it. Why did Intel change the static branch prediction mechanism over these years?

Cases where TAGE does "amazingly" well


Assembly code layout: not so much for branch prediction, but because not-taken branches are easier on the front-end than taken branches. Better I-cache code density if the fast-path is just a straight line, and taken branches mean the part of a fetch block after the branch isn't useful.

Superscalar CPUs fetch code in blocks, e.g. aligned 16 byte blocks, containing multiple instructions. In non-branching code, including not-taken conditional branches, all of those bytes are useful instruction bytes.


Branchless code: using cmov or other tricks to avoid branches

This is the asm equivalent of replacing if (c) a=b; with a = c ? b : a;. If b doesn't have side-effects, and a isn't a potentially-shared memory location, compilers can do "if-conversion" to do the conditional with a data dependency on c instead of a control dependency.

(C compilers can't introduce a non-atomic read/write: that could step on another thread's modification of the variable. Writing your code as always rewriting a value tells compilers that it's safe, which sometimes enables auto-vectorization: AVX-512 and Branching)

Potential downside to cmov in scalar code: the data dependency can become part of a loop-carried dependency chain and become a bottleneck, while branch prediction + speculative execution hide the latency of control dependencies. The branchless data dependency isn't predicted or speculated, which makes it good for unpredictable cases, but potentially bad otherwise.

363 questions
7
votes
3 answers

branch prediction on a function pointer

I have a loop that is running over and over again. The logic inside that loop is dependent on the mode that the program is in. To improve performance I was thinking that an array of function pointers can be initialized, functionPtr[], so that…
Michael
  • 1,321
  • 1
  • 13
  • 27
7
votes
3 answers

Set bit X of an integer to bit Y of another integer without branching?

Can the copy_bit function below be simplified to something like out[out_bit] = in[in_bit]? (i.e. Not using an if statement) template< typename T > inline void copy_bit( T& out, const T in, const std::size_t out_bit, const std::size_t in_bit ) { …
x-x
  • 7,287
  • 9
  • 51
  • 78
7
votes
1 answer

How does the branch predictor know if it is not correct?

This is the second time I'm asking this question; the first time someone did reply but I took too long to reply back to them and therefore didn't get the full understanding. What I'm trying to do is learn more about the instruction fetch parts of…
elemein
  • 197
  • 6
7
votes
1 answer

How can I dynamically hint a branch target to an x64 CPU?

I'd like to know how to write efficient jump tables for x64 processors, either in C, C++ or assembly. The input is known in advance, but impossible to predict algorithmically. Assuming I can look as far ahead as I want in the input stream, is…
Nathan Kurz
  • 1,649
  • 1
  • 14
  • 28
7
votes
3 answers

Branch-free implementation of f(x) := if x == 0 then 0 else (x * log(x))

I have this C function: double f(int x) { if (x <= 0) return 0.0; else return x * log(x); } which I am calling in a tight loop, and would like to get rid of the branch to see if it improves performance. I cannot use…
finnw
  • 47,861
  • 24
  • 143
  • 221
6
votes
3 answers

Is the if-branch faster than the else branch?

I came across this very nice infographic which gives a rough estimation about the CPU-cylces used for certain operations. While studying I noticed an entry "Right branch of if" which I assumes is the branch "if" is going to take if the condition is…
glades
  • 3,778
  • 1
  • 12
  • 34
6
votes
1 answer

Why is rv32gc optimising branchless code with branches for RISC-V?

Let's attempt to define a function that returns the maximum of two values x and y. A sufficient condition for these formulas to be valid is that, for signed integers, –2^30 <= x, y <= 2^30 – 1, and for unsigned integers, 0 <= x, y <= 2^31 – 1 (i.e.,…
6
votes
2 answers

What happens with nested branches and speculative execution?

Alright, so I know that if a particular conditional branch has a condition that takes time to compute (memory access, for instance), the CPU assumes a condition result and speculatively executes along that path. However, what would happen if, along…
6
votes
3 answers

What does it mean by a branch penalty?

Branch penalty in pipeline results from non-zero distance between ALU and IF. What does it mean by this statement?
user366312
  • 16,949
  • 65
  • 235
  • 452
6
votes
3 answers

The inner workings of Spectre (v2)

I have done some reading about Spectre v2 and obviously you get the non technical explanations. Peter Cordes has a more in-depth explanation but it doesn't fully address a few details. Note: I have never performed a Spectre v2 attack so I do not…
Lewis Kelsey
  • 4,129
  • 1
  • 32
  • 42
6
votes
1 answer

Does the x86-64 pipeline stall on an indirect jump like JMP RAX?

In x86-64, if you use the following assembly code: MOV RAX, (memory address) JMP RAX Does the pipeline stall before executing the branch (to wait for MOV to finish with RAX), or will it flush the pipeline like a conditional branch?
6
votes
1 answer

How to measure mispredictions for a single branch on Linux?

I know that I can get the total percentage of branch mispredictions during the execution of a program with perf stat. But how can I get the statistics for a specific branch (if or switch statement in C code)?
nwellnhof
  • 32,319
  • 7
  • 89
  • 113
6
votes
2 answers

Can you use builtin_expect with switch statement

I have a switch statement in some time-critical code. I was trying to optimize it with __builtin_expect, but it does not seem to be working. I'm wondering if anyone can tell me if I'm missing some detail, or if the compiler simply does not…
John
  • 3,400
  • 3
  • 31
  • 47
6
votes
1 answer

How to demonstrate the impact of instruction cache limitations

My orginial idea was to give an elegant code example, that would demonstrate the impact of instruction cache limitations. I wrote the following piece of code, that creates a large amount of identical functions, using template…
5
votes
0 answers

If a function was entered via a near call, can it do a far tail call without breaking return address prediction?

Consider this code: .globl _non_tail, _tail .text .code32 _non_tail: lcall $0x33, $_non_tail.heavensgate ret .code64 _non_tail.heavensgate: # do stuff. there's 12 bytes on the stack before the first argument lret .code32 _tail: …