CPU Design · All levels

Indirect Branch Prediction

Branch Prediction & Speculation: Indirect targets depend on history, call context, and pointer flow; predictor indexing and tagging must reduce aliasing while respecting security mitigations for speculative attacks.

What this topic teaches

Indirect Branch Prediction turns CPU design theory into actionable review decisions. Indirect targets depend on history, call context, and pointer flow; predictor indexing and tagging must reduce aliasing while respecting security mitigations for speculative attacks. The target is evidence-backed closure, not opinion-driven tuning.

Senior-engineer framing question

When indirect target accuracy, aliasing rate, and security hardening overhead shifts, can you prove first failing stage, dominant mechanism, accountable owner, and release-safe mitigation?

diagram

CPU PIPELINE VIEW - Indirect Branch Prediction

fetch -> decode -> rename -> dispatch -> execute -> retire
  |        |         |          |         |         |
icache   uop flow   map table  queueing  FU ports  ROB commit

steady-state goal:
keep every stage supplied without bubbles or flush storms

Focus: connect metric movement to the first stage loss
Metric tracked: indirect target accuracy, aliasing rate, and security hardening overhead

Architecture visuals

Draw the mechanism before changing knobs. These visuals are optimized for design reviews and interview whiteboards.

Indirect target aliasing view

diagram

BRANCH PREDICTOR VIEW - Indirect Branch Prediction

fetch PC -> BTB lookup -> direction predictor -> target select -> fetch redirect
               |               |                    |
          BTB miss cost     confidence         RAS / indirect path

branch resolves in execute:
correct prediction  -> pipeline keeps flowing
mispredict          -> flush + restart + refill

Focus: highlight path-history ambiguity and mitigation overhead

Indirect miss root-cause tree

diagram

ROOT-CAUSE TREE - Indirect Branch Prediction

indirect target accuracy, aliasing rate, and security hardening overhead regressed
        |
  reproducible on fixed seed?
      /               \
    no                 yes
    |                   |
env/tool drift      first failing stage?
                    /        |        \
                front-end   execute   memory/system
                   |          |            |
              fetch/decode   port/ROB   cache/TLB/NoC

Stop at first confirmed mechanism, then patch with owner accountability.

Out-of-order control map

diagram

OOO CORE BLOCK DIAGRAM - Indirect Branch Prediction

decode -> rename -> dispatch -> reservation stations -> execute units
             |                        |                    |
       free-list / map table       wakeup-select         writeback
             \                        |                    /
              +-------- reorder buffer / retire ---------+

Focus: rename to retire dataflow

Memory hierarchy map

diagram

CPU CACHE + MEMORY HIERARCHY - Indirect Branch Prediction

                 [ L1I ]   [ L1D ]
               32-64KB, ~4 cycles
                      \     /
                       [  L2  ]
                 512KB-2MB, ~12 cycles
                           |
                         [ L3 ]
               shared LLC, 30-60 cycles
                           |
                    [ DDR/HBM memory ]
                    80-150ns effective

Optimization lens: latency vs capacity tradeoff

Speculation lens

diagram

BRANCH PREDICTOR VIEW - Indirect Branch Prediction

fetch PC -> BTB lookup -> direction predictor -> target select -> fetch redirect
               |               |                    |
          BTB miss cost     confidence         RAS / indirect path

branch resolves in execute:
correct prediction  -> pipeline keeps flowing
mispredict          -> flush + restart + refill

Focus: minimize wrong-path work

Ownership layers

diagram

CPU OWNERSHIP LAYERS - Indirect Branch Prediction

artifact area     owner
----------------  ----------------------------
architecture    CPU security architect
RTL/microarch   predictor RTL owner
software/tools  compiler/runtime owner

Rule: every regressed metric must map to an explicit owner and closure artifact.

Evidence required

Primary metric: indirect target accuracy, aliasing rate, and security hardening overhead.
Primary artifact: indirect branch trace corpus, target-alias map, and mitigation cost report.
Owners to include: CPU security architect, predictor RTL owner, compiler/runtime owner.
One reproducible failing workload and one stable comparator run.
One run with fully locked environment metadata for causal comparison.

Compute-memory limit lens

diagram

CPU ROOFLINE - Indirect Branch Prediction

performance
   ^
   |                 compute roof
   |                /
   |               /
   |--------------/---------------- memory roof
   +----------------------------------------------> arithmetic intensity
      memory-bound                 compute-bound

Interpretation: separate compute and memory limits

Key takeaways

Classify stage loss before proposing fixes.
Use artifacts to separate mechanism from symptoms.
Close with owner accountability and rollback criteria.

Common pitfalls

Using average IPC alone while ignoring tail behavior.
Comparing traces across mismatched binaries or thermal states.
Calling closure without workload-level validation.

CPU deep dive

Speculation helps only when wrong-path cost and recovery bandwidth are tightly controlled.

Concept diagram

diagram

SPECULATION LOOP

predict direction/target -> speculative fetch/decode -> resolve -> flush/recover

Metric graph

diagram

SPECULATION COST MIX

wrong-path decode work  █████
flush recovery delay    ████
refill starvation       ███

Reports and artifacts

branch accuracy by workload
BTB/RAS pressure report
mispredict recovery timeline
bad-speculation CPI share

Mini case study

Indirect branch aliasing in one service raised wrong-path work enough to dominate total CPI despite high ALU utilization.

Debug branches

Break down mispredicts by branch family and code region
Measure flush depth and refill bandwidth separately
Validate predictor changes under security mitigation settings

Senior review question

Ask: which CPI/latency evidence proves this topic is truly closed beyond synthetic benchmarks?

Key takeaways

Always connect microarchitectural counter changes to product workload outcomes.
Lock binary, compiler, firmware, and thermal metadata before comparing CPU traces.

Common pitfalls

Treating average IPC as sufficient proof while ignoring latency tails and outliers.
Applying predictor or prefetch tweaks without first-failing-stage attribution.
Declaring closure without reproducible perf, correctness, and power gates.

Practice this lesson