[gary_0]

> This is called branch prediction, it has been the source of many fun security issues...

No, that's speculative execution you just described. Branch prediction was implemented long before out-of-order CPUs were a thing, as you need branch prediction to make the most of pipelining (eg. fetching and decoding a new instruction while you're still executing the previous one--if you predict branches, you're more likely to keep the pipeline full).

[Arnavion]

Speculative execution does not require out-of-order execution. When you predict a branch, you're speculatively executing the predicted branch. Whether you're doing it in the same order as instruction order or out of order is independent of that.

[gary_0]

The article is talking about OoO which is why I mentioned it. My point is that branch prediction and speculative execution are different things. You can do speculative execution without a branch predictor (run both branches and throw out the one that's wrong).

[Arnavion]

You're right, I missed the article specifically mentions Meltdown in that sentence, not Spectre.

[Wowfunhappy]

If you're executing instructions in order, wouldn't you already know the result of the branch by the time you reach its code?

[Sesse__]

You're starting them in order and you're ending (retiring) them in order, but you're not necessarily ending one instruction before you're starting the next one. For instance, in a very simple pipeline, you can start decoding the next instruction before you've completed the previous one, so you can do some work in parallel.

[Arnavion]

The fetch stage of the pipeline will have needed to predict the branch N cycles before the execute stage of the pipeline actually gets around to evaluating it, in order to continue fetching the post-branch instructions. Without branch prediction the fetch stage would need to stall until that happens, which decreases throughput. The point of branch prediction and the subsequent speculative execution is to optimistically avoid that stall.

[gary_0]

A good explanation of branch prediction: https://danluu.com/branch-prediction/

[monocasa]

Essentially all microarchtectural state is fodder for side channel exploits.

Static branch prediction like "predict taken if negative branch offset" doesn't leak anything, but just about any dynamically updated tables will (almost tautologically) contain statistical information about what was executed recently.