Skip to content
STIMSMITH

Branch prediction

Concept

Branch prediction is a CPU microarchitectural mechanism that predicts conditional branch direction to support instruction-level parallelism. Accurate predictors reduce wrong-path execution and can improve performance and energy use, but branch prediction is also security-sensitive because branch prediction unit collisions can be exploited in transient-execution attacks and side channels. The provided evidence also shows branch predictions being exposed as microarchitectural feedback in SNAP and implemented in an evaluated RISC-V BOOM configuration using a gshare branch predictor.

First seen 5/25/2026
Last seen 7/5/2026
Evidence 23 chunks
Wiki v10

WIKI

Overview

Branch prediction predicts the likely direction of a conditional branch instruction to support instruction-level parallelism (ILP). The workload-characterization source frames branch prediction as a pattern-recognition problem: a predictor learns mappings from execution context to branch outcome. [C1]

Performance role

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

13 connections
BlackParrot part of → 96% 2e
BlackParrot has a Branch History Table and Branch Target Buffer for branch prediction
SNAP ← uses 100% 2e
SNAP uses branch prediction results from the LBQ to approximate data flow information.
Last Branch Queue ← uses 100% 2e
The LBQ stores the prediction result for each branch to enable data flow approximation.
Pipeline Modeling ← uses 85% 2e
The pipeline model includes branch prediction as a supported processor feature.
CPU Pipeline part of → 100% 2e
Branch prediction is a component of the CPU pipeline that predicts branch targets to avoid stalls.
TestRIG ← mentions 90% 1e
TestRIG discovered a branch prediction issue in the Toooba processor.
PIPE Pipeline Processor ← uses 100% 1e
PIPE uses branch prediction to speculatively fetch instructions.
RISC-V BOOM ← implements 100% 1e
RISC-V BOOM implements a gshare branch predictor as part of its front-end.
The paper mentions branch prediction as a control logic mechanism verified by the approach.
The paper mentions branch prediction as a micro-architectural feature affecting verification.
RISC-V part of → 85% 1e
RISC-V processors may include branch prediction
BRVer ← evaluates 95% 1e
BRVer addresses branch prediction by systematically generating branch-intensive diagnostics.
pipelined processor part of → 85% 1e
Branch prediction is a micro-architectural feature of pipelined processors that verification must handle.

CITATIONS

9 sources
9 citations — click to expand
[1] C1: Branch prediction predicts the likely direction of conditional branches and can be modeled as learning mappings from context to branch outcome. Workload Characterization for Branch Predictability
[2] C2: Accurate branch prediction reduces wrong-path execution and can improve performance and energy consumption; branch working set size and branch predictability correlate with misprediction rates for schemes such as TAGE and perceptron. Workload Characterization for Branch Predictability
[3] C3: The branch working set is defined using frequent branch contexts composed of branch address plus global and local history, and the cited study characterizes 2,451 traces into branch-working-set-size and predictability categories. Workload Characterization for Branch Predictability
[4] C4: Branch predictions are microarchitectural state available in the processor pipeline and normally invisible to software. Hardware Support to Improve Fuzzing Performance and Precision
[5] C5: SNAP uses branch predictions and last-executed branches to provide richer fuzzing feedback, including immediate control-flow context and approximated data flows. Hardware Support to Improve Fuzzing Performance and Precision
[6] C6: SNAP uses prediction results for recorded LBQ branch sequences to infer longer branch history and approximate data flow from input changes to branch decisions. Hardware Support to Improve Fuzzing Performance and Precision
[7] C7: The evaluated BOOM processor configuration includes a front end with 8-wide fetch, 16 RAS entries, 512 BTB entries, and a gshare branch predictor. Hardware Support to Improve Fuzzing Performance and Precision
[8] C8: Branch-instruction collisions inside the BPU can be exploited for eavesdropping on secret-related branch operations and malicious speculative execution. STBPU: A Reasonably Secure Branch Prediction Unit
[9] C9: Partitioning or flushing a BPU can have limited security coverage and harm accuracy and performance; STBPU proposes per-entity BPU data representation and monitoring of prediction-related events. STBPU: A Reasonably Secure Branch Prediction Unit