Branch prediction
ConceptBranch prediction is a CPU microarchitectural mechanism that predicts the likely direction of conditional branch instructions to support instruction-level parallelism (ILP). The provided evidence covers workload-driven characterization of branch-prediction accuracy, security attacks and mitigations targeting the branch prediction unit (BPU), and the use of branch predictions as microarchitectural feedback exposed by the RISC-V SNAP hardware for fuzzing, including its relationship with the RISC-V Control Transfer Records (CTR) extension. Additional evidence also treats branch-prediction behavior as a target of microprocessor functional verification testcases.
First seen 5/25/2026
Last seen 8/17/2026
Evidence 26 chunks
Wiki v12
WIKI
Overview
Branch prediction predicts the likely direction of a conditional branch instruction to support instruction-level parallelism (ILP). The workload-characterization source frames branch prediction as a pattern-recognition problem: a predictor learns a mapping from an execution context to a branch outcome. [C1]
Performance role
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
14 connectionsSNAP uses branch prediction results from the LBQ to approximate data flow information.
The LBQ stores the prediction result for each branch to enable data flow approximation.
The pipeline model includes branch prediction as a supported processor feature.
Branch prediction is a component of the CPU pipeline that predicts branch targets to avoid stalls.
BlackParrot has a Branch History Table and Branch Target Buffer for branch prediction
TestRIG discovered a branch prediction issue in the Toooba processor.
An Approach to Test Programs Generation for Microprocessors Based on Pipeline Hazards Templates ← uses 90% 1e
The paper mentions branch prediction as a control logic mechanism verified by the approach.
RISC-V BOOM implements a gshare branch predictor as part of its front-end.
PIPE uses branch prediction to speculatively fetch instructions.
The CTR extension includes BPFRZ and CTRTARGET_MISP bits related to branch prediction misprediction tracking.
Cross-level processor verification via endless randomized instruction stream generation with coverage-guided aging ← mentions 90% 1e
The paper mentions branch prediction as a micro-architectural feature affecting verification.
RISC-V processors may include branch prediction
BRVer addresses branch prediction by systematically generating branch-intensive diagnostics.
Branch prediction is a micro-architectural feature of pipelined processors that verification must handle.
LINKED ENTITIES
4 linksBranch Prediction Unit component_of STBPU evidence explicitly identifies the branch prediction unit (BPU) as the structure inside which branch-instruction collisions occur and which STBPU redesigns.
Transient Execution Attack threat_to STBPU paper identifies malicious speculative executions triggered via BPU collisions as a class of transient execution attacks against branch prediction.
RISC-V Control Transfer Records related_to The RISC-V CTR extension defines CSRs (e.g., CTRCTL_BPFRZ, CTRTARGET_MISP) that record branch outcomes and expose branch-prediction state such as mispredictions to privileged software.
Functional Verification test_target_for The UCI ADL-driven functional test generation paper lists branch mis-prediction and pipeline flushing as explicit testcase categories for verifying pipelined microprocessors.
CITATIONS
11 sources11 citations — click to expand
[1] Branch prediction predicts the likely direction of a conditional branch instruction and can be framed as a pattern-recognition problem that learns a mapping from execution context to branch outcome. Workload Characterization for Branch Predictability
[2] Accurate branch prediction reduces wrong-path instructions, improving performance and energy; branch working set size and branch predictability are workload-driven identifiers highly correlated with misprediction rates of modern schemes such as TAGE and perceptron. Workload Characterization for Branch Predictability
[3] The branch working set of a trace is a group of the most frequently occurring branch contexts, defined as a 3-part tuple of branch address and associated global and local history; 2,451 workload traces were characterized into seven working-set-size and nine predictability categories. Workload Characterization for Branch Predictability
[4] Branch predictions are microarchitectural state available in the processor pipeline during program execution; under normal execution they are invisible to software but can be exposed by hardware-level tracing mechanisms. Hardware Support to Improve Fuzzing Performance and Precision (SNAP)
[5] SNAP exposes branch predictions (which are invisible to software) as extra execution semantics including immediate control-flow context and approximated data flows, alongside code coverage. Hardware Support to Improve Fuzzing Performance and Precision (SNAP)
[6] SNAP uses prediction results for branches recorded in the Last Branch Queue (LBQ) to infer a longer effective branch history, and treats a change in a branch's prediction result caused by a mutated input byte as an approximation of data flow from that input offset to the branch condition. Hardware Support to Improve Fuzzing Performance and Precision (SNAP)
[7] The SNAP BOOM evaluation configuration uses an 8-wide fetch front end with 16 RAS entries, 512 BTB entries, and a gshare branch predictor. Hardware Support to Improve Fuzzing Performance and Precision (SNAP)
[8] Modern processors face threats exploiting branch-instruction collisions inside the branch prediction unit (BPU), including eavesdropping on secret-related branch operations and triggering malicious speculative executions. STBPU: A Reasonably Secure Branch Prediction Unit
[9] Mitigations such as partitioning or flushing the BPU can stop some collision-based exploits only to a limited extent and can negatively affect branch prediction accuracy and CPU performance; STBPU customizes BPU data representation per isolated software entity and proactively changes it on detected prediction events to defend against brute-force collision attempts. STBPU: A Reasonably Secure Branch Prediction Unit
[10] The RISC-V Control Transfer Records (CTR) extension defines CSRs (e.g., CSR_MCTRCTL 0x34e, CSR_SCTRCTL 0x14e, CSR_SCTRSTATUS 0x14f, CSR_SCTRDEPTH 0x15f) and configuration bits such as CTRCTL_BPFRZ, CTRCTL_TKBRINH, CTRCTL_NTBREN and per-transfer-type inhibit bits; CTRTARGET_MISP carries branch misprediction information and CTRDATA_TYPE_TAKEN_BRANCH/CTRDATA_TYPE_NONTAKEN_BRANCH record types distinguish branch outcomes. [PATCH RFC 2/6] riscv: perf: Add Control transfer records CSR definations.
[11] Functional test program generation for pipelined microprocessors treats Branch Prediction as an explicit testcase category that produces branch mis-prediction, stalls, and pipeline flushing, and treats every feedback path in the pipeline (including the branch-prediction feedback path) as a coverage target. Architecture Description Language driven Functional Test Program Generation for Microprocessors using SMV