Skip to content
STIMSMITH

Branch Prediction Unit

Concept WIKI v1 · 7/6/2026

A Branch Prediction Unit (BPU) is a hardware component within a processor's instruction fetch pipeline that predicts the outcomes and targets of branch instructions to keep the pipeline supplied with instructions despite control-flow uncertainty. Modern BPUs are known to be susceptible to collision-based transient execution attacks and side-channel threats, motivating research into secure BPU designs such as STBPU and CIBPU. BPUs are also a standard block targeted during functional verification of RISC-V cores using UVM-based environments.

Branch Prediction Unit (BPU)

Overview

A Branch Prediction Unit (BPU) is a hardware structure inside a microprocessor's instruction fetch stage that speculates on the direction and target of branch instructions before they are resolved. By predicting outcomes in advance, the BPU keeps the pipeline fed with instructions, avoiding stalls that would otherwise occur when the processor must wait for a branch condition to be evaluated [1].

Role in the Processor Pipeline

The BPU sits within the instruction fetch path and works together with surrounding pipeline stages. In a typical RISC-V core verification environment, the BPU is one of the discrete blocks exercised by the testbench, alongside:

  • Instruction Fetch Unit (IFU)
  • Decode Unit
  • Execution Unit (ALU, MUL, DIV, etc.)
  • Register File
  • Control and Status Registers (CSRs)
  • Load/Store Unit (LSU)

Functional verification of the BPU focuses on ensuring that branch prediction behaves correctly under a range of control-flow scenarios, including proper pipeline behaviour with forwarding, stalling, and flushing [1].

Security Concerns

Modern BPUs have been the subject of numerous security threats exploiting collisions between branch instructions inside the predictor. These attacks range from eavesdropping on secret-related branch operations to triggering malicious speculative execution. Defending branch predictors is challenging because:

  • Partitioning or flushing the BPU can stop some collision-based exploits, but only to a limited extent.
  • The same mitigations tend to degrade branch prediction accuracy and overall CPU performance.

Secure BPU Proposals

STBPU — Secret Token Branch Prediction Unit

STBPU proposes a secure BPU design that defends against collision-based transient execution attacks and BPU side channels while incurring minimal performance overhead. Its approach is to:

  • Customize the data representation inside the BPU for each software entity that requires isolation.
  • Monitor prediction-related events and preemptively change the BPU's data representation to prevent brute-force attempts to trigger malicious branch instruction collisions [arxiv:2108.02156v2].

CIBPU — Conflict-Invisible Secure Branch Prediction Unit

CIBPU argues that prior secure BPU designs suffer from one or both of the following problems:

  • Physical-isolation schemes offer limited security and significantly reduce prediction capability, causing prominent performance degradation.
  • Encryption-based schemes with periodic key re-randomization can be compromised by advanced attack algorithms and carry considerable performance overhead.

CIBPU responds with a set of design techniques aimed at making branch conflicts invisible to attackers:

  • Redundant storage design
  • Load-aware indexing
  • Replacement design
  • An encryption mechanism that does not require periodic key updates

According to the authors, CIBPU provides thorough security analysis showing strong protection throughout the BPU's lifecycle. An implementation in a RISC-V core model in gem5 reports an average performance overhead of 1.12%–2.20% with acceptable hardware storage overhead, described as the lowest among state-of-the-art secure BPU schemes. A second implementation in the open-source RISC-V core SonicBOOM, burned onto an FPGA board, shows an average performance degradation of about 2.01%, consistent with the gem5 results [arxiv:2501.10983v1].

Verification Context

In UVM-based verification flows for RISC-V cores, the Branch Prediction Unit is treated as a discrete block that must be verified individually, with assertions, functional coverage, and reference-model comparison (such as Spike). Verification objectives specific to the BPU include ensuring correct branch-prediction behaviour under varied control-flow scenarios and validating the interaction between prediction and the rest of the pipeline [1].

See Also

CITATIONS

7 sources
7 citations
[1] The BPU is one of the discrete blocks verified in a UVM-based RISC-V core verification environment alongside IFU, decode, execution, register file, CSRs, and LSU. Verification Of Risc-V Core Blocks Using Uvm
[2] Modern BPUs have faced numerous security threats exploiting branch instruction collisions, ranging from side-channel leakage to malicious speculative execution. STBPU: A Reasonably Secure Branch Prediction Unit
[3] STBPU customizes data representation inside the BPU per isolated software entity and monitors prediction-related events to prevent brute-force collision attacks. STBPU: A Reasonably Secure Branch Prediction Unit
[4] Prior physical-isolation SBPU schemes offer limited security and degrade prediction capability, while encryption-based SBPU schemes with periodic key re-randomization can be compromised and carry notable overhead. CIBPU: A Conflict-Invisible Secure Branch Prediction Unit
[5] CIBPU uses redundant storage, load-aware indexing, replacement design, and an encryption mechanism that does not require periodic key updates to make branch conflicts invisible to attackers. CIBPU: A Conflict-Invisible Secure Branch Prediction Unit
[6] CIBPU implemented in a RISC-V core model in gem5 reports average performance overhead of 1.12%-2.20%, and a SonicBOOM FPGA implementation reports about 2.01% average degradation. CIBPU: A Conflict-Invisible Secure Branch Prediction Unit
[7] Verification of the BPU must confirm correct branch-prediction behaviour under varied control-flow scenarios and validate pipeline interactions including forwarding, stalling, and flushing. Verification Of Risc-V Core Blocks Using Uvm