branch predictor

Concept

A branch predictor is a dynamic prediction mechanism in a processor's Instruction Fetch (IF) unit that predicts the next Program Counter (PC). In cited RISC-V superscalar evidence (CVA5), the predictor comprises a Branch History Table (BHT) for taken/not-taken direction (using a GShare indexing scheme), a Branch Target Buffer (BTB) for branch target addresses, and a Return Address Stack (RAS) for return addresses. A flush controller in the Instruction Decode stage compares resolved branch outcomes to stored predictions and redirects the pipeline on misprediction. The branch predictor is a dynamic micro-architectural structure that, along with other dynamic structures (e.g., load/store queues, reorder buffers, instruction queues), requires long execution history to reconstruct in FPGA debugging, making it harder to reproduce than registers and pipeline registers. Cited sources describe prediction accuracy above 95% as a verification hazard for mispredicted paths. Cited RTL design evidence treats BHT/BTB sizes as configurable microarchitectural knobs. Cited TaPaFuzz work contributes microarchitecture fixes to the CVA5 RISC-V core allowing it to fully reset its caches and branch predictors between fuzzer runs. Public context highlights load-driven and graph-application branch-predictor research as ongoing optimization avenues.

First seen 5/27/2026

Last seen 8/16/2026

Evidence 14 chunks

Wiki v6

WIKI

Overview

A branch predictor is a dynamic prediction mechanism in a processor's Instruction Fetch (IF) unit. In cited RISC-V superscalar processor design, the IF unit fetches instructions from the instruction cache and predicts the next Program Counter (PC), i.e., the address of the next instruction to fetch. The dynamic predictor is described as an instrumental part of the IF unit. [citation: IF-unit-next-PC]

Main structures

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

13 connections

mispredicted path fuzzing ← uses 90% 2e

Mispredicted path fuzzing forces branch predictor to produce taken predictions for testing.

Logic Fuzzer ← uses 100% 2e

Logic Fuzzer can fuzz branch predictor tables to exercise mispredicted paths.

CVA5 RISC-V Core ← uses 100% 2e

CVA5 has a branch predictor that must be cleared between fuzzer runs.

BOOM part of → 95% 2e

BOOM has a branch predictor that requires long execution history to reconstruct.

table mutator ← uses 95% 2e

Table mutators fuzz branch predictor tables during simulation.

Parameterization part of → 90% 1e

Branch predictor structures are configurable microarchitectural knobs exposed through parameterization.

Branch History Table (BHT) ← part of 93% 1e

Branch History Table (BHT) is one of the configurable branch predictor structures.

Branch Target Buffer (BTB) ← part of 93% 1e

Branch Target Buffer (BTB) is one of the configurable branch predictor structures.

microarchitectural state part of → 95% 1e

The branch predictor is a micro-architectural state component.

Superscalar Out-of-Order Processor part of → 95% 1e

The branch predictor is part of the instruction fetch unit of the processor.

Branch History Table ← part of 95% 1e

The BHT is a component of the branch predictor.

Branch Target Buffer ← part of 95% 1e

The BTB is a component of the branch predictor.

Return Address Stack ← part of 90% 1e

The RAS is a component of the branch predictor.

LINKED ENTITIES

2 links

BOOM PART_OF Extracted graph relationship

microarchitectural state PART_OF Extracted graph relationship

CITATIONS

15 sources

15 citations — click to expand

[1] In cited RISC-V superscalar processor design, the IF unit fetches instructions from the instruction cache and the dynamic branch predictor predicts the next PC; the predictor is described as instrumental to the IF unit. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[2] The cited predictor comprises a Branch History Table (BHT) with GShare indexing for taken/not-taken direction, a Branch Target Buffer (BTB) for branch target addresses, and a Return Address Stack (RAS) for return addresses. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[3] The predictor-update interface should be driven by sequences resembling real code patterns (for/while/nested loops, if blocks) rather than purely random predictions. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[4] A flush controller in the Instruction Decode stage compares resolved branch results to stored predictions (using a FIFO of predictions and a predictor-update signal from Execute) and flushes/redirects the pipeline on misprediction. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[5] Cited RTL design lists branch predictor structures (BHT vs. BTB sizes) among configurable microarchitectural knobs alongside pipeline depth, cache associativity, and bus interfaces, as part of a broader hyper-parameterization approach covering XLEN, ISA extensions, and bus-protocol selection. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[6] Cited Logic Fuzzer evidence describes branch prediction accuracy above 95% as a verification hazard where the mispredicted path may be overlooked, and reports that without fuzzing unique RISC-V instruction coverage on the mispredicted path did not reach 60% after 200+ tests in a CVA6 experiment, while fuzzing can reach 100% instruction coverage. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[7] Without fuzzing, BTB PC predictions stay within a narrow range (constrained to addresses encoded in the ELF .text section); with fuzzing, BTB entries can produce falsely predicted addresses over a broader range or random addresses at runtime. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[8] In the Dromajo-based Logic Fuzzer, RTL accesses the table mutator of the processor's branch predictor via DPI, and the Dromajo fuzzer object allocates a table with the same size as the branch predictor. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[9] Software graybox fuzzing frameworks typically implement CF monitoring by patching additional function calls into the target, causing interrupts and runtime overhead; hardware CF monitoring in parallel to actual execution is proposed as an alternative with no additional runtime overhead. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[10] TaPaFuzz contributes microarchitecture fixes to the CVA5 RISC-V core allowing it to fully reset its caches and branch predictors between fuzzer runs, and an AXI wrapper for legalizing aborted AXI transfers due to random partial design resets; the BRAM variant uses 54%–66% additional LUTs/registers vs. plain CVA5 at a 10 MHz lower frequency, while DRAM/DDR4 needs 2%–5% more registers/LUTs and reduces BRAM by 80 KiB. An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing (TaPaFuzz)

[11] Cited Prelude Table 1 classifies branch predictors as micro-architectural state NOT collected by their method (✗), in contrast to architectural registers (PC, GPRs, CSRs, FPRs) which are required (✓); full-snapshot micro-architectural state is 23.4 MB vs. Prelude's 1 KB (0.004%), and total snapshots are 4.023 GB vs. 18.6 KB (0.00046%). Prelude: Priming-Guided State Reconstruction for Efficient FPGA Processor Debugging

[12] Cited Prelude evaluation reports that the Fetch module has a lower signal reproduction rate due to dynamic structures like the branch predictor requiring long execution history; overall geomean reproduction rises from 86.7% at 10² instructions to 91.5% at 10⁶ instructions; LSU maintains stable rates (memory access patterns partially dynamic but largely deterministic over short segments), and ROB reaches very high rates (most signals store instruction information). Prelude: Priming-Guided State Reconstruction for Efficient FPGA Processor Debugging

[13] Cited Prelude reports a warm-up phase after snapshot replay that allows internal queues, buffers, and predictors to settle, ensuring replay proceeds under a consistent and reproducible micro-architectural context; the framework integrates with both BOOM and Rocket RISC-V cores with only minor area overhead (LUTRAMs, Flip-Flops, Logic LUTs each within a few percent of baseline). Prelude: Priming-Guided State Reconstruction for Efficient FPGA Processor Debugging

[14] The Load Driven Branch Predictor (LDBP) targets branches dependent on hard-to-predict load data, exploiting that the load address pattern (e.g., arrays, maps) is predictable even when load data is random; scaling a 256-KBit history-based predictor to 1 MBit only reduces mispredictions by ~10%, while augmenting a 150-Kbit IMLI with LDBP reduces average branch mispredictions by 20% and improves average IPC by 13.1% on SPEC CINT2006 and GAP benchmarks. Load Driven Branch Predictor (LDBP)

[15] Public-context branch-predictor work on graph applications notes that real-world graph workloads generally exceed cache size, that branch mispredictions are frequent in graph processing, and that further branch-predictor optimization beyond memory-hierarchy improvements is still possible to handle branches that cause mispredictions. Optimizing Branch Predictor for Graph Applications