Skip to content
STIMSMITH

Return Address Stack

Concept

A Return Address Stack (RAS) is a branch-prediction structure used to predict function-return targets. In the provided RISC-V superscalar processor evidence, it is part of the instruction-fetch unit’s dynamic predictor: decoded function calls provide return addresses, and return instructions pop an RAS entry to supply the next predicted program counter. The RAS is also relevant to processor-verification fuzzing because Logic Fuzzer techniques used to perturb branch-predictor targets can be applied to the RAS.

First seen 5/27/2026
Last seen 5/28/2026
Evidence 3 chunks
Wiki v3

WIKI

Overview

A Return Address Stack (RAS) is a component of a processor’s dynamic branch predictor. In the cited RISC-V superscalar processor description, the instruction-fetch (IF) unit fetches instructions from the instruction cache and predicts the next Program Counter (PC), i.e. the address of the next instruction to fetch. The dynamic predictor in that IF unit includes a Branch History Table (BHT), a Branch Target Buffer (BTB), and a Return Address Stack.[1]

The RAS stores return addresses of decoded function calls. When a function-return instruction is encountered, the processor pops an entry from the RAS and uses that entry as the next predicted PC address.[2]

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

4 connections
mispredicted path fuzzing ← uses 85% 1e
Mispredicted path fuzzing can also be applied to the Return Address Stack.
Logic Fuzzer ← uses 85% 1e
The same mispredicted path fuzzing technique can be applied to the Return Address Stack.
Instruction Fetch Unit part of → 98% 1e
The RAS is a component of the dynamic predictor in the instruction fetch unit.
branch predictor part of → 90% 1e
The RAS is a component of the branch predictor.

CITATIONS

5 sources
5 citations — click to expand
[1] The IF unit fetches instructions and predicts the next PC, and its dynamic predictor includes BHT, BTB, and RAS. [PDF] UVM-based verification of RISC-V superscalar processors
[2] The RAS stores return addresses of decoded function calls and pops an entry for use as the next predicted PC when a function-return instruction is encountered. [PDF] UVM-based verification of RISC-V superscalar processors
[3] BTB fuzzing can provide false or random predicted addresses at runtime, potentially causing iTLB page faults on mispredicted paths, and the same technique can be applied to the RAS. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation
[4] Logic Fuzzer table mutators allocate fuzzer-managed tables matching branch-predictor size, access them through DPI instead of the RTL memory model, and fuzz them randomly or with specific patterns during simulation. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation
[5] Logic Fuzzer can create microarchitectural states no program could reach, but co-simulation failures exposed by fuzzing are treated as potential bugs requiring proof or disproof, and the paper’s presented bugs were confirmed by designers. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation