Branch Prediction Research Articles

Leaking Secrets through Modern Branch Predictor in the Speculative World

Transient execution attacks that exploit speculation have raised significant concerns in computer systems. Typically, branch predictors are leveraged to trigger mis-speculation in transient execution attacks. In this work, we demonstrate a new class of speculation-based attack that targets branch prediction unit (BPU). We find that speculative resolution of conditional branches (i.e., in nested speculation) alter the states of pattern history table (PHT) in modern processors, which are not restored after the corresponding branches are later squashed. Such characteristic allows attackers to exploit BPU as the secret transmitting medium in transient execution attacks. To evaluate the discovered vulnerability, we build a novel attack framework, BranchSpectre, that enables exfiltration of unintended secrets through observing speculative PHT updates (in the form of covert and side channels). We further investigate PHT collision mechanism in the history-based predictor as well as the branch prediction mode transitions in Intel processors. Built upon such knowledge, we implement an ultra high-speed covert channel (BranchSpectre-cc) as well as two side channels (i.e., BranchSpectre-v1 and BranchSpectre-v2) that merely rely on BPU for mis-speculation trigger and secret inference in the speculative domain. Notably, BranchSpectre side channels can take advantage of much simpler code patterns than the ones used in Spectre attacks. We present an extensive BranchSpectre code gadget analysis on a set of popular real-world application code bases followed by a demonstration of real-world side channel attack on OpenSSL. The evaluation results show substantial wider existence and higher exploitability of BranchSpectre code patterns in real-world software. Finally, we discuss several secure branch prediction mechanisms that can mitigate transient execution attacks exploiting modern branch predictors.

An Aggressive Implementation Method of Branch Instruction Prefetch

Due to the demand in the field of industrial control, we developed a CPU core based on ARMv8m architecture [1], named TS400, and its performance is comparable to Arm Cortex-M33 [2]. The TS400 has four stages of pipelining, thus having a higher clock frequency than Cortex-M33 which has three stages. With the increase of pipeline stages, extra idle clock beats will be introduced when the pipeline is flushed, which will increase the clock cycles per instruction (CPI) value and decrease the score of CoreMark. Accurate instruction fetch and branch prediction can effectively reduce the impact of refreshing pipeline, at the cost of extra logic resources. In TS400, an aggressive branch instruction prefetch method is designed. Compared with branch prediction technology, this method does not need complex branch prediction logic and is suitable for the design of embedded CPU. The aggressive branch instruction prefetch method includes: 1) reducing the time cost of conditional branch target fetching to the minimum by taking the branch first and then confirming the branch taking result; 2) optimizing the bus control signal timing of the prefetch instruction to make the target address prefetch respond in time. The aggressive branch prefetch method reduces the impact of pipeline stall caused by the execution of conditional branch instructions as much as possible, thus achieving better running performance than Cortex-M33 at the same clock frequency, while the clock frequency performance is superior to Cortex-M33.

Leveraging Value Equality Prediction for Value Speculation

Value Prediction (VP) has recently been gaining interest in the research community, since prior work has established practical solutions for its implementation that provide meaningful performance gains. A constant challenge of contemporary context-based value predictors is to sufficiently capture value redundancy and exploit the predictable execution paths. To do so, modern context-based VP techniques tightly associate recurring values with instructions and contexts by building confidence upon them after a plethora of repetitions. However, when execution monotony exists in the form of intervals, the potential prediction coverage is limited, since prediction confidence is reset at the beginning of each new interval. In this study, we address this challenge by introducing the notion of Equality Prediction (EP), which represents the binary facet of VP. Following a twofold decision scheme (similar to branch prediction), at fetch time, EP makes use of control-flow history to predict equality between the last committed result for this instruction and the result of the currently fetched occurrence. When equality is predicted with high confidence, the last committed value is used. Our simulation results show that this technique obtains the same level of performance as previously proposed state-of-the-art context-based value predictors. However, by virtue of exploiting equality patterns that are not captured by previous VP schemes, our design can improve the speedup of standard VP by 19% on average, when combined with contemporary prediction models.

RVCoreP: An Optimized RISC-V Soft Processor of Five-Stage Pipelining

RISC-V is a RISC based open and loyalty free instruction set architecture which has been developed since 2010, and can be used for cost-effective soft processors on FPGAs. The basic 32-bit integer instruction set in RISC-V is defined as RV32I, which is sufficient to support the operating system environment and suits for embedded systems. In this paper, we propose an optimized RV32I soft processor named RVCoreP adopting five-stage pipelining. The processor applies three effective optimization methods to improve the operating frequency. These methods are instruction fetch unit optimization including pipelined branch prediction mechanism, ALU optimization, and data alignment and sign-extension optimization for data memory output. We implement RVCoreP in Verilog HDL and verify the behavior using Verilog simulation and an actual Xilinx Atrix-7 FPGA board. We evaluate IPC (instructions per cycle), operating frequency, hardware resource utilization, and processor performance. From the evaluation results, we show that RVCoreP achieves 30.0% performance improvement compared with VexRiscv, which is a high-performance and open source RV32I processor selected from some related works.

Shooting Down the Server Front-End Bottleneck

The front-end bottleneck is a well-established problem in server workloads owing to their deep software stacks and large instruction footprints. Despite years of research into effective L1-I and BTB prefetching, state-of-the-art techniques force a trade-off between metadata storage cost and performance. Temporal Stream prefetchers deliver high performance but require a prohibitive amount of metadata to accommodate the temporal history. Meanwhile, BTB-directed prefetchers incur low cost by using the existing in-core branch prediction structures but fall short on performance due to BTB’s inability to capture the massive control flow working set of server applications. This work overcomes the fundamental limitation of BTB-directed prefetchers, which is capturing a large control flow working set within an affordable BTB storage budget. We re-envision the BTB organization to maximize its control flow coverage by observing that an application’s instruction footprint can be mapped as a combination of its unconditional branch working set and, for each unconditional branch, a spatial encoding of the cache blocks around the branch target. Effectively capturing a map of the application’s instruction footprint in the BTB enables highly effective BTB-directed prefetching that outperforms the state-of-the-art prefetchers by up to 10% for equivalent storage budget.

AI for Computer Architecture: Principles, Practice, and Prospects

Artificial intelligence has already enabled pivotal advances in diverse fields, yet its impact on computer architecture has only just begun. In particular, recent work has explored broader application to the design, optimization, and simulation of computer architecture. Notably, machine-learning-based strategies often surpass prior state-of-the-art analytical, heuristic, and human-expert approaches. This book reviews the application of machine learning in system-wide simulation and run-time optimization, and in many individual components such as caches/memories, branch predictors, networks-on-chip, and GPUs. The book further analyzes current practice to highlight useful design strategies and identify areas for future work, based on optimized implementation strategies, opportune extensions to existing work, and ambitious long term possibilities. Taken together, these strategies and techniques present a promising future for increasingly automated computer architecture designs.

Design and Evaluation of Experiment Course Arrangement System Based on Backtracking and Analytic Hierarchy Process

With the continuous expansion of the scale of colleges and universities, it may be necessary to temporarily add some experiment class while teaching, so the demand of the experiment course arrangement system is increasing. Based on the backtracking method, this paper constructs a basic algorithm for the problem of courses arrangement in the laboratory. The algorithm supports the functionality to adding new courses to the schedule at any time, and is able to randomly generate the schedule which generates different outcome at each time the algorithm runs. The branch prediction method is used to optimize the performance of the algorithm. At last, a personal and digital evaluation method of teachers and students’ satisfaction is given by using Analytic Hierarchy Process (AHP) to solve the curriculum problem. By using this method, the curriculum generated by this algorithm can be optimized, so as to getting more satisfactory schedule plan for teachers and students.

Tension Strength Prediction of Transverse Branch Plate-to-Rectangular Joint with Concrete Filling

This paper predicts the tension strength of Concrete-filled Branch Plate-to-Rectangular Hollow (CBPRH) joint by conducting experimental and theoretical analysis. A total of 46 X-joints with different geometric parameters were investigated, in which 4 specimens were tested under ultimate tension and 42 specimens were numerically analyzed. The joint’s strength, failure mode and load-displacement curve were obtained. Perfobond Leister Rib (PBR) was welded in part of the specimens to investigate its effect on joint’s tensile performance. It is shown that the ultimate strength of transverse CBPRH joint benefit from grouting of chord and installation of PBR. The ultimate strength of CBPRH joint with PBR is larger than the counterpart without PBR. Tension strength equations were proposed for both CBPRH joints with and without PBR by nonlinear regression. The chord axial stress reduction factor was discussed and a modified equation originated from hollow joint was recommended for CBPRH joint. Connection efficiency was presented and compared among branch plate-to-rectangular hollow (BPRH) joint, CBPRH joint and CBPRH joint with PBR.

Securing Branch Predictors with Two-Level Encryption

Modern processors rely on various speculative mechanisms to meet performance demand. Branch predictors are one of the most important micro-architecture components to deliver performance. However, they have been under heavy scrutiny because of recent side-channel attacks. Branch predictors are indexed using the PC and recent branch histories. An adversary can manipulate these parameters to access and control the same branch predictor entry that a victim uses. Recent Spectre attacks exploit this to set up speculative-execution-based security attacks. In this article, we aim to mitigate branch predictor side-channels using two-level encryption. At the first level, we randomize the set-index by encrypting the PC using a per-context secret key. At the second level, we encrypt the data in each branch predictor entry. While periodic key changes make the branch predictor more secure, performance degradation can be significant. To alleviate performance degradation, we propose a practical set update mechanism that also considers parallelism in multi-banked branch predictors. We show that our mechanism exhibits only 1.0% and 0.2% performance degradation while changing keys every 10K and 50K cycles, respectively, which is much lower than other state-of-the-art approaches.

Hybrid branch prediction for pipelined MIPS processor

In the modern microprocessors that designed with pipeline stages, 
 the performance of these types of processors will be affected when executing branch instructions, because in this case there will be stalls in the pipeline. In turn this causes in reducing the Cycle Per Instruction (CPI) of the processor. In the case of executing a branch instruction, the processor needs an extra clocks to know if that branch will happen (Taken) or not (Not Taken) and also it requires calculating the new address in the case of the branch is Taken. The prediction that the branch is T / NT is an important stage in enhancing the processor performance. In this research more than one method of branch prediction (hybrid) is used and the designed circuit will choose different types of prediction algoritms depending on the type of the branch. Some of these methods were used are static while the other are dynamic. All circuits were built practically and examined by applying different programs on the designed predictor algorithm to compute the performance of the processor.

The Case for Domain-Specialized Branch Predictors for Graph-Processing

Branch prediction is believed by many to be a solved problem, with state-of-the-art predictors achieving near-perfect prediction for many programs. In this article, we conduct a detailed simulation of graph-processing workloads in the GAPBS benchmark suite and show that branch mispredictions occur frequently and are still a large limitation on performance in key graph-processing applications. We provide a detailed analysis of which branches are mispredicting and show that a few key branches are the main source of performance degradation across the graph-processing benchmarks we looked at. We also propose a few ideas for future work to improve branch prediction accuracy on graph workloads.

Rebasing Instruction Prefetching: An Industry Perspective

Instruction prefetching can play a pivotal role in improving the performance of workloads with large instruction footprints and frequent, costly frontend stalls. In particular, Fetch Directed Prefetching (FDP) is an effective technique to mitigate frontend stalls since it leverages existing branch prediction resources in a processor and incurs very little hardware overhead. Modern processors have been trending towards provisioning more frontend resources, and this bodes well for FDP as it requires these resources to be effective. However, recent academic research has been using outdated and less than optimal frontend baselines that employ smaller structures, which may result in misleading outcomes. In this letter, we present a detailed FDP microarchitecture and evaluate two improvements, better branch history management and post-fetch correction. We believe that our FDP-based frontend design can serve as a new reference baseline for instruction prefetching research to bridge the gap between academia and industry.

Spectre attacks

Modern processors use branch prediction and speculative execution to maximize performance. For example, if the destination of a branch depends on a memory value that is in the process of being read, CPUs will try to guess the destination and attempt to execute ahead. When the memory value finally arrives, the CPU either discards or commits the speculative computation. Speculative logic is unfaithful in how it executes, can access the victim's memory and registers, and can perform operations with measurable side effects. Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim's confidential information via a side channel to the adversary. This paper describes practical attacks that combine methodology from side-channel attacks, fault attacks, and return-oriented programming that can read arbitrary memory from the victim's process. More broadly, the paper shows that speculative execution implementations violate the security assumptions underpinning numerous software security mechanisms, such as operating system process separation, containerization, just-in-time (JIT) compilation, and countermeasures to cache timing and side-channel attacks. These attacks represent a serious threat to actual systems because vulnerable speculative execution capabilities are found in microprocessors from Intel, AMD, and ARM that are used in billions of devices. Although makeshift processor-specific countermeasures are possible in some cases, sound solutions will require fixes to processor designs as well as updates to instruction set architectures (ISAs) to give hardware architects and software developers a common understanding as to what computation state CPU implementations are (and are not) permitted to leak.

DESIGN AND FPGA BASED IMPLEMENTATION OF 1-BIT DYNAMIC BRANCH PREDICTOR FOR THE PARALLELISM PROCESSOR

To improve the performance of the processors, the pipeline technique is used extensively to implement I.L.P (Instruction Level Parallelism). We measure the processor performance through the quantity of Instructions Level Parallelism represented through its design. We can counterstrike the parallelism with the aid of the execution of conditional branch instructions, which might additionally break the flow of the program execution. To overcome the branch problem, numerous ways have been suggested proactive to predict both the direction as well as the address of the executed instructions. In this paper, the FPGA ( Field Programmable Gate Arrays) based implementation of the 1-bit dynamic branch predictor is presented. The 1-bit dynamic branch predictor is developed especially for conditional branch instructions. The pipeline would not detach from the instruction queue when any conditional instructions occur as a 1-bit dynamic branch predictor implements it. This technique improves processor performance by implementing a deduction in the controlling hazard in the pipeline. Modelsim and Quartus tool is used for the design and implementation of the predictor.

Multi Fluxon Storage and its Implications for Microprocessor Design

One of the main challenges for single flux quantum (SFQ) technology to successfully implement a microprocessor is to have a compact and robust on-chip memory that can be used for register files and cache memory. In this context, we designed high capacity destructive readout (HC-DRO) cells. The design is based on our insight that each cell can store more than one SFQ pulse with the same area footprint of a regular DRO cell. In our current design, we demonstrate a single HC-DRO cell that can store up to three SFQ pulses thereby enabling us to store the equivalent of two bits of memory in a single cell. We have designed a register file (RF) architecture for a microprocessor and used the HC-DRO cells to reduce the Josephson junction count required for its implementation. The RF architecture presented in this work can also be used for implementing cache memories. We also demonstrate the benefits of doubling the storage density with HC-DRO cells by designing a 2-bit branch predictor circuit block for a 5-stage pipeline microprocessor that dramatically improves the cycles per instruction metric of an SFQ based microprocessor. All the design details are presented in the paper by verifying the design concepts through JSIM simulations and Verilog simulations.

Branch-aware data variable allocation for energy optimization of hybrid SRAM+NVM SPM☆

Abstract In this paper, we are interested in the energy optimization of hybrid Scratchpad Memory (SPM) which consists of SRAM and Non-Volatile Memory (NVM). We approach the energy optimization by data allocation with the consideration of the impact of program structure like branches. Our method is composed of two stages, i.e., program analysis stage and data allocation stage. In program analysis stage, we design two strategies to predict the branch execution of the program and reduce the number of reading/writing operations. Specifically, we propose Branch-based Static Analysis (BSA) strategy for simple programs and Neural Network Branch Prediction (NNBP) strategy for complex programs separately. In data allocation stage, we propose an Energy-based Data Allocation (EDA) strategy to reduce the energy consumption, which can determine how to allocate/migrate data variables onto SRAM/NVM. Incorporating these two stages, we have two branch-aware data variable allocation approaches, i.e., BSA+EDA for simple programs and NNBP+EDA for complex programs. Based on the existing benchmarks, we conduct extensive experiments to evaluate the proposed approaches. The experimental results show that both BSA+EDA and NNBP+EDA can effectively reduce the energy consumption up to 39.4% compared with the other approaches. Moreover, experiments demonstrate that BSA+EDA is suitable for simple programs whereas NNBP+EDA is suitable for complex programs.

Tuning a general purpose software cache library for TaihuLight’s SW26010 processor

The Sunway TaihuLight supercomputer has been installed for several years and many applications have been ported or built for TaihuLight. Initially most applications running on TaihuLight are with regular memory access patterns, such as dense linear algebra, structured grids and dynamic programming. At the year of 2018, developers have published a general purpose graph processing framework, a ported version of LAMMPS and a sparse triangular solver. These applications are with irregular memory access patterns which need a lot of special processings to make use of the computing processing elements (CPEs) of TaihuLight. While those strategies are efficient, doing such processing may be difficult for wider range of applications, especially for the constantly changing molecular dynamics applications or dynamic unstructured grids. In this paper, we present our work of designing a general purpose software cache library, SWCache, for simplifying the work of applying software cache in kernels, as well as a series of tools for tuning and modelling the performance of our software cache. After a series of optimizations including reordering branches for better branch prediction, hand-tuning register allocation, we evaluate our implementation in two mini-apps: miniFE and miniMD. Experiments show that our tuned software cache library can be applied in these applications, and can provide 20% speedup in miniMD compared to the strategies in a previous port of LAMMPS. Also, the workload of writing code can be reduced by using our library. Besides, the experience of efficient macro-based programming should be valuable for further application development on CPEs which are lack of C++ support.

Branch Prediction Attack on Blinded Scalar Multiplication

In recent years, performance counters have been used as a side channel source to monitor branch mispredictions, in order to attack cryptographic algorithms. However, the literature considers blinding techniques as effective countermeasures against such attacks. In this article, we present the first template attack on the branch predictor. We target blinded scalar multiplications with a side-channel attack that uses branch misprediction traces. Since an accurate model of the branch predictor is a crucial element of our attack, we first reverse-engineer the branch predictor. Our attack proceeds with a first online acquisition step, followed by an offline template attack with a template building phase and a template matching phase. During the template matching phase, we use a strategy we call Deduce & Remove , to first infer the candidate values from templates based on a model of the branch predictor, and subsequently eliminate erroneous observations. This last step uses the properties of the target blinding technique to remove wrong guesses and thus naturally provides error correction in key retrieval. In the later part of this article, we demonstrate a template attack on Curve1174 where the double-and-add always algorithm implementation is free from conditional branching on the secret scalar. In that case, we target the data-dependent branching based on the modular reduction operations of long integer multiplications. Such implementations still exist in open source software and can be vulnerable, even if top level safeguards like blinding are used. We provide experimental results on scalar splitting, scalar randomization, and point blinding to show that the secret scalar can be correctly recovered with high confidence. Finally, we conclude with recommendations on countermeasures to thwart such attacks.

Performance Assessment of RISC-V Architecture

This paper presents the performance evaluation of RISC – V architecture based processor using Gem5 simulator. The performance analysis metrics such as bandwidth, latency, throughput, branch prediction, pipeline stages and memory hierarchy of the processor architecture are studied using Gem5 simulator. Different simulation models are carried out to arrive the best reference model for RISC-V architecture design and development. In this reference model cache memory functionality feature is verified with the verification methodology called Universal Verification Methodology (UVM). From simulations it is found that both the program and data cache provides optimum performance in terms of execution time, hit rates, miss rate and miss latencies.

Trinetra: a solution to handle cross-VM time-driven attack

The efficient utilization of hardware and software resources plays a vital role in a high-performance computing environment. Where on the one side, a shared pool of resources facilitates faster processing with limited resources, this mechanism also widens the scope of many kinds of security attacks on the other side. Side-channel attack (SCA) is one such attack where methods to monitor the activity of exploited shared resource is carried out to extract the private key. One such SCA, branch prediction analysis attack, launched with time-driven attack (TDA) method is considered in this paper. With the consideration of the virtualization environment, proposal of an algorithm Trinetra, to detect the presence of cross-VM TDA, is the primary focus of our paper. We have tested the performance of Trinetra with experimental analysis in addition to the attack simulation. Performance evaluation has found the Trinetra very effective with negligible performance overhead.