BeKnight+: Mitigating Information Leakage in Speculatively-updated Branch Predictor
Published in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (TCAD), 2026
Information leakage through processor microarchitectural components exploiting speculative execution is raising significant security concerns. Modern commercial processors incorporate branch predictor designs where internal states of branch predictor structures are speculatively updated. Recent studies have shown that speculatively updated branch predictors allow side channel exploitation in the speculative domain, extending branch predictors to be another source of transmitting medium in transient execution attacks. While postponing updates of branch predictor states at a later time (e.g., during commit) can avoid exploitation in the speculation domain, it can result in belated correction of prediction outcomes (e.g., branch direction), leading to non-trivial degradation of prediction performance. In this paper, we present BeKnight+, a secure branch predictor design that defeats speculative side channels targeting the branch direction prediction structure as the source of leakage. BeKnight+ aims to retain the performance advantage of early branch predictor updates (i.e., at resolution time) while ensuring no transient leakage. To achieve this, BeKnight+ conscientiously tracks the ownership and speculative changes of potentially unsafe pattern history entries using a small Speculative Pattern Lookaside Buffer (SPLB). BeKnight+ efficiently audits the use of pattern history by allowing subsequent predictions in the same domain to benefit from early updates while annulling potential leakage through ensuring architecturally correct pattern is used on detection of a domain conflict.
Recommended citation: M. H. I. Chowdhuryy, Z. Zhang, and F. Yao, “BeKnight+: Mitigating information leakage in speculatively-updated branch predictor,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (TCAD), 2026.
Recommended citation: M. H. I. Chowdhuryy, Z. Zhang, and F. Yao, “BeKnight+: Mitigating information leakage in speculatively-updated branch predictor,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems (TCAD), 2026.
Download Paper