Branch Target Buffer

Concept

A Branch Target Buffer (BTB) is a hardware branch-prediction structure in the CPU front-end that caches branch target PC addresses for speculative fetch. It works alongside the Branch History Table (BHT) and Return Address Stack (RAS), interacts tightly with the L1 instruction cache, is the target of reverse-engineering studies on both x86 and ARM, and is a key microarchitectural resource exploited by Spectre-V2 transient-execution attacks.

First seen 5/27/2026

Last seen 6/13/2026

Evidence 7 chunks

Wiki v4

WIKI

Overview

A Branch Target Buffer (BTB) is a branch-prediction structure used by the instruction-fetch path of a CPU. It records the target Program Counter (PC) address of branch instructions so the processor can determine taken-branch destinations more quickly. In a cited RISC-V superscalar processor description, the Instruction Fetch (IF) unit fetches instructions from the instruction cache, predicts the next PC, and includes a BTB as part of its dynamic predictor alongside the Branch History Table (BHT) and the Return Address Stack (RAS). [C1]

Role in the Branch Prediction Subsystem

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections

mispredicted path fuzzing ← uses 95% 2e

Mispredicted path fuzzing manipulates Branch Target Buffer entries to generate atypical addresses.

Logic Fuzzer ← uses 100% 2e

Logic Fuzzer fuzzes Branch Target Buffer entries to generate atypical instruction addresses.

Rocket Core part of → 80% 1e

The Branch Target Buffer (BTB) is a component of the Rocket Core processor shown in coverage breakup.

Instruction Fetch Unit part of → 98% 1e

The BTB is a component of the dynamic predictor in the instruction fetch unit.

branch predictor part of → 95% 1e

The BTB is a component of the branch predictor.

Spectre-V2 ← uses 100% 1e

Spectre-V2 exploits the Branch Target Buffer by using different arguments to switch between training and exploiting.

LINKED ENTITIES

2 links

Spectre-V2 USES Extracted graph relationship

Rocket Core mentioned_in_block_diagram In the ProcessorFuzz RTL coverage illustration, BTB is shown as a named block within the Rocket Core RTL alongside DCache, MulDiv, and other blocks.

CITATIONS

7 sources

7 citations — click to expand

[1] The BTB is part of the IF unit's dynamic predictor and records branch target PC addresses alongside the BHT and RAS. ProcessorFuzz: Processor Fuzzing with Control and Status Register Transition

[2] BTB full/empty, read-every-line, and write-every-line coverpoints are part of IF-unit functional coverage, alongside BHT and RAS coverpoints. ProcessorFuzz: Processor Fuzzing with Control and Status Register Transition

[3] BTB appears as a named RTL block in the Rocket Core coverage illustration in ProcessorFuzz, alongside DCache, MulDiv, and the Rocket core. ProcessorFuzz: Processor Fuzzing with Control and Status Register Transition

[4] Spectre-V2 requires different arguments (a0) to switch between training and exploiting the BTB with the same code, unlike Spectre-V1 whose training and transient sections are independent as long as branch instructions share an address offset. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing

[5] Modern industry trend uses large BTBs (hundreds of KB per core) with a decoupled front-end providing fetch-directed L1I instruction prefetching; BTB and L1I misses remain frequent in server workloads; academic techniques like BTB prefetching have not provided significant gains on modern cores. Micro BTB: A High Performance and Lightweight Last-Level Branch Target Buffer for Servers

[6] The MicroBTB stores branch targets as offsets relative to the branch instruction, enabling multiple branches per entry; a 4K-entry MBTB provides 17.61% performance improvement over an 8K-entry baseline with 47.5 KB storage savings per core on 100 industry-provided server workloads. Micro BTB: A High Performance and Lightweight Last-Level Branch Target Buffer for Servers

[7] On the Raspberry Pi 4B Cortex-A72, reverse-engineered BTB parameters are 4K-entry capacity, 11-bit set index from bit 5 to bit 15 of the PC, and 2 ways per set; this is the first ARM BTB reverse-engineering work, extending prior x86 methodologies via ARM-specific PMU events. Branch Target Buffer Reverse Engineering on Arm