Skip to content
STIMSMITH

Branch Target Buffer (BTB)

Concept WIKI v1 · 6/21/2026

The Branch Target Buffer (BTB) is a hardware structure within a CPU's branch predictor that caches branch target addresses to accelerate instruction fetching. It is one of the primary structures supporting instruction fetch efficiency alongside the L1 instruction cache and the instruction TLB.

Branch Target Buffer (BTB)

Overview

The Branch Target Buffer (BTB) is a specialized hardware structure that is part of a CPU's branch prediction logic. It records the target Program Counter (PC) address of previously executed branch instructions so that the address can be determined quickly when the same branch is encountered again [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd]. By caching target addresses, the BTB helps expedite the determination of branch-taken addresses during instruction fetch.

Role in the Instruction Fetch Unit

In a typical superscalar processor pipeline, the Instruction Fetch (IF) stage is responsible for fetching instructions from the instruction cache and predicting the next PC address. The dynamic predictor used during this stage comprises several key components [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd]:

  • Branch History Table (BHT): maintains a history of branch outcomes (taken/not-taken) using a GShare indexing scheme to predict branch direction.
  • Branch Target Buffer (BTB): records the target PC address of each branch instruction, expediting the determination of branch-taken addresses.
  • Return Address Stack (RAS): stores return addresses of decoded function calls; when a return instruction is encountered, the popped RAS entry is used as the next predicted PC address.

During IF, the BTB provides target PC candidates (Target PC 1, Target PC 2) along with hit signals (Hit 1, Hit 2) for the two fetched instructions. The Selection Logic then combines these with the BHT's taken/not-taken predictions and the RAS to produce the next PC addresses (NextPC1, NextPC2) [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd].

Importance for Instruction Fetch Efficiency

Efficiency in instruction fetching is critical to CPU performance, and this requires the primary structures—L1 instruction caches (L1i), Branch Target Buffers (BTB), and instruction TLBs (iTLB)—to have the requisite information when needed [chunk:arxiv-2406.06738]. When the primary BTB lacks an entry, the fetch engine stalls while the entry is obtained, harming performance.

Microarchitectural Implementation Considerations

The BTB's size and associativity are configurable microarchitectural parameters that can be tuned during CPU design. RISC-V cores, in particular, expose BTB size as a configurable knob alongside other branch predictor structures like BHT size, cache associativity, and bus interfaces [chunk:7883121c-43ce-4f2e-9a78-4177f693093d].

Verification Aspects

Verifying a BTB requires comprehensive functional coverage. Typical coverpoints include reading from every line of the BTB array, writing to every line of the BTB array, and verifying the BTB is full/empty states [chunk:19b185d2-3db7-47d0-a06b-7cb3fd060b53]. In a representative RISC-V superscalar design, the BTB array consists of 256 lines with two read ports [chunk:19b185d2-3db7-47d0-a06b-7cb3fd060b53]. Coverage is closed when every line has been both read and written, and the boundary conditions (full/empty) have been exercised.

Security Relevance

Understanding the BTB's design and implementation provides valuable insights for both compiler optimization and the mitigation of hardware attacks such as Spectre, since the BTB plays a critical role in branch prediction [chunk:arxiv-2412.05413]. The proprietary nature of dominant CPUs (Intel, AMD, Apple, Qualcomm) means specific BTB implementation details are not publicly available, motivating reverse-engineering efforts [chunk:arxiv-2412.05413].

Related Structures

  • Branch Predictor: The BTB is a component of the branch predictor subsystem, which also includes the BHT and RAS [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd].
  • Branch History Table (BHT): Works in conjunction with the BTB to predict both direction and target of branches [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd].
  • Return Address Stack (RAS): Complements the BTB for function return address prediction [chunk:ddb97f7c-4c0b-40b5-9a11-820c4d7125cd].
  • L1 Instruction Cache (L1i): Another primary structure critical to instruction fetch efficiency [chunk:arxiv-2406.06738].
  • Instruction TLB (iTLB): Provides virtual-to-physical address translation for instruction fetches [chunk:arxiv-2406.06738].

LINKED ENTITIES

1 links
branch predictor PART_OF

CITATIONS

5 sources
5 citations
[1] The BTB records the target PC address of each branch instruction to expedite the determination of branch-taken addresses. UVM-based verification of RISC-V superscalar processors
[2] The BTB is one of the primary structures (alongside L1i and iTLB) critical to instruction fetch efficiency. Improving Instruction Fetch Efficiency via High-Level Program Map Traversal
[3] BTB size and associativity are configurable microarchitectural parameters in RISC-V cores. Inside RISC-V: Navigating the RTL Design & Verification Landscape
[4] BTB verification requires coverage of read/write to every BTB array line and full/empty states; example design has 256 lines with two read ports. UVM-based verification of RISC-V superscalar processors
[5] BTB design and implementation are relevant for compiler optimization and mitigation of hardware attacks such as Spectre. Branch Target Buffer Reverse Engineering on Arm