ENDBR32

ENDBR32 marks the valid targets of indirect CALLs and JMPs in 32-bit code, in legacy protected mode and in compatibility mode, for the indirect branch tracking of Intel’s CET. It is ENDBR64’s twin for those modes, and that page explains the tracking and the 0F 1E hint space that makes both a NOP on processors without it. The two differ only in their last byte: F3 0F 1E FB for ENDBR32, F3 0F 1E FA for ENDBR64.

The mode decides, not the program#

Each one ends a tracked branch only in its own modes. In 64-bit mode ENDBR32 is a NOP that does not reset the tracker, so an indirect branch that lands on it there raises #CP as on any other instruction, and in 32-bit code ENDBR64 is just as wrong. What counts is the mode, not the size of pointers: with -mx32 -fcf-protection=branch, GCC 14 and Clang 23 at -O2 still begin functions with ENDBR64, as x32 code runs in 64-bit mode. With -m32 both emit ENDBR32, at the start of every function that can be reached indirectly, as they do with ENDBR64 for 64-bit code.

Tracking state of its own#

User and supervisor code have separate trackers, enabled by IA32_U_CET and IA32_S_CET, and ENDBR32 returns the tracker of the current privilege level to idle, as ENDBR64 does. A 32-bit program under a 64-bit kernel runs in compatibility mode, where ENDBR32 is the marker, while the kernel’s own 64-bit code needs ENDBR64.

On this machine#

This Zen 5 reported no indirect branch tracking in CPUID (leaf 7, EDX bit 20 clear) and ran both recorded cases as a NOP, changing no register and no flag. AMD’s manuals describe CET’s shadow stacks but list neither ENDBR32 nor ENDBR64; the bytes are a hint NOP there, as on any processor that has no tracking.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

pass                             # a NOP in 64-bit mode
# where it ends the branch, outside 64-bit mode, it clears TRACKER and
# SUPPRESS as ENDBR64 does. In 64-bit mode it does not: after an
# indirect CALL or JMP with tracking on, it is the wrong instruction
# and raises #CP(ENDBRANCH) before it runs, as any but ENDBR64 would

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More CET instructions

• CLRSSBSY
• ENDBR64
• INCSSPD
• INCSSPQ
• RDSSPD
• RDSSPQ
• RSTORSSP
• SAVEPREVSSP
• SETSSBSY
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ