ENDBR64

ENDBR64 marks an address as a valid target of an indirect CALL or JMP in 64-bit code. It belongs to the indirect branch tracking of Intel’s CET: while tracking is on, an indirect CALL or JMP must land on an ENDBR64, or the processor raises #CP at the target, before it runs the instruction there. ENDBR64 itself changes no register and no flag; it only returns the tracker to its idle state. Without tracking it is a NOP: on processors without CET, while tracking is off, and outside 64-bit mode, where ENDBR32 does its job.

Four bytes of NOP space#

F3 0F 1E FA lies in the reserved hint space 0F 18 to 0F 1F that the NOP page describes, so the same binary runs everywhere: a CET-aware processor checks the marks, an older one skips them. Direct CALLs and JMPs, conditional jumps and RET are not tracked; RET is the shadow stack’s business. AMD’s manuals describe CET’s shadow stacks but not this tracking, and list no ENDBR64. This Zen 5 reported no indirect branch tracking in CPUID and ran both recorded cases as a NOP.

Where compilers put it#

GCC 14 and Clang 23 emit ENDBR64 only when asked, with -fcf-protection=branch or =full. Then at -O2:

• every function that can be reached indirectly begins with it: every function with external linkage, and a static one whose address is taken. A static function only called directly gets none;
• it follows each call to setjmp, as longjmp comes back to that point with an indirect jump;
• the jump through a switch table carries a 3E prefix, notrack jmp, which exempts it where the OS allows, so the case labels need no ENDBR64;
• __attribute__((nocf_check)) leaves it out of a function.

Things to know#

• What it checks. Only that the target is some ENDBR64: a corrupted function pointer can still reach the start of any marked function, but not the middle of one.
• Separate trackers. User and supervisor mode each have their own state, enabled by IA32_U_CET and IA32_S_CET.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if cr4 >> 23 & 1:                # CR4.CET; a processor without CET
                                 # has it clear: then a NOP
    if CPL == 3:
        if u_cet >> 2 & 1:       # ENDBR_EN: tracking on
            u_cet = u_cet & ~0xC00
                                 # TRACKER back to IDLE, SUPPRESS
                                 # cleared, whatever they were
    elif s_cet >> 2 & 1:
        s_cet = s_cet & ~0xC00
# outside 64-bit mode a NOP that ends no branch: ENDBR32 does there.
# AMD's manuals describe CET's shadow stacks only, not this tracking,
# and list no ENDBR64, whose bytes are a hint NOP there as on older
# processors

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More CET instructions

• CLRSSBSY
• ENDBR32
• INCSSPD
• INCSSPQ
• RDSSPD
• RDSSPQ
• RSTORSSP
• SAVEPREVSSP
• SETSSBSY
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ