IBHF

IBHF, the indirect branch history fence, keeps branch history from before it out of the predictions of later indirect branches. Intel added it against the branch history form of intra-mode branch target injection, in which the attacker and the victim run in the same predictor mode. It works together with the BHI_DIS_S control: while that is set, indirect branches executed in rings 0 to 2 after the fence do not pick their predicted targets from the history of branches before it, return predictions from the return stack buffer excepted. The fence takes effect only when executed in ring 0, and the IBHF extension page gives the CPUID bit, BHI_CTRL.

A NOP elsewhere#

The encoding, F3 48 0F 1E F8, lies in the same hint-NOP space as ENDBR64 (F3 0F 1E FA), with a REX.W prefix, so a processor without BHI_DIS_S runs it as a NOP, and Intel states that it may be used on all processors. GNU objdump 2.44 prints the bytes as repz nop rax. The REX byte also explains why it exists only in 64-bit mode: in 32-bit code, 48h is DEC EAX, and objdump reads the same bytes as repz dec eax followed by nop eax. XED decodes the bytes as IBHF only when told that the processor has it, and as a hint NOP otherwise, which is why the probe left it unrun on Zen 5.

Where it goes#

Intel’s guidance places IBHF at the end of the software sequence that clears the branch history, so that one sequence serves old and new processors: on processors that enumerate BHI_NO, the short clearing sequence with IBHF is enough even without BHI_DIS_S, and a guest operating system can use the clearing sequence with IBHF at its end. Where BHI_DIS_S is available, setting it and executing IBHF is the preferred way to clear the history around classic BPF programs. On Arrow Lake and Lunar Lake, a microcode update may be needed for IBHF to take effect.

In our builds Clang 23’s assembler encodes ibhf as F3 48 0F 1E F8, while GNU as 2.44 rejects the mnemonic.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

pass                             # the indirect branches after it do
                                 # not predict from the history of
                                 # those before it
# a hint NOP (0F 1E /7) on a processor without IBHF

Operands

None: XED lists no operands for this form.

Flags

None: XED records no flag that the forms test or change.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.