System
IBHF
Indirect Branch History Fence: in ring 0 with BHI_DIS_S set, keeps branch history from before the fence from steering the predicted targets of later indirect branches.
- CPUID
- BHI_CTRL
CPUID.(EAX=07H,ECX=2):EDX[4] - Instructions
- 1 mnemonic
- Processors
- Arrow Lake, Panther Lake, Nova Lake
Branch history injection (BHI) attacks let one context influence the predicted targets of indirect branches in another through the shared branch history. Intel’s BHI_DIS_S control, enumerated by the BHI_CTRL bit CPUID.(EAX=07H,ECX=2):EDX[4], limits that for the kernel. IBHF, the indirect branch history fence, adds a finer tool: while BHI_DIS_S is set, indirect branches after the fence executed in rings 0 to 2 do not use branch history from before it (return predictions excepted).
IBHF is encoded as F3 48 0F 1E F8 and exists only in 64-bit mode. It has an effect only when executed in ring 0, and on processors without BHI_DIS_S it executes as a NOP.
Instructions
| Mnemonic | Summary | Forms |
|---|---|---|
| IBHF | Indirect branch history fence: in ring 0 with BHI_DIS_S set, stops older branch history from steering later indirect branches; a no-op without BHI_CTRL. | 1 |
CPUID and processors
XED splits IBHF into 1 ISA set. Software can use a form when the processor reports every CPUID bit of one alternative of the form's ISA set.
| ISA set | CPUID | Processors in XED |
|---|---|---|
IBHF | BHI_CTRL | Arrow Lake, Panther Lake, Nova Lake |
Sources
- Intel XED v2026.08.23 (commit
0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model. - Intel: Branch History Injection and Intra-mode Branch Target Injection
The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.