Re: [PATCH] x86: Document -mno-cet-switch

[Florian Weimer <fweimer@redhat.com>]

* H. J. Lu:

>> NOTRACK avoids the need for ENDBR instructions, right?  That's a
>> hardening improvement, so it should be used by default.
>
> NOTRACK weakens IBT since it disables IBT on the indirect jump instruction.
> GCC uses it in the jump table to avoid ENDBR.

Typical jump table code looks like this:

Dump of assembler code for function __cache_sysconf:
   0x00000000000f7a80 <+0>:	endbr64 
   0x00000000000f7a84 <+4>:	sub    $0xb9,%edi
   0x00000000000f7a8a <+10>:	cmp    $0xc,%edi
   0x00000000000f7a8d <+13>:	ja     0xf7b70 <__cache_sysconf+240>
   0x00000000000f7a93 <+19>:	lea    0xba926(%rip),%rdx        # 0x1b23c0
   0x00000000000f7a9a <+26>:	movslq (%rdx,%rdi,4),%rax
   0x00000000000f7a9e <+30>:	add    %rdx,%rax
   0x00000000000f7aa1 <+33>:	notrack jmp *%rax

There's no ENDBR instruction between range check, the address
computation, and the NOTRACK JMP, so it's not possible to redirect that
JMP to some other place.

I don't know if GCC systematically enforces this in its optimizers,
though.

Thanks,
Florian