* H. J. Lu: >> NOTRACK avoids the need for ENDBR instructions, right? That's a >> hardening improvement, so it should be used by default. > > NOTRACK weakens IBT since it disables IBT on the indirect jump instruction. > GCC uses it in the jump table to avoid ENDBR.
Typical jump table code looks like this: Dump of assembler code for function __cache_sysconf: 0x00000000000f7a80 <+0>: endbr64 0x00000000000f7a84 <+4>: sub $0xb9,%edi 0x00000000000f7a8a <+10>: cmp $0xc,%edi 0x00000000000f7a8d <+13>: ja 0xf7b70 <__cache_sysconf+240> 0x00000000000f7a93 <+19>: lea 0xba926(%rip),%rdx # 0x1b23c0 0x00000000000f7a9a <+26>: movslq (%rdx,%rdi,4),%rax 0x00000000000f7a9e <+30>: add %rdx,%rax 0x00000000000f7aa1 <+33>: notrack jmp *%rax There's no ENDBR instruction between range check, the address computation, and the NOTRACK JMP, so it's not possible to redirect that JMP to some other place. I don't know if GCC systematically enforces this in its optimizers, though. Thanks, Florian
