On Tue, Oct 13, 2026 at 11:06:14AM +0200, Peter Zijlstra wrote: > On Tue, Oct 13, 2026 at 01:37:03AM -0700, Kees Cook wrote: > > On Tue, Oct 13, 2026 at 08:44:05AM +0200, Peter Zijlstra wrote: > > > On Mon, Oct 12, 2026 at 11:41:03AM -0700, Kees Cook wrote: > > > > Clang never has this jump: with retpolines, LLVM's IndirectBrExpand pass > > > > turns the label addresses into indexes and the "goto *" into a switch, > > > > which Clang's -fno-jump-tables then makes a compare tree. So it's only > > > > constructed this way under GCC, but since now we can turn on kCFI with > > > > GCC, the objtool warning about indirects without kcfi protection trips. > > > > > > OK, then the next question; do we *want* to allow a 'naked' indirect > > > branch to survive? > > > > I originally struggled about this. I'd really rather that GCC not codgen > > like this at all. On the other hand, it's a bounded load and jump through > > an .rodata table, so that's kind of a manual CFI. :P (And if it gets > > targeted via ROP, it doesn't matter: everything is a target then.) > > With IBT enabled, I would image GCC will also spray ENDBR around like > there is no tomorrow :/
And that would in turn cause more problems for FineIBT evasion, since that more or less depends on ENDBR being followed by the hash check. With FRED we got rid of the 'naked' ENDBR instances on entry, but now we get them here :-(
