Re: [PATCH v22 8/8] x86/vdso: Add ENDBR64 to __vdso_sgx_enter_enclave

On 3/12/21 8:55 AM, Jarkko Sakkinen wrote:

quoted

ENDBR is a special new instruction for the Indirect Branch Tracking
(IBT) component of CET.  IBT prevents attacks by ensuring that (most)
indirect branches and function calls may only land at ENDBR
instructions.  Branches that don't follow the rules will result in
control flow (#CF) exceptions.

ENDBR is a noop when IBT is unsupported or disabled.  Most ENDBR
instructions are inserted automatically by the compiler, but branch
targets written in assembly must have ENDBR added manually, like this one.

Thank you, this clears the whole thing a lot.

Doesn't this mean that it could be there just as well unconditionally?

It could be there unconditionally.  But, I think it's still worth the
#ifdef just out of the principle of being as tidy as possible.  The
#ifdef is basically as low cost and low complexity as you get.  It is
also somewhat self-documenting: "This instruction is only necessary when
your CPU supports IBT".