On Wed, Apr 28, 2021 at 7:48 AM David Laight [off-list ref] wrote:

From: Yu-cheng Yu

quoted

Sent: 27 April 2021 21:47

Control-flow Enforcement (CET) is a new Intel processor feature that blocks
return/jump-oriented programming attacks.  Details are in "Intel 64 and
IA-32 Architectures Software Developer's Manual" [1].

...

Does this feature require that 'binary blobs' for out of tree drivers
be compiled by a version of gcc that adds the ENDBRA instructions?

If enabled for userspace, what happens if an old .so is dynamically
loaded?
Or do all userspace programs and libraries have to have been compiled
with the ENDBRA instructions?

If you believe that the userspace tooling for the legacy IBT table
actually works, then it should just work.  Yu-cheng, etc: how well
tested is it?

--Andy