@@ -1074,7 +1074,7 @@ Enable shadow stack built-in functions from Control-flow Enforcement
Technology (CET).
mcet-switch
-Target Var(flag_cet_switch) Init(0)
+Target Var(flag_cet_switch) Init(1)
Turn on CET instrumentation for switch statements that use a jump table and
an indirect jump.
@@ -1455,7 +1455,7 @@ See RS/6000 and PowerPC Options.
-msse4a -m3dnow -m3dnowa -mpopcnt -mabm -mbmi -mtbm -mfma4 -mxop
-madx -mlzcnt -mbmi2 -mfxsr -mxsave -mxsaveopt -mrtm -mhle -mlwp
-mmwaitx -mclzero -mpku -mthreads -mgfni -mvaes -mwaitpkg
--mshstk -mmanual-endbr -mcet-switch -mforce-indirect-call
+-mshstk -mmanual-endbr -mno-cet-switch -mforce-indirect-call
-mavx512vbmi2 -mavx512bf16 -menqcmd
-mvpclmulqdq -mavx512bitalg -mmovdiri -mmovdir64b -mavx512vpopcntdq
-mavx5124fmaps -mavx512vnni -mavx5124vnniw -mprfchw -mrdpid
@@ -34886,16 +34886,15 @@ function attribute. This is useful when used with the option
@option{-fcf-protection=branch} to control ENDBR insertion at the
function entry.
+@opindex mno-cet-switch
@opindex mcet-switch
-@item -mcet-switch
-By default, CET instrumentation is turned off on switch statements that
-use a jump table and indirect branch track is disabled. Since jump
-tables are stored in read-only memory, this does not result in a direct
-loss of hardening. But if the jump table index is attacker-controlled,
-the indirect jump may not be constrained by CET. This option turns on
-CET instrumentation to enable indirect branch track for switch statements
-with jump tables which leads to the jump targets reachable via any indirect
-jumps.
+@item -mno-cet-switch
+When @option{-fcf-protection=branch} is enabled, by default, switch statements
+that use a jump table are instrumented to use ENDBR instructions and constrain
+the indirect jump with CET to protect against an attacker-controlled jump table
+index. @option{-mno-cet-switch} generates a NOTRACK indirect jump and removes
+ENDBR instructions, which may make the jump table smaller at the cost of an
+unprotected indirect jump.
@opindex mcall-ms2sysv-xlogues
@opindex mno-call-ms2sysv-xlogues
@@ -1,6 +1,6 @@
/* Verify that CET works. */
/* { dg-do compile } */
-/* { dg-options "-O -fcf-protection" } */
+/* { dg-options "-O -fcf-protection -mno-cet-switch" } */
/* { dg-final { scan-assembler-times "endbr32" 1 { target ia32 } } } */
/* { dg-final { scan-assembler-times "endbr64" 1 { target { ! ia32 } } } } */
/* { dg-final { scan-assembler-times "notrack jmp\[ \t]+\[*]" 1 } } */
@@ -1,6 +1,6 @@
/* Verify that CET works. */
/* { dg-do compile } */
-/* { dg-options "-O -fcf-protection -mcet-switch" } */
+/* { dg-options "-O -fcf-protection" } */
/* { dg-final { scan-assembler-times "endbr32" 12 { target ia32 } } } */
/* { dg-final { scan-assembler-times "endbr64" 12 { target { ! ia32 } } } } */
/* { dg-final { scan-assembler-times "\[ \t]+jmp\[ \t]+\[*]" 1 } } */