Arm Branch Target Identification/Intel CET & jump table

jump-table.sh

PATH=/tmp/Rel/bin:$PATH
cat > switch.cc <<e
#define DO A(0) A(1) A(2) A(3) A(4) A(5) A(6) A(7) A(8) A(9) A(10) A(11) A(12) A(13)
#define A(i) void bar##i();
DO
#undef A
void ext();
void foo(int i) {
  switch (i) {
#define A(i) case i: bar##i(); break;
    DO
  default: __builtin_unreachable();
  }
  ext();
}
e
aarch64-linux-gnu-g++ -S -O2 switch.cc -mbranch-protection=bti -o a64-gcc.s
clang++ -S --target=aarch64-linux-gnu -O2 switch.cc -mbranch-protection=bti -o a64-clang.s
g++ -S -O2 switch.cc -fcf-protection=branch -o x86_64-gcc.s
clang++ -S --target=x86_64-linux-gnu -O2 switch.cc -fcf-protection=branch -o x86_64-clang.s

There are two interesting differences between AArch64 and x86.

Indirect branch target indicator

x86 code generates notrack jmp *%rax to disable IBT checking for this indirect branch.

Bound checking

The presence of __builtin_unreachable(); causes x86_64-gcc to remove a bound check cmpl $13, %edi.
This, combined with movslq (%rdx,%rdi,4), %rax; addq %rdx, %rax; notrack jmp *%rax, creates a powerful JOP gadget for malicious users.

AArch64 made a decision to keep the bound checking despite an unreachable default case.
The LLVM side decision was made in July 2023 https://reviews.llvm.org/D155485 .

---

AArch64 needs more cases to generate a jump table.
(Clang can toggle the threshold using -mllvm -aarch64-min-jump-table-entries=4 (default: 13).)
The extra branch target indicator wastes space but the waste is probably less noticeable.
In contrast, x86 generates jump tables in more cases.