-fcf-protection=branch should generate endbr instead of notrack jumps

[lvwr]

When -fcf-protection=branch is used, the compiler will generate jump tables where the indirect jump is prefixed with the NOTRACK prefix, so it can jump to non-ENDBR targets. Yet, for NOTRACK prefixes to work, the NOTRACK specific enable bit must be set, what renders the binary broken on any environment where this is not the case. In fact, having NOTRACK disabled was a design choice for the Linux kernel CET support [https://lkml.org/lkml/2022/3/7/1068].

With the above, the compiler should generate jump tables with ENDBRs, for proper correctness. And, if security regarding the additional ENDBRs is a concern, the code can be explicitly compiled with -fno-jump-tables.

This was also reported on gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104816

[lvwr]

quick reproducer, just in case: https://godbolt.org/z/TTexr89nx

[llvmbot]

@llvm/issue-subscribers-backend-x86