Orc compiled code is not friendly to Intel IBT

IBT (indirect branch tracking) is a new security feature which marks indirect branch targets specially, and causes a SIGSEGV if the target of an indirect branch is not marked properly. In order for IBT to be enabled, all shared libraries need to be marked as IBT-enabled, and in turn this means that all object files need to be marked as IBT-enabled. For an object file to be IBT-enabled, you should compile it with -fcf-protection. For most packages, distributions can just blindly add the flag, but not for Orc.

The problem in Orc is that any run-time generated code is going to be the target of an indirect branch (and also any extern symbol can potentially be one). Therefore, -fcf-protection support must be placed directly in Orc. If the compiler supports the -fcf-protection option, in order to support IBT Orc should generate an endbr32 or endbr64 instruction (respectively for 32-bit or 64-bit code) at the top of every function it generates.