JIT: Add IBT support

Indirect Branch Tracking (IBT) is part of Intel's Control-Flow
Enforcement Technology (CET). IBT is hardware based, forward edge
Control-Flow-Integrity mechanism where any indirect CALL/JMP must target
an ENDBR instruction or suffer #CP.

This commit adds IBT support for JIT:
1. Add endbr32/64 instruction in Dynasm.
2. Insert endbr32/64 in indirect branch target for jitted code.

gcc support CET since v8.1 and set it to default since gcc 11. With this
commit, endbr is inserted in jitted code if PHP is compiled with "gcc
-fcf-protection=full/branch".

Signed-off-by: Chen, Hu <hu1.chen@intel.com>

Author: chen-hu-97

ext/opcache/jit/dynasm/dasm_x86.lua

@@ -1147,6 +1147,8 @@ local map_op = {
   rep_0 =	"F3",
   repe_0 =	"F3",
   repz_0 =	"F3",
+  endbr32_0 =	"F30F1EFB",
+  endbr64_0 =	"F30F1EFA",
   -- F4: *hlt
   cmc_0 =	"F5",
   -- F6: test... mb,i; div... mb

ext/opcache/jit/zend_jit_x86.dasc

@@ -1623,6 +1623,16 @@ static size_t tsrm_tls_offset;
 ||	}
 |.endmacro
 
+|.macro ENDBR
+||#if defined (__CET__) && (__CET__ & 1) != 0
+|	.if X64
+|		endbr64
+|	.else
+|		endbr32
+|	.endif
+||#endif
+|.endmacro
+
 static bool reuse_ip = 0;
 static bool delayed_call_chain = 0;
 static uint32_t  delayed_call_level = 0;
@@ -2322,7 +2332,7 @@ static int zend_jit_hybrid_func_hot_counter_stub(dasm_State **Dst)
 	}
 
 	|->hybrid_func_hot_counter:
-
+	|	ENDBR
 	return zend_jit_hybrid_hot_counter_stub(Dst,
 		((ZEND_JIT_COUNTER_INIT + JIT_G(hot_func) - 1) / JIT_G(hot_func)));
 }
@@ -2334,7 +2344,6 @@ static int zend_jit_hybrid_loop_hot_counter_stub(dasm_State **Dst)
 	}
 
 	|->hybrid_loop_hot_counter:
-
 	return zend_jit_hybrid_hot_counter_stub(Dst,
 		((ZEND_JIT_COUNTER_INIT + JIT_G(hot_loop) - 1) / JIT_G(hot_loop)));
 }
@@ -2379,7 +2388,7 @@ static int zend_jit_hybrid_func_trace_counter_stub(dasm_State **Dst)
 	}
 
 	|->hybrid_func_trace_counter:
-
+	|	ENDBR
 	return zend_jit_hybrid_trace_counter_stub(Dst,
 		((ZEND_JIT_COUNTER_INIT + JIT_G(hot_func) - 1)  / JIT_G(hot_func)));
 }
@@ -2391,7 +2400,7 @@ static int zend_jit_hybrid_ret_trace_counter_stub(dasm_State **Dst)
 	}
 
 	|->hybrid_ret_trace_counter:
-
+	|	ENDBR
 	return zend_jit_hybrid_trace_counter_stub(Dst,
 		((ZEND_JIT_COUNTER_INIT + JIT_G(hot_return) - 1) / JIT_G(hot_return)));
 }
@@ -2403,7 +2412,7 @@ static int zend_jit_hybrid_loop_trace_counter_stub(dasm_State **Dst)
 	}
 
 	|->hybrid_loop_trace_counter:
-
+	|	ENDBR
 	return zend_jit_hybrid_trace_counter_stub(Dst,
 		((ZEND_JIT_COUNTER_INIT + JIT_G(hot_loop) - 1) / JIT_G(hot_loop)));
 }
@@ -3049,6 +3058,7 @@ static int zend_jit_align_func(dasm_State **Dst)
 
 static int zend_jit_prologue(dasm_State **Dst)
 {
+	|	ENDBR
 	if (zend_jit_vm_kind == ZEND_VM_KIND_HYBRID) {
 		|	SUB_HYBRID_SPAD
 	} else if (GCC_GLOBAL_REGS) {