Regarding hardware features that support control-flow integrity, which correctly pairs what protects returns from functions with what protects indirect calls and jumps such as those through function pointers?

Answer: A. Returns are protected by shadow stacks or pointer authentication; indirect calls and jumps by mechanisms requiring a designated marker instruction at the start of the target

A shadow stack compares the return address with its copy, and pointer authentication checks the authentication code attached to the return address, so both protect returns from functions. For indirect calls and jumps, Intel IBT and Arm Branch Target Identification require a marker instruction at the start of the target (ENDBR64 on x86) and turn branches into the middle of functions and the like into exceptions. However, any place with a marker can still be reached from any indirect branch, so these features are sometimes combined with finer checks by the compiler that restrict targets to functions of a matching type. KPTI is a countermeasure against Meltdown and the IOMMU restricts device DMA; neither protects control flow.

• A. Correct. Returns and indirect branches are protected by different mechanisms.
• B. The pairing is reversed. Marker instructions protect the targets of indirect branches and shadow stacks protect returns.
• C. Neither KPTI nor the IOMMU is a mechanism for protecting control flow.