title: Is it possible to temporarily suppress Intel CET for a single ret instruction, or otherwise use retpolines with it?
body: <p>Intel CET (control-flow enforcement technology) consists of two pieces: SS (shadow stack) and IBT (indirect branch tracking). If you need to indirectly branch to somewhere that you can't put an <code>endbr64</code> for some reason, you can suppress IBT for a single <code>jmp</code> or <code>call</code> instruction with <code>notrack</code>. Is there an equivalent way to suppress SS for a single <code>ret</code> instruction?</p>
  
  <p>For context, I'm thinking about how this will interact with retpolines, which the key control flow of goes more-or-less like <code>push real_target; call retpoline; pop junk; ret</code>. If there's not a way to suppress SS for that <code>ret</code>, then is there some other way for retpolines to work when CET is enabled? If not, what options will we have? Will we need to maintain two sets of binary packages for everything, one for old CPUs that need retpolines, and one for new CPUs that support CET? And what about if Intel turns out to be wrong, and we do end up still needing retpolines on their new CPUs? Will we have to abandon CET to use them?</p>