Indirect Branch Tracking Ready Ahead Of Linux 5.18

Indirect Branch Tracking (IBT) as part of Intel's Control-flow Enforcement Technology (CET) is set to be supported as part of the upcoming Linux 5.18 kernel. Last night the IBT patch series has queued into TIP's x86/core ahead of the Linux 5.18 merge window.

Indirect Branch Tracking is hardware-based, course-grain forward-edge Control Flow Integrity (CFI) protection. When enabled for the kernel build, it ensures indirect calls land on an ENDBR instruction. Besides all of the Linux kernel patches to make IBT a reality, there is compiler-side support necessary that means GCC 9 and newer or LLVM Clang 14 and newer.

IBT is for protecting against jump/call oriented programming attacks. Indirect Branch Tracking is part of Intel CET found since Tiger Lake. The other portion of CET is the Intel Shadow Stack also seeing Linux work.

While Intel was recently focusing more on the Shadow Stack (SS) patches and shifted IBT to the back-burner, well known kernel developer Peter Zijlstra of Intel recently began working on the IBT support for Linux. He's been sending out many revisions to the patches and now it looks like everything is good to go for Linux 5.18.

After sending out the latest round yesterday, the latest milestone is as of last night all the IBT kernel patches were queued into TIP's x86/core Git thus putting it on the platter for Linux 5.18. This security feature can be enabled with the X86_KERNEL_IBT option when building the Linux kernel with GCC 9+ or Clang 14+.