Intel Sends Out Latest Patches Preparing Linux CET Virtualization

Since Linux 5.18 there has been Indirect Branch Tracking (IBT) in the mainline kernel that was contributed by Intel as part of their Control-flow Enforcement Technology (CET). For Linux 6.4 Intel engineers tried to get the Shadow Stack support mainlined as the other part of CET, but issues were uncovered at the last minute. Hopefully Shadow Stack support will be merged for the v6.5 cycle but beyond that host support, Intel engineers have also been working on CET virtualization for enabling these security features for use within virtual machines.

Today marks the third iteration of the patches from Intel for CET virtualization for leveraging these CPU hardware features -- found since Intel Tiger Lake processors -- to help fend off ROP/JOP style control-flow subversion attacks within VMs.

The current patches get Control-flow Enforcement Technology working for user Shadow Stack and Indirect Branch Tracking as well as kernel Indirect Branch Tracking support. Intel CET supervisor Shadow Stack support is left to be worked on in the future.

Besides needing this pending code as well as the Shadow Stack code not yet mainlined as of v6.4, there are also some pending QEMU patches needed for this CET virtualization. Those interested in the latest kernel patches for this effort, they can be found via this LKML patch series. The v3 patches have been re-based against linux-next and contain several fixes over the prior patch iterations.