A Technical Deep Dive Into Intel CET Implementation in Linux
summary
Detailed Linux kernel plumbing for Intel CET: IBT enforces forward-edge targets with the ENDBR opcode and a sealed IBT table (merged in Linux 5.18), while hardware-backed shadow stacks validate returns using the Shadow Stack Pointer (SSP) and produce a control protection fault (vector 21) on mismatch. Userspace shadow stacks appear in Linux 6.6 (default shadow stack size up to 8 MiB, guard page mapped above 4 GiB). Kernel handles sigframe tokens, XSAVE/restore of SSP across context switches, arch_prctl(2) opt-in, GLIBC_TUNABLES override, JIT and map_shadow_stack are unresolved edge cases.
AI-written summary · about
chapters (17)
- 0:00Intel CET introduction
- 1:31Control flow integrity importance
- 4:20Intel CET technology pillars
- 5:45Indirect branch tracking in Linux
- 8:09ENDBR compilation and runtime
- 10:17Safe ENDBR generation in kernel
- 11:21Control protection exceptions
- 13:16Shadow stacks and validation
- 14:18Kernel setup for shadow stack
- 16:48Signals with shadow stacks
- 19:17Signal frame tokens snippet
- 20:00Fork/vfork/pthread shadow stack
- 21:27Context switching and SSP
- 22:17Enabling user shadow stacks
- 23:43Edge cases and challenges
- 25:33CET features timeline
- 26:38Q&A
related talks
01h 05mHow to Survive the Hardware Assisted Control-Flow Integrity Enforcement
58mFineIBT Enhanced: Hardening Linux’s Microarchitectural Security on X86
27mFiner-grained kernel control flow integrity and challenges
44mLinux Kernel Control-Flow Integrity Sup...
39mControl Flow Integrity in the Linux Kernel
41mRISC-V Control-Flow Integrity (CFI)
24mGuarded Control Stack on arm64: Challenges in Enabling Shadow Stack Support...
36mStatus of Embedded Linux