guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

fanquake · 2022-01-21T13:43:03Z

Arm Pointer Authentication (PAC) is a method of hardening code from Return Oriented Programming (ROP) attacks. It uses a tag in a pointer to sign and verify pointers. Branch Target Identification (BTI) is another code hardening method, where the branch/jump target is identified with a special landing pad instruction. Outside of some system support in glibc+kernel, packages gain the additional hardening by compiling with the -mbranch-protection=flag available in recent versions of GCC. In particular -mbranch-protection=standard enables both BTI and PAC, with backwards compatible to armv8.0 code sequences that activate on v8.3 (PAC) & v8.5 (BTI) enabled Arm machines. (taken from Fedora).

Creation of a BTI enabled binary also requires that everything being linked in be BTI enabled. This means you currently cannot, for example, cross-compile using a Ubuntu based aarch64 toolchain, if you're wanting to use this feature. This can be shown using -Wl,z,force-bti, which will emit warnings for linked objects that are not BTI enabled (this is used in configure to detect when to disable using the flags). i.e:

int main() { return 0; }

# aarch64-linux-gnu-g++ (Ubuntu 13.2.0-23ubuntu4) 13.2.0
aarch64-linux-gnu-g++ test.cpp -mbranch-protection=standard -Wl,-z,force-bti
/usr/lib/gcc-cross/aarch64-linux-gnu/13/../../../../aarch64-linux-gnu/bin/ld: /usr/lib/gcc-cross/aarch64-linux-gnu/13/../../../../aarch64-linux-gnu/lib/../lib/Scrt1.o: warning: BTI turned on by -z force-bti when all inputs do not have BTI in NOTE section.

Closes #19075.

DrahtBot · 2022-01-21T19:58:15Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/24123.

Reviews

See the guideline for information on the review process.

Type	Reviewers
Concept ACK	hebasto, laanwj, kristapsk

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

Conflicts

No conflicts as of last run.

hebasto · 2022-01-22T22:25:52Z

Concept ACK.

From reading docs it's still unclear to me whether -mbranch-protection=standard implies -mbranch-protection=bti?

$ ./test/lint/lint-git-commit-check.sh 
The subject line of commit hash f799135959461079a220c5ddc97ea9a6b0056b2b is followed by a non-empty line. Subject lines should always be followed by a blank line.

laanwj · 2022-01-25T16:00:02Z

Concept ACK.

We might want to wait with doing this until hardware supporting BTI and PAC is available to test on, though.

configure.ac

DrahtBot · 2022-05-17T19:05:22Z

Guix builds

File	commit `225e5b5` (master)	commit `6e02029` (master and this pull)
SHA256SUMS.part	`1b58b80ca65983b3...`	`60902da13322462a...`
*-aarch64-linux-gnu-debug.tar.gz	`26b50f702207b949...`	`da73c81f36ba2f4f...`
*-aarch64-linux-gnu.tar.gz	`93156ddbf46f81df...`	`49d87e2a6f62f992...`
*-arm-linux-gnueabihf-debug.tar.gz	`448908d67e456427...`	`6995a4237a002a65...`
*-arm-linux-gnueabihf.tar.gz	`595189752c32bf97...`	`b3aadb2d8f165b42...`
*-arm64-apple-darwin-unsigned.dmg	`8fe9a774204a88c7...`	`068c1b89b9bacaef...`
*-arm64-apple-darwin-unsigned.tar.gz	`293f411c2dc51edb...`	`c09afa12e0677dc9...`
*-arm64-apple-darwin.tar.gz	`abca1d81d437a08a...`	`c15b198b2d1f03fc...`
*-powerpc64-linux-gnu-debug.tar.gz	`1744beebac78a5d6...`	`18afbab08627bbd0...`
*-powerpc64-linux-gnu.tar.gz	`ec4d4712136dc767...`	`564780d6229517f2...`
*-powerpc64le-linux-gnu-debug.tar.gz	`ac1890b8743df6a5...`	`08950113d8f8a24a...`
*-powerpc64le-linux-gnu.tar.gz	`b0ebc5e4120bf000...`	`5033d195b6c3a5f7...`
*-riscv64-linux-gnu-debug.tar.gz	`702be3dc495a5a10...`	`06fb203fb1b5161a...`
*-riscv64-linux-gnu.tar.gz	`ad1394d672c7b965...`	`be8de64710848522...`
*-win64-debug.zip	`5464743530003d4d...`	`c9e8d9c625b5eb35...`
*-win64-setup-unsigned.exe	`955c755466eb2b07...`	`7ef06802748bdc8f...`
*-win64-unsigned.tar.gz	`0126640c2d061f14...`	`146ee2330f8ddfa4...`
*-win64.zip	`5b07889e2dce9103...`	`4e2f315a1f35caee...`
*-x86_64-apple-darwin-unsigned.dmg	`c5526437a0193c3b...`	`2c0af2ea1cd7545d...`
*-x86_64-apple-darwin-unsigned.tar.gz	`e1d81f18176fab2e...`	`6bc18c838e5fff4f...`
*-x86_64-apple-darwin.tar.gz	`d34e5f7fe086c51f...`	`64b3270b92cd3128...`
*-x86_64-linux-gnu-debug.tar.gz	`acb6561a5919c80f...`	`6f25c5199f7623a8...`
*-x86_64-linux-gnu.tar.gz	`00bb67a5b4e29ca3...`	`8645814c4e7e8c7e...`
*.tar.gz	`ab4e54f5d920eb45...`	`9c521162a3ecfd6e...`
guix_build.log	`68d9a71f1973680b...`	`754faf723b062cbf...`
guix_build.log.diff		`85fe222476c6b46f...`

fanquake · 2022-06-28T10:43:34Z

I've changed the approach here, and this is now based on #25437 and parts of #25484.

This adds --enable-standard-branch-protection to the configure flags when building GCC, which turns on the usage of branch-protection features by default. I've also added a commit that switches to using glibc 2.33 for the aarch64 build. glibc 2.32 was the first to ship with support for aarch64 branch protection features when built with a compatible compiler (see commit message for details). We couldn't actually use this for Guix builds, because it would break out back compat requires (the symbol checks fail), so this is still just for demonstration.

kristapsk · 2022-06-28T10:54:57Z

Concept ACK

DrahtBot · 2024-06-26T17:49:01Z

🚧 At least one of the CI tasks failed. Make sure to run all tests locally, according to the
documentation.

Possibly this is due to a silent merge conflict (the changes in this pull request being
incompatible with the current code in the target branch). If so, make sure to rebase on the latest
commit of the target branch.

Leave a comment here, if you need help tracking down a confusing failure.

_{Debug: https://github.com/bitcoin/bitcoin/runs/26712572542}

fanquake · 2024-08-23T12:25:40Z

Rebased on master and dropped a commit, also bumped the glibc 2.33 branch to the latest commit. Still based on #30433, but the main blocker here remains the glibc bump.

fanquake · 2024-08-23T12:28:47Z

For now, the Guix built bins could be inspected with:

# bitcoin/guix-build-30af1c56da93/output/aarch64-linux-gnu/bitcoin-30af1c56da93/bin# readelf -n * | grep "AArch64"
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC
      Properties: AArch64 feature: BTI, PAC

hebasto · 2024-08-27T14:20:33Z

It would be helpful if someone with BTI-enabled hardware could test the binaries and verified BTI during runtime.

Unfortunately, I'm unable to do it by myself, as my hardware supports only PAC, not BTI.

…ags for aarch64-linux 001b1cf build: use standard branch-protection for aarch64-linux (fanquake) Pull request description: Use `-mbranch-protection=standard` when targetting `*aarch64-*-linux*`. Part of #24123, but this flag can already be used on a best effort basis. Note that this flag is also already used by default, in the toolchain, on various distros (i.e Fedora). ACKs for top commit: hebasto: ACK 001b1cf. TheCharlatan: ACK 001b1cf Tree-SHA512: 2d7ae60f59921a62d51139cb0fd5cecbed4f63266564b2623b7d160f5b0c2c42c78ef8aeff787f485eccc46a9ffd5da70023ec093df6add7c982e0d48a1601b5

fanquake · 2024-09-13T15:27:29Z

Rebased for #30433, and updated to add an export allowance for __libc_single_threaded.

…o hardening flags 61a6c3b build: add `-mbranch-protection=bti` to aarch64 hardening flags (fanquake) Pull request description: This is a simpler (less hardening) version of bitcoin#24123. You can inspect binaries using `readelf -n`, and look for BTI in a `.note.gnu.property`. i.e ```bash readelf -n src/bitcoin-cli Displaying notes found in: .note.gnu.property Owner Data size Description GNU 0x00000010NT_GNU_PROPERTY_TYPE_0 Properties: AArch64 feature: BTI ``` Related to bitcoin#19075. ACKs for top commit: TheCharlatan: utACK 61a6c3b Tree-SHA512: 64504de44e91d853165daf4111dca905d8eb9ef3f4bfb0d447c677b02c9100dbd56f13e6fe6539fb06c2343a094229591ac5d1bd9e184b32b512c0ac3f9bac36

glibc 2.32 was the first to ship with support for branch protection when compiled with a compatible compiler, see below. However a number of bugfixes/improvements shipped in glibc 2.33, so use that, rather than trying to backport all relevant changes. glibc 2.32 release notes: https://lwn.net/Articles/828210/ * AArch64 now supports standard branch protection security hardening in glibc when it is built with a GCC that is configured with --enable-standard-branch-protection (or if -mbranch-protection=standard flag is passed when building both GCC target libraries and glibc, in either case a custom GCC is needed). This includes branch target identification (BTI) and pointer authentication for return addresses (PAC-RET). They require armv8.5-a and armv8.3-a architecture extensions respectively for the protection to be effective, otherwise the used instructions are nops. User code can use PAC-RET without libc support, but BTI requires a libc that is built with BTI support, otherwise runtime objects linked into user code will not be BTI compatible. `__libc_single_threaded` added as it is now exported from at least `bitcoin-wallet` and `test_bitcoin`.

fanquake added Linux/Unix Build system labels Jan 21, 2022

This was referenced Jan 21, 2022

build: support OpenBSD in depends #23998

Merged

build: add support for NetBSD in depends #23955

Merged

build: add support for FreeBSD to depends #23948

Merged

fanquake force-pushed the mbranch_protection_aarch64_linux branch from 9313bf6 to c98b6eb Compare January 23, 2022 05:01

DrahtBot mentioned this pull request Jan 28, 2022

build: remove use of TARGET_OS and BUILD_OS #23969

Closed

luke-jr reviewed Jan 29, 2022

View reviewed changes

configure.ac Outdated Show resolved Hide resolved

DrahtBot added the Needs rebase label Feb 2, 2022

maflcko added the DrahtBot Guix build requested label Feb 2, 2022

Vic23M approved these changes Feb 12, 2022

View reviewed changes

fanquake force-pushed the mbranch_protection_aarch64_linux branch from c98b6eb to b51e648 Compare May 12, 2022 13:18

fanquake removed the Needs rebase label May 12, 2022

DrahtBot removed the DrahtBot Guix build requested label May 17, 2022

DrahtBot mentioned this pull request May 29, 2022

build: Improve depends build system robustness #22552

Closed

fanquake force-pushed the mbranch_protection_aarch64_linux branch from b51e648 to 616e9b9 Compare June 27, 2022 15:03

fanquake mentioned this pull request Jun 27, 2022

Guix: enable toolchain hardening by default #25484

Merged

DrahtBot mentioned this pull request Jun 27, 2022

guix: remove explicit glibc stack protector disabling #25437

Merged

fanquake force-pushed the mbranch_protection_aarch64_linux branch from 616e9b9 to f4a72a1 Compare June 28, 2022 10:38

DrahtBot mentioned this pull request Jun 28, 2022

guix: Simplify code for Linux builds #25169

Closed

fanquake force-pushed the mbranch_protection_aarch64_linux branch 2 times, most recently from 17ae4aa to 4f74122 Compare June 30, 2022 16:30

DrahtBot mentioned this pull request Jul 8, 2022

[POC] guix: produce a fully -static-pie bitcoind #25573

Draft

DrahtBot mentioned this pull request Jul 19, 2022

guix: Drop repetition of option's default value #25639

Merged

fanquake force-pushed the mbranch_protection_aarch64_linux branch from aac821e to c29a4e4 Compare July 11, 2024 16:12

fanquake mentioned this pull request Jul 11, 2024

build: add standard branch-protection to hardening flags for aarch64-linux #30433

Merged

DrahtBot removed the CI failed label Jul 11, 2024

fanquake mentioned this pull request Jul 24, 2024

guix: update LIEF from 0.13.2 to 0.15.x #30520

Open

DrahtBot mentioned this pull request Aug 16, 2024

build: Remove Autotools-based build system #30664

Merged

hebasto added the Needs CMake port label Aug 16, 2024

DrahtBot mentioned this pull request Aug 22, 2024

build: Mark x86_64-linux-gnu release binaries as CET-enabled #30685

Closed

fanquake force-pushed the mbranch_protection_aarch64_linux branch from c29a4e4 to 30af1c5 Compare August 23, 2024 12:20

fanquake force-pushed the mbranch_protection_aarch64_linux branch from 30af1c5 to c5b775e Compare August 28, 2024 10:30

fanquake removed the Needs CMake port label Aug 28, 2024

fanquake force-pushed the mbranch_protection_aarch64_linux branch from c5b775e to 1d22173 Compare August 28, 2024 13:18

fanquake changed the title ~~guix: Pointer Authentication and Branch Target Identification for aarch64 Linux (Guix)~~ guix: Pointer Authentication and Branch Target Identification for aarch64 Linux Sep 13, 2024

fanquake force-pushed the mbranch_protection_aarch64_linux branch 2 times, most recently from bffcd69 to e596204 Compare September 13, 2024 15:05

fanquake mentioned this pull request Oct 11, 2024

Consider making 27.x Long-Term Support (LTS) #31068

Open

fanquake force-pushed the mbranch_protection_aarch64_linux branch from e596204 to f91b1f5 Compare November 27, 2024 11:19

DrahtBot mentioned this pull request Dec 19, 2024

guix: latest 2.31 glibc #31529

Merged

DrahtBot added the Needs rebase label Dec 20, 2024

fanquake force-pushed the mbranch_protection_aarch64_linux branch from f91b1f5 to 1a3b8ce Compare January 6, 2025 10:43

DrahtBot removed the Needs rebase label Jan 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

fanquake commented Jan 21, 2022 •

edited

Loading

DrahtBot commented Jan 21, 2022 •

edited

Loading

hebasto commented Jan 22, 2022

laanwj commented Jan 25, 2022 •

edited

Loading

DrahtBot commented May 17, 2022

fanquake commented Jun 28, 2022

kristapsk commented Jun 28, 2022

DrahtBot commented Jun 26, 2024

fanquake commented Aug 23, 2024

fanquake commented Aug 23, 2024

hebasto commented Aug 27, 2024

fanquake commented Sep 13, 2024

guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

Are you sure you want to change the base?

guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

Conversation

fanquake commented Jan 21, 2022 • edited Loading

DrahtBot commented Jan 21, 2022 • edited Loading

Code Coverage & Benchmarks

Reviews

Conflicts

hebasto commented Jan 22, 2022

laanwj commented Jan 25, 2022 • edited Loading

DrahtBot commented May 17, 2022

Guix builds

fanquake commented Jun 28, 2022

kristapsk commented Jun 28, 2022

DrahtBot commented Jun 26, 2024

fanquake commented Aug 23, 2024

fanquake commented Aug 23, 2024

hebasto commented Aug 27, 2024

fanquake commented Sep 13, 2024

fanquake commented Jan 21, 2022 •

edited

Loading

DrahtBot commented Jan 21, 2022 •

edited

Loading

laanwj commented Jan 25, 2022 •

edited

Loading