PE: check for control flow instrumentation

fanquake commented at 9:13 am on November 17, 2021: member

Addresses the Windows portion of #21888.

Now that we require GCC 8+ we can unconditionally use -fcf-protection=full when building Boost in depends. Building Boost with this option is required so that the main provided to test_bitcoin.exe has instrumentation.

Note that the presence of instrumentation does not mean it will be used, as that is determined at runtime by the CPU. From the Intel control flow enforcement documentation:

The ENDBR32 and ENDBR64 instructions will have the same effect as the NOP instruction on Intel 64 processors that do not support CET. On processors supporting CET, these instructions do not change register or flag state. This allows CET instrumented programs to execute on processors that do not support CET. Even when CET is supported and enabled, these NOP–like instructions do not affect the execution state of the program, do not cause any additional register pressure, and are minimally intrusive from power and performance perspectives.

Guix Build:

 0bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 15d41d43c44945810f92193504e8b4c1ac8eb9dfc3b19d0ab8d53bff0c8443a2a  guix-build-f31d4bd21401/output/aarch64-linux-gnu/SHA256SUMS.part
 28edb0e01b7bc2d646b62e4e35b1867ee940acca18a02ee609c52c4f7680de5ae  guix-build-f31d4bd21401/output/aarch64-linux-gnu/bitcoin-f31d4bd21401-aarch64-linux-gnu-debug.tar.gz
 31a06306f365e8329cea0eba7436085d30fe59c244a888ecb6407faf5110c57ab  guix-build-f31d4bd21401/output/aarch64-linux-gnu/bitcoin-f31d4bd21401-aarch64-linux-gnu.tar.gz
 4b5b74926ff9ff597d66b92d33926df34c3e1c6f92b863850a6fb1beea019fd6e  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/SHA256SUMS.part
 5743b5c5cec7881b032520a309ae2399ec8dadb82eb9da424aefd646f9252ff1d  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/bitcoin-f31d4bd21401-arm-linux-gnueabihf-debug.tar.gz
 61f218a954b65b352c80922ea6b61276e8e7050ad8bdd9d7610049b87c66069e5  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/bitcoin-f31d4bd21401-arm-linux-gnueabihf.tar.gz
 7c164de32c6cc24ec247b5a8de7f1a5442369d5804a4b2a3e0d9dc4ab4e5ec401  guix-build-f31d4bd21401/output/dist-archive/bitcoin-f31d4bd21401.tar.gz
 8feb0a055eabd6ddd2ce0dac954f5f5886044800a7535b8f78c7dfbd9c243512c  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/SHA256SUMS.part
 90b6e877b5de7b69a5d474469d666a536cd8f6f6e865230a7763f62426357ae91  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/bitcoin-f31d4bd21401-powerpc64-linux-gnu-debug.tar.gz
10fb38bcfd319af1e8bace03f240b32592940ac3efe15d23fd39353f36f9ae3838  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/bitcoin-f31d4bd21401-powerpc64-linux-gnu.tar.gz
1115fffe69f33297ef30a8b2eb8bdef8564f030920bed6d5ff56d6e7b8bef9c199  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/SHA256SUMS.part
12f847b92c7c098bf8a4f6c84714270c173d4323e2d3025dd8f4444ee921a0bdd0  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/bitcoin-f31d4bd21401-powerpc64le-linux-gnu-debug.tar.gz
139b8b6e12dd8a1a3ba0f5522c2a22f2bd60d5473880fa22d42e91364a08e48396  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/bitcoin-f31d4bd21401-powerpc64le-linux-gnu.tar.gz
146f0f3b603b35c751a364b77ca94477085cf54a1c5d811dd3407dd1b86b2e3c64  guix-build-f31d4bd21401/output/riscv64-linux-gnu/SHA256SUMS.part
1569f1a93a8d698e68d8baf81a6c871f9eab0446ec352f7709971293b0b898f128  guix-build-f31d4bd21401/output/riscv64-linux-gnu/bitcoin-f31d4bd21401-riscv64-linux-gnu-debug.tar.gz
16b71d415f30a893fada9d6609fab309a3c099716462c795e444bf49bd8631ea53  guix-build-f31d4bd21401/output/riscv64-linux-gnu/bitcoin-f31d4bd21401-riscv64-linux-gnu.tar.gz
176f842bc5483e867b8d1c769d1faa19b9f08bc0fa28d027fe0fac108858a4926e  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/SHA256SUMS.part
18a9a43aa4aade18bf606493009229ad3239af7365594ef60a0c39789d870f159d  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx-unsigned.dmg
1926891e7d258ec8a85344a0a888fd4159378d747a2a77fb8d9e5655f1a3ad4aee  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx-unsigned.tar.gz
20a2578799da61a3f1b6cd047aa5641e050de2e810162ec8596931cec12d1cbb56  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx64.tar.gz
21571803809f358ed5ef1f1ed6b6266b54bd33b0e6308c53ddae967e53af930a46  guix-build-f31d4bd21401/output/x86_64-linux-gnu/SHA256SUMS.part
22ea45499e8d2a2f0791f29732a5f169fb97525d6d8adcdfa1c160e950944ce8fe  guix-build-f31d4bd21401/output/x86_64-linux-gnu/bitcoin-f31d4bd21401-x86_64-linux-gnu-debug.tar.gz
23ba5b63e64267d7685de77e3063e24659f223d4b4c42d43f42fb15e716afcfe78  guix-build-f31d4bd21401/output/x86_64-linux-gnu/bitcoin-f31d4bd21401-x86_64-linux-gnu.tar.gz
24b4ba9d8cfd6999c0039890330afab5d5b1faf5ded33dcbebc5e73d8dae308246  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/SHA256SUMS.part
253aa5cf722341b79aca78ea11fe4e65e0c642997b0214d3893a86a2e808afbe87  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win-unsigned.tar.gz
26b48402235751f15f09fad64b7bd42f851a64a9744e47ed6888b4e9754fb0d3d9  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64-debug.zip
27e33183aa7316f399621fd7b1c258d850294cdaaebb505364410a399467c0943b  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64-setup-unsigned.exe
284baba568a8a93d04086055df512d680c8365d42779123c56bccee41e4de33e5e  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64.zip

build: use -fcf-protection=full when building Windows Boost in depends 0445e1a1a5

scripts: test for PE control flow instrumentation f31d4bd214

fanquake added the label Windows on Nov 17, 2021

fanquake added the label Build system on Nov 17, 2021

fanquake added the label DrahtBot Guix build requested on Nov 17, 2021

DrahtBot commented at 2:56 am on November 18, 2021: member

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#22555 (build: Fix make apk for Android w/ non-default SOURCES_PATH in depends by hebasto)
#22552 (build: Improve depends build system robustness by hebasto)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

DrahtBot commented at 4:35 pm on November 19, 2021: member

Guix builds

File	commit fe03f7a37fd0ef05149161f6b95a25493e1fe38f(master)	commit 19c66355b77e7f6bda7ed4301ba616668f664cea(master and this pull)
SHA256SUMS.part	`044bb745547def7a...`	`f77810dc46b3c418...`
*-aarch64-linux-gnu-debug.tar.gz	`09bbff302ad3331e...`	`20047b5cdcd53b01...`
*-aarch64-linux-gnu.tar.gz	`430b9f97f423b06a...`	`9f85909daee782f1...`
*-arm-linux-gnueabihf-debug.tar.gz	`50a27653d6994b6a...`	`3088b492a730ab90...`
*-arm-linux-gnueabihf.tar.gz	`81a07a9da6f858a0...`	`f7d741dab38db3b1...`
*-osx-unsigned.dmg	`3e2009f5309e90c5...`	`d474eca304ed21df...`
*-osx-unsigned.tar.gz	`4b62c341efb32478...`	`7d8a8bbecd2e6f8b...`
*-osx64.tar.gz	`15db1c07fa4e9d30...`	`f5ffad2553bf1da4...`
*-powerpc64-linux-gnu-debug.tar.gz	`a1e42ccb04825279...`	`8de245b8ee80c1e5...`
*-powerpc64-linux-gnu.tar.gz	`378f31682cfccc5f...`	`6d4d04cbc173ec99...`
*-powerpc64le-linux-gnu-debug.tar.gz	`7a93b3ab8e90cf7e...`	`4287cedd40eab256...`
*-powerpc64le-linux-gnu.tar.gz	`a1277ecf841344cf...`	`0e2547872cd24545...`
*-riscv64-linux-gnu-debug.tar.gz	`b43821a269135bd8...`	`03e5e0ccb8031f11...`
*-riscv64-linux-gnu.tar.gz	`7e274b4336478453...`	`0b805cefa81746c7...`
*-win-unsigned.tar.gz	`99e7f5561fe50fff...`	`1bfac268b6a5ce9a...`
*-win64-debug.zip	`41e203dfc0daedec...`	`e733893020080cbc...`
*-win64-setup-unsigned.exe	`63dc48e24fa4c39a...`	`70bd96523a7a78af...`
*-win64.zip	`5535e45ef7494fba...`	`d9e68ca4f466c339...`
*-x86_64-linux-gnu-debug.tar.gz	`38eaad4f9ea9d1c6...`	`186bdfcdd0fcfdf5...`
*-x86_64-linux-gnu.tar.gz	`a33a93e0a8ac54a5...`	`d1c46c727a11bd28...`
*.tar.gz	`f5fcc5155e947e72...`	`9bcc0a884ad1ce40...`
guix_build.log	`d6bb3add848de882...`	`a87a75885e7413c7...`
guix_build.log.diff		`99eb30af4945d666...`

DrahtBot removed the label DrahtBot Guix build requested on Nov 19, 2021

laanwj commented at 5:28 pm on November 19, 2021: member

Code review ACK f31d4bd21401228799d78aab70de881ea39f99f2

guix builds match @fanquake’s

 0find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 15d41d43c44945810f92193504e8b4c1ac8eb9dfc3b19d0ab8d53bff0c8443a2a  guix-build-f31d4bd21401/output/aarch64-linux-gnu/SHA256SUMS.part
 28edb0e01b7bc2d646b62e4e35b1867ee940acca18a02ee609c52c4f7680de5ae  guix-build-f31d4bd21401/output/aarch64-linux-gnu/bitcoin-f31d4bd21401-aarch64-linux-gnu-debug.tar.gz
 31a06306f365e8329cea0eba7436085d30fe59c244a888ecb6407faf5110c57ab  guix-build-f31d4bd21401/output/aarch64-linux-gnu/bitcoin-f31d4bd21401-aarch64-linux-gnu.tar.gz
 4b5b74926ff9ff597d66b92d33926df34c3e1c6f92b863850a6fb1beea019fd6e  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/SHA256SUMS.part
 5743b5c5cec7881b032520a309ae2399ec8dadb82eb9da424aefd646f9252ff1d  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/bitcoin-f31d4bd21401-arm-linux-gnueabihf-debug.tar.gz
 61f218a954b65b352c80922ea6b61276e8e7050ad8bdd9d7610049b87c66069e5  guix-build-f31d4bd21401/output/arm-linux-gnueabihf/bitcoin-f31d4bd21401-arm-linux-gnueabihf.tar.gz
 7c164de32c6cc24ec247b5a8de7f1a5442369d5804a4b2a3e0d9dc4ab4e5ec401  guix-build-f31d4bd21401/output/dist-archive/bitcoin-f31d4bd21401.tar.gz
 8feb0a055eabd6ddd2ce0dac954f5f5886044800a7535b8f78c7dfbd9c243512c  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/SHA256SUMS.part
 90b6e877b5de7b69a5d474469d666a536cd8f6f6e865230a7763f62426357ae91  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/bitcoin-f31d4bd21401-powerpc64-linux-gnu-debug.tar.gz
10fb38bcfd319af1e8bace03f240b32592940ac3efe15d23fd39353f36f9ae3838  guix-build-f31d4bd21401/output/powerpc64-linux-gnu/bitcoin-f31d4bd21401-powerpc64-linux-gnu.tar.gz
1115fffe69f33297ef30a8b2eb8bdef8564f030920bed6d5ff56d6e7b8bef9c199  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/SHA256SUMS.part
12f847b92c7c098bf8a4f6c84714270c173d4323e2d3025dd8f4444ee921a0bdd0  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/bitcoin-f31d4bd21401-powerpc64le-linux-gnu-debug.tar.gz
139b8b6e12dd8a1a3ba0f5522c2a22f2bd60d5473880fa22d42e91364a08e48396  guix-build-f31d4bd21401/output/powerpc64le-linux-gnu/bitcoin-f31d4bd21401-powerpc64le-linux-gnu.tar.gz
146f0f3b603b35c751a364b77ca94477085cf54a1c5d811dd3407dd1b86b2e3c64  guix-build-f31d4bd21401/output/riscv64-linux-gnu/SHA256SUMS.part
1569f1a93a8d698e68d8baf81a6c871f9eab0446ec352f7709971293b0b898f128  guix-build-f31d4bd21401/output/riscv64-linux-gnu/bitcoin-f31d4bd21401-riscv64-linux-gnu-debug.tar.gz
16b71d415f30a893fada9d6609fab309a3c099716462c795e444bf49bd8631ea53  guix-build-f31d4bd21401/output/riscv64-linux-gnu/bitcoin-f31d4bd21401-riscv64-linux-gnu.tar.gz
176f842bc5483e867b8d1c769d1faa19b9f08bc0fa28d027fe0fac108858a4926e  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/SHA256SUMS.part
18a9a43aa4aade18bf606493009229ad3239af7365594ef60a0c39789d870f159d  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx-unsigned.dmg
1926891e7d258ec8a85344a0a888fd4159378d747a2a77fb8d9e5655f1a3ad4aee  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx-unsigned.tar.gz
20a2578799da61a3f1b6cd047aa5641e050de2e810162ec8596931cec12d1cbb56  guix-build-f31d4bd21401/output/x86_64-apple-darwin19/bitcoin-f31d4bd21401-osx64.tar.gz
21571803809f358ed5ef1f1ed6b6266b54bd33b0e6308c53ddae967e53af930a46  guix-build-f31d4bd21401/output/x86_64-linux-gnu/SHA256SUMS.part
22ea45499e8d2a2f0791f29732a5f169fb97525d6d8adcdfa1c160e950944ce8fe  guix-build-f31d4bd21401/output/x86_64-linux-gnu/bitcoin-f31d4bd21401-x86_64-linux-gnu-debug.tar.gz
23ba5b63e64267d7685de77e3063e24659f223d4b4c42d43f42fb15e716afcfe78  guix-build-f31d4bd21401/output/x86_64-linux-gnu/bitcoin-f31d4bd21401-x86_64-linux-gnu.tar.gz
24b4ba9d8cfd6999c0039890330afab5d5b1faf5ded33dcbebc5e73d8dae308246  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/SHA256SUMS.part
253aa5cf722341b79aca78ea11fe4e65e0c642997b0214d3893a86a2e808afbe87  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win-unsigned.tar.gz
26b48402235751f15f09fad64b7bd42f851a64a9744e47ed6888b4e9754fb0d3d9  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64-debug.zip
27e33183aa7316f399621fd7b1c258d850294cdaaebb505364410a399467c0943b  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64-setup-unsigned.exe
284baba568a8a93d04086055df512d680c8365d42779123c56bccee41e4de33e5e  guix-build-f31d4bd21401/output/x86_64-w64-mingw32/bitcoin-f31d4bd21401-win64.zip

fanquake merged this on Nov 21, 2021

fanquake closed this on Nov 21, 2021

fanquake deleted the branch on Nov 21, 2021

sidhujag referenced this in commit e10e74aa7e on Nov 21, 2021

sidhujag referenced this in commit 53cc664727 on Nov 23, 2021

DrahtBot locked this on Nov 21, 2022

PE: check for control flow instrumentation #23535

Conflicts

Guix builds