[3.12] gh-128605: Add branch protections for x86_64 in asm_trampolineS (#128606)

[stratakis]

Apply Intel Control-flow Technology for x86-64 on asm_trampoline.S.

Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks.

Manual application is required for the assembly files.

See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html

• Issue: asm_trampoline.S misses branch protection flags for x86_64 #128605

[vstinner]

LGTM

[encukou]

It looks like the 3.14 & 3.13 backports broke buildbots; please don't merge until that's investigated.

[ZeroIntensity]

Wait, why is this being backported to 3.12?

[vstinner]

Wait, why is this being backported to 3.12?

It's a securiy fix to harden Python binary.

[vstinner]

!buildbot AMD64 Fedora Stable

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @vstinner for commit ec66179 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135094%2Fmerge

The command will test the builders whose names match following regular expression: AMD64 Fedora Stable

The builders matched are:

• AMD64 Fedora Stable Refleaks PR
• AMD64 Fedora Stable Clang Installed PR
• AMD64 Fedora Stable LTO PR
• AMD64 Fedora Stable PR
• AMD64 Fedora Stable LTO + PGO PR
• AMD64 Fedora Stable Clang PR

[vstinner]

!buildbot AMD64 Fedora Stable

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @vstinner for commit ec66179 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135094%2Fmerge

The command will test the builders whose names match following regular expression: AMD64 Fedora Stable

The builders matched are:

• AMD64 Fedora Stable Refleaks PR
• AMD64 Fedora Stable Clang Installed PR
• AMD64 Fedora Stable LTO PR
• AMD64 Fedora Stable PR
• AMD64 Fedora Stable LTO + PGO PR
• AMD64 Fedora Stable Clang PR

[vstinner]

@encukou: I removed the DO-NOT-MERGE label since the change was merged (again) in 3.13 and 3.14 branches without breaking the buildbots. Moreover, I ran the buildbots on this PR and they pass successfully.

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @encukou for commit ec66179 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F135094%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[encukou]

Thanks!
To me it looks more like a security feature than a fix, but, that's for the RM to decide :)

[vstinner]

There are many buildbot failures, but all of them are unrelated.

buildbot/aarch64 Android PR
buildbot/AMD64 Android PR

Unrelated: FileNotFoundError: [Errno 2] No such file or directory: b'Android/android.py'

buildbot/aarch64 Ubuntu 22.04 BigMem PR
buildbot/AMD64 Windows11 Bigmem PR

Unrelated: regrtest.py: error: unrecognized arguments: --prioritize=test_bigmem,test_lzma,test_bz2,test_re,test_array

buildbot/AMD64 Windows PGO NoGIL PR
buildbot/AMD64 Windows Server 2022 NoGIL PR

Unrelated: MSBUILD : error MSB1001: Unknown switch. with Switch: --disable-gil

buildbot/ARM64 MacOS M1 Refleaks NoGIL PR

Unrelated: test_socket leaked [20, 20, 20] file descriptors, sum=60

buildbot/ARM64 Raspbian PR

Unrelated encodings/Unicode errors.

4 tests failed: test_httpservers test_pathlib test_urllib test_zipfile

Example: UnicodeEncodeError: 'latin-1' codec can't encode character '\ufffd' in position 112: ordinal not in range(256)
Example: FileNotFoundError: [Errno 2] No such file or directory: '@test_1628940_tmpæ'.

buildbot/ARM64 Windows Non-Debug PR

Unrelated: test_recursive_pickle (test.test_functools.TestPartialC.test_recursive_pickle) ... Windows fatal exception: stack overflow

buildbot/iOS ARM64 Simulator PR

Unrelated: Invalid configuration 'arm64-apple-ios-simulator': Kernel 'ios' not known to work with OS 'simulator'.

buildbot/wasm32-wasi PR

Unrelated: python3: can't open file '/home/buildbot/buildarea/pull_request.bcannon-wasi.wasi.debug/build/Tools/wasm/wasi.py': [Errno 2] No such file or directory

[vstinner]

To me it looks more like a security feature than a fix, but, that's for the RM to decide :)

It's a regression compared to Python 3.11.

[vstinner]

Thanks for the merge @pablogsal.