pacbti testing using aws greengrass

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/.python-version

@@ -0,0 +1 @@
+2.7.18

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/_index.md

@@ -0,0 +1,55 @@
+---
+title: Test Arm PAC/BTI instruction readiness with an AWS IoT Greengrass custom component
+
+description: Learn how to deploy an AWS IoT Greengrass custom component to Arm devices and verify PAC/BTI support through MQTT-triggered tests.
+
+draft: true
+cascade:
+    draft: true
+
+minutes_to_complete: 30   
+
+who_is_this_for: This Learning Path is for developers who want to use AWS IoT Greengrass to deploy a PAC/BTI test component to Arm platforms.
+
+learning_objectives: 
+    - Create an AWS IoT Greengrass custom component with the PAC/BTI test harness.
+    - Register an Armv8 and an Armv9 device as AWS IoT Greengrass core devices.
+    - Run PAC/BTI checks through MQTT and interpret the results for each device.
+
+prerequisites:
+    - A [Amazon AWS](https://aws.amazon.com/) account with access to AWS IoT Greengrass and AWS S3
+
+
+author: Varun Chari, Doug Anson
+
+### Tags
+skilllevels: Introductory
+subjects: Performance and Architecture
+cloud_service_providers:
+    - AWS
+
+armips:
+    - Neoverse
+
+tools_software_languages:
+    - Python
+    - Java
+    - MQTT
+    - YAML
+
+operatingsystems:
+    - Linux
+
+further_reading:
+  - resource:
+      title: AWS IoT Greengrass documentation
+      link: https://aws.amazon.com/greengrass/
+      type: documentation
+
+
+### FIXED, DO NOT MODIFY
+# ================================================================================
+weight: 1                       # _index.md always has weight of 1 to order correctly
+layout: "learningpathall"       # All files under learning paths have this same wrapper
+learning_path_main_page: "yes"  # This should be surfaced when looking for related content. Only set for _index.md of learning path content.
+---

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/_next-steps.md

@@ -0,0 +1,8 @@
+---
+# ================================================================================
+#       FIXED, DO NOT MODIFY THIS FILE
+# ================================================================================
+weight: 21                  # Set to always be larger than the content in this path to be at the end of the navigation.
+title: "Next Steps"         # Always the same, html page title.
+layout: "learningpathall"   # All files under learning paths have this same wrapper for Hugo processing.
+---

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/background.md

@@ -0,0 +1,20 @@
+---
+title: Overview of AWS IoT Greengrass and the Arm v9 PAC and BTI instructions
+
+weight: 2
+
+layout: "learningpathall"
+---
+
+### AWS IoT Greengrass
+
+AWS IoT Greengrass is an edge runtime and cloud service for building, deploying, and managing software on devices outside the cloud, such as industrial gateways, robots, cameras, and other IoT systems. It lets devices run applications locally for lower latency, reduced bandwidth use, and continued operation when connectivity is limited, while still integrating with AWS services. In Greengrass V2, key features include a modular component model for packaging software, support for Lambda functions, containers, native processes, and custom runtimes, secure communication with AWS IoT Core, local messaging and device state handling, fleet deployments and over-the-air updates, optional stream processing, and edge machine learning inference.
+
+
+### PAC/BTI Arm v9 instructions
+
+Armv9 Pointer Authentication (PAC) and Branch Target Identification (BTI) are security features designed to make control-flow attacks harder. PAC helps protect return addresses and pointers by adding a cryptographic signature that is checked before the pointer is used, which can detect tampering such as return-oriented programming attempts. BTI complements this by restricting where indirect branches are allowed to land, helping prevent attackers from jumping into unintended instruction sequences. Together, PAC and BTI strengthen software defenses at the instruction-set level, especially for modern operating systems, hypervisors, and applications that need improved resistance to memory-corruption exploits.
+
+### What you've learned and what's next
+
+Next, you'll use AWS IoT Greengrass to create and deploy a custom component to local Arm-based devices and verify each device's PAC/BTI support.

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/custom-component.md

@@ -0,0 +1,170 @@
+---
+title: Creating an AWS IoT Greengrass custom component
+
+weight: 5
+
+layout: "learningpathall"
+---
+
+### Introduction
+
+In this section, you create an AWS IoT Greengrass custom component that uses an artifact package to test PAC/BTI support on target Arm devices.
+
+### S3 bucket creation for the custom component artifact
+
+1. In the AWS Console, go to **S3**.
+
+![Creating an S3 bucket](images/s3-1.png "Creating an S3 bucket to store our component's artifact")
+
+2. Create a bucket and give it a name. Keep the default settings for this tutorial.
+
+![Creating an S3 bucket](images/s3-2.png "Creating an S3 bucket to store our component's artifact")
+
+3. Select **Create bucket**.
+
+![Creating an S3 bucket](images/s3-3.png "Creating an S3 bucket to store our component's artifact")
+
+4. Record the bucket name. You will use it in the YAML recipe.
+
+5. On your local machine, clone the asset repository:
+
+```bash
+git clone https://github.com/DougAnsonAustinTx/pac-bti-gg-assets 
+cd ./pac-bti-gg-assets
+```
+
+6. In the S3 bucket view, select **Upload** and upload this artifact from the cloned repository:
+`./arm-pac-bti-greengrass-demo-mqtt-trigger.zip`
+
+![Upload to an S3 bucket](images/upload-1.png "Uploading to our S3 bucket")
+
+7. Select **Add files**, choose the artifact, and then select **Upload**.
+
+![Upload to an S3 bucket](images/upload-2.png "Uploading to our S3 bucket")
+
+Your artifact is now available in S3. Next, create the custom Greengrass component.
+
+### Custom component creation
+
+1. In the AWS Console, go to **IoT Core** -> **Greengrass devices** and select **Components**.
+
+2. Select **Create component**.
+
+![Creating a Greengrass custom component](images/custom-1.png "Creating a custom component")
+
+3. Select **Enter recipe as YAML** and clear the default sample content.
+
+![Creating a Greengrass custom component](images/custom-2.png "Creating a custom component")
+
+4. Copy and paste the following YAML recipe into the editor.
+
+{{% notice Note %}}
+In the YAML code below, locate **YOUR_S3_BUCKET** and replace it with the S3 bucket name you created in the previous step.
+{{% /notice %}}
+
+
+
+```yaml
+RecipeFormatVersion: '2020-01-25'
+ComponentName: arm-com.arm.demo.PacBtiDemo
+ComponentVersion: '1.0.4'
+ComponentDescription: Demonstrate how PAC/BTI changes the exploit outcome for the same vulnerable app deployed with AWS IoT Greengrass.
+ComponentPublisher: Arm
+ComponentType: aws.greengrass.generic
+
+ComponentConfiguration:
+  DefaultConfiguration:
+    accessControl:
+      aws.greengrass.ipc.mqttproxy:
+        com.arm.demo.PacBtiDemo:mqttproxy:1:
+          policyDescription: Allow the PAC/BTI demo to subscribe for attack triggers and publish result events.
+          operations:
+            - aws.greengrass#PublishToIoTCore
+            - aws.greengrass#SubscribeToIoTCore
+          resources:
+            - arm/demo/*/security/pacbti/attack/trigger
+            - arm/demo/*/security/pacbti/attack/result
+
+Manifests:
+  - Platform:
+      os: linux
+
+    Artifacts:
+      - Uri: s3://YOUR_S3_BUCKET/arm-pac-bti-greengrass-demo-mqtt-trigger.zip
+        Unarchive: ZIP
+        Permission:
+          Read: OWNER
+          Execute: OWNER
+
+    Lifecycle:
+      Install:
+        RequiresPrivilege: true
+        Script: |-
+          set -e
+
+          PROJECT_ROOT="{artifacts:decompressedPath}/arm-pac-bti-greengrass-demo-mqtt-trigger/arm-pac-bti-greengrass-demo"
+          WORK_DIR="{work:path}"
+          VENV_DIR="{work:path}/venv"
+
+          python3 -m venv "${VENV_DIR}"
+          "${VENV_DIR}/bin/python" -m pip install --upgrade pip
+          "${VENV_DIR}/bin/pip" install --no-cache-dir awsiotsdk
+
+          bash "${PROJECT_ROOT}/greengrass/install.sh" \
+            "${PROJECT_ROOT}" \
+            "${WORK_DIR}"
+
+      Run:
+        Script: |-
+          set -e
+
+          PROJECT_ROOT="{artifacts:decompressedPath}/arm-pac-bti-greengrass-demo-mqtt-trigger/arm-pac-bti-greengrass-demo"
+          WORK_DIR="{work:path}"
+          VENV_DIR="{work:path}/venv"
+
+          BUILD_FLAVOR="$(cat "${WORK_DIR}/state/selected_flavor")"
+          BINARY="${WORK_DIR}/build/${BUILD_FLAVOR}/vuln_demo"
+          OUTPUT_DIR="${WORK_DIR}/results"
+          THING_NAME="{iot:thingName}"
+          TRIGGER_TOPIC="arm/demo/${THING_NAME}/security/pacbti/attack/trigger"
+          RESULT_TOPIC="arm/demo/${THING_NAME}/security/pacbti/attack/result"
+
+
+          mkdir -p "${OUTPUT_DIR}"
+
+          echo "THING_NAME=${THING_NAME}"
+          echo "TRIGGER_TOPIC=${TRIGGER_TOPIC}"
+          echo "RESULT_TOPIC=${RESULT_TOPIC}"
+
+          if [ ! -x "${VENV_DIR}/bin/python" ]; then
+            echo "Virtual environment Python not found at ${VENV_DIR}/bin/python"
+            exit 1
+          fi
+
+          if [ ! -x "${BINARY}" ]; then
+            echo "Binary not found or not executable: ${BINARY}"
+            exit 1
+          fi
+
+          export PYTHONUNBUFFERED=1
+
+          exec "${VENV_DIR}/bin/python" "${PROJECT_ROOT}/tools/demo_runner.py" \
+            --project-root "${PROJECT_ROOT}" \
+            --binary "${BINARY}" \
+            --build-flavor "${BUILD_FLAVOR}" \
+            --output-dir "${OUTPUT_DIR}" \
+            --trigger-topic "${TRIGGER_TOPIC}" \
+            --result-topic "${RESULT_TOPIC}"
+```
+
+5. After you update the bucket name, select **Create component**.
+
+![Creating a Greengrass custom component](images/custom-3.png "Creating a custom component")
+
+6. Confirm the custom component appears in the component list.
+
+![Creating a Greengrass custom component](images/custom-4.png "Creating a custom component")
+
+### What we've accomplished
+
+You created an AWS IoT Greengrass custom component and connected it to the S3-hosted artifact. In the next section, you'll deploy it to both Greengrass core devices.

content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/deployment.md

@@ -0,0 +1,47 @@
+---
+title: Deploying an AWS IoT Greengrass custom component
+
+weight: 6
+
+layout: "learningpathall"
+---
+
+### Introduction
+
+In this section, you use a Greengrass thing group to deploy a set of components, including your PAC/BTI test component, to both Greengrass core devices.
+
+### Create Deployment
+
+1. In the AWS Console, go to **IoT Core** -> **Greengrass** -> **Deployments**, then select **Create**.
+
+![Creating a Greengrass deployment](images/deploy-1.png "Creating a deployment")
+
+2. Name your deployment and select the thing group `My_PAC_BTI_Test_Devices`, then select **Next**.
+
+![Name and select thing group](images/deploy-2.png "Creating a deployment")
+
+3. Select **Next**.
+
+![Select Defaults](images/deploy-3.png "Select Defaults")
+
+4. Select **Next**.
+
+![Select Defaults](images/deploy-4.png "Select Defaults")
+
+5. Select **Next**.
+
+![Select Defaults](images/deploy-5.png "Select Defaults")
+
+6. Scroll down and select **Deploy**.
+
+![Deploy](images/deploy-6.png "Deploy")
+
+7. Once deployed, Greengrass installs and prepares the custom component on each PAC/BTI test device (Thor and RPi5). Wait until the **Execution overview** shows **2** successful targets.
+
+![Deploy status](images/deploy-7.png "Deploy status")
+
+When both devices show successful deployment, you're ready to run PAC/BTI tests on each device.
+
+### What we learned
+
+In this section, you created a Greengrass deployment that targeted the thing group containing both PAC/BTI test devices. The deployment installed the PAC/BTI custom component by following the YAML recipe you defined.