-
Notifications
You must be signed in to change notification settings - Fork 12.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rewrite x86_64-fortanix-unknown-sgx-lvi to rmake
- Loading branch information
Showing
6 changed files
with
110 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 3 additions & 0 deletions
3
.../x86_64-fortanix-unknown-sgx-lvi/Makefile → ...x86_64-fortanix-unknown-sgx-lvi/_Makefile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 4 additions & 0 deletions
4
...x86_64-fortanix-unknown-sgx-lvi/script.sh → ...86_64-fortanix-unknown-sgx-lvi/_script.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,94 @@ | ||
// ignore-tidy-linelength | ||
// Reason: intel.com link | ||
|
||
// This security test checks that the disassembled form of certain symbols | ||
// is "hardened" - that means, the assembly instructions match a pattern that | ||
// mitigate potential Load Value Injection vulnerabilities. | ||
// To do so, a test crate is compiled, and certain symbols are found, disassembled | ||
// and checked one by one. | ||
// See https://github.com/rust-lang/rust/pull/77008 | ||
|
||
// On load value injection: | ||
// https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/load-value-injection.html | ||
|
||
//@ only-x86_64-fortanix-unknown-sgx | ||
|
||
use run_make_support::{cmd, cwd, llvm_filecheck, llvm_objdump, regex, set_current_dir, target}; | ||
|
||
fn main() { | ||
let main_dir = cwd(); | ||
set_current_dir("enclave"); | ||
// HACK(eddyb) sets `RUSTC_BOOTSTRAP=1` so Cargo can accept nightly features. | ||
// These come from the top-level Rust workspace, that this crate is not a | ||
// member of, but Cargo tries to load the workspace `Cargo.toml` anyway. | ||
cmd("cargo") | ||
.env("RUSTC_BOOTSTRAP", "1") | ||
.arg("-v") | ||
.arg("run") | ||
.arg("--target") | ||
.arg(target()) | ||
.run(); | ||
set_current_dir(&main_dir); | ||
// Rust has various ways of adding code to a binary: | ||
// - Rust code | ||
// - Inline assembly | ||
// - Global assembly | ||
// - C/C++ code compiled as part of Rust crates | ||
// For those different kinds, we do have very small code examples that should be | ||
// mitigated in some way. Mostly we check that ret instructions should no longer be present. | ||
check("unw_getcontext", "unw_getcontext.checks"); | ||
check("__libunwind_Registers_x86_64_jumpto", "jumpto.checks"); | ||
|
||
check("std::io::stdio::_print::[[:alnum:]]+", "print.with_frame_pointers.checks"); | ||
|
||
check("st_plus_one_global_asm", "rust_plus_one_global_asm.checks"); | ||
|
||
check("_plus_one_c", "cc_plus_one_c.checks"); | ||
check("_plus_one_c_asm", "cc_plus_one_c_asm.checks"); | ||
check("_plus_one_cxx", "cc_plus_one_cxx.checks"); | ||
check("_plus_one_cxx_asm", "cc_plus_one_cxx_asm.checks"); | ||
check("_plus_one_asm", "cc_plus_one_asm.checks"); | ||
|
||
check("cmake_plus_one_c", "cmake_plus_one_c.checks"); | ||
check("cmake_plus_one_c_asm", "cmake_plus_one_c_asm.checks"); | ||
check("cmake_plus_one_c_global_asm", "cmake_plus_one_c_global_asm.checks"); | ||
check("cmake_plus_one_cxx", "cmake_plus_one_cxx.checks"); | ||
check("cmake_plus_one_cxx_asm", "cmake_plus_one_cxx_asm.checks"); | ||
check("cmake_plus_one_cxx_global_asm", "cmake_plus_one_cxx_global_asm.checks"); | ||
check("cmake_plus_one_asm", "cmake_plus_one_asm.checks"); | ||
} | ||
|
||
fn check(func_re: &str, mut checks: &str) { | ||
let dump = llvm_objdump() | ||
.input("enclave/target/x86_64-fortanix-unknown-sgx/debug/enclave") | ||
.args(&["--syms", "--demangle"]) | ||
.run() | ||
.stdout_utf8(); | ||
let re = regex::Regex::new(&format!("[[:blank:]]+{func_re}")).unwrap(); | ||
let func = re.find_iter(&dump).map(|m| m.as_str().trim()).collect::<Vec<&str>>().join(","); | ||
let dump = llvm_objdump() | ||
.input("enclave/target/x86_64-fortanix-unknown-sgx/debug/enclave") | ||
.args(&["--syms", &format!("--disassemble-symbols={func}")]) | ||
.run() | ||
.stdout_utf8(); | ||
let dump = dump.as_bytes(); | ||
|
||
// Unique case, must succeed at one of two possible tests. | ||
// This is because frame pointers are optional, and them being enabled requires | ||
// an additional `popq` in the pattern checking file. | ||
if func_re == "std::io::stdio::_print::[[:alnum:]]+" { | ||
let output = llvm_filecheck().stdin(&dump).patterns(checks).run_unchecked(); | ||
if !output.status().success() { | ||
checks = "print.without_frame_pointers.checks"; | ||
} | ||
} else { | ||
llvm_filecheck().stdin(&dump).patterns(checks).run(); | ||
} | ||
if !["rust_plus_one_global_asm", "cmake_plus_one_c_global_asm", "cmake_plus_one_cxx_global_asm"] | ||
.contains(&func_re) | ||
{ | ||
// The assembler cannot avoid explicit `ret` instructions. Sequences | ||
// of `shlq $0x0, (%rsp); lfence; retq` are used instead. | ||
llvm_filecheck().args(&["--implicit-check-not", "ret"]).stdin(dump).patterns(checks).run(); | ||
} | ||
} |