user0/rust
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LVI hardening tests for cmake

Browse source
This commit is contained in:
Raoul Strackx 2020-03-27 14:19:07 +01:00
parent 64811ed5a5
commit d8a7904e06
11 changed files with 120 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/cmake_plus_one_c.checks Normal file
View file

@ -0,0 +1,6 @@
CHECK: cmake_plus_one_c
CHECK: lfence
CHECK: popq
CHECK-NEXT: popq [[REGISTER:%[a-z]+]]
CHECK-NEXT: lfence
CHECK-NEXT: jmpq *[[REGISTER]]

16
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/cmake_plus_one_c_asm.checks Normal file
View file

@ -0,0 +1,16 @@
CHECK: cmake_plus_one_c_asm
CHECK: lfence
CHECK: lfence
CHECK: lfence
CHECK: lfence
CHECK: movl
CHECK: lfence
CHECK-NEXT: incl
CHECK-NEXT: jmp 0x{{[[:xdigit:]]+}} <cmake_plus_one_c_asm+0x{{[[:xdigit:]]+}}>
CHECK-NEXT: shlq $0, (%rsp)
CHECK-NEXT: lfence
CHECK-NEXT: retq
CHECK: popq
CHECK-NEXT: popq [[REGISTER:%[a-z]+]]
CHECK-NEXT: lfence
CHECK-NEXT: jmpq *[[REGISTER]]

6
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/cmake_plus_one_cxx.checks Normal file
View file

@ -0,0 +1,6 @@
CHECK: cmake_plus_one_cxx
CHECK: lfence
CHECK: popq
CHECK-NEXT: popq [[REGISTER:%[a-z]+]]
CHECK-NEXT: lfence
CHECK-NEXT: jmpq *[[REGISTER]]

16
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/cmake_plus_one_cxx_asm.checks Normal file
View file

@ -0,0 +1,16 @@
CHECK: cmake_plus_one_cxx_asm
CHECK: lfence
CHECK: lfence
CHECK: lfence
CHECK: lfence
CHECK: movl
CHECK: lfence
CHECK-NEXT: incl
CHECK-NEXT: jmp 0x{{[[:xdigit:]]+}} <cmake_plus_one_cxx_asm+0x{{[[:xdigit:]]+}}>
CHECK-NEXT: shlq $0, (%rsp)
CHECK-NEXT: lfence
CHECK-NEXT: retq
CHECK: popq
CHECK-NEXT: popq [[REGISTER:%[a-z]+]]
CHECK-NEXT: lfence
CHECK-NEXT: jmpq *[[REGISTER]]

1
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/Cargo.toml
View file

@ -10,3 +10,4 @@ edition = "2018"
[build-dependencies]
cc = "1.0"
cmake = "0.1"

15
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/build.rs
View file

@ -8,4 +8,19 @@ fn main() {
.cpp_set_stdlib(None)
.file("foo_cxx.cpp")
.compile("foo_cxx");
// When the cmake crate detects the clang compiler, it passes the
// "--target" argument to the linker which subsequently fails. The
// `CMAKE_C_COMPILER_FORCED` option makes sure that `cmake` does not
// tries to test the compiler. From version 3.6 the option
// `CMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY` can be used
// https://cmake.org/cmake/help/v3.5/module/CMakeForceCompiler.html
let dst = cmake::Config::new("libcmake_foo")
.build_target("cmake_foo")
.define("CMAKE_C_COMPILER_FORCED", "1")
.define("CMAKE_CXX_COMPILER_FORCED", "1")
.define("CMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY", "1")
.build();
println!("cargo:rustc-link-search=native={}/build/", dst.display());
println!("cargo:rustc-link-lib=static=cmake_foo");
}

4
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/libcmake_foo/CMakeLists.txt Normal file
View file

@ -0,0 +1,4 @@
add_library(cmake_foo STATIC
src/foo.c
src/foo_cxx.cpp
)

17
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/libcmake_foo/src/foo.c Normal file
View file

@ -0,0 +1,17 @@
int cmake_plus_one_c(int *arg) {
return *arg + 1;
}
int cmake_plus_one_c_asm(int *arg) {
int value = 0;
asm volatile ( " movl (%1), %0\n"
" inc %0\n"
" jmp 1f\n"
" retq\n" // never executed, but a shortcut to determine how the assembler deals with `ret` instructions
"1:\n"
: "=r"(value)
: "r"(arg) );
return value;
}

20
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/libcmake_foo/src/foo_cxx.cpp Normal file
View file

@ -0,0 +1,20 @@
extern "C" int cmake_plus_one_cxx(int *arg);
extern "C" int cmake_plus_one_cxx_asm(int *arg);
int cmake_plus_one_cxx(int *arg) {
return *arg + 1;
}
int cmake_plus_one_cxx_asm(int *arg) {
int value = 0;
asm volatile ( " movl (%1), %0\n"
" inc %0\n"
" jmp 1f\n"
" retq\n" // never executed, but a shortcut to determine how the assembler deals with `ret` instructions
"1:\n"
: "=r"(value)
: "r"(arg) );
return value;
}

9
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/enclave/src/main.rs
View file

@ -3,6 +3,10 @@ extern {
fn cc_plus_one_c_asm(arg : &u32) -> u32;
fn cc_plus_one_cxx(arg : &u32) -> u32;
fn cc_plus_one_cxx_asm(arg : &u32) -> u32;
fn cmake_plus_one_c(arg : &u32) -> u32;
fn cmake_plus_one_c_asm(arg : &u32) -> u32;
fn cmake_plus_one_cxx(arg : &u32) -> u32;
fn cmake_plus_one_cxx_asm(arg : &u32) -> u32;
}
fn main() {
@ -13,5 +17,10 @@ fn main() {
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cc_plus_one_c_asm(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cc_plus_one_cxx(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cc_plus_one_cxx_asm(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cmake_plus_one_c(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cmake_plus_one_c_asm(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cmake_plus_one_cxx(&value));
println!("Answer to the Ultimate Question of Life, the Universe, and Everything: {}!", cmake_plus_one_cxx_asm(&value));
}
}

10
src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/script.sh
View file

@ -39,7 +39,17 @@ build
#check "libunwind::Registers_x86_64::jumpto()" jumpto.checks
check "std::io::stdio::_print::h87f0c238421c45bc" print.checks
#TODO: the current passes cannot handle module level assembly!
# No checks are implemented
check cc_plus_one_c cc_plus_one_c.checks
check cc_plus_one_c_asm cc_plus_one_c_asm.checks
check cc_plus_one_cxx cc_plus_one_cxx.checks
check cc_plus_one_cxx_asm cc_plus_one_cxx_asm.checks
check cmake_plus_one_c cmake_plus_one_c.checks
check cmake_plus_one_c_asm cmake_plus_one_c_asm.checks
check cmake_plus_one_cxx cmake_plus_one_cxx.checks
check cmake_plus_one_cxx_asm cmake_plus_one_cxx_asm.checks
#WARNING clang/clang++ use an integrated assembler when given an assembly file.
# LVI patches are *not* applied