Skip to content

Commit fd4b177

Browse files
borsbors
committed
Auto merge of rust-lang#72655 - jethrogb:sgx-lvi-hardening, r=petrochenkov
Enable LVI hardening for x86_64-fortanix-unknown-sgx This implements mitigations for the Load Value Injection vulnerability (CVE-2020-0551) for the `x86_64-fortanix-unknown-sgx` target by enabling new LLVM passes. More information about LVI and mitigations may be found at https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection. This PR unconditionally enables the mitigations for `x86_64-fortanix-unknown-sgx` since there is no available hardware that doesn't require the mitigations. This may be reconsidered in the future. * [x] This depends on rust-lang/compiler-builtins#359
2 parents bc10b68 + ea48f2e commit fd4b177

File tree

8 files changed

+74
-30
lines changed

8 files changed

+74
-30
lines changed

‎Cargo.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -642,9 +642,9 @@ dependencies = [
642642

643643
[[package]]
644644
name = "compiler_builtins"
645-
version = "0.1.31"
645+
version = "0.1.32"
646646
source = "registry+https://github.com/rust-lang/crates.io-index"
647-
checksum = "702af8463c84fd83dd76a307ebd47ab3cc866e847bebd4a1deeb6bcc4a658327"
647+
checksum = "7bc4ac2c824d2bfc612cba57708198547e9a26943af0632aff033e0693074d5c"
648648
dependencies = [
649649
"cc",
650650
"rustc-std-workspace-core",

‎src/bootstrap/cc_detect.rs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@ use crate::{Build, GitRepo};
3737
// try to infer the archiver path from the C compiler path.
3838
// In the future this logic should be replaced by calling into the `cc` crate.
3939
fn cc2ar(cc: &Path, target: &str) -> Option<PathBuf> {
40-
if let Some(ar) = env::var_os("AR") {
40+
if let Some(ar) = env::var_os(format!("AR_{}", target.replace("-", "_"))) {
41+
Some(PathBuf::from(ar))
42+
} else if let Some(ar) = env::var_os("AR") {
4143
Some(PathBuf::from(ar))
4244
} else if target.contains("msvc") {
4345
None

‎src/ci/docker/dist-various-2/Dockerfile

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,29 @@ RUN apt-get update && apt-get build-dep -y clang llvm && apt-get install -y --no
2828
RUN apt-key adv --batch --yes --keyserver keyserver.ubuntu.com --recv-keys 74DA7924C5513486
2929
RUN add-apt-repository -y 'deb http://apt.dilos.org/dilos dilos2 main'
3030

31+
ENV \
32+
AR_x86_64_fuchsia=x86_64-fuchsia-ar \
33+
CC_x86_64_fuchsia=x86_64-fuchsia-clang \
34+
CXX_x86_64_fuchsia=x86_64-fuchsia-clang++ \
35+
AR_aarch64_fuchsia=aarch64-fuchsia-ar \
36+
CC_aarch64_fuchsia=aarch64-fuchsia-clang \
37+
CXX_aarch64_fuchsia=aarch64-fuchsia-clang++ \
38+
AR_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-ar \
39+
CC_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-gcc \
40+
CXX_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-g++ \
41+
AR_x86_64_sun_solaris=x86_64-sun-solaris2.10-ar \
42+
CC_x86_64_sun_solaris=x86_64-sun-solaris2.10-gcc \
43+
CXX_x86_64_sun_solaris=x86_64-sun-solaris2.10-g++ \
44+
CC_armv7_unknown_linux_gnueabi=arm-linux-gnueabi-gcc-7 \
45+
CXX_armv7_unknown_linux_gnueabi=arm-linux-gnueabi-g++-7 \
46+
AR_x86_64_fortanix_unknown_sgx=ar \
47+
CC_x86_64_fortanix_unknown_sgx=x86_64-fortanix-unknown-sgx-clang-11 \
48+
CFLAGS_x86_64_fortanix_unknown_sgx="-mlvi-hardening -mllvm -x86-experimental-lvi-inline-asm-hardening" \
49+
CXX_x86_64_fortanix_unknown_sgx=x86_64-fortanix-unknown-sgx-clang++-11 \
50+
CXXFLAGS_x86_64_fortanix_unknown_sgx="-mlvi-hardening -mllvm -x86-experimental-lvi-inline-asm-hardening" \
51+
CC=gcc-7 \
52+
CXX=g++-7
53+
3154
WORKDIR /build
3255
COPY scripts/musl.sh /build
3356
RUN env \
@@ -46,34 +69,18 @@ COPY dist-various-2/build-solaris-toolchain.sh /tmp/
4669
RUN /tmp/build-solaris-toolchain.sh x86_64 amd64 solaris-i386
4770
RUN /tmp/build-solaris-toolchain.sh sparcv9 sparcv9 solaris-sparc
4871
COPY dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh /tmp/
72+
COPY dist-various-2/x86_64-fortanix-unknown-sgx-clang-wrap.sh /usr/bin/x86_64-fortanix-unknown-sgx-clang-11
73+
RUN ln -s /usr/bin/x86_64-fortanix-unknown-sgx-clang-11 /usr/bin/x86_64-fortanix-unknown-sgx-clang++-11
4974
# We pass the commit id of the port of LLVM's libunwind to the build script.
5075
# Any update to the commit id here, should cause the container image to be re-built from this point on.
51-
RUN /tmp/build-x86_64-fortanix-unknown-sgx-toolchain.sh "5125c169b30837208a842f85f7ae44a83533bd0e"
76+
RUN /tmp/build-x86_64-fortanix-unknown-sgx-toolchain.sh "800f95131fe6acd20b96b6f4723ca3c820f3d379"
5277

5378
COPY dist-various-2/build-wasi-toolchain.sh /tmp/
5479
RUN /tmp/build-wasi-toolchain.sh
5580

5681
COPY scripts/sccache.sh /scripts/
5782
RUN sh /scripts/sccache.sh
5883

59-
ENV \
60-
AR_x86_64_fuchsia=x86_64-fuchsia-ar \
61-
CC_x86_64_fuchsia=x86_64-fuchsia-clang \
62-
CXX_x86_64_fuchsia=x86_64-fuchsia-clang++ \
63-
AR_aarch64_fuchsia=aarch64-fuchsia-ar \
64-
CC_aarch64_fuchsia=aarch64-fuchsia-clang \
65-
CXX_aarch64_fuchsia=aarch64-fuchsia-clang++ \
66-
AR_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-ar \
67-
CC_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-gcc \
68-
CXX_sparcv9_sun_solaris=sparcv9-sun-solaris2.10-g++ \
69-
AR_x86_64_sun_solaris=x86_64-sun-solaris2.10-ar \
70-
CC_x86_64_sun_solaris=x86_64-sun-solaris2.10-gcc \
71-
CXX_x86_64_sun_solaris=x86_64-sun-solaris2.10-g++ \
72-
CC_armv7_unknown_linux_gnueabi=arm-linux-gnueabi-gcc-7 \
73-
CXX_armv7_unknown_linux_gnueabi=arm-linux-gnueabi-g++-7 \
74-
CC=gcc-7 \
75-
CXX=g++-7
76-
7784
ENV CARGO_TARGET_X86_64_FUCHSIA_AR /usr/local/bin/llvm-ar
7885
ENV CARGO_TARGET_X86_64_FUCHSIA_RUSTFLAGS \
7986
-C link-arg=--sysroot=/usr/local/x86_64-fuchsia \

‎src/ci/docker/dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,15 @@ url="https://github.com/fortanix/llvm-project/archive/${1}.tar.gz"
1313
repo_name="llvm-project"
1414

1515
install_prereq() {
16+
curl https://apt.llvm.org/llvm-snapshot.gpg.key|apt-key add -
17+
add-apt-repository -y 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic main'
1618
apt-get update
1719
apt-get install -y --no-install-recommends \
1820
build-essential \
1921
ca-certificates \
2022
cmake \
21-
git
23+
git \
24+
clang-11
2225
}
2326

2427
build_unwind() {
@@ -35,7 +38,14 @@ build_unwind() {
3538
# Build libunwind
3639
mkdir -p build
3740
cd build
41+
target_CC="CC_${target//-/_}"
42+
target_CXX="CXX_${target//-/_}"
43+
target_CFLAGS="CFLAGS_${target//-/_}"
44+
target_CXXFLAGS="CXXFLAGS_${target//-/_}"
3845
cmake -DCMAKE_BUILD_TYPE="RELEASE" -DRUST_SGX=1 -G "Unix Makefiles" \
46+
-DCMAKE_C_COMPILER="${!target_CC}" -DCMAKE_CXX_COMPILER="${!target_CXX}" \
47+
-DCMAKE_C_FLAGS="${!target_CFLAGS}" -DCMAKE_CXX_FLAGS="${!target_CXXFLAGS}" \
48+
-DCMAKE_C_COMPILER_TARGET=$target -DCMAKE_CXX_COMPILER_TARGET=$target \
3949
-DLLVM_ENABLE_WARNINGS=1 -DLIBUNWIND_ENABLE_WERROR=1 -DLIBUNWIND_ENABLE_PEDANTIC=0 \
4050
-DLLVM_PATH=../../llvm/ ../
4151
make unwind_static

‎src/ci/docker/dist-various-2/x86_64-fortanix-unknown-sgx-clang-wrap.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
3+
args=("$@")
4+
5+
for i in "${!args[@]}"; do
6+
# x86_64-fortanix-unknown-sgx doesn't have a C sysroot for things like
7+
# stdint.h and the C++ STL. Unlike GCC, clang will not use the host's
8+
# sysroot instead. Force it.
9+
if [ "${args[$i]}" = "--target=x86_64-fortanix-unknown-sgx" ]; then
10+
args[$i]="--target=x86_64-unknown-linux-gnu"
11+
fi
12+
done
13+
14+
exec "${0/x86_64-fortanix-unknown-sgx-clang/clang}" "${args[@]}"

‎src/librustc_target/spec/x86_64_fortanix_unknown_sgx.rs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ pub fn target() -> Result<Target, String> {
6161
max_atomic_width: Some(64),
6262
panic_strategy: PanicStrategy::Unwind,
6363
cpu: "x86-64".into(),
64-
features: "+rdrnd,+rdseed".into(),
64+
features: "+rdrnd,+rdseed,+lvi-cfi,+lvi-load-hardening".into(),
65+
llvm_args: vec!["--x86-experimental-lvi-inline-asm-hardening".into()],
6566
position_independent_executables: true,
6667
pre_link_args: iter::once((
6768
LinkerFlavor::Lld(LldFlavor::Ld),

‎src/libstd/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ panic_unwind = { path = "../libpanic_unwind", optional = true }
2020
panic_abort = { path = "../libpanic_abort" }
2121
core = { path = "../libcore" }
2222
libc = { version = "0.2.51", default-features = false, features = ['rustc-dep-of-std'] }
23-
compiler_builtins = { version = "0.1.31" }
23+
compiler_builtins = { version = "0.1.32" }
2424
profiler_builtins = { path = "../libprofiler_builtins", optional = true }
2525
unwind = { path = "../libunwind" }
2626
hashbrown = { version = "0.6.2", default-features = false, features = ['rustc-dep-of-std'] }

‎src/libstd/sys/sgx/abi/entry.S

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,9 @@ usercall:
324324
/* return */
325325
mov %rsi,%rax /* RAX = return value */
326326
/* NOP: mov %rdx,%rdx */ /* RDX = return value */
327-
ret
327+
pop %r11
328+
lfence
329+
jmp *%r11
328330

329331
/*
330332
The following functions need to be defined externally:
@@ -343,20 +345,28 @@ extern "C" fn entry(p1: u64, p2: u64, p3: u64, secondary: bool, p4: u64, p5: u64
343345
.global get_tcs_addr
344346
get_tcs_addr:
345347
mov %gs:tcsls_tcs_addr,%rax
346-
ret
348+
pop %r11
349+
lfence
350+
jmp *%r11
347351

348352
.global get_tls_ptr
349353
get_tls_ptr:
350354
mov %gs:tcsls_tls_ptr,%rax
351-
ret
355+
pop %r11
356+
lfence
357+
jmp *%r11
352358

353359
.global set_tls_ptr
354360
set_tls_ptr:
355361
mov %rdi,%gs:tcsls_tls_ptr
356-
ret
362+
pop %r11
363+
lfence
364+
jmp *%r11
357365

358366
.global take_debug_panic_buf_ptr
359367
take_debug_panic_buf_ptr:
360368
xor %rax,%rax
361369
xchg %gs:tcsls_debug_panic_buf_ptr,%rax
362-
ret
370+
pop %r11
371+
lfence
372+
jmp *%r11

0 commit comments

Comments
 (0)