From cac0955658cb591d4629bf90aaa542a66e25be55 Mon Sep 17 00:00:00 2001 From: Taylor Beebe Date: Fri, 14 Jun 2024 14:07:33 -0700 Subject: BaseTools: Update Stack Cookie Logic This patch updates the GenC logic to generate a random stack cookie value for the stack check libraries. These random values improve security for modules which cannot update the global intrinsics. If the stack cookie value is randomized in the AutoGen.h file each build, the build system will determine the module/library must be rebuilt causing effectively a clean build every time. This also makes binary reproducibility impossible. This patch updates the early build scripts to create 32 and 64-bit JSON files in the build output directory which each contain 100 randomized stack cookie values for each bitwidth. If the JSON files are already present, then they are not recreated which allows them to be stored and moved to other builds for binary reproducibility. Because they are in the build directory, a clean build will cause the values to be regenerated. The logic which creates AutoGen.h will read these JSON files and use a hash of the module GUID (the hash seed is fixed in Basetools) to index into the array of stack cookie values for the module bitwidth. This model is necessary because there isn't thread-consistent data so we cannot use a locking mechanism to ensure only one thread is writing to the stack cookie files at a time. With this model, the build threads only need to read from the files. Signed-off-by: Oliver Smith-Denny --- BaseTools/Source/Python/AutoGen/GenC.py | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'BaseTools/Source/Python/AutoGen') diff --git a/BaseTools/Source/Python/AutoGen/GenC.py b/BaseTools/Source/Python/AutoGen/GenC.py index 5ad10cee28..86991e7675 100755 --- a/BaseTools/Source/Python/AutoGen/GenC.py +++ b/BaseTools/Source/Python/AutoGen/GenC.py @@ -21,6 +21,9 @@ from .StrGather import * from .GenPcdDb import CreatePcdDatabaseCode from .IdfClassObject import * +import json +import secrets + ## PCD type string gItemTypeStringDatabase = { TAB_PCDS_FEATURE_FLAG : TAB_PCDS_FIXED_AT_BUILD, @@ -2039,6 +2042,34 @@ def CreateFooterCode(Info, AutoGenC, AutoGenH): def CreateCode(Info, AutoGenC, AutoGenH, StringH, UniGenCFlag, UniGenBinBuffer, StringIdf, IdfGenCFlag, IdfGenBinBuffer): CreateHeaderCode(Info, AutoGenC, AutoGenH) + # The only 32 bit archs we have are IA32 and ARM, everything else is 64 bit + Bitwidth = 32 if Info.Arch == 'IA32' or Info.Arch == 'ARM' else 64 + + if GlobalData.gStackCookieValues64 == [] and os.path.exists(os.path.join(Info.PlatformInfo.BuildDir, "StackCookieValues64.json")): + with open (os.path.join(Info.PlatformInfo.BuildDir, "StackCookieValues64.json"), "r") as file: + GlobalData.gStackCookieValues64 = json.load(file) + if GlobalData.gStackCookieValues32 == [] and os.path.exists(os.path.join(Info.PlatformInfo.BuildDir, "StackCookieValues32.json")): + with open (os.path.join(Info.PlatformInfo.BuildDir, "StackCookieValues32.json"), "r") as file: + GlobalData.gStackCookieValues32 = json.load(file) + + try: + if Bitwidth == 32: + CookieValue = int(GlobalData.gStackCookieValues32[hash(Info.Guid) % len(GlobalData.gStackCookieValues32)]) + else: + CookieValue = int(GlobalData.gStackCookieValues64[hash(Info.Guid) % len(GlobalData.gStackCookieValues64)]) + except: + EdkLogger.warn("build", "Failed to get Stack Cookie Value List! Generating random value.", ExtraData="[%s]" % str(Info)) + if Bitwidth == 32: + CookieValue = secrets.randbelow (0xFFFFFFFF) + else: + CookieValue = secrets.randbelow (0xFFFFFFFFFFFFFFFF) + + AutoGenH.Append(( + '#define STACK_COOKIE_VALUE 0x%XULL\n' % CookieValue + if Bitwidth == 64 else + '#define STACK_COOKIE_VALUE 0x%X\n' % CookieValue + )) + CreateGuidDefinitionCode(Info, AutoGenC, AutoGenH) CreateProtocolDefinitionCode(Info, AutoGenC, AutoGenH) CreatePpiDefinitionCode(Info, AutoGenC, AutoGenH) -- cgit v1.2.3