-
Notifications
You must be signed in to change notification settings - Fork 12.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
run-make: Delete cat-and-grep-sanity-check
and restrict branch-protection-check-IBT
to stable
#129156
base: master
Are you sure you want to change the base?
Conversation
This PR modifies cc @jieyouxu |
@bors delegate+ (try jobs) |
✌️ @Oneirical, you can now approve this pull request! If @jieyouxu told you to " |
@bors try |
run-make: Delete `cat-and-grep-sanity-check` and restrict `branch-protection-check-IBT` to stable Part of rust-lang#121876 and the associated [Google Summer of Code project](https://blog.rust-lang.org/2024/05/01/gsoc-2024-selected-projects.html). First, this PR deletes the now useless `cat-and-grep-sanity-check` test. Second, it revisits the `branch-protection-check-IBT` test, which was disabled due to a nonsensical `llvm_components` check. rust-lang#126720 states that the test does work on stable rustc, so let's check this: added `//@ only-stable`. If this works, some of the FIXME and commented-out lines will need cleanup before merging. Please try: try-job: x86_64-gnu-stable
This comment has been minimized.
This comment has been minimized.
41cd029
to
d85d292
Compare
@bors try- (feature request: this should be called bors give up) |
@bors try |
run-make: Delete `cat-and-grep-sanity-check` and restrict `branch-protection-check-IBT` to stable Part of rust-lang#121876 and the associated [Google Summer of Code project](https://blog.rust-lang.org/2024/05/01/gsoc-2024-selected-projects.html). First, this PR deletes the now useless `cat-and-grep-sanity-check` test. Second, it revisits the `branch-protection-check-IBT` test, which was disabled due to a nonsensical `llvm_components` check. rust-lang#126720 states that the test does work on stable rustc, so let's check this: added `//@ only-stable`. If this works, some of the FIXME and commented-out lines will need cleanup before merging. Please try: try-job: x86_64-gnu-stable
The job Click to see the possible cause of the failure (guessed by this bot)
|
The job Click to see the possible cause of the failure (guessed by this bot)
|
💔 Test failed - checks-actions |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm. I'll need to find PG-exploit-mitigations experts to help us take a look. This seems weird.
@@ -4,17 +4,16 @@ | |||
// python3 x.py test --target x86_64-unknown-linux-gnu tests/run-make/branch-protection-check-IBT/ | |||
|
|||
//@ only-x86_64 | |||
//@ only-stable |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Problem: this can't be correct, it's been in stable since forever, and I don't see any changes that would cause this to not be emitted (yet).
|
||
//@ ignore-test | ||
// FIXME(jieyouxu): see the FIXME in the Makefile |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remark (for myself): FIXME
let llvm_components = env_var("LLVM_COMPONENTS"); | ||
if !format!(" {llvm_components} ").contains(" x86 ") { | ||
return; | ||
} | ||
// if !llvm_components_contain("x86") { | ||
// panic!(); | ||
// } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Discussion (self-remark mostly): it's not entirely clear to me why we need to check for llvm-components.
EDIT: because if we want to run target-specific codegen, it will need the llvm component. Right.
cc @bjorn3 do you have any idea if AFAICT (at least on nightly/master), on a $ rustc \
--target=x86_64-linux-unknown-gnu \
-Z cf-protection=branch \
-C link-args='-nostartfiles' \
hello_world.rs \
-o hello_world
$ llvm-readelf -nW hello_world only has build-id, not Update: may need |
As nikic suggested, I was able to repro the note via $ RUSTFLAGS="-Z cf-protection=branch" cargo +nightly build -Z build-std --target=x86_64-unknown-linux-gnu so we probably want to use bootstrap cargo like in some other tests (yes I know this will require internet connection and is probably not ideal). |
Not all that familiar with this, but I would IBT to only be enabled for the process if |
☔ The latest upstream changes (presumably #131387) made this pull request unmergeable. Please resolve the merge conflicts. |
@Oneirical any updates on this? thanks |
@rustbot review (I need to look at it again) |
Part of #121876 and the associated Google Summer of Code project.
First, this PR deletes the now useless
cat-and-grep-sanity-check
test.Second, it revisits the
branch-protection-check-IBT
test, which was disabled due to a nonsensicalllvm_components
check. #126720 states that the test does work on stable rustc, so let's check this: added//@ only-stable
.If this works, some of the FIXME and commented-out lines will need cleanup before merging.
Please try:
try-job: x86_64-gnu-stable