kaidokert / fixed-bigint-rs
98%

DEFAULT BRANCH: main
Repo Added
Files 26
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 98.316%. Remained the same
26999934421

push

github

web-flow 
Extend asm-grep scope to follow helpers reachable from fixtures (#122)

* Extend asm-grep scope to follow helpers reachable from fixtures

Previously the gate scoped to `ct_fix__*` / `nct_fix__*` symbols only,
on the assumption that LTO would inline every Ct helper into the
fixture body and bring it under inspection. That assumption broke in
PR #119 — `const_leading_zeros_ct` doesn't inline (too large), so
when its `u32::leading_zeros()` intrinsic call lowered to `test/je/bsr`
on baseline x86_64, asm-grep didn't see the `je` and the bug only
surfaced via ctgrind. We worked around that one with a workflow
RUSTFLAGS, but only ctgrind targets benefit from that mitigation.

Walk call-graph reachability instead. From each Ct fixture symbol,
follow `bl` / `call` / `jal` / `rcall` / etc. edges transitively
through the disassembly, building the set of helpers actually reached
from a Ct call path. Scan every reachable helper for forbidden
mnemonics. Negative-control fixtures are deliberately excluded from
the seed set — their bodies pull in Nct helpers that have branchful
behaviour by design.

Resolving call targets in a static archive uses `objdump --reloc`:
unresolved cross-CGU calls print as self-relative placeholders
otherwise, so the relocation entries are interleaved with the
disassembly and a new parse line picks them up.

False positives — public-parameter loops like
`<FixedUInt as ConditionallySelectable>::conditional_select`'s
`for i in 0..N` compiling to `cmp/b.lt` — are handled by a per-target
`allowed_helpers` regex list in `TargetSpec`. The shared `HELPER_ALLOWLIST`
covers every helper the smoke run on aarch64-apple-darwin surfaced:
the bit-shift family, `const_ct_select`, the per-limb scanners, the
bitwise / num_traits / subtle trait impls on `FixedUInt`. Each entry
was inspected and confirmed to be a compile-time-bounded loop; the
corresponding CT property is also exercised by ctgrind, so any future
secret-dependent branch slipping in still get... (continued)

2860 of 2909 relevant lines covered (98.32%)

367.57 hits per line

Relevant lines Covered
2909 RELEVANT LINES 2860 COVERED LINES
367.57 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26999934421 main Extend asm-grep scope to follow helpers reachable from fixtures (#122) * Extend asm-grep scope to follow helpers reachable from fixtures Previously the gate scoped to `ct_fix__*` / `nct_fix__*` symbols only, on the assumption that LTO would inli... push web-flow github
98.32
26999733994 asm-grep-helper-scope Clarify HELPER_ALLOWLIST sharing rationale Drop the misleading "smoke run on aarch64-apple-darwin" framing — the classification is source-semantic (each helper body is a public-bounded loop) and holds independently of any backend's lowering. Spel... Pull #122 kaidokert github
98.32
26999386927 asm-grep-helper-scope Allowlist armv6m-only compiler-rt runtime helpers Cortex-M0 reaches a few more compiler-rt symbols transitively because the ISA itself lacks the relevant instruction: __clzsi2 / __clzdi2 — software CLZ (no `clz` on armv6m) __udivmodsi4 ... Pull #122 kaidokert github
98.32
26999116500 asm-grep-helper-scope Allowlist compiler_builtins::mem and __{ashl,ashr,lshr}[dt]i3 Two more compiler-runtime helpers slip through the helper-scope walker: - compiler_builtins::mem::{memcpy,memset,memmove,memcmp} — the Rust implementations of the bare-name byte hel... Pull #122 kaidokert github
98.32
26999023608 asm-grep-helper-scope Add per-target RUSTFLAGS scoping + thumbv6m intrinsic allowlist x86_64-unknown-linux-gnu: baseline x86_64 lowers u32::leading_zeros() to test/je/bsr (bsr is undefined on zero). Pass +lzcnt,+bmi1 via matrix.extra_rustflags so the intrinsic lowers ... Pull #122 kaidokert github
98.32
26998457324 asm-grep-helper-scope Strip +offset/-offset/@plt suffixes from captured call targets `objdump` decorates the call-target operand differently depending on file format and reloc type: - ELF GOTPCREL: `R_X86_64_GOTPCREL _ZN…E-0x4` - Inline tag with non-zero offset: `<so... Pull #122 kaidokert github
98.32
26997792763 asm-grep-helper-scope Extend asm-grep scope to follow helpers reachable from fixtures Previously the gate scoped to `ct_fix__*` / `nct_fix__*` symbols only, on the assumption that LTO would inline every Ct helper into the fixture body and bring it under inspection. Th... Pull #122 kaidokert github
98.32
26997019830 main Add category ASYM: asymmetric-taint regression fixtures (#121) * Add category ASYM: asymmetric-taint regression fixtures The existing Cat A/B/C fixtures taint both operands symmetrically, which is the right pattern for general CT-property verifi... push web-flow github
98.32
26996777840 asymmetric-taint-fixtures Cap shift amount to BIT_SIZE before usize cast on Ct path PR #121's earlier simplification dropped explicit overflow detection for the Ct path, relying on `const_shl_ct` / `const_shr_ct`'s barrel saturation to produce zero for shifts >= BIT_SIZE.... Pull #121 kaidokert github
98.32
26996066403 asymmetric-taint-fixtures Skip normalize_shift_amount on the Ct path `normalize_shift_amount` contains `if bits >= bit_size_u32` (a flag- based branch derived from the shift amount) and `bits % bit_size_u32` (variable-time modulo). Both are side-channel risks on Ct when b... Pull #121 kaidokert github
98.32
See All Builds (289)