From 81342e41097b2abfcc8a44e1ba22602c54f25db4 Mon Sep 17 00:00:00 2001 From: Wojciech Ozga Date: Tue, 29 Sep 2026 07:34:21 +0000 Subject: [PATCH 1/3] make codebase comliant with CodeQL scans Signed-off-by: Wojciech Ozga --- .github/workflows/build.yml | 3 +++ .github/workflows/verify.yml | 2 ++ .../handlers/cove_host_extension/promote_to_confidential_vm.rs | 2 ++ tools/cove_tap_tool/src/generate.rs | 2 ++ 4 files changed, 9 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index cdd7011..f189c4c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ "main" ] +permissions: + contents: read + jobs: build: runs-on: ubuntu-24.04 diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 5cb1725..a74bf02 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -3,6 +3,8 @@ name: Verification tests on: [push, pull_request] +permissions: + contents: read jobs: build: diff --git a/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs b/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs index f202ee0..4564e96 100644 --- a/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs +++ b/security-monitor/src/non_confidential_flow/handlers/cove_host_extension/promote_to_confidential_vm.rs @@ -125,6 +125,7 @@ impl PromoteToConfidentialVm { let mut measurements = StaticMeasurements::default(); memory_protector.finalize(&mut measurements, vm_memory_layout)?; confidential_harts[Self::BOOT_HART_ID].measure(measurements.pcr_boot_hart_mut()); + // codeql[rust/cleartext-logging] - digest values intentionally logged in debug builds debug!("VM measurements: {:?}", measurements); Ok(measurements) } @@ -204,6 +205,7 @@ impl PromoteToConfidentialVm { Some(attestation_payload) => { ensure!(attestation_payload.digests.len() > 0, Error::LocalAttestationFailed())?; for digest in attestation_payload.digests.iter() { + // codeql[rust/cleartext-logging] - digest values intentionally logged in debug builds debug!("Reference PCR{:?}={:?}=0x{}", digest.pcr_id, digest.algorithm, digest.value_in_hex()); ensure!(digest.algorithm == riscv_cove_tap::DigestAlgorithm::Sha512, Error::LocalAttestationNotSupportedDigest())?; let pcr_value = MeasurementDigest::try_from(digest.value.as_slice()).map_err(|_| Error::LocalAttestationFailed())?; diff --git a/tools/cove_tap_tool/src/generate.rs b/tools/cove_tap_tool/src/generate.rs index 02b0d5c..adeb583 100644 --- a/tools/cove_tap_tool/src/generate.rs +++ b/tools/cove_tap_tool/src/generate.rs @@ -57,6 +57,7 @@ pub fn generate_tap( algorithm: DigestAlgorithm::Sha512, value: pcr_value, }; + // codeql[rust/cleartext-logging] - intentional operator output for CLI tool println!("Writing PCR{}={}", pcr_id, tap_digest.value_in_hex()); digests.push(tap_digest); } @@ -67,6 +68,7 @@ pub fn generate_tap( name: secret_name, value: secret_value, }; + // codeql[rust/cleartext-logging] - intentional operator output for CLI tool println!("Writing secret {}", secret_name); secrets.push(secret); } From aa0f82df9d61a0039d4b9a157a6b17df387063f2 Mon Sep 17 00:00:00 2001 From: Wojciech Ozga Date: Tue, 29 Sep 2026 07:38:09 +0000 Subject: [PATCH 2/3] update dependencies Signed-off-by: Wojciech Ozga --- security-monitor/Cargo.lock | 108 ++++++++++++++++----------------- tools/cove_tap_tool/Cargo.lock | 8 +-- 2 files changed, 58 insertions(+), 58 deletions(-) diff --git a/security-monitor/Cargo.lock b/security-monitor/Cargo.lock index 50e575b..d992ed7 100644 --- a/security-monitor/Cargo.lock +++ b/security-monitor/Cargo.lock @@ -39,18 +39,18 @@ dependencies = [ [[package]] name = "aho-corasick" -version = "1.1.3" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916" +checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba" dependencies = [ "memchr", ] [[package]] name = "autocfg" -version = "1.5.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" +checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "bindgen" @@ -68,14 +68,14 @@ dependencies = [ "regex", "rustc-hash", "shlex", - "syn 2.0.107", + "syn 3.0.6", ] [[package]] name = "bitflags" -version = "2.10.0" +version = "2.13.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3" +checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06" [[package]] name = "block-buffer" @@ -83,7 +83,7 @@ version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa" dependencies = [ - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", ] [[package]] @@ -97,9 +97,9 @@ dependencies = [ [[package]] name = "cfg-if" -version = "1.0.4" +version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" +checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600" [[package]] name = "cipher" @@ -114,9 +114,9 @@ dependencies = [ [[package]] name = "clang-sys" -version = "1.8.1" +version = "1.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4" +checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a" dependencies = [ "glob", "libc", @@ -150,7 +150,7 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", "rand_core", ] @@ -220,9 +220,9 @@ dependencies = [ [[package]] name = "generic-array" -version = "1.3.4" +version = "1.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "985a5578ebdb02351d484a77fb27e7cb79272f1ba9bc24692d8243c3cfe40660" +checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e" dependencies = [ "rustversion", "typenum", @@ -239,9 +239,9 @@ dependencies = [ [[package]] name = "glob" -version = "0.3.3" +version = "0.3.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280" +checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b" [[package]] name = "hybrid-array" @@ -254,9 +254,9 @@ dependencies = [ [[package]] name = "hybrid-array" -version = "0.4.10" +version = "0.4.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214" +checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17" dependencies = [ "ctutils", "typenum", @@ -268,7 +268,7 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7" dependencies = [ - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", ] [[package]] @@ -293,9 +293,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.177" +version = "0.2.189" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" [[package]] name = "libloading" @@ -309,15 +309,15 @@ dependencies = [ [[package]] name = "log" -version = "0.4.28" +version = "0.4.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432" +checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" [[package]] name = "memchr" -version = "2.7.6" +version = "2.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273" +checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98" [[package]] name = "memoffset" @@ -349,7 +349,7 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66" dependencies = [ - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", "kem", "module-lattice", "rand_core", @@ -363,7 +363,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe" dependencies = [ "ctutils", - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", "num-traits", ] @@ -424,28 +424,28 @@ dependencies = [ [[package]] name = "prettyplease" -version = "0.2.37" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" +checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0" dependencies = [ "proc-macro2", - "syn 2.0.107", + "syn 3.0.6", ] [[package]] name = "proc-macro2" -version = "1.0.101" +version = "1.0.107" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de" +checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9" dependencies = [ "unicode-ident", ] [[package]] name = "quote" -version = "1.0.41" +version = "1.0.47" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1" +checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001" dependencies = [ "proc-macro2", ] @@ -458,9 +458,9 @@ checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" [[package]] name = "regex" -version = "1.12.2" +version = "1.13.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4" +checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d" dependencies = [ "aho-corasick", "memchr", @@ -470,9 +470,9 @@ dependencies = [ [[package]] name = "regex-automata" -version = "0.4.13" +version = "0.4.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c" +checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2" dependencies = [ "aho-corasick", "memchr", @@ -481,9 +481,9 @@ dependencies = [ [[package]] name = "regex-syntax" -version = "0.8.8" +version = "0.8.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4" [[package]] name = "riscv-decode" @@ -504,9 +504,9 @@ dependencies = [ [[package]] name = "rustc-hash" -version = "2.1.1" +version = "2.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d" +checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d" [[package]] name = "rustc_version" @@ -519,16 +519,16 @@ dependencies = [ [[package]] name = "rustversion" -version = "1.0.22" +version = "1.0.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" +checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f" [[package]] name = "security-monitor" version = "0.4.0" dependencies = [ "flattened_device_tree", - "hybrid-array 0.4.10", + "hybrid-array 0.4.15", "memoffset 0.9.1", "opensbi-sys", "pointers_utility", @@ -572,9 +572,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" [[package]] name = "spin" -version = "0.12.2" +version = "0.12.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8abadc99fd9c7bbb7d0ca2b31d72a067d0c0dcd7aad25ab8cac71ba91417694b" +checksum = "0134f9043ed38b087ac4f7d4af44c79e2c9e5094421fe3164f435ce585953b10" [[package]] name = "static_assertions" @@ -595,9 +595,9 @@ dependencies = [ [[package]] name = "syn" -version = "2.0.107" +version = "3.0.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a26dbd934e5451d21ef060c018dae56fc073894c5a7896f882928a76e6d081b" +checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" dependencies = [ "proc-macro2", "quote", @@ -626,15 +626,15 @@ dependencies = [ [[package]] name = "typenum" -version = "1.19.0" +version = "1.20.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb" +checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "unicode-ident" -version = "1.0.19" +version = "1.0.26" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d" +checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954" [[package]] name = "universal-hash" diff --git a/tools/cove_tap_tool/Cargo.lock b/tools/cove_tap_tool/Cargo.lock index f87d042..4520dfd 100644 --- a/tools/cove_tap_tool/Cargo.lock +++ b/tools/cove_tap_tool/Cargo.lock @@ -557,18 +557,18 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f" +checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e" dependencies = [ "thiserror-impl", ] [[package]] name = "thiserror-impl" -version = "2.0.20" +version = "2.0.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" +checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524" dependencies = [ "proc-macro2", "quote", From 90519ac97efe83e4e937408aba877a4c6c737d30 Mon Sep 17 00:00:00 2001 From: Wojciech Ozga Date: Thu, 8 Oct 2026 14:52:41 +0000 Subject: [PATCH 3/3] try getting rid of a box Signed-off-by: Wojciech Ozga --- .../src/core/architecture/riscv/mmu/page_table.rs | 4 ++-- .../src/core/architecture/riscv/mmu/page_table_entry.rs | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/security-monitor/src/core/architecture/riscv/mmu/page_table.rs b/security-monitor/src/core/architecture/riscv/mmu/page_table.rs index b41d1c8..a0f4472 100644 --- a/security-monitor/src/core/architecture/riscv/mmu/page_table.rs +++ b/security-monitor/src/core/architecture/riscv/mmu/page_table.rs @@ -127,7 +127,7 @@ impl PageTable { let address = NonConfidentialMemoryAddress::new(pointer)?; let page_size = paging_system.data_page_size(level); let page = PageAllocator::acquire_page(page_size)?.copy_from_non_confidential_memory(address)?; - LogicalPageTableEntry::PageWithConfidentialVmData(Box::new(page)) + LogicalPageTableEntry::PageWithConfidentialVmData(page) } }; serialized_representation.write(index, logical_page_table_entry.serialize()).unwrap(); @@ -161,7 +161,7 @@ impl PageTable { &mut self, confidential_vm_address: &ConfidentialVmPhysicalAddress, page_size: &PageSize, ) -> Result { let page = PageAllocator::acquire_page(*page_size)?.zeroize(); - let entry = LogicalPageTableEntry::PageWithConfidentialVmData(Box::new(page)); + let entry = LogicalPageTableEntry::PageWithConfidentialVmData(page); self.map_page(confidential_vm_address, page_size, entry)?; Ok(*page_size) } diff --git a/security-monitor/src/core/architecture/riscv/mmu/page_table_entry.rs b/security-monitor/src/core/architecture/riscv/mmu/page_table_entry.rs index 4442ab9..770bb11 100644 --- a/security-monitor/src/core/architecture/riscv/mmu/page_table_entry.rs +++ b/security-monitor/src/core/architecture/riscv/mmu/page_table_entry.rs @@ -19,7 +19,7 @@ pub(super) enum LogicalPageTableEntry { PointerToNextPageTable(Box), #[rr::pattern("PageWithConfidentialVmData" $ "p", "conf", "perm")] #[rr::refinement("-[ #(#p); #conf; #perm]")] - PageWithConfidentialVmData(Box>), + PageWithConfidentialVmData(Page), #[rr::pattern("PageSharedWithHypervisor" $ "sp", "conf", "perm")] #[rr::refinement("-[ #sp; #conf; #perm]")] PageSharedWithHypervisor(SharedPage),