320 lines
14 KiB
Python
320 lines
14 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate the fail-closed Phase-1.0R launch-context analysis."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
from typing import Any
|
|
|
|
|
|
PHASE = "PHASE_1_0R_LAUNCH_CONTEXT_ANALYSIS"
|
|
STATUS = "NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED"
|
|
RA_SOURCE = "12cf1d783c41eb303987e49a5a920805a59ef7a4"
|
|
RA_HEAD = "606909706f91d7213751c245081333f56c2cce89"
|
|
SDK_COMMIT = "d2e2e585740362976a39fdd5ccf390f199a7bc37"
|
|
SDL_COMMIT = "0baf4ac49382b537ba449901b5b6d0d189bb1fbb"
|
|
ELFLDR_COMMIT = "197623058f509eddde18868dafcb92fdcac66464"
|
|
MANAGER_COMMIT = "e23d94ff91233aa770e2342800c1467875bdef44"
|
|
PACBREW_COMMIT = "c2abcfcb60f569128abd0e8e70ad03a67bee5ea7"
|
|
AUTHORIZATION_FIELDS = (
|
|
"target_build_authorized", "ps5_connection_authorized",
|
|
"device_transfer_authorized", "device_execution_authorized",
|
|
"result_receive_authorized", "installation_authorized",
|
|
"autoload_authorized", "device_write_authorized", "automatic_retry",
|
|
)
|
|
|
|
|
|
def load_json(path: Path) -> dict[str, Any]:
|
|
value = json.loads(path.read_text(encoding="utf-8"))
|
|
if not isinstance(value, dict):
|
|
raise ValueError("launch-context manifest is not an object")
|
|
return value
|
|
|
|
|
|
def sha256(path: Path) -> str:
|
|
digest = hashlib.sha256()
|
|
with path.open("rb") as stream:
|
|
for chunk in iter(lambda: stream.read(1024 * 1024), b""):
|
|
digest.update(chunk)
|
|
return digest.hexdigest()
|
|
|
|
|
|
def git(root: Path, *args: str) -> str:
|
|
result = subprocess.run(
|
|
["git", *args], cwd=root, capture_output=True, text=True, check=False)
|
|
if result.returncode:
|
|
raise RuntimeError(result.stderr.strip() or "git failed")
|
|
return result.stdout
|
|
|
|
|
|
def all_false(record: dict[str, Any], fields: tuple[str, ...]) -> bool:
|
|
return all(record.get(field) is False for field in fields)
|
|
|
|
|
|
def source_identities_are_exact(record: dict[str, Any]) -> bool:
|
|
return record == {
|
|
"retroarch_artifact_source_commit": RA_SOURCE,
|
|
"retroarch_inspected_head": RA_HEAD,
|
|
"sdk_commit": SDK_COMMIT,
|
|
"sdl_commit": SDL_COMMIT,
|
|
"hardened_elfldr_commit": ELFLDR_COMMIT,
|
|
"controlled_payload_manager_commit": MANAGER_COMMIT,
|
|
"pacbrew_commit": PACBREW_COMMIT,
|
|
"lakesnes_reference_commit":
|
|
"a2db690123649c7ffbc68a663af31efb3a41bf3f",
|
|
}
|
|
|
|
|
|
def sdl2main_is_lifecycle_only(record: dict[str, Any]) -> bool:
|
|
return record == {
|
|
"linked_by_exact_retroarch_artifact": False,
|
|
"calls_hide_splash_before_sdl_main": True,
|
|
"calls_load_exec_exit_after_sdl_main_returns": True,
|
|
"adds_application_registration": False,
|
|
"adds_title_identity": False,
|
|
"adds_lnc_setup": False,
|
|
"adds_videoout_ownership_setup": False,
|
|
"pre_submit_difference": "EARLIER_HIDE_SPLASH_ONLY",
|
|
"post_return_action": "LOAD_EXEC_EXIT",
|
|
}
|
|
|
|
|
|
def retroarch_path_is_exact(record: dict[str, Any]) -> bool:
|
|
return record == {
|
|
"sdk_crt1_linked": True,
|
|
"sdl_video_backend_linked": True,
|
|
"sdl2main_linked": False,
|
|
"system_service_hide_splash_imported": True,
|
|
"system_service_load_exec_imported": False,
|
|
"sdl_video_hides_splash_before_videoout_open": True,
|
|
}
|
|
|
|
|
|
def launch_routes_are_fail_closed(record: dict[str, Any]) -> bool:
|
|
direct = record.get("direct_raw_elf", {})
|
|
manager = record.get("payload_manager_raw_elf", {})
|
|
return (
|
|
direct == {"constructor": "HARDENED_ELFLDR_SPAWN",
|
|
"app_registration_found": False}
|
|
and manager == {"constructor": "HARDENED_ELFLDR_SPAWN",
|
|
"transport": "LOOPBACK_9021",
|
|
"app_registration_found": False}
|
|
and record.get("direct_and_manager_same_elfldr_spawn_path") is True
|
|
and record.get("controlled_route_creates_distinct_app_context") is False
|
|
and record.get("port_launcher_contract") == "PARTIAL_UNBOUND"
|
|
and record.get("active_app_state_runtime") == "UNPROVEN"
|
|
)
|
|
|
|
|
|
def packaging_is_not_launcher_proof(record: dict[str, Any]) -> bool:
|
|
return record == {
|
|
"pacbrew_is_launcher": False,
|
|
"pacbrew_classification": "PACKAGE_METADATA_ONLY",
|
|
"homebrew_js_is_app_registration": False,
|
|
"lakesnes_links_sdl2main": True,
|
|
"lakesnes_launcher_implementation_bound": False,
|
|
"official_port_runtime_success_used_as_hardware_evidence": False,
|
|
}
|
|
|
|
|
|
def runtime_observation_is_not_promoted(record: dict[str, Any]) -> bool:
|
|
return record == {
|
|
"lnc_log_classification": "OBSERVED_NONUNIQUE_CORRELATION",
|
|
"lnc_exact_caller_observed": False,
|
|
"lnc_log_accepted_as_root_cause": False,
|
|
"first_submit_failure_remains": True,
|
|
"visible_output_proven": False,
|
|
"cleanup_proven": False,
|
|
}
|
|
|
|
|
|
def decision_is_blocked(record: dict[str, Any]) -> bool:
|
|
return (
|
|
record.get("root_cause_resolved") is False
|
|
and record.get("sdl2main_change_allowed") is False
|
|
and record.get("lnc_or_system_service_change_allowed") is False
|
|
and record.get("submit_parameter_change_allowed") is False
|
|
and record.get("new_videoout_call_allowed") is False
|
|
and record.get("target_build_allowed") is False
|
|
and record.get("device_action_allowed") is False
|
|
and record.get("safe_next_steps") == [
|
|
"OFFLINE_EXACT_HBLDR_SHSRV_PROVENANCE_AUDIT",
|
|
"HOST_OR_SOFTWARE_ONLY_INTEGRATION",
|
|
]
|
|
)
|
|
|
|
|
|
def file_identity_is_exact(path: Path, record: dict[str, Any]) -> bool:
|
|
return path.stat().st_size == record.get("size") and \
|
|
sha256(path) == record.get("sha256")
|
|
|
|
|
|
def validate(
|
|
root: Path, retroarch_root: Path, sdk_root: Path, sdl_root: Path,
|
|
elfldr_root: Path, manager_root: Path, pacbrew_root: Path,
|
|
) -> list[str]:
|
|
errors: list[str] = []
|
|
try:
|
|
record = load_json(
|
|
root / "manifests/retroarch/phase-1.0r-launch-context-analysis.json")
|
|
except (OSError, ValueError, json.JSONDecodeError) as error:
|
|
return [str(error)]
|
|
if record.get("phase") != PHASE or record.get("status") != STATUS:
|
|
errors.append("phase/status mismatch")
|
|
if record.get("start_commit") != "dbd2b2658bb12018a691c4a0edfb06c2a103848f":
|
|
errors.append("start commit mismatch")
|
|
if not all_false(record.get("authorizations", {}), AUTHORIZATION_FIELDS):
|
|
errors.append("authorization remains active")
|
|
if not source_identities_are_exact(record.get("source_identities", {})):
|
|
errors.append("source identity mismatch")
|
|
if not sdl2main_is_lifecycle_only(record.get("sdl2main", {})):
|
|
errors.append("SDL2main semantics were promoted or changed")
|
|
if not retroarch_path_is_exact(record.get("exact_retroarch_path", {})):
|
|
errors.append("exact RetroArch linkage mismatch")
|
|
if not launch_routes_are_fail_closed(record.get("launch_routes", {})):
|
|
errors.append("launch route was promoted")
|
|
if not packaging_is_not_launcher_proof(record.get("packaging_and_ports", {})):
|
|
errors.append("packaging or descriptor was promoted to launcher proof")
|
|
if not runtime_observation_is_not_promoted(record.get("runtime_observation", {})):
|
|
errors.append("runtime observation was promoted")
|
|
if not decision_is_blocked(record.get("decision", {})):
|
|
errors.append("target change or device path is not blocked")
|
|
performed = record.get("performed_actions", {})
|
|
if set(performed) != {
|
|
"target_source_changed", "target_artifact_created", "ps5_connected",
|
|
"device_transfer_performed", "target_execution_performed",
|
|
"result_received_from_device",
|
|
} or not all(value is False for value in performed.values()):
|
|
errors.append("performed-action boundary mismatch")
|
|
tests = record.get("tests", {})
|
|
if not (
|
|
tests.get("chimera_gfx_ctest") == "64_OF_64_PASS"
|
|
and tests.get("phase10r_guardrails") == 20
|
|
and tests.get("safety_audit") == "PASS"
|
|
and tests.get("secret_scan") == "PASS"
|
|
and tests.get("network_required_by_tests") is False
|
|
and tests.get("hardware_claim_from_host_test") is False
|
|
):
|
|
errors.append("test evidence mismatch")
|
|
|
|
repositories = (
|
|
(retroarch_root, RA_HEAD, "RetroArch"),
|
|
(sdk_root, SDK_COMMIT, "SDK"),
|
|
(sdl_root, SDL_COMMIT, "SDL"),
|
|
(elfldr_root, ELFLDR_COMMIT, "elfldr"),
|
|
(manager_root, MANAGER_COMMIT, "Payload Manager"),
|
|
(pacbrew_root, PACBREW_COMMIT, "PacBrew"),
|
|
)
|
|
try:
|
|
for repository, commit, name in repositories:
|
|
if git(repository, "rev-parse", "HEAD").strip() != commit:
|
|
errors.append(f"{name} HEAD mismatch")
|
|
if git(repository, "status", "--porcelain"):
|
|
errors.append(f"{name} tree is dirty")
|
|
|
|
exact = record["exact_files"]
|
|
paths = {
|
|
"sdl2main": sdl_root / "src/main/ps5/SDL_ps5_main.c",
|
|
"sdl_ps5_video": sdl_root / "src/video/ps5/SDL_ps5video.c",
|
|
"sdk_crt": sdk_root / "crt/crt.c",
|
|
"elfldr": elfldr_root / "elfldr.c",
|
|
"elfldr_socket_server": elfldr_root / "socksrv.c",
|
|
"payload_manager_launcher": manager_root / "src/ps5_launcher.c",
|
|
"retroarch_makefile": retroarch_root / "Makefile.ps5",
|
|
"artifact": retroarch_root / "build/phase10m/write-diag-a/retroarch_ps5_write_diag.elf",
|
|
"linker_map": retroarch_root / "build/phase10m/write-diag-a/retroarch_ps5_write_diag.map",
|
|
}
|
|
for name, path in paths.items():
|
|
if not file_identity_is_exact(path, exact[name]):
|
|
errors.append(f"{name} file identity mismatch")
|
|
|
|
wrapper = paths["sdl2main"].read_text(encoding="utf-8")
|
|
if not all(token in wrapper for token in (
|
|
"sceSystemServiceHideSplashScreen();", "SDL_main(argc, argv);",
|
|
'sceSystemServiceLoadExec("exit", 0);')):
|
|
errors.append("SDL2main lifecycle source mismatch")
|
|
if any(token in wrapper for token in ("sceLnc", "sceVideoOut", "AppId", "TitleId")):
|
|
errors.append("unexpected registration/VideoOut token in SDL2main")
|
|
|
|
video = paths["sdl_ps5_video"].read_text(encoding="utf-8")
|
|
video_init = video.find("static int PS5_VideoInit(_THIS)")
|
|
hide = video.find("sceSystemServiceHideSplashScreen();", video_init)
|
|
open_call = video.find("sceVideoOutOpen(0xff, 0, 0, NULL);", video_init)
|
|
if video_init < 0 or hide < 0 or open_call < 0 or hide >= open_call:
|
|
errors.append("SDL splash-hide/open ordering mismatch")
|
|
|
|
crt = paths["sdk_crt"].read_text(encoding="utf-8")
|
|
if "_start(payload_args_t *args)" not in crt or \
|
|
"main(argc, argv, environ)" not in crt:
|
|
errors.append("SDK CRT entry contract mismatch")
|
|
if any(token in crt for token in ("sceLnc", "sceVideoOut", "AppId")):
|
|
errors.append("unexpected application registration in SDK CRT")
|
|
|
|
socksrv = paths["elfldr_socket_server"].read_text(encoding="utf-8")
|
|
elfldr = paths["elfldr"].read_text(encoding="utf-8")
|
|
if "payload_spawn(" not in socksrv or "elfldr_spawn(" not in socksrv:
|
|
errors.append("elfldr raw route mismatch")
|
|
if "rfork_thread(" not in elfldr or "execve(SceSpZeroConf" not in elfldr:
|
|
errors.append("elfldr process constructor mismatch")
|
|
|
|
manager = paths["payload_manager_launcher"].read_text(encoding="utf-8")
|
|
if "int ps5_launch_elf(" not in manager or \
|
|
'inet_addr("127.0.0.1")' not in manager:
|
|
errors.append("Payload Manager loopback launch mismatch")
|
|
|
|
makefile = paths["retroarch_makefile"].read_text(encoding="utf-8")
|
|
if "libSDL2.a" not in makefile or "libSDL2main" in makefile:
|
|
errors.append("RetroArch SDL linkage mismatch")
|
|
link_map = paths["linker_map"].read_text(encoding="utf-8", errors="replace")
|
|
if "crt1.o:(.text._start)" not in link_map or \
|
|
"libSDL2.a(SDL_ps5video.c.o)" not in link_map:
|
|
errors.append("linker-map source binding missing")
|
|
if any(token in link_map for token in (
|
|
"SDL_ps5_main", "libSDL2main", "sceSystemServiceLoadExec")):
|
|
errors.append("linker map unexpectedly contains SDL2main")
|
|
|
|
recipe = (pacbrew_root / "SDL2/PKGBUILD").read_text(encoding="utf-8")
|
|
if "ps5-payload-dev/SDL.git" not in recipe or \
|
|
"sha256sums=('SKIP')" not in recipe:
|
|
errors.append("PacBrew SDL recipe mismatch")
|
|
|
|
tracked = git(root, "ls-files").splitlines()
|
|
if any(path.lower().endswith((".elf", ".self", ".sprx", ".pkg", ".map"))
|
|
for path in tracked):
|
|
errors.append("target artifact or linker map is tracked")
|
|
except (OSError, RuntimeError, KeyError) as error:
|
|
errors.append(str(error))
|
|
return errors
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
parser.add_argument("--retroarch-root", type=Path, required=True)
|
|
parser.add_argument("--sdk-root", type=Path, required=True)
|
|
parser.add_argument("--sdl-root", type=Path, required=True)
|
|
parser.add_argument("--elfldr-root", type=Path, required=True)
|
|
parser.add_argument("--manager-root", type=Path, required=True)
|
|
parser.add_argument("--pacbrew-root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
errors = validate(
|
|
args.root.resolve(), args.retroarch_root.resolve(),
|
|
args.sdk_root.resolve(), args.sdl_root.resolve(),
|
|
args.elfldr_root.resolve(), args.manager_root.resolve(),
|
|
args.pacbrew_root.resolve())
|
|
if errors:
|
|
for error in errors:
|
|
print(f"ERROR: {error}")
|
|
return 1
|
|
print("Phase-1.0R launch-context analysis validation passed")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|