tools: Add unsafe analyzer cargo gegier

Signed-off-by: Sangwan Kwon <[email protected]>

.github/workflows/ci.yml

@@ -181,3 +181,19 @@ jobs:
     - name: Run cli build (x86_64, aarch64)
       working-directory: cli
       run: make
+
+  rust-unsafe-analysis:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install dependencies
+      run: ./scripts/init-unsafe-analysis.sh
+
+    - name: Run unsafe analyzer
+      run: ./scripts/analyze-unsafe.sh
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: tools
+        path: out/unsafe-analysis.log

.gitmodules

@@ -60,3 +60,6 @@
 [submodule "third-party/certifier"]
 	path = third-party/certifier
 	url = https://github.com/vmware-research/certifier-framework-for-confidential-computing
+[submodule "third-party/cargo-geiger"]
+	path = third-party/cargo-geiger
+	url = https://github.com/bitboom/cargo-geiger

scripts/analyze-unsafe.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -e
+
+ROOT=$(git rev-parse --show-toplevel)
+TOOL=$ROOT/third-party/cargo-geiger
+OUT=$ROOT/out
+
+mkdir -p $OUT
+
+cd $ROOT/plat/fvp
+cargo geiger --output-format Ratio | tee $OUT/unsafe-analysis.log

scripts/init-unsafe-analysis.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+ROOT=$(git rev-parse --show-toplevel)
+HERE=$ROOT/scripts
+TOOL=$ROOT/third-party/cargo-geiger
+
+$HERE/deps/rust.sh
+
+git submodule update --init $TOOL
+cargo +stable install cargo-geiger --force --locked \
+	--path $TOOL/cargo-geiger \
+	--target x86_64-unknown-linux-gnu