From: "Tobin C. Harding" <me@tobin.cc>
To: me@tobin.cc, kaiwan.billimoria@gmail.com
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>,
Alexander Kapshuk <alexander.kapshuk@gmail.com>,
LKML <linux-kernel@vger.kernel.org>,
kernel-hardening@lists.openwall.com
Subject: [PATCH 5/5] leaking_addresses: add support for 5 page table levels
Date: Thu, 7 Dec 2017 15:32:25 +1100 [thread overview]
Message-ID: <1512621145-4783-6-git-send-email-me@tobin.cc> (raw)
In-Reply-To: <1512621145-4783-1-git-send-email-me@tobin.cc>
Currently script only supports 4 page table levels because of the way
the kernel address regular expression is crafted. We can do better than
this. Using previously added support for kernel configuration options we
can get the number of page table levels defined by
CONFIG_PGTABLE_LEVELS. Using this value a correct regular expression can
be crafted. This only supports 5 page tables on x86_64.
Add support for 5 page table levels on x86_64.
Signed-off-by: Tobin C. Harding <me@tobin.cc>
---
scripts/leaking_addresses.pl | 60 ++++++++++++++++++++++++++++++++++++++------
1 file changed, 53 insertions(+), 7 deletions(-)
diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl
index 892bfe9e01fe..82be5f18ea5f 100755
--- a/scripts/leaking_addresses.pl
+++ b/scripts/leaking_addresses.pl
@@ -21,6 +21,7 @@ use Term::ANSIColor qw(:constants);
use Getopt::Long qw(:config no_auto_abbrev);
use Config;
use bigint qw/hex/;
+use feature 'state';
my $P = $0;
my $V = '0.01';
@@ -39,12 +40,14 @@ my @SUPPORTED_ARCHITECTURES = ('x86_64', 'ppc64');
# Command line options.
my $help = 0;
my $debug = 0;
+
my $raw = 0;
my $output_raw = ""; # Write raw results to file.
my $input_raw = ""; # Read raw results from file instead of scanning.
my $suppress_dmesg = 0; # Don't show dmesg in output.
my $squash_by_path = 0; # Summary report grouped by absolute path.
my $squash_by_filename = 0; # Summary report grouped by filename.
+
my $kernel_config_file = ""; # Kernel configuration file.
# Do not parse these files (absolute path).
@@ -212,11 +215,13 @@ sub get_kernel_config_option
} else {
my $file = '/boot/config-' . `uname -r`;
+ chomp $file;
@config_files = ($file, '/boot/config');
}
foreach my $file (@config_files) {
-# chomp $config_file;
+ printf("file: %s\n", $file);
+
$value = option_from_file($option, $file);
if ($value ne "") {
last;
@@ -295,12 +300,8 @@ sub may_leak_address
return 0;
}
- # One of these is guaranteed to be true.
- if (is_x86_64()) {
- $address_re = '\b(0x)?ffff[[:xdigit:]]{12}\b';
- } elsif (is_ppc64()) {
- $address_re = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b';
- }
+ $address_re = get_address_re();
+ dprint("Kernel address regular expression: %s\n", $address_re);
while (/($address_re)/g) {
if (!is_false_positive($1)) {
@@ -311,6 +312,51 @@ sub may_leak_address
return 0;
}
+sub get_address_re
+{
+ my $re;
+
+ if (is_x86_64()) {
+ $re = get_x86_64_re();
+ } elsif (is_ppc64()) {
+ $re = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b';
+ }
+
+ if ($re eq "") {
+ print STDERR "$0: failed to build kernel address regular expression\n";
+ }
+
+ return $re;
+}
+
+sub get_x86_64_re
+{
+ state $ptl = get_page_table_levels();
+ my $re;
+
+ if ($ptl == 5) {
+ $re = '\b(0x)?ff[[:xdigit:]]{14}\b';
+ } else {
+ $re = '\b(0x)?ffff[[:xdigit:]]{12}\b';
+ }
+
+ return $re;
+}
+
+sub get_page_table_levels
+{
+ my $ptl = "";
+ my $default_ptl = "4";
+
+ $ptl = get_kernel_config_option('CONFIG_PGTABLE_LEVELS');
+ if ($ptl eq "") {
+ $ptl = $default_ptl;
+ printf(STDERR "$0: defaulting to %s page table levels\n", $default_ptl);
+ }
+
+ return $ptl;
+}
+
sub parse_dmesg
{
open my $cmd, '-|', 'dmesg';
--
2.7.4
prev parent reply other threads:[~2017-12-07 4:33 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-07 4:32 [PATCH 0/5] leaking_addresses: support 5 page table level Tobin C. Harding
2017-12-07 4:32 ` [PATCH 1/5] leaking_addresses: remove command examples Tobin C. Harding
2017-12-07 4:32 ` [PATCH 2/5] leaking_addresses: indent dependant options Tobin C. Harding
2017-12-07 4:32 ` [PATCH 3/5] leaking_addresses: add range check for vsyscall memory Tobin C. Harding
2017-12-07 4:32 ` [PATCH 4/5] leaking_addresses: add support for kernel config file Tobin C. Harding
2017-12-08 1:55 ` Kaiwan N Billimoria
2017-12-07 4:32 ` Tobin C. Harding [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1512621145-4783-6-git-send-email-me@tobin.cc \
--to=me@tobin.cc \
--cc=alexander.kapshuk@gmail.com \
--cc=kaiwan.billimoria@gmail.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=kirill@shutemov.name \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®