peter/spectre-meltdown-checker
peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2024-12-26 20:10:31 +01:00
Code Issues Projects Releases Wiki Activity

misc: message clarifications

Browse Source
This commit is contained in:
Stéphane Lesimple 2018-03-25 12:27:40 +02:00
parent ece25b98a1
commit 28da7a0103
1 changed files with 29 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
spectre-meltdown-checker.sh
View File

@ -43,24 +43,27 @@ show_usage()
Second mode is the "offline" mode, where you can inspect a non-running kernel. Second mode is the "offline" mode, where you can inspect a non-running kernel.
You'll need to specify the location of the vmlinux file, config and System.map files: You'll need to specify the location of the vmlinux file, config and System.map files:
--kernel kernel_file Specify a (possibly compressed) Linux or BSD kernel file --kernel kernel_file specify a (possibly compressed) Linux or BSD kernel file
--config kernel_config Specify a kernel config file (Linux only) --config kernel_config specify a kernel config file (Linux only)
--map kernel_map_file Specify a kernel System.map file (Linux only) --map kernel_map_file specify a kernel System.map file (Linux only)
Options: Options:
--no-color Don't use color codes --no-color don't use color codes
--verbose, -v Increase verbosity level --verbose, -v increase verbosity level, possibly several times
--no-sysfs Don't use the /sys interface even if present
--sysfs-only Only use the /sys interface, don't run our own checks --no-sysfs don't use the /sys interface even if present [Linux]
--coreos Special mode for CoreOS (use an ephemeral toolbox to inspect kernel) --sysfs-only only use the /sys interface, don't run our own checks [Linux]
--arch-prefix PREFIX Specify a prefix for cross-inspecting a kernel of a different arch, for example "aarch64-linux-gnu-", --coreos special mode for CoreOS (use an ephemeral toolbox to inspect kernel) [Linux]
so that invoked tools such as objdump will be prefixed with this (i.e. aarch64-linux-gnu-objdump)
--batch text Produce machine readable output, this is the default if --batch is specified alone --arch-prefix PREFIX specify a prefix for cross-inspecting a kernel of a different arch, for example "aarch64-linux-gnu-",
--batch json Produce JSON output formatted for Puppet, Ansible, Chef... so that invoked tools will be prefixed with this (i.e. aarch64-linux-gnu-objdump)
--batch nrpe Produce machine readable output formatted for NRPE --batch text produce machine readable output, this is the default if --batch is specified alone
--batch prometheus Produce output for consumption by prometheus-node-exporter --batch json produce JSON output formatted for Puppet, Ansible, Chef...
--variant [1,2,3] Specify which variant you'd like to check, by default all variants are checked --batch nrpe produce machine readable output formatted for NRPE
Can be specified multiple times (e.g. --variant 2 --variant 3) --batch prometheus produce output for consumption by prometheus-node-exporter
--variant [1,2,3] specify which variant you'd like to check, by default all variants are checked,
can be specified multiple times (e.g. --variant 2 --variant 3)
Return codes: Return codes:
0 (not vulnerable), 2 (vulnerable), 3 (unknown), 255 (error) 0 (not vulnerable), 2 (vulnerable), 3 (unknown), 255 (error)
@ -1313,7 +1316,7 @@ check_cpu()
fi fi
if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then
spec_ctrl_msr=-1 spec_ctrl_msr=-1
pstatus yellow UNKNOWN "couldn't read MSR, is MSR support enabled in your kernel?" pstatus yellow UNKNOWN "is msr kernel module available?"
else else
# the new MSR 'SPEC_CTRL' is at offset 0x48 # the new MSR 'SPEC_CTRL' is at offset 0x48
# here we use dd, it's the same as using 'rdmsr 0x48' but without needing the rdmsr tool # here we use dd, it's the same as using 'rdmsr 0x48' but without needing the rdmsr tool
@ -1355,7 +1358,7 @@ check_cpu()
pstatus green YES "SPEC_CTRL feature bit" pstatus green YES "SPEC_CTRL feature bit"
cpuid_spec_ctrl=1 cpuid_spec_ctrl=1
elif [ $ret -eq 2 ]; then elif [ $ret -eq 2 ]; then
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/cpuid, is cpuid support enabled in your kernel?" pstatus yellow UNKNOWN "is cpuid kernel module available?"
else else
pstatus red NO pstatus red NO
fi fi
@ -1381,7 +1384,7 @@ check_cpu()
_info " * Indirect Branch Prediction Barrier (IBPB)" _info " * Indirect Branch Prediction Barrier (IBPB)"
_info_nol " * PRED_CMD MSR is available: " _info_nol " * PRED_CMD MSR is available: "
if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?" pstatus yellow UNKNOWN "is msr kernel module available?"
else else
# the new MSR 'PRED_CTRL' is at offset 0x49, write-only # the new MSR 'PRED_CTRL' is at offset 0x49, write-only
# here we use dd, it's the same as using 'wrmsr 0x49 0' but without needing the wrmsr tool # here we use dd, it's the same as using 'wrmsr 0x49 0' but without needing the wrmsr tool
@ -1421,7 +1424,7 @@ check_cpu()
elif [ "$cpuid_spec_ctrl" = 1 ]; then elif [ "$cpuid_spec_ctrl" = 1 ]; then
pstatus green YES "SPEC_CTRL feature bit" pstatus green YES "SPEC_CTRL feature bit"
elif [ $ret -eq 2 ]; then elif [ $ret -eq 2 ]; then
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/cpuid, is cpuid support enabled in your kernel?" pstatus yellow UNKNOWN "is cpuid kernel module available?"
else else
pstatus red NO pstatus red NO
fi fi
@ -1434,7 +1437,7 @@ check_cpu()
elif [ "$spec_ctrl_msr" = 0 ]; then elif [ "$spec_ctrl_msr" = 0 ]; then
pstatus red NO pstatus red NO
else else
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?" pstatus yellow UNKNOWN "is cpuid kernel module available?"
fi fi
_info_nol " * CPU indicates STIBP capability: " _info_nol " * CPU indicates STIBP capability: "
@ -1443,7 +1446,7 @@ check_cpu()
if [ $ret -eq 0 ]; then if [ $ret -eq 0 ]; then
pstatus green YES pstatus green YES
elif [ $ret -eq 2 ]; then elif [ $ret -eq 2 ]; then
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/cpuid, is cpuid support enabled in your kernel?" pstatus yellow UNKNOWN "is cpuid kernel module available?"
else else
pstatus red NO pstatus red NO
fi fi
@ -1457,7 +1460,7 @@ check_cpu()
pstatus green YES pstatus green YES
cpuid_arch_capabilities=1 cpuid_arch_capabilities=1
elif [ $ret -eq 2 ]; then elif [ $ret -eq 2 ]; then
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/cpuid, is cpuid support enabled in your kernel?" pstatus yellow UNKNOWN "is cpuid kernel module available?"
else else
pstatus red NO pstatus red NO
cpuid_arch_capabilities=0 cpuid_arch_capabilities=0
@ -1474,7 +1477,7 @@ check_cpu()
pstatus red NO pstatus red NO
elif [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then elif [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then
spec_ctrl_msr=-1 spec_ctrl_msr=-1
pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?" pstatus yellow UNKNOWN "is msr kernel module available?"
else else
# the new MSR 'ARCH_CAPABILITIES' is at offset 0x10a # the new MSR 'ARCH_CAPABILITIES' is at offset 0x10a
# here we use dd, it's the same as using 'rdmsr 0x10a' but without needing the rdmsr tool # here we use dd, it's the same as using 'rdmsr 0x10a' but without needing the rdmsr tool
@ -1544,7 +1547,7 @@ check_cpu()
check_cpu_vulnerabilities() check_cpu_vulnerabilities()
{ {
_info "* CPU vulnerability to the three speculative execution attacks variants" _info "* CPU vulnerability to the three speculative execution attack variants"
for v in 1 2 3; do for v in 1 2 3; do
_info_nol " * Vulnerable to Variant $v: " _info_nol " * Vulnerable to Variant $v: "
if is_cpu_vulnerable $v; then if is_cpu_vulnerable $v; then
@ -2225,7 +2228,7 @@ check_variant3_linux()
if [ "$xen_pv_domu" = 1 ]; then if [ "$xen_pv_domu" = 1 ]; then
pstatus red YES pstatus red YES
else else
pstatus green NO pstatus blue NO
fi fi
fi fi