mirror of
https://github.com/speed47/spectre-meltdown-checker.git
synced 2026-08-03 10:35:34 +02:00
feat: add ARM64 silicon errata checks (issue #357)
Add detection for three speculation/security-relevant ARM64 errata families that are tracked by vendor erratum IDs rather than CVEs: Speculative AT TLB corruption (1165522/1319367/1319537/1530923), speculative unprivileged load (2966298/3117295), and MSR SSBS not self-synchronizing (3194386 and siblings). Reserves a new CVE-0001-NNNN placeholder range for vendor errata and adds a --errata <number> selector alongside --variant/--cve. CPU affection is determined per-core from (implementer, part, variant, revision) tuples read from /proc/cpuinfo, matching the kernel's MIDR ranges (including Kryo4xx Silver for erratum 1530923). Kernel mitigation detection uses the erratum-specific CONFIG_ARM64_ERRATUM_NNNN symbols, kernel image descriptor strings, and dmesg output (no sysfs for these)
This commit is contained in:
Stéphane Lesimple
@@ -24,6 +24,9 @@ show_usage() {
|
||||
can be used multiple times (e.g. --variant 3a --variant l1tf). For a list use 'help'.
|
||||
--cve CVE specify which CVE you'd like to check, by default all supported CVEs are checked
|
||||
can be used multiple times (e.g. --cve CVE-2017-5753 --cve CVE-2020-0543)
|
||||
--errata NUMBER specify a vendor-numbered erratum (e.g. ARM64 erratum 1530923) that has no CVE
|
||||
assigned. Maps the erratum to the corresponding check. For a list use 'help'.
|
||||
Can be used multiple times (e.g. --errata 1530923 --errata 3194386).
|
||||
|
||||
Check scope:
|
||||
--no-sysfs don't use the /sys interface even if present [Linux]
|
||||
@@ -154,9 +157,12 @@ g_smc_cpu_info_line=''
|
||||
# CVE Registry: single source of truth for all CVE metadata.
|
||||
# Fields: cve_id|json_key_name|affected_var_suffix|complete_name_and_aliases
|
||||
#
|
||||
# Two ranges of placeholder IDs are reserved when no real CVE applies:
|
||||
# Three ranges of placeholder IDs are reserved when no real CVE applies:
|
||||
# CVE-0000-NNNN: permanent placeholder for supplementary checks (--extra only)
|
||||
# that will never receive a real CVE (e.g. SLS, compile-time hardening).
|
||||
# CVE-0001-NNNN: permanent placeholder for vendor-numbered errata that will never
|
||||
# receive a CVE (e.g. ARM64 silicon errata tracked only by erratum ID).
|
||||
# Selectable via --errata <number>.
|
||||
# CVE-9999-NNNN: temporary placeholder for real vulnerabilities awaiting CVE
|
||||
# assignment. Rename across the codebase once the real CVE is issued.
|
||||
readonly CVE_REGISTRY='
|
||||
@@ -193,6 +199,9 @@ CVE-2023-28746|RFDS|rfds|Register File Data Sampling (RFDS)
|
||||
CVE-2024-45332|BPI|bpi|Branch Privilege Injection (BPI)
|
||||
CVE-0000-0001|SLS|sls|Straight-Line Speculation (SLS)
|
||||
CVE-2025-54505|FPDSS|fpdss|FPDSS, AMD Zen1 Floating-Point Divider Stale Data Leak
|
||||
CVE-0001-0001|ARM SPEC AT|arm_spec_at|ARM64 errata 1165522/1319367/1319537/1530923, Speculative AT TLB corruption
|
||||
CVE-0001-0002|ARM SPEC UNPRIV LOAD|arm_spec_unpriv_load|ARM64 errata 2966298/3117295, Speculative unprivileged load
|
||||
CVE-0001-0003|ARM SSBS NOSYNC|arm_ssbs_nosync|ARM64 erratum 3194386, MSR SSBS not self-synchronizing
|
||||
'
|
||||
|
||||
# Derive the supported CVE list from the registry
|
||||
|
||||
@@ -106,6 +106,10 @@ is_cpu_affected() {
|
||||
affected_srbds=''
|
||||
affected_mmio=''
|
||||
affected_sls=''
|
||||
# ARM64 speculation-related errata (ARM Ltd, implementer 0x41); non-ARM systems are immune below.
|
||||
affected_arm_spec_at=''
|
||||
affected_arm_spec_unpriv_load=''
|
||||
affected_arm_ssbs_nosync=''
|
||||
# DIV0, FPDSS, Zenbleed and Inception are all AMD specific, look for "is_amd" below:
|
||||
_set_immune div0
|
||||
_set_immune fpdss
|
||||
@@ -827,6 +831,77 @@ is_cpu_affected() {
|
||||
_infer_immune sls
|
||||
fi
|
||||
|
||||
# ARM64 silicon errata (speculation/security-relevant, no CVE assignments).
|
||||
# References: arch/arm64/Kconfig (ARM64_ERRATUM_*), arch/arm64/kernel/cpu_errata.c MIDR lists.
|
||||
# Iterates per-core (impl, part, variant, revision) tuples. Implementers currently handled:
|
||||
# 0x41 ARM Ltd; 0x51 Qualcomm (Kryo4xx Silver for erratum 1530923).
|
||||
# Revision ranges mirror the kernel's MIDR_RANGE/MIDR_REV_RANGE/MIDR_REV macros. A variant
|
||||
# 'v' and revision 'p' are packed as (v<<4)|p for range compares — equivalent to the kernel's
|
||||
# layout (MIDR_VARIANT_SHIFT=20, MIDR_REVISION_MASK=0xf) under the same order semantics.
|
||||
# Unknown variant/revision ⇒ treat as in range (whitelist principle, DEVELOPMENT.md rule 5).
|
||||
if [ -n "$cpu_part_list" ]; then
|
||||
i=0
|
||||
for cpupart in $cpu_part_list; do
|
||||
i=$((i + 1))
|
||||
# shellcheck disable=SC2086
|
||||
cpuimpl=$(echo $cpu_impl_list | awk '{print $'$i'}')
|
||||
# shellcheck disable=SC2086
|
||||
cpuvar=$(echo $cpu_variant_list | awk '{print $'$i'}')
|
||||
# shellcheck disable=SC2086
|
||||
cpurev=$(echo $cpu_revision_list | awk '{print $'$i'}')
|
||||
packed=''
|
||||
[ -n "$cpuvar" ] && [ -n "$cpurev" ] && packed=$(((cpuvar << 4) | cpurev))
|
||||
|
||||
# Speculative AT TLB corruption (errata 1165522, 1319367, 1319537, 1530923)
|
||||
if [ "$cpuimpl" = 0x41 ]; then
|
||||
if echo "$cpupart" | grep -q -w -e 0xd07 -e 0xd08; then
|
||||
# Cortex-A57 (0xd07) / A72 (0xd08): all revisions
|
||||
_set_vuln arm_spec_at
|
||||
elif echo "$cpupart" | grep -q -w -e 0xd05 -e 0xd0b; then
|
||||
# Cortex-A55 (0xd05) / A76 (0xd0b): r0p0..r2p0 (packed 0..32)
|
||||
if [ -z "$packed" ] || [ "$packed" -le 32 ]; then
|
||||
_set_vuln arm_spec_at
|
||||
fi
|
||||
fi
|
||||
elif [ "$cpuimpl" = 0x51 ] && [ "$cpupart" = 0x805 ]; then
|
||||
# Qualcomm Kryo4xx Silver: kernel matches MIDR_REV(var 0xd, rev 0xe) only — packed 0xde = 222
|
||||
if [ -z "$packed" ] || [ "$packed" = 222 ]; then
|
||||
_set_vuln arm_spec_at
|
||||
fi
|
||||
fi
|
||||
|
||||
# Speculative unprivileged load (errata 2966298 A520, 3117295 A510) — ARM Ltd only
|
||||
if [ "$cpuimpl" = 0x41 ]; then
|
||||
if [ "$cpupart" = 0xd46 ]; then
|
||||
# Cortex-A510: all revisions
|
||||
_set_vuln arm_spec_unpriv_load
|
||||
elif [ "$cpupart" = 0xd80 ]; then
|
||||
# Cortex-A520: r0p0..r0p1 (packed 0..1)
|
||||
if [ -z "$packed" ] || [ "$packed" -le 1 ]; then
|
||||
_set_vuln arm_spec_unpriv_load
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# MSR SSBS not self-synchronizing (erratum 3194386 + siblings) — ARM Ltd only, all revisions.
|
||||
# A76/A77/A78/A78C/A710/A715/A720/A720AE/A725, X1/X1C/X2/X3/X4/X925, N1/N2/N3, V1/V2/V3/V3AE
|
||||
if [ "$cpuimpl" = 0x41 ]; then
|
||||
if echo "$cpupart" | grep -q -w \
|
||||
-e 0xd0b -e 0xd0d -e 0xd41 -e 0xd4b \
|
||||
-e 0xd47 -e 0xd4d -e 0xd81 -e 0xd89 -e 0xd87 \
|
||||
-e 0xd44 -e 0xd4c -e 0xd48 -e 0xd4e -e 0xd82 -e 0xd85 \
|
||||
-e 0xd0c -e 0xd49 -e 0xd8e \
|
||||
-e 0xd40 -e 0xd4f -e 0xd84 -e 0xd83; then
|
||||
_set_vuln arm_ssbs_nosync
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
# Default everything else to immune (covers non-ARM, and ARM cores not in the affected lists)
|
||||
_infer_immune arm_spec_at
|
||||
_infer_immune arm_spec_unpriv_load
|
||||
_infer_immune arm_ssbs_nosync
|
||||
|
||||
# shellcheck disable=SC2154
|
||||
{
|
||||
pr_debug "is_cpu_affected: final results: variant1=$affected_variant1 variant2=$affected_variant2 variant3=$affected_variant3 variant3a=$affected_variant3a"
|
||||
@@ -834,6 +909,7 @@ is_cpu_affected() {
|
||||
pr_debug "is_cpu_affected: final results: mlpds=$affected_mlpds mdsum=$affected_mdsum taa=$affected_taa itlbmh=$affected_itlbmh srbds=$affected_srbds"
|
||||
pr_debug "is_cpu_affected: final results: div0=$affected_div0 fpdss=$affected_fpdss zenbleed=$affected_zenbleed inception=$affected_inception retbleed=$affected_retbleed tsa=$affected_tsa downfall=$affected_downfall reptar=$affected_reptar rfds=$affected_rfds its=$affected_its"
|
||||
pr_debug "is_cpu_affected: final results: vmscape=$affected_vmscape bpi=$affected_bpi sls=$affected_sls mmio=$affected_mmio"
|
||||
pr_debug "is_cpu_affected: final results: arm_spec_at=$affected_arm_spec_at arm_spec_unpriv_load=$affected_arm_spec_unpriv_load arm_ssbs_nosync=$affected_arm_ssbs_nosync"
|
||||
}
|
||||
affected_variantl1tf_sgx="$affected_variantl1tf"
|
||||
# even if we are affected to L1TF, if there's no SGX, we're not affected to the original foreshadow
|
||||
|
||||
@@ -170,7 +170,7 @@ while [ -n "${1:-}" ]; do
|
||||
case "$2" in
|
||||
help)
|
||||
echo "The following parameters are supported for --variant (can be used multiple times):"
|
||||
echo "1, 2, 3, 3a, 4, msbds, mfbds, mlpds, mdsum, l1tf, taa, mcepsc, srbds, mmio, sbdr, sbds, drpw, div0, fpdss, zenbleed, downfall, retbleed, inception, reptar, rfds, tsa, tsa-sq, tsa-l1, its, vmscape, bpi, sls"
|
||||
echo "1, 2, 3, 3a, 4, msbds, mfbds, mlpds, mdsum, l1tf, taa, mcepsc, srbds, mmio, sbdr, sbds, drpw, div0, fpdss, zenbleed, downfall, retbleed, inception, reptar, rfds, tsa, tsa-sq, tsa-l1, its, vmscape, bpi, sls, arm-spec-at, arm-spec-unpriv-load, arm-ssbs-nosync"
|
||||
exit 0
|
||||
;;
|
||||
1)
|
||||
@@ -301,12 +301,60 @@ while [ -n "${1:-}" ]; do
|
||||
opt_cve_list="$opt_cve_list CVE-0000-0001"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
arm-spec-at)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0001"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
arm-spec-unpriv-load)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0002"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
arm-ssbs-nosync)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0003"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
*)
|
||||
echo "$0: error: invalid parameter '$2' for --variant, see --variant help for a list" >&2
|
||||
exit 255
|
||||
;;
|
||||
esac
|
||||
shift 2
|
||||
elif [ "$1" = "--errata" ]; then
|
||||
# Vendor-numbered errata selector (currently ARM64). Maps an erratum number
|
||||
# (e.g. 1530923) to the CVE-0001-NNNN check that covers it.
|
||||
if [ -z "$2" ]; then
|
||||
echo "$0: error: option --errata expects a parameter (an erratum number, e.g. 1530923, or 'help')" >&2
|
||||
exit 255
|
||||
fi
|
||||
case "$2" in
|
||||
help)
|
||||
echo "The following erratum numbers are supported for --errata (can be used multiple times):"
|
||||
echo " Speculative AT TLB corruption: 1165522, 1319367, 1319537, 1530923"
|
||||
echo " Speculative unprivileged load: 2966298, 3117295"
|
||||
echo " MSR SSBS not self-synchronizing: 3194386 (and siblings: 3312417, 3324334, 3324335,"
|
||||
echo " 3324336, 3324338, 3324339, 3324341, 3324344, 3324346,"
|
||||
echo " 3324347, 3324348, 3324349, 3456084, 3456091, 3456106,"
|
||||
echo " 3456111)"
|
||||
exit 0
|
||||
;;
|
||||
1165522 | 1319367 | 1319537 | 1530923)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0001"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
2966298 | 3117295)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0002"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
3194386 | 3312417 | 3324334 | 3324335 | 3324336 | 3324338 | 3324339 | 3324341 | 3324344 | 3324346 | 3324347 | 3324348 | 3324349 | 3456084 | 3456091 | 3456106 | 3456111)
|
||||
opt_cve_list="$opt_cve_list CVE-0001-0003"
|
||||
opt_cve_all=0
|
||||
;;
|
||||
*)
|
||||
echo "$0: error: unsupported erratum number '$2' for --errata, see --errata help for a list" >&2
|
||||
exit 255
|
||||
;;
|
||||
esac
|
||||
shift 2
|
||||
elif [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
|
||||
show_header
|
||||
show_usage
|
||||
|
||||
@@ -24,13 +24,22 @@ parse_cpu_details() {
|
||||
if grep -qw avx512 "$g_procfs/cpuinfo" 2>/dev/null; then cap_avx512=1; fi
|
||||
cpu_vendor=$(grep '^vendor_id' "$g_procfs/cpuinfo" | awk '{print $3}' | head -n1)
|
||||
cpu_friendly_name=$(grep '^model name' "$g_procfs/cpuinfo" | cut -d: -f2- | head -n1 | sed -e 's/^ *//')
|
||||
# special case for ARM follows
|
||||
if grep -qi 'CPU implementer[[:space:]]*:[[:space:]]*0x41' "$g_procfs/cpuinfo"; then
|
||||
cpu_vendor='ARM'
|
||||
# some devices (phones or other) have several ARMs and as such different part numbers,
|
||||
# an example is "bigLITTLE", so we need to store the whole list, this is needed for is_cpu_affected
|
||||
# ARM-style cpuinfo: parse per-core implementer/part/arch/variant/revision lists
|
||||
# (big.LITTLE / heterogeneous systems have different values per core).
|
||||
# cpu_variant_list and cpu_revision_list are consumed by ARM64 errata affection checks
|
||||
# that need to match a specific revision range.
|
||||
if grep -q 'CPU implementer' "$g_procfs/cpuinfo"; then
|
||||
cpu_impl_list=$(awk '/CPU implementer/ {print $4}' "$g_procfs/cpuinfo")
|
||||
cpu_part_list=$(awk '/CPU part/ {print $4}' "$g_procfs/cpuinfo")
|
||||
cpu_arch_list=$(awk '/CPU architecture/ {print $3}' "$g_procfs/cpuinfo")
|
||||
cpu_variant_list=$(awk '/CPU variant/ {print $4}' "$g_procfs/cpuinfo")
|
||||
cpu_revision_list=$(awk '/CPU revision/ {print $4}' "$g_procfs/cpuinfo")
|
||||
fi
|
||||
# Map first-seen implementer to cpu_vendor; note that heterogeneous systems
|
||||
# (e.g. DynamIQ with ARM+Kryo cores) would all map to one vendor here, but
|
||||
# per-core vendor decisions are made via cpu_impl_list where needed.
|
||||
if grep -qi 'CPU implementer[[:space:]]*:[[:space:]]*0x41' "$g_procfs/cpuinfo"; then
|
||||
cpu_vendor='ARM'
|
||||
# take the first one to fill the friendly name, do NOT quote the vars below
|
||||
# shellcheck disable=SC2086
|
||||
arch=$(echo $cpu_arch_list | awk '{ print $1 }')
|
||||
|
||||
Reference in New Issue
Block a user