Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package spectre-meltdown-checker for
openSUSE:Factory checked in at 2023-08-31 13:46:03
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/spectre-meltdown-checker (Old)
and /work/SRC/openSUSE:Factory/.spectre-meltdown-checker.new.1766 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "spectre-meltdown-checker"
Thu Aug 31 13:46:03 2023 rev:12 rq:1108155 version:0.46
Changes:
--------
---
/work/SRC/openSUSE:Factory/spectre-meltdown-checker/spectre-meltdown-checker.changes
2022-04-01 21:37:35.076524018 +0200
+++
/work/SRC/openSUSE:Factory/.spectre-meltdown-checker.new.1766/spectre-meltdown-checker.changes
2023-08-31 13:52:10.810081700 +0200
@@ -1,0 +2,17 @@
+Wed Aug 30 15:39:04 UTC 2023 - Marcus Meissner <meiss...@suse.com>
+
+- updated to 0.46
+ This release mainly focuses on the detection of the new Zenbleed
+ (CVE-2023-20593) vulnerability, among few other changes that were in
+ line waiting for a release:
+
+ - feat: detect the vulnerability and mitigation of Zenbleed (CVE-2023-20593)
+ - feat: add the linux-firmware repository as another source for CPU
microcode versions
+ - feat: arm: add Neoverse-N2, Neoverse-V1 and Neoverse-V2
+ - fix: docker: adding missing utils (#433)
+ - feat: add support for Guix System kernel
+ - fix: rewrite SQL to be sqlite3 >= 3.41 compatible (#443)
+ - fix: a /devnull file was mistakenly created on the filesystem
+ - fix: fwdb: ignore MCEdb versions where an official Intel version exists
(fixes #430)
+
+-------------------------------------------------------------------
Old:
----
v0.45.tar.gz
New:
----
v0.46.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ spectre-meltdown-checker.spec ++++++
--- /var/tmp/diff_new_pack.baEV9Q/_old 2023-08-31 13:52:11.870119588 +0200
+++ /var/tmp/diff_new_pack.baEV9Q/_new 2023-08-31 13:52:11.874119732 +0200
@@ -1,7 +1,7 @@
#
# spec file for package spectre-meltdown-checker
#
-# Copyright (c) 2022 SUSE LLC
+# Copyright (c) 2023 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +17,7 @@
Name: spectre-meltdown-checker
-Version: 0.45
+Version: 0.46
Release: 0
Summary: Spectre & Meltdown Vulnerability Checker
License: GPL-3.0-only
++++++ v0.45.tar.gz -> v0.46.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/spectre-meltdown-checker-0.45/.github/workflows/check.yml
new/spectre-meltdown-checker-0.46/.github/workflows/check.yml
--- old/spectre-meltdown-checker-0.45/.github/workflows/check.yml
2022-03-27 12:41:17.000000000 +0200
+++ new/spectre-meltdown-checker-0.46/.github/workflows/check.yml
2023-07-26 18:07:02.000000000 +0200
@@ -24,7 +24,7 @@
fi
- name: check direct execution
run: |
- expected=15
+ expected=16
nb=$(sudo ./spectre-meltdown-checker.sh --batch json | jq '.[]|.CVE' |
wc -l)
if [ "$nb" -ne "$expected" ]; then
echo "Invalid number of CVEs reported: $nb instead of $expected"
@@ -34,7 +34,7 @@
fi
- name: check docker-compose run execution
run: |
- expected=15
+ expected=16
docker-compose build
nb=$(docker-compose run --rm spectre-meltdown-checker --batch json |
jq '.[]|.CVE' | wc -l)
if [ "$nb" -ne "$expected" ]; then
@@ -45,7 +45,7 @@
fi
- name: check docker run execution
run: |
- expected=15
+ expected=16
docker build -t spectre-meltdown-checker .
nb=$(docker run --rm --privileged -v /boot:/boot:ro -v
/dev/cpu:/dev/cpu:ro -v /lib/modules:/lib/modules:ro spectre-meltdown-checker
--batch json | jq '.[]|.CVE' | wc -l)
if [ "$nb" -ne "$expected" ]; then
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/spectre-meltdown-checker-0.45/Dockerfile
new/spectre-meltdown-checker-0.46/Dockerfile
--- old/spectre-meltdown-checker-0.45/Dockerfile 2022-03-27
12:41:17.000000000 +0200
+++ new/spectre-meltdown-checker-0.46/Dockerfile 2023-07-26
18:07:02.000000000 +0200
@@ -1,7 +1,7 @@
-FROM alpine:3.7
+FROM alpine:latest
-RUN apk --update --no-cache add kmod binutils grep perl
+RUN apk --update --no-cache add kmod binutils grep perl zstd wget sharutils
unzip sqlite procps coreutils iucode-tool gzip xz bzip2 lz4
-COPY . /check
+COPY spectre-meltdown-checker.sh /
-ENTRYPOINT ["/check/spectre-meltdown-checker.sh"]
+ENTRYPOINT ["/spectre-meltdown-checker.sh"]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/spectre-meltdown-checker-0.45/README.md
new/spectre-meltdown-checker-0.46/README.md
--- old/spectre-meltdown-checker-0.45/README.md 2022-03-27 12:41:17.000000000
+0200
+++ new/spectre-meltdown-checker-0.46/README.md 2023-07-26 18:07:02.000000000
+0200
@@ -18,8 +18,9 @@
[CVE-2018-12127](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12127)
| Microarchitectural Load Port Data Sampling | MLPDS, RIDL
[CVE-2019-11091](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11091)
| Microarchitectural Data Sampling Uncacheable Memory | MDSUM, RIDL
[CVE-2019-11135](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11135)
| TSX asynchronous abort | TAA, ZombieLoad V2
-[CVE-2018-12207](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12207)
| Machine Mheck Exception on Page Size Changes | MCEPSC, No eXcuses,
iTLB Multihit
+[CVE-2018-12207](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12207)
| Machine Check Exception on Page Size Changes | MCEPSC, No eXcuses,
iTLB Multihit
[CVE-2020-0543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0543)
| Special Register Buffer Data Sampling | SRBDS
+[CVE-2023-20593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20593)
| Cross-Process Information Leak | Zenbleed
Supported operating systems:
- Linux (all versions, flavors and distros)
@@ -178,3 +179,9 @@
- Impact: Kernel
- Mitigation: microcode update + kernel update helping to protect various
CPU internal buffers from unprivileged speculative access to data
- Performance impact of the mitigation: low
+
+**CVE-2023-20593** Cross-Process Information Leak (Zenbleed)
+
+ - Impact: Kernel & all software
+ - Mitigation: either kernel mitigation by disabling a CPU optimization
through an MSR bit, or CPU microcode mitigation
+ - Performance impact of the mitigation: TBD
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/spectre-meltdown-checker-0.45/spectre-meltdown-checker.sh
new/spectre-meltdown-checker-0.46/spectre-meltdown-checker.sh
--- old/spectre-meltdown-checker-0.45/spectre-meltdown-checker.sh
2022-03-27 12:41:17.000000000 +0200
+++ new/spectre-meltdown-checker-0.46/spectre-meltdown-checker.sh
2023-07-26 18:07:02.000000000 +0200
@@ -12,24 +12,27 @@
#
# Stephane Lesimple
#
-VERSION='0.45'
+VERSION='0.46'
trap 'exit_cleanup' EXIT
trap '_warn "interrupted, cleaning up..."; exit_cleanup; exit 1' INT
exit_cleanup()
{
+ saved_ret=$?
# cleanup the temp decompressed config & kernel image
[ -n "${dumped_config:-}" ] && [ -f "$dumped_config" ] && rm -f
"$dumped_config"
[ -n "${kerneltmp:-}" ] && [ -f "$kerneltmp" ] && rm -f
"$kerneltmp"
[ -n "${kerneltmp2:-}" ] && [ -f "$kerneltmp2" ] && rm -f
"$kerneltmp2"
[ -n "${mcedb_tmp:-}" ] && [ -f "$mcedb_tmp" ] && rm -f
"$mcedb_tmp"
[ -n "${intel_tmp:-}" ] && [ -d "$intel_tmp" ] && rm -rf
"$intel_tmp"
+ [ -n "${linuxfw_tmp:-}" ] && [ -f "$linuxfw_tmp" ] && rm -f
"$linuxfw_tmp"
[ "${mounted_debugfs:-}" = 1 ] && umount /sys/kernel/debug 2>/dev/null
[ "${mounted_procfs:-}" = 1 ] && umount "$procfs" 2>/dev/null
[ "${insmod_cpuid:-}" = 1 ] && rmmod cpuid 2>/dev/null
[ "${insmod_msr:-}" = 1 ] && rmmod msr 2>/dev/null
[ "${kldload_cpuctl:-}" = 1 ] && kldunload cpuctl 2>/dev/null
[ "${kldload_vmm:-}" = 1 ] && kldunload vmm 2>/dev/null
+ exit $saved_ret
}
# if we were git clone'd, adjust VERSION
@@ -84,10 +87,11 @@
--batch nrpe produce machine readable output
formatted for NRPE
--batch prometheus produce output for consumption by
prometheus-node-exporter
- --variant VARIANT specify which variant you'd like to
check, by default all variants are checked
- VARIANT can be one of 1, 2, 3, 3a, 4,
l1tf, msbds, mfbds, mlpds, mdsum, taa, mcepsc, srbds
- can be specified multiple times (e.g.
--variant 2 --variant 3)
- --cve [cve1,cve2,...] specify which CVE you'd like to check,
by default all supported CVEs are checked
+ --variant VARIANT specify which variant you'd like to
check, by default all variants are checked.
+ can be used multiple times (e.g.
--variant 3a --variant l1tf)
+ for a list of supported VARIANT
parameters, use --variant help
+ --cve CVE specify which CVE you'd like to check,
by default all supported CVEs are checked
+ can be used multiple times (e.g. --cve
CVE-2017-5753 --cve CVE-2020-0543)
--hw-only only check for CPU information, don't
check for any variant
--no-hw skip CPU information and checks, if
you're inspecting a kernel not to be run on this host
--vmm [auto,yes,no] override the detection of the presence
of a hypervisor, default: auto
@@ -168,7 +172,7 @@
global_unknown=0
nrpe_vuln=''
-supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640
CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646 CVE-2018-12126
CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 CVE-2019-11135 CVE-2018-12207
CVE-2020-0543'
+supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640
CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646 CVE-2018-12126
CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 CVE-2019-11135 CVE-2018-12207
CVE-2020-0543 CVE-2023-20593'
# find a sane command to print colored messages, we prefer `printf` over `echo`
# because `printf` behavior is more standard across Linux/BSD
@@ -293,6 +297,7 @@
CVE-2019-11135) echo "ZombieLoad V2, TSX Asynchronous Abort
(TAA)";;
CVE-2018-12207) echo "No eXcuses, iTLB Multihit, machine check
exception on page size changes (MCEPSC)";;
CVE-2020-0543) echo "Special Register Buffer Data Sampling
(SRBDS)";;
+ CVE-2023-20593) echo "Zenbleed, cross-process information
leak";;
*) echo "$0: error: invalid CVE '$1' passed to cve2name()" >&2;
exit 255;;
esac
}
@@ -317,6 +322,7 @@
CVE-2019-11135) return $variant_taa;;
CVE-2018-12207) return $variant_itlbmh;;
CVE-2020-0543) return $variant_srbds;;
+ CVE-2023-20593) return $variant_zenbleed;;
*) echo "$0: error: invalid variant '$1' passed to
is_cpu_affected()" >&2; exit 255;;
esac
}
@@ -346,6 +352,8 @@
variant_taa=''
variant_itlbmh=''
variant_srbds=''
+ # Zenbleed if extremely AMD specific, look for "is_and" below:
+ variant_zenbleed=immune
if is_cpu_mds_free; then
[ -z "$variant_msbds" ] && variant_msbds=immune
@@ -467,6 +475,11 @@
_debug "is_cpu_affected: cpu not affected by
speculative store bypass so not vuln to variant4"
fi
variantl1tf=immune
+
+ # Zenbleed
+ amd_legacy_erratum "$(amd_model_range 0x17 0x30 0x0 0x4f 0xf)"
&& variant_zenbleed=vuln
+ amd_legacy_erratum "$(amd_model_range 0x17 0x60 0x0 0x7f 0xf)"
&& variant_zenbleed=vuln
+ amd_legacy_erratum "$(amd_model_range 0x17 0xa0 0x0 0xaf 0xf)"
&& variant_zenbleed=vuln
elif [ "$cpu_vendor" = CAVIUM ]; then
variant3=immune
variant3a=immune
@@ -493,9 +506,9 @@
if [ -n "$cpupart" ] && [ -n "$cpuarch" ]; then
# Cortex-R7 and Cortex-R8 are real-time and
only used in medical devices or such
# I can't find their CPU part number, but it's
probably not that useful anyway
- # model R7 R8 A8 A9 A12 A15 A17 A57 A72 A73
A75 A76 Neoverse-N1 A77
- # part ? ? c08 c09 c0d c0f c0e d07 d08 d09
d0a d0b d0c d0d
- # arch 7? 7? 7 7 7 7 7 8 8 8 8
8 8 8
+ # model R7 R8 A8 A9 A12 A15 A17 A57 A72 A73
A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2
+ # part ? ? c08 c09 c0d c0f c0e d07 d08 d09
d0a d0b d0d d0c d40 d49 d4f
+ # arch 7? 7? 7 7 7 7 7 8 8 8 8
8 8 8 8 8 8
#
# Whitelist identified non-affected processors,
use vulnerability information from
#
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
@@ -546,6 +559,13 @@
[ -z "$variant3a" ] && variant3a=immune
variant4=vuln
_debug "checking cpu$i: armv8
A76/A77/NeoverseN1 non affected to variant 2, 3 & 3a"
+ elif [ "$cpuarch" = 8 ] && echo "$cpupart" |
grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f; then
+ variant1=vuln
+ [ -z "$variant2" ] && variant2=immune
+ [ -z "$variant3" ] && variant3=immune
+ [ -z "$variant3a" ] && variant3a=immune
+ [ -z "$variant4" ] && variant4=immune
+ _debug "checking cpu$i: armv8
NeoverseN2/V1/V2 non affected to variant 2, 3, 3a & 4"
elif [ "$cpuarch" -le 7 ] || { [ "$cpuarch" = 8
] && [ $(( cpupart )) -lt $(( 0xd07 )) ]; } ; then
[ -z "$variant1" ] && variant1=immune
[ -z "$variant2" ] && variant2=immune
@@ -615,6 +635,7 @@
[ "$variant_taa" = "immune" ] && variant_taa=1 || variant_taa=0
[ "$variant_itlbmh" = "immune" ] && variant_itlbmh=1 || variant_itlbmh=0
[ "$variant_srbds" = "immune" ] && variant_srbds=1 || variant_srbds=0
+ [ "$variant_zenbleed" = "immune" ] && variant_zenbleed=1 ||
variant_zenbleed=0
variantl1tf_sgx="$variantl1tf"
# even if we are affected to L1TF, if there's no SGX, we're not
affected to the original foreshadow
[ "$cpuid_sgx" = 0 ] && variantl1tf_sgx=1
@@ -837,6 +858,29 @@
_info
}
+# Family-Model-Stepping to CPUID
+# prints CPUID in base-10 to stdout
+fms2cpuid()
+{
+ _family="$1"
+ _model="$2"
+ _stepping="$3"
+
+ if [ "$(( _family ))" -le 15 ]; then
+ _extfamily=0
+ _lowfamily=$(( _family ))
+ else
+ # when we have a family > 0xF, then lowfamily is stuck at 0xF
+ # and extfamily is ADDED to it (as in "+"), to ensure old
software
+ # never sees a lowfamily < 0xF for newer families
+ _lowfamily=15
+ _extfamily=$(( (_family) - 15 ))
+ fi
+ _extmodel=$(( (_model & 0xF0 ) >> 4 ))
+ _lowmodel=$(( (_model & 0x0F ) >> 0 ))
+ echo $(( (_stepping & 0x0F) | (_lowmodel << 4) | (_lowfamily << 8) |
(_extmodel << 16) | (_extfamily << 20) ))
+}
+
[ -z "$HOME" ] && HOME="$(getent passwd "$(whoami)" | cut -d: -f6)"
mcedb_cache="$HOME/.mcedb"
update_fwdb()
@@ -896,13 +940,15 @@
echo ERROR "please install the \`sqlite3\` program"
return 1
fi
- mcedb_revision=$(sqlite3 "$mcedb_tmp" "select revision from MCE")
+ mcedb_revision=$(sqlite3 "$mcedb_tmp" "SELECT \"revision\" from
\"MCE\"")
if [ -z "$mcedb_revision" ]; then
echo ERROR "downloaded file seems invalid"
return 1
fi
- sqlite3 "$mcedb_tmp" "alter table Intel add column origin text"
- sqlite3 "$mcedb_tmp" "update Intel set origin='mce'"
+ sqlite3 "$mcedb_tmp" "ALTER TABLE \"Intel\" ADD COLUMN \"origin\" TEXT"
+ sqlite3 "$mcedb_tmp" "ALTER TABLE \"AMD\" ADD COLUMN \"origin\" TEXT"
+ sqlite3 "$mcedb_tmp" "UPDATE \"Intel\" SET \"origin\"='mce'"
+ sqlite3 "$mcedb_tmp" "UPDATE \"AMD\" SET \"origin\"='mce'"
echo OK "MCExtractor database revision $mcedb_revision"
@@ -940,7 +986,7 @@
_version=$(echo "$_line" | awk '{print $8}')
_version=$(( _version ))
_version=$(printf "0x%08X" "$_version")
- _sqlstm="$(printf "INSERT INTO Intel
(origin,cpuid,version,yyyymmdd) VALUES (\"%s\",\"%s\",\"%s\",\"%s\");" "intel"
"$(printf "%08X" "$_cpuid")" "$(printf "%08X" "$_version")" "$_date")"
+ _sqlstm="$(printf "INSERT INTO \"Intel\"
(\"origin\",\"cpuid\",\"version\",\"yyyymmdd\") VALUES ('%s','%s','%s','%s');"
"intel" "$(printf "%08X" "$_cpuid")" "$(printf "%08X" "$_version")" "$_date")"
sqlite3 "$mcedb_tmp" "$_sqlstm"
done
_intel_timestamp=$(stat -c %Y
"$intel_tmp/Intel-Linux-Processor-Microcode-Data-Files-main/license"
2>/dev/null)
@@ -949,10 +995,52 @@
_intel_latest_date=$(date +%Y%m%d -d @"$_intel_timestamp")
else
echo "Falling back to the latest microcode date"
- _intel_latest_date=$(sqlite3 "$mcedb_tmp" "SELECT yyyymmdd from
Intel WHERE origin = 'intel' ORDER BY yyyymmdd DESC LIMIT 1;")
+ _intel_latest_date=$(sqlite3 "$mcedb_tmp" "SELECT \"yyyymmdd\"
FROM \"Intel\" WHERE \"origin\"='intel' ORDER BY \"yyyymmdd\" DESC LIMIT 1;")
fi
echo DONE "(version $_intel_latest_date)"
+ # now parse the most recent linux-firmware amd-ucode README file
+ _info_nol "Fetching latest amd-ucode README from linux-firmware
project... "
+
linuxfw_url="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/amd-ucode/README";
+ linuxfw_tmp=$(mktemp -t smc-linuxfw-XXXXXX)
+ if command -v wget >/dev/null 2>&1; then
+ wget -q "$linuxfw_url" -O "$linuxfw_tmp"; ret=$?
+ elif command -v curl >/dev/null 2>&1; then
+ curl -sL "$linuxfw_url" -o "$linuxfw_tmp"; ret=$?
+ elif command -v fetch >/dev/null 2>&1; then
+ fetch -q "$linuxfw_url" -o "$linuxfw_tmp"; ret=$?
+ else
+ echo ERROR "please install one of \`wget\`, \`curl\` of
\`fetch\` programs"
+ return 1
+ fi
+ if [ "$ret" != 0 ]; then
+ echo ERROR "error $ret while downloading linux-firmware README"
+ return $ret
+ fi
+ echo DONE
+
+ _info_nol "Parsing the README... "
+ nbfound=0
+ for line in $(grep -E 'Family=0x[0-9a-f]+ Model=0x[0-9a-f]+
Stepping=0x[0-9a-f]+: Patch=0x[0-9a-f]+' "$linuxfw_tmp" | tr " " ","); do
+ _debug "Parsing line $line"
+ _family=$( echo "$line" | grep -Eoi 'Family=0x[0-9a-f]+' |
cut -d= -f2)
+ _model=$( echo "$line" | grep -Eoi 'Model=0x[0-9a-f]+' |
cut -d= -f2)
+ _stepping=$(echo "$line" | grep -Eoi 'Stepping=0x[0-9a-f]+' |
cut -d= -f2)
+ _version=$( echo "$line" | grep -Eoi 'Patch=0x[0-9a-f]+' |
cut -d= -f2)
+ _version=$(printf "0x%08X" "$(( _version ))")
+ _cpuid=$(fms2cpuid "$_family" "$_model" "$_stepping")
+ _cpuid=$(printf "0x%08X" "$_cpuid")
+ _date="20000101"
+ _sqlstm="$(printf "INSERT INTO \"AMD\"
(\"origin\",\"cpuid\",\"version\",\"yyyymmdd\") VALUES ('%s','%s','%s','%s');"
"linux-firmware" "$(printf "%08X" "$_cpuid")" "$(printf "%08X" "$_version")"
"$_date")"
+ _debug "family $_family model $_model stepping $_stepping cpuid
$_cpuid"
+ _debug "$_sqlstm"
+ sqlite3 "$mcedb_tmp" "$_sqlstm"
+ nbfound=$((nbfound + 1))
+ unset _family _model _stepping _version _cpuid _date _sqlstm
+ done
+ echo "found $nbfound microcodes"
+ unset nbfound
+
dbversion="$mcedb_revision+i$_intel_latest_date"
if [ "$1" != builtin ] && [ -n "$previous_dbversion" ] && [
"$previous_dbversion" = "v$dbversion" ]; then
@@ -964,8 +1052,11 @@
{
echo "# Spectre & Meltdown Checker";
echo "# %%% MCEDB v$dbversion";
- sqlite3 "$mcedb_tmp" "SELECT '#
I,0x'||t1.cpuid||',0x'||MAX(t1.version)||','||t1.yyyymmdd FROM Intel AS t1 LEFT
OUTER JOIN Intel AS t2 ON t2.cpuid=t1.cpuid AND t2.yyyymmdd > t1.yyyymmdd WHERE
t2.yyyymmdd IS NULL GROUP BY t1.cpuid ORDER BY t1.cpuid ASC;" | grep -v '^#
.,0x00000000,';
- sqlite3 "$mcedb_tmp" "SELECT '#
A,0x'||t1.cpuid||',0x'||MAX(t1.version)||','||t1.yyyymmdd FROM AMD AS t1 LEFT
OUTER JOIN AMD AS t2 ON t2.cpuid=t1.cpuid AND t2.yyyymmdd > t1.yyyymmdd WHERE
t2.yyyymmdd IS NULL GROUP BY t1.cpuid ORDER BY t1.cpuid ASC;" | grep -v '^#
.,0x00000000,';
+ # ensure the official Intel DB always has precedence over
mcedb, even if mcedb has seen a more recent fw
+ sqlite3 "$mcedb_tmp" "DELETE FROM \"Intel\" WHERE
\"origin\"!='intel' AND \"cpuid\" IN (SELECT \"cpuid\" FROM \"Intel\" WHERE
\"origin\"='intel' GROUP BY \"cpuid\" ORDER BY \"cpuid\" ASC);"
+ # we'll use the more recent fw for Intel and AMD
+ sqlite3 "$mcedb_tmp" "SELECT '#
I,0x'||\"t1\".\"cpuid\"||',0x'||MAX(\"t1\".\"version\")||','||\"t1\".\"yyyymmdd\"
FROM \"Intel\" AS \"t1\" LEFT OUTER JOIN \"Intel\" AS \"t2\" ON
\"t2\".\"cpuid\"=\"t1\".\"cpuid\" AND \"t2\".\"yyyymmdd\" > \"t1\".\"yyyymmdd\"
WHERE \"t2\".\"yyyymmdd\" IS NULL GROUP BY \"t1\".\"cpuid\" ORDER BY
\"t1\".\"cpuid\" ASC;" | grep -v '^# .,0x00000000,';
+ sqlite3 "$mcedb_tmp" "SELECT '#
A,0x'||\"t1\".\"cpuid\"||',0x'||MAX(\"t1\".\"version\")||','||\"t1\".\"yyyymmdd\"
FROM \"AMD\" AS \"t1\" LEFT OUTER JOIN \"AMD\" AS \"t2\" ON
\"t2\".\"cpuid\"=\"t1\".\"cpuid\" AND \"t2\".\"yyyymmdd\" > \"t1\".\"yyyymmdd\"
WHERE \"t2\".\"yyyymmdd\" IS NULL GROUP BY \"t1\".\"cpuid\" ORDER BY
\"t1\".\"cpuid\" ASC;" | grep -v '^# .,0x00000000,';
} > "$mcedb_cache"
echo DONE "(version $dbversion)"
@@ -1126,25 +1217,29 @@
shift 2
elif [ "$1" = "--variant" ]; then
if [ -z "$2" ]; then
- echo "$0: error: option --variant expects a parameter
(1, 2, 3, 3a, 4 or l1tf)" >&2
+ echo "$0: error: option --variant expects a parameter
(see --variant help)" >&2
exit 255
fi
case "$2" in
- 1) opt_cve_list="$opt_cve_list
CVE-2017-5753"; opt_cve_all=0;;
- 2) opt_cve_list="$opt_cve_list
CVE-2017-5715"; opt_cve_all=0;;
- 3) opt_cve_list="$opt_cve_list
CVE-2017-5754"; opt_cve_all=0;;
- 3a) opt_cve_list="$opt_cve_list
CVE-2018-3640"; opt_cve_all=0;;
- 4) opt_cve_list="$opt_cve_list
CVE-2018-3639"; opt_cve_all=0;;
- msbds) opt_cve_list="$opt_cve_list CVE-2018-12126";
opt_cve_all=0;;
- mfbds) opt_cve_list="$opt_cve_list CVE-2018-12130";
opt_cve_all=0;;
- mlpds) opt_cve_list="$opt_cve_list CVE-2018-12127";
opt_cve_all=0;;
- mdsum) opt_cve_list="$opt_cve_list CVE-2019-11091";
opt_cve_all=0;;
- l1tf) opt_cve_list="$opt_cve_list CVE-2018-3615
CVE-2018-3620 CVE-2018-3646"; opt_cve_all=0;;
- taa) opt_cve_list="$opt_cve_list CVE-2019-11135";
opt_cve_all=0;;
- mcepsc) opt_cve_list="$opt_cve_list CVE-2018-12207";
opt_cve_all=0;;
- srbds) opt_cve_list="$opt_cve_list CVE-2020-0543";
opt_cve_all=0;;
+ help) echo "The following parameters are supported
for --variant (can be used multiple times):";
+ echo "1, 2, 3, 3a, 4, msbds, mfbds,
mlpds, mdsum, l1tf, taa, mcepsc, srbds, zenbleed";
+ exit 0;;
+ 1) opt_cve_list="$opt_cve_list
CVE-2017-5753"; opt_cve_all=0;;
+ 2) opt_cve_list="$opt_cve_list
CVE-2017-5715"; opt_cve_all=0;;
+ 3) opt_cve_list="$opt_cve_list
CVE-2017-5754"; opt_cve_all=0;;
+ 3a) opt_cve_list="$opt_cve_list
CVE-2018-3640"; opt_cve_all=0;;
+ 4) opt_cve_list="$opt_cve_list
CVE-2018-3639"; opt_cve_all=0;;
+ msbds) opt_cve_list="$opt_cve_list
CVE-2018-12126"; opt_cve_all=0;;
+ mfbds) opt_cve_list="$opt_cve_list
CVE-2018-12130"; opt_cve_all=0;;
+ mlpds) opt_cve_list="$opt_cve_list
CVE-2018-12127"; opt_cve_all=0;;
+ mdsum) opt_cve_list="$opt_cve_list
CVE-2019-11091"; opt_cve_all=0;;
+ l1tf) opt_cve_list="$opt_cve_list
CVE-2018-3615 CVE-2018-3620 CVE-2018-3646"; opt_cve_all=0;;
+ taa) opt_cve_list="$opt_cve_list
CVE-2019-11135"; opt_cve_all=0;;
+ mcepsc) opt_cve_list="$opt_cve_list
CVE-2018-12207"; opt_cve_all=0;;
+ srbds) opt_cve_list="$opt_cve_list
CVE-2020-0543"; opt_cve_all=0;;
+ zenbleed) opt_cve_list="$opt_cve_list
CVE-2023-20593"; opt_cve_all=0;;
*)
- echo "$0: error: invalid parameter '$2' for
--variant, expected either 1, 2, 3, 3a, 4, l1tf, msbds, mfbds, mlpds, mdsum,
taa, mcepsc or srbds" >&2;
+ echo "$0: error: invalid parameter '$2' for
--variant, see --variant help for a list" >&2;
exit 255
;;
esac
@@ -1235,6 +1330,7 @@
CVE-2019-11135) aka="TAA";;
CVE-2018-12207) aka="ITLBMH";;
CVE-2020-0543) aka="SRBDS";;
+ CVE-2023-20593) aka="ZENBLEED";;
*) echo "$0: error: invalid CVE '$1' passed to
pvulnstatus()" >&2; exit 255;;
esac
@@ -1975,6 +2071,7 @@
[ "$cpu_family" = 23 ] && return 0
return 1
}
+
is_moksha_cpu()
{
parse_cpu_details
@@ -1983,6 +2080,68 @@
return 1
}
+# mimick the Linux macro
+##define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \
+# ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
+amd_model_range()
+{
+ echo $(( ($1 << 24) | ($2 << 16) | ($3 << 12) | ($4 << 4) | ($5) ))
+}
+
+# mimick the Linux func, usage:
+# amd_legacy_erratum $(amd_model_range 0x17 0x30 0x0 0x4f 0xf)
+# return true (0) if the current CPU is affected by this erratum, 1 otherwise
+amd_legacy_erratum()
+{
+ _range="$1"
+ _ms=$((cpu_model << 4 | cpu_stepping))
+ if [ "$cpu_family" = $(( ( (_range) >> 24) & 0xff )) ] && \
+ [ $_ms -ge $(( ( (_range) >> 12) & 0xfff )) ] && \
+ [ $_ms -le $(( (_range) & 0xfff )) ]; then
+ return 0
+ fi
+ return 1
+}
+
+# returns 0 (true) if yes, 1 otherwise
+# returns 2 if not applicable
+has_zenbleed_fixed_firmware()
+{
+ # return cached data
+ [ -n "$zenbleed_fw" ] && return "$zenbleed_fw"
+ # or compute it:
+ zenbleed_fw=2 # unknown
+ # only amd
+ if ! is_amd; then
+ zenbleed_fw=1
+ return $zenbleed_fw
+ fi
+ # list of known fixed firmwares, from commit
522b1d69219d8f083173819fde04f994aa051a98
+ _tuples="
+ 0x30,0x3f,0x0830107a
+ 0x60,0x67,0x0860010b
+ 0x68,0x6f,0x08608105
+ 0x70,0x7f,0x08701032
+ 0xa0,0xaf,0x08a00008
+ "
+ for tuple in $_tuples; do
+ _model_low=$( echo "$tuple" | cut -d, -f1)
+ _model_high=$(echo "$tuple" | cut -d, -f2)
+ _fwver=$( echo "$tuple" | cut -d, -f3)
+ if [ $((cpu_model)) -ge $((_model_low)) ] && [ $((cpu_model))
-le $((_model_high)) ]; then
+ if [ $((cpu_ucode)) -ge $((_fwver)) ]; then
+ zenbleed_fw=0 # true
+ break
+ else
+ zenbleed_fw=1 # false
+ zenbleed_fw_required=$_fwver
+ fi
+ fi
+ done
+ unset _tuples
+ return $zenbleed_fw
+}
+
# Test if the current host is a Xen PV Dom0 / DomU
is_xen() {
if [ ! -d "$procfs/xen" ]; then
@@ -2248,6 +2407,8 @@
[ -e "/boot/kernel-genkernel-$(uname -m)-$(uname -r)" ] &&
opt_kernel="/boot/kernel-genkernel-$(uname -m)-$(uname -r)"
# NixOS:
[ -e "/run/booted-system/kernel" ] &&
opt_kernel="/run/booted-system/kernel"
+ # Guix System:
+ [ -e "/run/booted-system/kernel/bzImage" ] &&
opt_kernel="/run/booted-system/kernel/bzImage"
# systemd kernel-install:
[ -e "/etc/machine-id" ] && [ -e "/boot/$(cat
/etc/machine-id)/$(uname -r)/linux" ] && opt_kernel="/boot/$(cat
/etc/machine-id)/$(uname -r)/linux"
# Clear Linux:
@@ -3282,6 +3443,21 @@
cpuid_srbds=0
fi
+ if is_amd; then
+ _info_nol " * CPU microcode is known to fix Zenbleed: "
+ has_zenbleed_fixed_firmware; ret=$?
+ if [ $ret -eq 0 ]; then
+ # affected CPU, new fw
+ pstatus green YES
+ elif [ $ret -eq 1 ]; then
+ # affected CPU, old fw
+ pstatus red NO "required version: $zenbleed_fw_required"
+ else
+ # unaffected CPU
+ pstatus yellow NO
+ fi
+ fi
+
_info_nol " * CPU microcode is known to cause stability problems: "
if is_ucode_blacklisted; then
pstatus red YES "$ucode_found"
@@ -3383,7 +3559,7 @@
else
# ignore SC2009 as `ps ax` is actually used as a
fallback if `pgrep` isn't installed
# shellcheck disable=SC2009
- if command -v ps >/devnull && ps ax | grep -vw grep |
grep -q -e '\<qemu' -e '/qemu' -e '<\kvm' -e '/kvm' -e '/xenstored' -e
'/xenconsoled'; then
+ if command -v ps >/dev/null && ps ax | grep -vw grep |
grep -q -e '\<qemu' -e '/qemu' -e '<\kvm' -e '/kvm' -e '/xenstored' -e
'/xenconsoled'; then
has_vmm=1
fi
fi
@@ -5744,6 +5920,132 @@
fi
}
+####################
+# Zenbleed section
+
+check_CVE_2023_20593()
+{
+ cve='CVE-2023-20593'
+ _info "\033[1;34m$cve aka '$(cve2name "$cve")'\033[0m"
+ if [ "$os" = Linux ]; then
+ check_CVE_2023_20593_linux
+ #elif echo "$os" | grep -q BSD; then
+ # check_CVE_2023_20593_bsd
+ else
+ _warn "Unsupported OS ($os)"
+ fi
+}
+
+check_CVE_2023_20593_linux()
+{
+ status=UNK
+ sys_interface_available=0
+ msg=''
+ if [ "$opt_sysfs_only" != 1 ]; then
+ _info_nol "* Zenbleed mitigation is supported by kernel: "
+ kernel_zenbleed=''
+ if [ -n "$kernel_err" ]; then
+ kernel_zenbleed_err="$kernel_err"
+ # commit 522b1d69219d8f083173819fde04f994aa051a98
+ elif grep -q 'Zenbleed:' "$kernel"; then
+ kernel_zenbleed="found zenbleed message in kernel image"
+ fi
+ if [ -n "$kernel_zenbleed" ]; then
+ pstatus green YES "$kernel_zenbleed"
+ elif [ -n "$kernel_zenbleed_err" ]; then
+ pstatus yellow UNKNOWN "$kernel_zenbleed_err"
+ else
+ pstatus yellow NO
+ fi
+ _info_nol "* Zenbleed kernel mitigation enabled and active: "
+ if [ "$opt_live" = 1 ]; then
+ # read the DE_CFG MSR, we want to check the 9th bit
+ # don't do it on non-Zen2 AMD CPUs or later, aka Family
17h,
+ # as the behavior could be unknown on others
+ if is_amd && [ "$cpu_family" -ge $((0x17)) ]; then
+ read_msr 0xc0011029; ret=$?
+ if [ $ret = $READ_MSR_RET_OK ]; then
+ if [ $(( read_msr_value >> 9 & 1 )) -eq
1 ]; then
+ pstatus green YES
"FP_BACKUP_FIX bit set in DE_CFG"
+ fp_backup_fix=1
+ else
+ pstatus yellow NO
"FP_BACKUP_FIX is cleared in DE_CFG"
+ fp_backup_fix=0
+ fi
+ elif [ $ret = $READ_MSR_RET_KO ]; then
+ pstatus yellow UNKNOWN "Couldn't read
the DE_CFG MSR"
+ else
+ pstatus yellow UNKNOWN "$read_msr_msg"
+ fi
+ else
+ fp_backup_fix=0
+ pstatus blue N/A "CPU is incompatible"
+ fi
+ else
+ pstatus blue N/A "not testable in offline mode"
+ fi
+
+ _info_nol "* Zenbleed mitigation is supported by CPU microcode:
"
+ has_zenbleed_fixed_firmware; ret=$?
+ if [ $ret -eq 0 ]; then
+ pstatus green YES
+ cpu_ucode_zenbleed=1
+ elif [ $ret -eq 1 ]; then
+ pstatus yellow NO
+ cpu_ucode_zenbleed=2
+ else
+ pstatus yellow UNKNOWN
+ cpu_ucode_zenbleed=3
+ fi
+
+ elif [ "$sys_interface_available" = 0 ]; then
+ # we have no sysfs but were asked to use it only!
+ msg="/sys vulnerability interface use forced, but it's not
available!"
+ status=UNK
+ fi
+
+ if ! is_cpu_affected "$cve" ; then
+ # override status & msg in case CPU is not vulnerable after all
+ pvulnstatus "$cve" OK "your CPU vendor reported your CPU model
as not affected"
+ elif [ -z "$msg" ]; then
+ # if msg is empty, sysfs check didn't fill it, rely on our own
test
+ zenbleed_print_vuln=0
+ if [ "$opt_live" = 1 ]; then
+ if [ "$fp_backup_fix" = 1 ] && [ "$cpu_ucode_zenbleed"
= 1 ]; then
+ # this should never happen, but if it does,
it's interesting to know
+ pvulnstatus $cve OK "Both your CPU microcode
and kernel are mitigating Zenbleed"
+ elif [ "$cpu_ucode_zenbleed" = 1 ]; then
+ pvulnstatus $cve OK "Your CPU microcode
mitigates Zenbleed"
+ elif [ "$fp_backup_fix" = 1 ]; then
+ pvulnstatus $cve OK "Your kernel mitigates
Zenbleed"
+ else
+ zenbleed_print_vuln=1
+ fi
+ else
+ if [ "$cpu_ucode_zenbleed" = 1 ]; then
+ pvulnstatus $cve OK "Your CPU microcode
mitigates Zenbleed"
+ elif [ -n "$kernel_zenbleed" ]; then
+ pvulnstatus $cve OK "Your kernel mitigates
Zenbleed"
+ else
+ zenbleed_print_vuln=1
+ fi
+ fi
+ if [ "$zenbleed_print_vuln" = 1 ]; then
+ pvulnstatus $cve VULN "Your kernel is too old to
mitigate Zenbleed and your CPU microcode doesn't mitigate it either"
+ explain "Your CPU vendor may have a new microcode for
your CPU model that mitigates this issue (refer to the hardware section
above).\n " \
+"Otherwise, the Linux kernel is able to mitigate this issue regardless of the
microcode version you have, but in this case\n " \
+"your kernel is too old to support this, your Linux distribution vendor might
have a more recent version you should upgrade to.\n " \
+"Note that either having an up to date microcode OR an up to date kernel is
enough to mitigate this issue.\n " \
+"To manually mitigate the issue right now, you may use the following command:
\`wrmsr -a 0xc0011029 \$((\$(rdmsr -c 0xc0011029) | (1<<9)))\`,\n " \
+"however note that this manual mitigation will only be active until the next
reboot."
+ fi
+ unset zenbleed_print_vuln
+ else
+ pvulnstatus $cve "$status" "$msg"
+ fi
+}
+
+
#######################
# END OF VULNS SECTIONS
@@ -5836,7 +6138,7 @@
# The builtin version follows, but the user can download an up-to-date copy
(to be stored in his $HOME) by using --update-fwdb
# To update the builtin version itself (by *modifying* this very file), use
--update-builtin-fwdb
-# %%% MCEDB v222+i20220208
+# %%% MCEDB v271+i20230614
# I,0x00000611,0x00000B27,19961218
# I,0x00000612,0x000000C6,19961210
# I,0x00000616,0x000000C6,19961210
@@ -5847,8 +6149,8 @@
# I,0x00000633,0x00000036,19980923
# I,0x00000634,0x00000037,19980923
# I,0x00000650,0x00000045,19990525
-# I,0x00000651,0x00000042,19990525
-# I,0x00000652,0x0000002D,19990518
+# I,0x00000651,0x00000040,19990525
+# I,0x00000652,0x0000002C,19990517
# I,0x00000653,0x00000010,19990628
# I,0x00000660,0x0000000A,19990505
# I,0x00000665,0x00000003,19990505
@@ -5859,8 +6161,8 @@
# I,0x00000672,0x00000038,19990922
# I,0x00000673,0x0000002E,19990910
# I,0x00000680,0x00000017,19990610
-# I,0x00000681,0x00000014,19991209
-# I,0x00000683,0x00000014,20010206
+# I,0x00000681,0x00000011,19990921
+# I,0x00000683,0x00000008,19991015
# I,0x00000686,0x00000008,20000505
# I,0x0000068A,0x00000005,20001207
# I,0x00000690,0x00000004,20000206
@@ -5883,8 +6185,8 @@
# I,0x000006E0,0x00000008,20050215
# I,0x000006E1,0x0000000C,20050413
# I,0x000006E4,0x00000026,20050816
-# I,0x000006E8,0x0000003C,20060208
-# I,0x000006EC,0x0000005B,20070208
+# I,0x000006E8,0x00000039,20051115
+# I,0x000006EC,0x00000059,20060912
# I,0x000006F0,0x00000005,20050818
# I,0x000006F1,0x00000012,20051129
# I,0x000006F2,0x0000005D,20101002
@@ -5894,7 +6196,7 @@
# I,0x000006F7,0x0000006B,20101002
# I,0x000006F9,0x00000084,20061012
# I,0x000006FA,0x00000095,20101002
-# I,0x000006FB,0x000000C1,20111004
+# I,0x000006FB,0x000000BC,20101003
# I,0x000006FD,0x000000A4,20101002
# I,0x00000F00,0xFFFF0001,20000130
# I,0x00000F01,0xFFFF0007,20000404
@@ -5908,7 +6210,7 @@
# I,0x00000F09,0x00000008,20010104
# I,0x00000F0A,0x00000015,20020821
# I,0x00000F11,0x0000000A,20030729
-# I,0x00000F12,0x0000002F,20030502
+# I,0x00000F12,0x0000002E,20030502
# I,0x00000F13,0x00000005,20030508
# I,0x00000F20,0x00000001,20010423
# I,0x00000F21,0x00000003,20010529
@@ -5941,23 +6243,23 @@
# I,0x00000F62,0x0000000F,20051215
# I,0x00000F63,0x00000005,20051010
# I,0x00000F64,0x00000004,20051223
-# I,0x00000F65,0x0000000B,20070510
+# I,0x00000F65,0x00000008,20060426
# I,0x00000F66,0x0000001B,20060310
# I,0x00000F68,0x00000009,20060714
# I,0x00001632,0x00000002,19980610
# I,0x00010650,0x00000002,20060513
# I,0x00010660,0x00000004,20060612
-# I,0x00010661,0x00000045,20101004
+# I,0x00010661,0x00000044,20101004
# I,0x00010670,0x00000005,20070209
# I,0x00010671,0x00000106,20070329
# I,0x00010674,0x84050100,20070726
-# I,0x00010676,0x00000612,20150802
-# I,0x00010677,0x0000070D,20150802
-# I,0x0001067A,0x00000A0E,20150729
+# I,0x00010676,0x0000060F,20100929
+# I,0x00010677,0x0000070A,20100929
+# I,0x0001067A,0x00000A0B,20100928
# I,0x000106A0,0xFFFF001A,20071128
# I,0x000106A1,0xFFFF000B,20080220
# I,0x000106A2,0xFFFF0019,20080714
-# I,0x000106A4,0x00000013,20150630
+# I,0x000106A4,0x00000012,20130621
# I,0x000106A5,0x0000001D,20180511
# I,0x000106C0,0x00000007,20070824
# I,0x000106C1,0x00000109,20071203
@@ -5965,7 +6267,7 @@
# I,0x000106C9,0x00000007,20090213
# I,0x000106CA,0x00000107,20090825
# I,0x000106D0,0x00000005,20071204
-# I,0x000106D1,0x0000002A,20150803
+# I,0x000106D1,0x00000029,20100930
# I,0x000106E0,0xFFFF0022,20090116
# I,0x000106E1,0xFFFF000D,20090206
# I,0x000106E2,0xFFFF0011,20090924
@@ -6061,20 +6363,20 @@
# I,0x000406D8,0x0000012D,20190916
# I,0x000406E1,0x00000020,20141111
# I,0x000406E2,0x0000002C,20150521
-# I,0x000406E3,0x000000EC,20210428
+# I,0x000406E3,0x000000F0,20211112
# I,0x000406E8,0x00000026,20160414
# I,0x000406F0,0x00000014,20150702
# I,0x000406F1,0x0B000040,20210519
# I,0x00050650,0x8000002B,20160208
# I,0x00050651,0x8000002B,20160208
# I,0x00050652,0x80000037,20170502
-# I,0x00050653,0x0100015C,20210526
-# I,0x00050654,0x02006C0A,20210616
-# I,0x00050655,0x03000012,20190412
-# I,0x00050656,0x0400320A,20210813
-# I,0x00050657,0x0500320A,20210813
+# I,0x00050653,0x01000171,20221221
+# I,0x00050654,0x02006F05,20221221
+# I,0x00050655,0x03000010,20181116
+# I,0x00050656,0x04003501,20221221
+# I,0x00050657,0x05003501,20221221
# I,0x0005065A,0x86002302,20210416
-# I,0x0005065B,0x07002402,20210604
+# I,0x0005065B,0x07002601,20221221
# I,0x00050661,0xF1000008,20150130
# I,0x00050662,0x0000001C,20190617
# I,0x00050663,0x0700001C,20210612
@@ -6083,10 +6385,11 @@
# I,0x00050670,0xFFFF0030,20151113
# I,0x00050671,0x000001B6,20180108
# I,0x000506A0,0x00000038,20150112
+# I,0x000506C0,0x00000002,20140613
# I,0x000506C2,0x00000014,20180511
# I,0x000506C8,0x90011010,20160323
-# I,0x000506C9,0x00000046,20210510
-# I,0x000506CA,0x00000022,20210622
+# I,0x000506C9,0x00000048,20211116
+# I,0x000506CA,0x00000028,20211116
# I,0x000506D1,0x00000102,20150605
# I,0x000506E0,0x00000018,20141119
# I,0x000506E1,0x0000002A,20150602
@@ -6094,7 +6397,7 @@
# I,0x000506E3,0x000000F0,20211112
# I,0x000506E8,0x00000034,20160710
# I,0x000506F0,0x00000010,20160607
-# I,0x000506F1,0x00000036,20210510
+# I,0x000506F1,0x00000038,20211202
# I,0x00060660,0x0000000C,20160821
# I,0x00060661,0x0000000E,20170128
# I,0x00060662,0x00000022,20171129
@@ -6102,64 +6405,79 @@
# I,0x000606A0,0x80000031,20200308
# I,0x000606A4,0x0B000280,20200817
# I,0x000606A5,0x0C0002F0,20210308
-# I,0x000606A6,0x0D000332,20211217
+# I,0x000606A6,0x0D000390,20221228
+# I,0x000606C0,0xFD000220,20210629
+# I,0x000606C1,0x01000230,20230127
# I,0x000606E0,0x0000000B,20161104
# I,0x000606E1,0x00000108,20190423
# I,0x000706A0,0x00000026,20170712
-# I,0x000706A1,0x00000038,20210510
-# I,0x000706A8,0x0000001C,20210510
+# I,0x000706A1,0x0000003E,20220916
+# I,0x000706A8,0x00000022,20220920
# I,0x000706E0,0x0000002C,20180614
# I,0x000706E1,0x00000042,20190420
# I,0x000706E2,0x00000042,20190420
# I,0x000706E3,0x81000008,20181002
# I,0x000706E4,0x00000046,20190905
-# I,0x000706E5,0x000000A8,20210526
+# I,0x000706E5,0x000000BA,20221225
# I,0x00080650,0x00000018,20180108
-# I,0x00080664,0x0B00000F,20210217
-# I,0x00080665,0x0B00000F,20210217
+# I,0x00080664,0x4C000021,20220815
+# I,0x00080665,0x4C000021,20220815
+# I,0x00080667,0x4C000021,20220815
# I,0x000806A0,0x00000010,20190507
-# I,0x000806A1,0x0000002D,20210902
+# I,0x000806A1,0x00000033,20230113
# I,0x000806C0,0x00000068,20200402
-# I,0x000806C1,0x0000009C,20211026
-# I,0x000806C2,0x00000022,20210716
+# I,0x000806C1,0x000000AA,20221228
+# I,0x000806C2,0x0000002A,20221228
# I,0x000806D0,0x00000050,20201217
-# I,0x000806D1,0x0000003C,20210716
-# I,0x000806E9,0x000000EC,20210428
-# I,0x000806EA,0x000000EC,20210428
-# I,0x000806EB,0x000000EC,20210428
-# I,0x000806EC,0x000000EC,20210428
+# I,0x000806D1,0x00000044,20221228
+# I,0x000806E9,0x000000F2,20230102
+# I,0x000806EA,0x000000F2,20221226
+# I,0x000806EB,0x000000F2,20221226
+# I,0x000806EC,0x000000F6,20221226
+# I,0x000806F3,0x8D000520,20220812
+# I,0x000806F4,0x2B000461,20230313
+# I,0x000806F5,0x2B000461,20230313
+# I,0x000806F6,0x2B000461,20230313
+# I,0x000806F7,0x2B000461,20230313
+# I,0x000806F8,0x2B000461,20230313
# I,0x00090660,0x00000009,20200617
-# I,0x00090661,0x00000015,20210921
+# I,0x00090661,0x00000017,20220715
# I,0x00090670,0x00000019,20201111
# I,0x00090671,0x0000001C,20210614
-# I,0x00090672,0x0000001F,20220303
+# I,0x00090672,0x0000002C,20230104
# I,0x00090674,0x00000219,20210425
-# I,0x00090675,0x0000001F,20220303
+# I,0x00090675,0x0000002C,20230104
# I,0x000906A0,0x0000001C,20210614
# I,0x000906A1,0x0000011F,20211104
# I,0x000906A2,0x00000315,20220102
-# I,0x000906A3,0x0000041B,20220308
-# I,0x000906A4,0x0000041B,20220308
-# I,0x000906C0,0x2400001F,20210809
-# I,0x000906E9,0x000000F0,20211112
-# I,0x000906EA,0x000000EC,20210428
-# I,0x000906EB,0x000000EC,20210428
-# I,0x000906EC,0x000000EC,20210428
-# I,0x000906ED,0x000000EC,20210428
+# I,0x000906A3,0x0000042A,20230214
+# I,0x000906A4,0x0000042A,20230214
+# I,0x000906C0,0x24000024,20220902
+# I,0x000906E9,0x000000F2,20221226
+# I,0x000906EA,0x000000F2,20230112
+# I,0x000906EB,0x000000F2,20221226
+# I,0x000906EC,0x000000F2,20230112
+# I,0x000906ED,0x000000F8,20230205
# I,0x000A0650,0x000000BE,20191010
# I,0x000A0651,0x000000C2,20191113
-# I,0x000A0652,0x000000EC,20210428
-# I,0x000A0653,0x000000EC,20210428
+# I,0x000A0652,0x000000F6,20221227
+# I,0x000A0653,0x000000F6,20230101
# I,0x000A0654,0x000000C6,20200123
-# I,0x000A0655,0x000000EE,20210428
-# I,0x000A0660,0x000000EA,20210428
-# I,0x000A0661,0x000000EC,20210429
+# I,0x000A0655,0x000000F6,20221226
+# I,0x000A0660,0x000000F6,20221226
+# I,0x000A0661,0x000000F6,20221226
# I,0x000A0670,0x0000002C,20201124
-# I,0x000A0671,0x00000050,20210829
+# I,0x000A0671,0x00000058,20221225
# I,0x000A0680,0x80000002,20200121
-# I,0x000B0670,0x00000009,20211115
-# I,0x000B06F2,0x0000001F,20220303
-# I,0x000B06F5,0x0000001F,20220303
+# I,0x000B0670,0x0000000E,20220220
+# I,0x000B0671,0x00000113,20230206
+# I,0x000B06A2,0x00004112,20230222
+# I,0x000B06A3,0x00004112,20230222
+# I,0x000B06E0,0x00000010,20221219
+# I,0x000B06F2,0x0000002C,20230104
+# I,0x000B06F5,0x0000002C,20230104
+# I,0x000C06F1,0x21000030,20230410
+# I,0x000C06F2,0x21000030,20230410
# A,0x00000F00,0x02000008,20070614
# A,0x00000F01,0x0000001C,20021031
# A,0x00000F10,0x00000003,20020325
@@ -6183,13 +6501,17 @@
# A,0x00100F00,0x01000020,20070326
# A,0x00100F20,0x010000CA,20100331
# A,0x00100F22,0x010000C9,20100331
+# A,0x00100F2A,0x01000084,20000101
# A,0x00100F40,0x01000085,20080501
# A,0x00100F41,0x010000DB,20111024
# A,0x00100F42,0x01000092,20081021
# A,0x00100F43,0x010000C8,20100311
+# A,0x00100F52,0x010000DB,20000101
+# A,0x00100F53,0x010000C8,20000101
# A,0x00100F62,0x010000C7,20100311
# A,0x00100F80,0x010000DA,20111024
# A,0x00100F81,0x010000D9,20111012
+# A,0x00100F91,0x010000D9,20000101
# A,0x00100FA0,0x010000DC,20111024
# A,0x00120F00,0x03000002,20100324
# A,0x00200F30,0x02000018,20070921
@@ -6239,20 +6561,36 @@
# A,0x00820F00,0x08200002,20180214
# A,0x00820F01,0x08200103,20190417
# A,0x00830F00,0x08300027,20190401
-# A,0x00830F10,0x08301052,20211111
+# A,0x00830F10,0x0830107A,20230517
# A,0x00850F00,0x08500004,20180212
# A,0x00860F00,0x0860000E,20200127
-# A,0x00860F01,0x08600106,20200619
-# A,0x00860F81,0x08608103,20200702
+# A,0x00860F01,0x08600109,20220328
+# A,0x00860F81,0x08608104,20220328
# A,0x00870F00,0x08700004,20181206
-# A,0x00870F10,0x08701021,20200125
+# A,0x00870F10,0x08701030,20220328
+# A,0x008A0F00,0x08A00008,20230615
# A,0x00A00F00,0x0A000033,20200413
-# A,0x00A00F10,0x0A001053,20211217
-# A,0x00A00F11,0x0A00115D,20211119
-# A,0x00A00F12,0x0A001227,20211215
+# A,0x00A00F10,0x0A001079,20230609
+# A,0x00A00F11,0x0A0011D1,20230710
+# A,0x00A00F12,0x0A001234,20230710
# A,0x00A00F80,0x0A008003,20211015
-# A,0x00A00F82,0x0A008204,20211015
+# A,0x00A00F82,0x0A008205,20220414
+# A,0x00A10F00,0x0A10004B,20220309
+# A,0x00A10F01,0x0A100104,20220207
+# A,0x00A10F0B,0x0A100B07,20220610
+# A,0x00A10F10,0x0A101020,20220913
+# A,0x00A10F11,0x0A101135,20230509
+# A,0x00A10F12,0x0A101235,20230509
# A,0x00A20F00,0x0A200025,20200121
-# A,0x00A20F10,0x0A201016,20210408
-# A,0x00A20F12,0x0A201205,20210719
-# A,0x00A50F00,0x0A50000C,20201208
+# A,0x00A20F10,0x0A201025,20211014
+# A,0x00A20F12,0x0A20120A,20211014
+# A,0x00A40F00,0x0A400016,20210330
+# A,0x00A40F40,0x0A404002,20210408
+# A,0x00A40F41,0x0A404102,20211018
+# A,0x00A50F00,0x0A50000D,20211014
+# A,0x00A60F00,0x0A600005,20211220
+# A,0x00A60F11,0x0A601114,20220712
+# A,0x00A60F12,0x0A601203,20220715
+# A,0x00AA0F00,0x0AA00009,20221006
+# A,0x00AA0F01,0x0AA00112,20230510
+# A,0x00AA0F02,0x0AA0020E,20230510
