fix: mmio: don't report "Intel never assessed this CPU" when the MSR is unreadable

When IA32_ARCH_CAPABILITIES (0x10a) can't be read from userspace (no msr
module, or kernel lockdown under Secure Boot), the FBSDP_NO/PSDP_NO/SBDR_SSDP_NO
bits were left at 0 ("explicitly not immune") instead of -1 ("unknown"). For a
recent CPU not in any kernel model list (e.g. Arrow Lake), this wrongly flipped
the MMIO Stale Data verdict into the "out of servicing period, Intel never
assessed this CPU" bucket.

DEVELOPMENT.md

@@ -41,22 +41,20 @@ The project uses 4 branches organized in two pipelines (production and dev/test)
 | **`test-build`** | Monolithic test script (built artifact) | CI from `test` |
 | **`source`** | Production source (split files + Makefile) | Developers |
 | **`source-build`** | Monolithic test script (built artifact) | CI from `source` |
-| **`master`** | Monolithic production script (built artifact) | `release` workflow, synced from `source-build` |
+| **`master`** | Monolithic production script (built artifact) | PR by developers from `source-build` |
 
 - **`source`** and **`test`** contain the split source files and the Makefile. These are the branches developers commit to.
 - **`master`**, **`source-build`** and **`test-build`** contain only the monolithic `spectre-meltdown-checker.sh` built by CI. Nobody commits to these directly.
 - **`master`** is the preexisting production branch that users pull from. It cannot be renamed.
 - **`test-build`** is a testing branch that users can pull from to test pre-release versions.
-- **`source-build`** is a preprod branch to prepare the artifact before releasing it to **`master`**. It is a build *output* branch and is never merged into `master`; instead the assembled files are copied across by the manual `release` workflow (see [RELEASE.md](RELEASE.md)), which keeps `master`'s own CI workflows untouched.
+- **`source-build`** is a preprod branch to prepare the artifact before merging to **`master`**.
 
 Typical workflow:
 1. Feature/fix branches are created from `test` and merged back into `test`.
 2. CI builds the script and pushes it to `test-build` for testing.
 3. When ready for release, `test` is merged into `source`.
 4. CI builds the script and pushes it to `source-build` for production.
-5. Developer runs the manual `release` workflow to sync `source-build`'s
+5. Developer creates a PR from `source-build` to `master`.
-   assembled files onto `master` and draft a GitHub release. See
-   [RELEASE.md](RELEASE.md) for the full procedure.
 
 ## Versioning
 
@@ -188,7 +186,7 @@ if [ $ret = $READ_CPUID_RET_OK ]; then
     cap_ssbd='Intel SSBD'
 elif [ $ret = $READ_CPUID_RET_ERR ] && [ "$g_mode" = live ]; then
     # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
-    if cpuinfo_has_flag ssbd; then
+    if grep ^flags "$g_procfs/cpuinfo" | grep -qw ssbd; then
         cap_ssbd='Intel SSBD (cpuinfo)'
         ret=$READ_CPUID_RET_OK
     fi

RELEASE.md

@@ -1,86 +0,0 @@
-# Releasing
-
-This document describes how a production release reaches the `master` branch
-and how a GitHub release is published. It complements the **Branch Model**
-section of [DEVELOPMENT.md](DEVELOPMENT.md).
-
-This file lives only on the `source`/`test` development branches. It is **not**
-part of `dist/`, so it never reaches `source-build` or `master` — users who
-`git clone` the `master` branch onto their servers get only the files needed to
-run the tool.
-
-## Why `master` is not a merge target
-
-`master` plays two roles at once:
-
-- It is the **distribution branch** — users clone it directly onto their
-  servers, so it must stay minimal (just the monolithic script and the few
-  files needed to run/build the container).
-- It is the repository's **default branch**, which is the only place GitHub
-  runs *scheduled* workflows from. The `autoupdate`, `stale` and `vuln-watch`
-  workflows are therefore **master-only** and deliberately kept off the
-  `source`/`test` line (see commit "remove from test branch workflows that must
-  live on master").
-
-`source-build` is a build **output** branch and does **not** carry those
-master-only workflows (the build's `rsync --delete` strips `.github/` down to
-what `source` ships). Merging the whole `source-build` tree into `master` would
-therefore drag the *absence* of those workflows into `master`, producing
-recurring `modify/delete` conflicts — and, worse, a clean merge could silently
-delete them when they hadn't been edited since the last release.
-
-So we never merge `source-build` into `master`. Instead we **copy only the
-assembled artifact files** across, and cut GitHub releases from `master`
-directly.
-
-## The `release` workflow
-
-`.github/workflows/release.yml` (which, like the other master-only workflows,
-lives **only on `master`**) is triggered manually via `workflow_dispatch` and
-offers two independent actions selected from the `action` dropdown. Run it
-against the `master` branch.
-
-### 1. `sync-from-source-build`
-
-Copies every top-level entry on `source-build` **except `.github/`**
-(`spectre-meltdown-checker.sh`, `README.md`, `doc/`, `Dockerfile`,
-`docker-compose.yml`) onto `master` as a single commit, mirroring exactly
-(deletions and renames included). `master`'s own `.github/` — its
-master-only CI — is never touched.
-
-The script's contents are copied byte-for-byte, so its `VERSION` (generated by
-the `source-build` build) is preserved unchanged. No version bump happens here.
-
-The job is a no-op if `master` is already up to date.
-
-### 2. `draft-github-release`
-
-Reads the `VERSION` from the script currently on `master`, and creates a
-**draft** GitHub release tagged `v<VERSION>`, with the monolithic script
-attached as an asset. Because it is a draft, **no tag is created and nothing is
-published** until you press *Publish* in the Releases UI — so this step is fully
-reversible.
-
-The changelog is auto-drafted by locating the `source-build` commit whose built
-`VERSION` matches the previous published release, then listing every assembled
-commit since. Treat it as a starting point and edit it before publishing.
-
-## Release procedure
-
-1. Confirm `source-build` holds the artifact you want to release (CI is green,
-   version string looks right).
-2. Run the **`release`** workflow on `master` with `action =
-   sync-from-source-build`. Review the resulting commit/diff on `master`.
-3. Run the **`release`** workflow on `master` with `action =
-   draft-github-release`.
-4. Open the draft release, review/edit the auto-generated changelog, then
-   **Publish** it. Publishing creates the `v<VERSION>` tag.
-
-Steps 2 and 3 are decoupled on purpose: you can refresh `master` from
-`source-build` (step 2) without cutting a formal GitHub release yet.
-
-## Rollback
-
-- Before publishing: delete the draft release in the UI (no tag exists yet).
-- After a bad `sync-from-source-build`: `master` history is intact — revert the
-  sync commit with a normal `git revert` (never force-push `master`).

src/db/200_mcedb.sh

@@ -8,7 +8,7 @@
 # with X being either I for Intel, or A for AMD
 # When the date is unknown it defaults to 20000101
 
-# %%% MCEDB v351+i20260512+1cce
+# %%% MCEDB v349+i20260227+615b
 # I,0x00000611,0xFF,0x00000B27,19961218
 # I,0x00000612,0xFF,0x000000C6,19961210
 # I,0x00000616,0xFF,0x000000C6,19961210
@@ -381,14 +381,14 @@
 # I,0x000806F2,0xFF,0x8C0004E0,20211112
 # I,0x000806F3,0xFF,0x8D000520,20220812
 # I,0x000806F4,0x10,0x2C000421,20250825
-# I,0x000806F4,0x87,0x2B000670,20251217
+# I,0x000806F4,0x87,0x2B000661,20250825
 # I,0x000806F5,0x10,0x2C000421,20250825
-# I,0x000806F5,0x87,0x2B000670,20251217
+# I,0x000806F5,0x87,0x2B000661,20250825
 # I,0x000806F6,0x10,0x2C000421,20250825
-# I,0x000806F6,0x87,0x2B000670,20251217
+# I,0x000806F6,0x87,0x2B000661,20250825
-# I,0x000806F7,0x87,0x2B000670,20251217
+# I,0x000806F7,0x87,0x2B000661,20250825
 # I,0x000806F8,0x10,0x2C000421,20250825
-# I,0x000806F8,0x87,0x2B000670,20251217
+# I,0x000806F8,0x87,0x2B000661,20250825
 # I,0x00090660,0xFF,0x00000009,20200617
 # I,0x00090661,0x01,0x0000001A,20240405
 # I,0x00090670,0xFF,0x00000019,20201111
@@ -425,12 +425,11 @@
 # I,0x000A06C0,0xFF,0x00000013,20230901
 # I,0x000A06C1,0xFF,0x00000005,20231201
 # I,0x000A06D0,0xFF,0x10000680,20240818
-# I,0x000A06D1,0x20,0x0A000142,20260129
+# I,0x000A06D1,0x20,0x0A000133,20251009
-# I,0x000A06D1,0x95,0x01000423,20260129
+# I,0x000A06D1,0x95,0x01000405,20251031
-# I,0x000A06E0,0xFF,0x80000953,20240902
+# I,0x000A06E1,0x97,0x01000303,20251202
-# I,0x000A06E1,0x97,0x01000307,20260226
 # I,0x000A06F0,0xFF,0x80000360,20240130
-# I,0x000A06F3,0x01,0x030003A3,20260130
+# I,0x000A06F3,0x01,0x03000382,20250730
 # I,0x000B0650,0x80,0x0000000D,20250925
 # I,0x000B0664,0xFF,0x00000030,20250529
 # I,0x000B0670,0xFF,0x0000000E,20220220
@@ -440,28 +439,25 @@
 # I,0x000B06A3,0xE0,0x00006134,20251008
 # I,0x000B06A8,0xE0,0x00006134,20251008
 # I,0x000B06D0,0xFF,0x0000001A,20240610
-# I,0x000B06D1,0x80,0x00000126,20251210
+# I,0x000B06D1,0x80,0x00000125,20250828
 # I,0x000B06E0,0x19,0x00000021,20250912
 # I,0x000B06F2,0x07,0x0000003E,20251012
 # I,0x000B06F5,0x07,0x0000003E,20251012
 # I,0x000B06F6,0x07,0x0000003E,20251012
 # I,0x000B06F7,0x07,0x0000003E,20251012
-# I,0x000C0652,0x82,0x00000121,20251215
+# I,0x000C0652,0x82,0x0000011B,20250803
 # I,0x000C0660,0xFF,0x00000018,20240516
-# I,0x000C0662,0x82,0x00000121,20251215
+# I,0x000C0662,0x82,0x0000011B,20250803
-# I,0x000C0664,0x82,0x00000121,20251215
+# I,0x000C0664,0x82,0x0000011B,20250803
-# I,0x000C06A2,0x82,0x00000121,20251215
+# I,0x000C06A2,0x82,0x0000011B,20250803
 # I,0x000C06C0,0xFF,0x00000012,20250325
-# I,0x000C06C1,0x90,0x0000011B,20260324
+# I,0x000C06C1,0xFF,0x00000115,20251203
-# I,0x000C06C2,0x90,0x0000011B,20260324
+# I,0x000C06C2,0xFF,0x00000115,20251203
-# I,0x000C06C3,0x90,0x0000011B,20260324
+# I,0x000C06C3,0xFF,0x00000115,20251203
-# I,0x000C06F1,0x87,0x210002E0,20251217
+# I,0x000C06F1,0x87,0x210002D3,20250825
-# I,0x000C06F2,0x87,0x210002E0,20251217
+# I,0x000C06F2,0x87,0x210002D3,20250825
-# I,0x000D0650,0xFF,0x00000009,20260309
+# I,0x000D0670,0xFF,0x00000003,20250825
-# I,0x000D0651,0xFF,0x00000009,20260309
+# I,0x000D06D0,0xFF,0x00000340,20250807
-# I,0x000D0670,0xFF,0x00000137,20260218
-# I,0x000D06D0,0xFF,0x80000370,20250917
-# I,0x000D06D1,0xFF,0x01000120,20260325
 # I,0x00FF0671,0xFF,0x0000010E,20220907
 # I,0x00FF0672,0xFF,0x0000000D,20210816
 # I,0x00FF0675,0xFF,0x0000000D,20210816
@@ -558,13 +554,13 @@
 # A,0x00880F40,0xFF,0x08804005,20210312
 # A,0x00890F00,0xFF,0x08900007,20200921
 # A,0x00890F01,0xFF,0x08900103,20201105
-# A,0x00890F02,0xFF,0x08900208,20241219
+# A,0x00890F02,0xFF,0x08900203,20230915
 # A,0x00890F10,0xFF,0x08901003,20230919
 # A,0x008A0F00,0xFF,0x08A0000B,20241125
 # A,0x00A00F00,0xFF,0x0A000033,20200413
 # A,0x00A00F10,0xFF,0x0A00107A,20240226
-# A,0x00A00F11,0xFF,0x0A0011DF,20260312
+# A,0x00A00F11,0xFF,0x0A0011DE,20250418
-# A,0x00A00F12,0xFF,0x0A00124B,20260305
+# A,0x00A00F12,0xFF,0x0A001247,20250327
 # A,0x00A00F80,0xFF,0x0A008005,20230707
 # A,0x00A00F82,0xFF,0x0A00820F,20241111
 # A,0x00A10F00,0xFF,0x0A10004B,20220309
@@ -603,15 +599,15 @@
 # A,0x00B00F00,0xFF,0x0B00004D,20240318
 # A,0x00B00F10,0xFF,0x0B001016,20240318
 # A,0x00B00F20,0xFF,0x0B002032,20241003
-# A,0x00B00F21,0xFF,0x0B002162,20251105
+# A,0x00B00F21,0xFF,0x0B002161,20251105
 # A,0x00B00F80,0xFF,0x0B008011,20241211
 # A,0x00B00F81,0xFF,0x0B008121,20251020
 # A,0x00B10F00,0xFF,0x0B10000F,20240320
-# A,0x00B10F10,0xFF,0x0B101059,20251105
+# A,0x00B10F10,0xFF,0x0B101058,20251105
 # A,0x00B20F40,0xFF,0x0B204037,20251019
 # A,0x00B40F00,0xFF,0x0B400034,20240318
-# A,0x00B40F40,0xFF,0x0B404038,20260408
+# A,0x00B40F40,0xFF,0x0B404035,20251020
-# A,0x00B40F41,0xFF,0x0B40410B,20260408
+# A,0x00B40F41,0xFF,0x0B404108,20251020
-# A,0x00B60F00,0xFF,0x0B60003C,20260401
+# A,0x00B60F00,0xFF,0x0B600037,20251019
-# A,0x00B60F80,0xFF,0x0B60803C,20260401
+# A,0x00B60F80,0xFF,0x0B608038,20251019
 # A,0x00B70F00,0xFF,0x0B700037,20251019

src/libs/003_intel_models.sh

@@ -72,7 +72,6 @@
     readonly INTEL_FAM6_ARROWLAKE_U=$((0xB5))
     readonly INTEL_FAM6_LUNARLAKE_M=$((0xBD))   # /* Lion Cove / Skymont */
     readonly INTEL_FAM6_PANTHERLAKE_L=$((0xCC)) # /* Cougar Cove / Darkmont */
-    readonly INTEL_FAM6_PANTHERLAKE_R=$((0xE5)) # /* Cougar Cove / Darkmont */
     readonly INTEL_FAM6_WILDCATLAKE_L=$((0xD5))
     readonly INTEL_FAM18_NOVALAKE=$((0x01))            # /* Coyote Cove / Arctic Wolf */
     readonly INTEL_FAM18_NOVALAKE_L=$((0x03))          # /* Coyote Cove / Arctic Wolf */

src/libs/200_cpu_affected.sh

@@ -562,7 +562,6 @@ is_cpu_affected() {
 06-c5-02/82,0000011b
 06-c6-02/82,0000011b
 06-bd-01/80,00000125
-06-55-07/bf,05003901
 06-55-0b/bf,07002b01
 06-8f-07/87,2b000661
 06-8f-08/87,2b000661
@@ -725,9 +724,9 @@ is_cpu_affected() {
             if [ -n "$cpupart" ] && [ -n "$cpuarch" ]; then
                 # Cortex-R7 and Cortex-R8 are real-time and only used in medical devices or such
                 # I can't find their CPU part number, but it's probably not that useful anyway
-                # model R7 R8 A8  A9  A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2 Neoverse-V3 Neoverse-V3AE
+                # model R7 R8 A8  A9  A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2
-                # part   ?  ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c         d40	  d49	      d4f	  d84	      d83
+                # part   ?  ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c         d40	  d49	      d4f
-                # arch  7? 7? 7   7   7   7   7   8   8   8   8   8   8   8           8		  8	      8		  8	      8
+                # arch  7? 7? 7   7   7   7   7   8   8   8   8   8   8   8           8		  8	      8
                 #
                 # Whitelist identified non-affected processors, use vulnerability information from
                 # https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
@@ -778,13 +777,13 @@ is_cpu_affected() {
                     _infer_immune variant3a
                     _set_vuln variant4
                     pr_debug "checking cpu$i: armv8 A76/A77/NeoverseN1 non affected to variant 2, 3 & 3a"
-                elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
+                elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f; then
                     _set_vuln variant1
                     _infer_immune variant2
                     _infer_immune variant3
                     _infer_immune variant3a
                     _infer_immune variant4
-                    pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2/V3/V3AE non affected to variant 2, 3, 3a & 4"
+                    pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2 non affected to variant 2, 3, 3a & 4"
                 elif [ "$cpuarch" -le 7 ] || { [ "$cpuarch" = 8 ] && [ $((cpupart)) -lt $((0xd07)) ]; }; then
                     _infer_immune variant1
                     _infer_immune variant2
@@ -845,14 +844,14 @@ is_cpu_affected() {
     # - arm64 (CVE-2020-13844): Cortex-A32/A34/A35/A53/A57/A72/A73 confirmed affected,
     #   and broadly all speculative Armv8-A cores. No kernel mitigation merged.
     #   Part numbers: A32=0xd01 A34=0xd02 A53=0xd03 A35=0xd04 A57=0xd07 A72=0xd08 A73=0xd09
-    #   Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f V3=0xd84 V3AE=0xd83
+    #   Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f
     if is_intel || is_amd; then
         _infer_vuln sls
     elif [ "$cpu_vendor" = ARM ]; then
         for cpupart in $cpu_part_list; do
             if echo "$cpupart" | grep -q -w -e 0xd01 -e 0xd02 -e 0xd03 -e 0xd04 \
                 -e 0xd07 -e 0xd08 -e 0xd09 -e 0xd0a -e 0xd0b -e 0xd0c -e 0xd0d \
-                -e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
+                -e 0xd40 -e 0xd49 -e 0xd4f; then
                 _set_vuln sls
             fi
         done

src/libs/330_cpu_misc.sh

@@ -22,9 +22,3 @@ is_coreos() {
     command -v coreos-install >/dev/null 2>&1 && command -v toolbox >/dev/null 2>&1 && return 0
     return 1
 }
-
-# Check whether /proc/cpuinfo has $1 in the flags line
-# Returns: 0 if flag found, 1 otherwise
-cpuinfo_has_flag() {
-    grep -Eq '^flags\b.+\b'"$1"'\b' "$g_procfs/cpuinfo" 2>/dev/null
-}

src/libs/350_cpu_detect2.sh

@@ -20,8 +20,8 @@ parse_cpu_details() {
     cap_avx2=0
     cap_avx512=0
     if [ -e "$g_procfs/cpuinfo" ]; then
-        if cpuinfo_has_flag avx2; then cap_avx2=1; fi
+        if grep -qw avx2 "$g_procfs/cpuinfo" 2>/dev/null; then cap_avx2=1; fi
-        if cpuinfo_has_flag avx512; then cap_avx512=1; fi
+        if grep -qw avx512 "$g_procfs/cpuinfo" 2>/dev/null; then cap_avx512=1; fi
         cpu_vendor=$(grep '^vendor_id' "$g_procfs/cpuinfo" | awk '{print $3}' | head -n1)
         cpu_friendly_name=$(grep '^model name' "$g_procfs/cpuinfo" | cut -d: -f2- | head -n1 | sed -e 's/^ *//')
         # ARM-style cpuinfo: parse per-core implementer/part/arch/variant/revision lists

src/libs/360_cpu_smt.sh

@@ -46,18 +46,8 @@ is_arm_cpu() {
 # Check whether SMT (HyperThreading) is enabled on the system
 # Returns: 0 if SMT enabled, 1 otherwise
 is_cpu_smt_enabled() {
-    local siblings cpucores smt_active
+    local siblings cpucores
-    # Most reliable: /sys/devices/system/cpu/smt/active mirrors the kernel's
+    # SMT / HyperThreading is enabled if siblings != cpucores
-    # sched_smt_active() (1=SMT active, 0=not), which is exactly what the kernel
-    # itself uses to derive the "SMT (disabled|vulnerable)" vulnerability strings.
-    if [ -r /sys/devices/system/cpu/smt/active ]; then
-        smt_active=$(cat /sys/devices/system/cpu/smt/active 2>/dev/null)
-        case "$smt_active" in
-            1) return 0 ;;
-            0) return 1 ;;
-        esac
-    fi
-    # Fallback: SMT / HyperThreading is enabled if siblings != cpucores
     if [ -e "$g_procfs/cpuinfo" ]; then
         siblings=$(awk '/^siblings/  {print $3;exit}' "$g_procfs/cpuinfo")
         cpucores=$(awk '/^cpu cores/ {print $4;exit}' "$g_procfs/cpuinfo")

src/libs/370_hw_vmm.sh

@@ -127,14 +127,7 @@ is_running_as_guest() {
     if [ "${g_is_guest_vm_cached:-0}" != 1 ]; then
         g_is_guest_vm=0
         g_is_guest_vm_reason=''
-        # A Xen dom0 runs on top of the hypervisor and therefore also has the
+        if [ -e "$g_procfs/cpuinfo" ] && grep -qw 'hypervisor' "$g_procfs/cpuinfo" 2>/dev/null; then
-        # 'hypervisor' CPUID flag set, but it's the privileged control domain:
-        # it has direct hardware access and a truthful view of the host CPU
-        # topology, so it must not be classified as a guest (#343). Check it
-        # before the cpuinfo probe below, which would otherwise match.
-        if is_xen_dom0; then
-            g_is_guest_vm=0
-        elif [ -e "$g_procfs/cpuinfo" ] && grep -qw 'hypervisor' "$g_procfs/cpuinfo" 2>/dev/null; then
             g_is_guest_vm=1
             g_is_guest_vm_reason="'hypervisor' flag in $g_procfs/cpuinfo"
         fi

src/libs/400_hw_check.sh

@@ -513,7 +513,7 @@ check_cpu() {
     fi
     if [ -z "$cap_ibrs" ] && [ $ret = $READ_CPUID_RET_ERR ] && has_runtime; then
         # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
-        if cpuinfo_has_flag ibrs; then
+        if grep ^flags "$g_procfs/cpuinfo" | grep -qw ibrs; then
             cap_ibrs='IBRS (cpuinfo)'
             cap_spec_ctrl=1
             pstatus green YES "ibrs flag in $g_procfs/cpuinfo"
@@ -588,7 +588,7 @@ check_cpu() {
         if [ $ret = $READ_CPUID_RET_OK ]; then
             cap_ibpb='IBPB_SUPPORT'
             pstatus green YES "IBPB_SUPPORT feature bit"
-        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && cpuinfo_has_flag ibpb; then
+        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && grep ^flags "$g_procfs/cpuinfo" | grep -qw ibpb; then
             # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
             cap_ibpb='IBPB (cpuinfo)'
             pstatus green YES "ibpb flag in $g_procfs/cpuinfo"
@@ -661,7 +661,7 @@ check_cpu() {
     fi
     if [ -z "$cap_stibp" ] && [ $ret = $READ_CPUID_RET_ERR ] && has_runtime; then
         # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
-        if cpuinfo_has_flag stibp; then
+        if grep ^flags "$g_procfs/cpuinfo" | grep -qw stibp; then
             cap_stibp='STIBP (cpuinfo)'
             pstatus green YES "stibp flag in $g_procfs/cpuinfo"
             ret=$READ_CPUID_RET_OK
@@ -733,9 +733,9 @@ check_cpu() {
 
     if [ -z "$cap_ssbd" ] && [ "$ret24" = $READ_CPUID_RET_ERR ] && [ "$ret25" = $READ_CPUID_RET_ERR ] && has_runtime; then
         # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
-        if cpuinfo_has_flag ssbd; then
+        if grep ^flags "$g_procfs/cpuinfo" | grep -qw ssbd; then
             cap_ssbd='SSBD (cpuinfo)'
-        elif cpuinfo_has_flag virt_ssbd; then
+        elif grep ^flags "$g_procfs/cpuinfo" | grep -qw virt_ssbd; then
             cap_ssbd='SSBD in VIRT_SPEC_CTRL (cpuinfo)'
         fi
     fi
@@ -795,7 +795,7 @@ check_cpu() {
     if [ $ret = $READ_CPUID_RET_OK ]; then
         pstatus green YES "L1D flush feature bit"
         cap_l1df=1
-    elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && cpuinfo_has_flag flush_l1d; then
+    elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && grep ^flags "$g_procfs/cpuinfo" | grep -qw flush_l1d; then
         # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
         pstatus green YES "flush_l1d flag in $g_procfs/cpuinfo"
         cap_l1df=1
@@ -815,7 +815,7 @@ check_cpu() {
         if [ $ret = $READ_CPUID_RET_OK ]; then
             cap_md_clear=1
             pstatus green YES "MD_CLEAR feature bit"
-        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && cpuinfo_has_flag md_clear; then
+        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && grep ^flags "$g_procfs/cpuinfo" | grep -qw md_clear; then
             # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
             cap_md_clear=1
             pstatus green YES "md_clear flag in $g_procfs/cpuinfo"
@@ -885,7 +885,7 @@ check_cpu() {
         if [ $ret = $READ_CPUID_RET_OK ]; then
             pstatus green YES
             cap_arch_capabilities=1
-        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && cpuinfo_has_flag arch_capabilities; then
+        elif [ $ret = $READ_CPUID_RET_ERR ] && has_runtime && grep ^flags "$g_procfs/cpuinfo" | grep -qw arch_capabilities; then
             # CPUID device unavailable (e.g. in a VM): fall back to /proc/cpuinfo
             pstatus green YES "arch_capabilities flag in $g_procfs/cpuinfo"
             cap_arch_capabilities=1

src/vulns-helpers/check_mds.sh

@@ -138,7 +138,7 @@ check_mds_linux() {
         if is_x86_kernel; then
             pr_info_nol "* Kernel supports using MD_CLEAR mitigation: "
             kernel_md_clear_can_tell=1
-            if [ "$g_mode" = live ] && cpuinfo_has_flag md_clear; then
+            if [ "$g_mode" = live ] && grep ^flags "$g_procfs/cpuinfo" | grep -qw md_clear; then
                 kernel_md_clear="md_clear found in $g_procfs/cpuinfo"
                 pstatus green YES "$kernel_md_clear"
             fi
@@ -175,21 +175,11 @@ check_mds_linux() {
                     mds_smt_mitigated=1
                     pstatus green YES
                 elif echo "$ret_sys_interface_check_fullmsg" | grep -q 'SMT Host state unknown'; then
-                    # The kernel appends "SMT Host state unknown" whenever the
+                    # The kernel appends "SMT Host state unknown" when running under
-                    # HYPERVISOR CPUID bit is set. That's true both inside a guest
+                    # a hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT
-                    # AND on a Xen dom0 (#343). In a guest we genuinely can't see
+                    # scheduling, so it can't be determined from inside the guest (#343).
-                    # the host's SMT scheduling; on dom0/bare metal the local SMT
+                    mds_smt_mitigated=2
-                    # state is authoritative, so trust it there.
+                    pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT"
-                    if is_running_as_guest; then
-                        mds_smt_mitigated=2
-                        pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT"
-                    elif is_cpu_smt_enabled; then
-                        mds_smt_mitigated=0
-                        pstatus yellow NO
-                    else
-                        mds_smt_mitigated=1
-                        pstatus green YES
-                    fi
                 else
                     mds_smt_mitigated=0
                     pstatus yellow NO

src/vulns-helpers/check_mmio.sh

@@ -233,21 +233,11 @@ check_mmio_linux() {
                     mmio_smt_mitigated=1
                     pstatus green YES
                 elif echo "$ret_sys_interface_check_fullmsg" | grep -q 'SMT Host state unknown'; then
-                    # The kernel appends "SMT Host state unknown" whenever the
+                    # The kernel appends "SMT Host state unknown" when running under
-                    # HYPERVISOR CPUID bit is set. That's true both inside a guest
+                    # a hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT
-                    # AND on a Xen dom0 (#343). In a guest we genuinely can't see
+                    # scheduling, so it can't be determined from inside the guest (#343).
-                    # the host's SMT scheduling; on dom0/bare metal the local SMT
+                    mmio_smt_mitigated=2
-                    # state is authoritative, so trust it there.
+                    pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT"
-                    if is_running_as_guest; then
-                        mmio_smt_mitigated=2
-                        pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT"
-                    elif is_cpu_smt_enabled; then
-                        mmio_smt_mitigated=0
-                        pstatus yellow NO
-                    else
-                        mmio_smt_mitigated=1
-                        pstatus green YES
-                    fi
                 else
                     mmio_smt_mitigated=0
                     pstatus yellow NO

src/vulns/CVE-2017-5715.sh

@@ -306,7 +306,7 @@ check_CVE_2017_5715_linux() {
                 # which in that case means ibrs is supported *and* enabled for kernel & user
                 # as per the ibrs patch series v3
                 if [ -z "$g_ibrs_supported" ]; then
-                    if cpuinfo_has_flag spec_ctrl_ibrs; then
+                    if grep ^flags "$g_procfs/cpuinfo" | grep -qw spec_ctrl_ibrs; then
                         pr_debug "ibrs: found spec_ctrl_ibrs flag in $g_procfs/cpuinfo"
                         g_ibrs_supported="spec_ctrl_ibrs flag in $g_procfs/cpuinfo"
                         # enabled=2 -> kernel & user

src/vulns/CVE-2017-5754.sh

@@ -11,7 +11,7 @@
 pti_performance_check() {
     local ret pcid invpcid
     pr_info_nol "  * Reduced performance impact of PTI: "
-    if cpuinfo_has_flag pcid; then
+    if [ -e "$g_procfs/cpuinfo" ] && grep ^flags "$g_procfs/cpuinfo" | grep -qw pcid; then
         pcid=1
     else
         read_cpuid 0x1 0x0 "$ECX" 17 1 1
@@ -21,7 +21,7 @@ pti_performance_check() {
         fi
     fi
 
-    if cpuinfo_has_flag invpcid; then
+    if [ -e "$g_procfs/cpuinfo" ] && grep ^flags "$g_procfs/cpuinfo" | grep -qw invpcid; then
         invpcid=1
     else
         read_cpuid 0x7 0x0 "$EBX" 10 1 1
@@ -110,11 +110,11 @@ check_CVE_2017_5754_linux() {
             dmesg_grep="$dmesg_grep|x86/pti: Unmapping kernel while in userspace"
             # aarch64
             dmesg_grep="$dmesg_grep|CPU features: detected( feature)?: Kernel page table isolation \(KPTI\)"
-            if cpuinfo_has_flag pti; then
+            if grep ^flags "$g_procfs/cpuinfo" | grep -qw pti; then
                 # vanilla PTI patch sets the 'pti' flag in cpuinfo
                 pr_debug "kpti_enabled: found 'pti' flag in $g_procfs/cpuinfo"
                 kpti_enabled=1
-            elif cpuinfo_has_flag kaiser; then
+            elif grep ^flags "$g_procfs/cpuinfo" | grep -qw kaiser; then
                 # kernel line 4.9 sets the 'kaiser' flag in cpuinfo
                 pr_debug "kpti_enabled: found 'kaiser' flag in $g_procfs/cpuinfo"
                 kpti_enabled=1

src/vulns/CVE-2018-3646.sh

@@ -89,7 +89,7 @@ check_CVE_2018_3646_linux() {
 
         pr_info "* Mitigation 2"
         pr_info_nol "  * L1D flush is supported by kernel: "
-        if [ "$g_mode" = live ] && cpuinfo_has_flag flush_l1d; then
+        if [ "$g_mode" = live ] && grep -qw flush_l1d "$g_procfs/cpuinfo"; then
             l1d_kernel="found flush_l1d in $g_procfs/cpuinfo"
         fi
         if [ -z "$l1d_kernel" ]; then
@@ -162,7 +162,7 @@ check_CVE_2018_3646_linux() {
 
         pr_info_nol "  * Hardware-backed L1D flush supported: "
         if [ "$g_mode" = live ]; then
-            if cpuinfo_has_flag flush_l1d || [ -n "$l1d_xen_hardware" ]; then
+            if grep -qw flush_l1d "$g_procfs/cpuinfo" || [ -n "$l1d_xen_hardware" ]; then
                 pstatus green YES "performance impact of the mitigation will be greatly reduced"
             else
                 pstatus blue NO "flush will be done in software, this is slower"

src/vulns/CVE-2019-11135.sh

@@ -87,18 +87,10 @@ check_CVE_2019_11135_linux() {
             elif echo "$ret_sys_interface_check_fullmsg" | grep -qF 'SMT vulnerable'; then
                 pvulnstatus "$cve" VULN "SMT (HyperThreading) must be disabled for full mitigation"
             elif echo "$ret_sys_interface_check_fullmsg" | grep -qF 'SMT Host state unknown'; then
-                # "SMT Host state unknown" is emitted whenever the HYPERVISOR
+                # The kernel appends "SMT Host state unknown" when running under a
-                # CPUID bit is set -- true both inside a guest AND on a Xen dom0
+                # hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT
-                # (#343). In a guest we can't see the host's SMT scheduling; on
+                # scheduling, so it can't be determined from inside the guest (#343).
-                # dom0/bare metal the local SMT state is authoritative, so trust
+                pvulnstatus "$cve" UNK "TAA is mitigated and TSX is disabled, but SMT (Hyper-Threading) cross-thread protection can't be verified from inside a VM guest: it depends on the hypervisor host's SMT/core-scheduling configuration"
-                # it there.
-                if is_running_as_guest; then
-                    pvulnstatus "$cve" UNK "TAA is mitigated and TSX is disabled, but SMT (Hyper-Threading) cross-thread protection can't be verified from inside a VM guest: it depends on the hypervisor host's SMT/core-scheduling configuration"
-                elif is_cpu_smt_enabled; then
-                    pvulnstatus "$cve" VULN "SMT (HyperThreading) must be disabled for full mitigation"
-                else
-                    pvulnstatus "$cve" "$status" "$msg"
-                fi
             else
                 pvulnstatus "$cve" "$status" "$msg"
             fi