toyos-cpuvuln: Linux's speculation verdicts and mitigation choice, pure (S1)

Cargo.toml

@@ -23,6 +23,7 @@ members = [
     "toyos-blockhold",
     "toyos-blockring",
     "toyos-bootmap",
+    "toyos-cpuvuln",
     "toyos-desktop",
     "toyos-dns",
     "toyos-dma",

issues/build/no-nightly-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md

@@ -0,0 +1,21 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# No nightly runner has had its CPUID and vulnerability lines captured
+
+`toyos-cpuvuln`'s `fixtures/awaiting-capture/` holds the lines this crate
+reads out of the pinned Linux for an EPYC Milan and an EPYC Turin as KVM
+guests, from bare-metal CPUID dumps with the hypervisor bit set. Which bits
+KVM passes through, whether it enumerates `ARCH_CAPABILITIES`, and whether the
+host's microcode gives `IBPB_BRTYPE` are guesses there. In nightly run
+36496779560 the 14 KVM shards ran on EPYC 7763 (11), 9V74 (2) and 9V45 (1),
+each as `-cpu host,+rdrand,+smap,+fsgsbase,+x2apic,+smep` with `-smp cores=N`.
+
+**Exit**: a nightly step boots the pinned Linux under that command line on
+the runner and records CPUID leaves 0, 1, 7.0, 7.2, 0x80000000, 0x80000008 and
+0x80000021, MSR 0x10A where enumerated, the microcode revision, and `grep .` over
+`/sys/devices/system/cpu/vulnerabilities/`; the two fixtures are replaced by
+what it records, and one is added per CPU model it meets.

issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md

@@ -18,7 +18,7 @@ Pull request #601 holds it. Ubuntu leaves the T14 only after this issue and
 close.
 
 **Exit**: both captures committed, and no Linux image; before the wipe the
-T14's adds CPUID 5, 0x19 and 0x80000001, MSR 0xCF, the split-lock line, and
+T14's adds CPUID 5, 0x19 and 0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the split-lock line, and
 the config's `X86_KERNEL_IBT` and `X86_INTEL_MEMORY_PROTECTION_KEYS`.
 **Mutation**: a config hash off by one byte is refused. **Oracle**: that
 Linux.

issues/kernel/the-speculation-decision-does-not-model-an-affected-cpus-l1tf-line.md

@@ -0,0 +1,32 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# The speculation decision does not model an affected CPU's l1tf line
+
+`toyos_cpuvuln::Decision::line` answers `Unmodelled::L1tf` for a CPU with
+`X86_BUG_L1TF`, because at `Ubuntu-6.8.0-142.142` that line rests on two
+things `Facts` does not carry:
+
+- **Whether RAM lies above `MAX_PA/2`**: `l1tf_select_mitigation` sets
+  `L1TF_PTEINV` only if no e820 RAM range reaches `l1tf_pfn_limit()`
+  (`bugs.c:2571-2583`; `asm/processor.h:217`), which is `x86_cache_bits` (CPUID 0x80000008:EAX,
+  raised to 44 for the models `override_cache_bits` names, `bugs.c:2513-2536`)
+  against the firmware's memory map. Without `L1TF_PTEINV` the line is
+  "Vulnerable" (`bugs.c:3330-3333,3376`).
+- **`kvm_intel`'s `l1tf_vmx_mitigation`**: the line's `VMX:` part is
+  `VMENTER_L1D_FLUSH_AUTO` until `kvm_intel` loads (`bugs.c:3074-3089`), a
+  module Linux's userspace loads, not a CPU fact.
+
+The first is readable by the kernel (the loader's memory map, CPUID); the
+second has no counterpart in a kernel that runs no VM, so parity needs a ruling
+on which `VMX:` state ToyOS is held to.
+
+No machine ToyOS is tested on reaches it: the T14 has `RDCL_NO`, and the TCG
+model and the nightly's KVM runners are AMD.
+
+**Exit**: the line is decided from the memory map and CPUID and the owner's
+`VMX:` ruling, and held by a fixture captured under the pinned Linux on such a
+CPU.

toyos-cpuvuln/Cargo.toml

@@ -0,0 +1,9 @@
+# A member of the host workspace (root `Cargo.toml`):
+# `no_std` so the kernel can depend on it by path, and its tests run on the host.
+
+[package]
+name = "toyos-cpuvuln"
+description = "Linux's verdict on each speculative-execution vulnerability and its mitigation choice, from a CPU's CPUID and MSR facts, pure."
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"

toyos-cpuvuln/fixtures/awaiting-capture/milan-kvm.txt

@@ -0,0 +1,17 @@
+/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Not affected
+/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
+/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
+/sys/devices/system/cpu/vulnerabilities/mds:Not affected
+/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
+/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
+/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Vulnerable: Safe RET, no microcode
+/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
+/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
+/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; IBPB: conditional; IBRS_FW; STIBP: disabled; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected
+/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsa:Vulnerable: Clear CPU buffers attempted, no microcode
+/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
+/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected

toyos-cpuvuln/fixtures/awaiting-capture/turin-kvm.txt

@@ -0,0 +1,17 @@
+/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Not affected
+/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
+/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
+/sys/devices/system/cpu/vulnerabilities/mds:Not affected
+/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
+/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
+/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
+/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
+/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced / Automatic IBRS; IBPB: conditional; STIBP: disabled; PBRSB-eIBRS: Not affected; BHI: Not affected
+/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsa:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
+/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected

toyos-cpuvuln/fixtures/t14.txt

@@ -0,0 +1,17 @@
+/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Mitigation: Microcode
+/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Mitigation: Aligned branch/return thunks
+/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
+/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
+/sys/devices/system/cpu/vulnerabilities/mds:Not affected
+/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
+/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
+/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
+/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
+/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced / Automatic IBRS; IBPB: conditional; PBRSB-eIBRS: SW sequence; BHI: SW loop, KVM: SW loop
+/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsa:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
+/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected

toyos-cpuvuln/fixtures/tcg.txt

@@ -0,0 +1,17 @@
+/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Not affected
+/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
+/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
+/sys/devices/system/cpu/vulnerabilities/mds:Not affected
+/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
+/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
+/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
+/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected
+/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected
+/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
+/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; STIBP: disabled; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected
+/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsa:Not affected
+/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
+/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected