From 385405448a4a6bac9d8185e1929a713ddd29df0b Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 1 Oct 2026 14:06:55 +0200 Subject: [PATCH 1/2] The T14's and the TCG model's Linux captures are fixtures; two #556 issues carried toyos-cpuvuln/fixtures/t14/ and tcg/ are pull request #601's toyos-t14linux/s0/t14/ and s0/tcg/ at 44eb3c2e, byte for byte: each of the 14 files carries its source's git blob ID. The fifteenth, s0/t14/vulnerabilities.txt, is blob 15ba1120, which main already holds as toyos-cpuvuln/fixtures/t14.txt, so it is not carried twice and t14/SOURCE names where it is. toyos-cpuvuln/fixtures/tcg.txt is console.txt's lines 379-395 without their CRs (cmp exit 0). #601's capture.sh and tcg.sh are not carried (no shell of our own), nor its toyos-t14linux reader. Provenance, read off the branch and the bytes: capture.sh ran as root on the T14 under its Ubuntu (#601's body: exit 0). tcg.sh booted the kernel and busybox initramfs that run copied off the T14, under QEMU 11.1.1 on the development host, at 2026-09-29 06:50:37 UTC by the guest's RTC (console.txt's `PM: RTC time` line), so the T14 run came first. Both were committed at 2026-09-29 06:58:16 UTC (44eb3c2e). Each directory's SOURCE carries this, as toyos-acpi/fixtures/*/SOURCE does for its captures. No digest row: src/sourcegate.rs's every_committed_binary_file_is_declared holds to COMMITTED_FILES only a file with a NUL in its first 8000 bytes or one under assets/, and these hold no NUL. console.txt keeps the CRLF line ends the serial port wrote; the tree has no .gitattributes and core.autocrlf is unset, so git stores them as they are. issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md narrows to what the capture lacks: cpuid.txt's 12 leaves hold no 5, 0x19 or 0x80000001; msr.txt reads 0x8B, 0x48, 0x10A and 0x123 and no 0xCF or 0x3A; kernel-log.txt's filter matches no split-lock line; and config-hardening.txt's grep names neither X86_KERNEL_IBT nor X86_INTEL_MEMORY_PROTECTION_KEYS. Nothing reads config-sha256.txt, so the mutation is still owed. "Pull request #601 holds it" goes with #601, and with nobody holding it the status is open. From #556 (wt/toyos-release at d30dfff3), each re-read against main: - the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from: still true. volume_handle (bootloader/src/loaderlog.rs:80-102) takes the first filesystem on any handle whose GPT unique GUID matches, and loaderlog::open and attempt.rs write through it; src/image.rs:240-243 draws every unique GUID once per image. The image release, its notes and the TOYOS-DATA clause they needed are not on main and go. Stage 2 of issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md already owns the fix ("loaderlog::volume_handle's machine-wide first match goes"), so the defect names its owner there, as the arm64 track's defects do. - the-toolchain-install-unpacks-an-asset-no-digest-vouches-for: still true. release::install (src/release.rs:107-160) checks nothing of the tarball's bytes, the tag hashes trees(), and the toyos-sysroot-witness check_installed_toolchain holds an install to is a file inside the tarball. nightly.yml's build job has contents: write and runs `--ci toolchain` with GH_TOKEN, which the bootstrap it starts inherits; the repository's default workflow token is read-only (`gh api repos/ToyOSOrg/ToyOS/actions/permissions/workflow`: "read"), so no other nightly job writes. The image release's boot and publish jobs are not on main and go. - the-kernel-dies-at-boot-on-the-edk2-firmware-qemu-ships: dropped, no longer true. #563 (51fe14c1a) made the kernel boot on Homebrew QEMU 11.1.1's edk2 and names this panic as what it fixed. Since dfe61e503 every harness boot takes its firmware from src/firmware.rs, which that commit measured resolving x86_64 on Homebrew QEMU 11.1.1 to 60-edk2-x86_64.json, whose pair (edk2-x86_64-code.fd, edk2-i386-vars.fd) is the one the issue names. Its exit's release_command_boots and src/redlist.rs are gone from main too. #556's release-badge issue is not carried, as the triage said. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L --- ...its-log-guid-not-the-one-it-booted-from.md | 24 ++ ...-unpacks-an-asset-no-digest-vouches-for.md | 25 ++ ...t14-and-the-tcg-model-are-not-committed.md | 8 +- toyos-cpuvuln/fixtures/t14/SOURCE | 21 + toyos-cpuvuln/fixtures/t14/cmdline.txt | 1 + .../fixtures/t14/config-hardening.txt | 41 ++ toyos-cpuvuln/fixtures/t14/config-sha256.txt | 1 + toyos-cpuvuln/fixtures/t14/cpuid.txt | 12 + toyos-cpuvuln/fixtures/t14/cpuinfo.txt | 224 ++++++++++ toyos-cpuvuln/fixtures/t14/dmi.txt | 8 + toyos-cpuvuln/fixtures/t14/kernel-log.txt | 10 + toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt | 1 + toyos-cpuvuln/fixtures/t14/msr.txt | 32 ++ toyos-cpuvuln/fixtures/t14/packages.txt | 2 + toyos-cpuvuln/fixtures/t14/uname.txt | 1 + toyos-cpuvuln/fixtures/t14/version.txt | 1 + toyos-cpuvuln/fixtures/tcg/SOURCE | 17 + toyos-cpuvuln/fixtures/tcg/console.txt | 397 ++++++++++++++++++ toyos-cpuvuln/fixtures/tcg/qemu-version.txt | 2 + 19 files changed, 824 insertions(+), 4 deletions(-) create mode 100644 issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md create mode 100644 issues/build/the-toolchain-install-unpacks-an-asset-no-digest-vouches-for.md create mode 100644 toyos-cpuvuln/fixtures/t14/SOURCE create mode 100644 toyos-cpuvuln/fixtures/t14/cmdline.txt create mode 100644 toyos-cpuvuln/fixtures/t14/config-hardening.txt create mode 100644 toyos-cpuvuln/fixtures/t14/config-sha256.txt create mode 100644 toyos-cpuvuln/fixtures/t14/cpuid.txt create mode 100644 toyos-cpuvuln/fixtures/t14/cpuinfo.txt create mode 100644 toyos-cpuvuln/fixtures/t14/dmi.txt create mode 100644 toyos-cpuvuln/fixtures/t14/kernel-log.txt create mode 100644 toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt create mode 100644 toyos-cpuvuln/fixtures/t14/msr.txt create mode 100644 toyos-cpuvuln/fixtures/t14/packages.txt create mode 100644 toyos-cpuvuln/fixtures/t14/uname.txt create mode 100644 toyos-cpuvuln/fixtures/t14/version.txt create mode 100644 toyos-cpuvuln/fixtures/tcg/SOURCE create mode 100644 toyos-cpuvuln/fixtures/tcg/console.txt create mode 100644 toyos-cpuvuln/fixtures/tcg/qemu-version.txt diff --git a/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md b/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md new file mode 100644 index 00000000000..2206dd17513 --- /dev/null +++ b/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md @@ -0,0 +1,24 @@ +--- +status: open +kind: defect +opened: 2026-09-27 +--- + +# The loader writes the first disk carrying its log GUID, not the one it booted from + +`loaderlog::volume_handle` (`bootloader/src/loaderlog.rs`) takes the first +filesystem on the machine whose GPT partition's unique GUID is the log +partition's, and `loader.log` and the attempt records are written there. +`src/image.rs` draws every unique GUID once per image, so every stick written +from one image carries the same ones. With two such sticks plugged in, the +loader can write the log partition of the stick it did not boot from: a disk +it was not given. + +Owned by stage 2 of +`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`, +which finds every volume the loader opens on the boot disk. + +**Exit condition.** The loader writes only the device it booted from: the log +volume is looked up on the device of the loaded image's own handle, and a boot +with two copies of one image attached writes the other copy's bytes not at +all. diff --git a/issues/build/the-toolchain-install-unpacks-an-asset-no-digest-vouches-for.md b/issues/build/the-toolchain-install-unpacks-an-asset-no-digest-vouches-for.md new file mode 100644 index 00000000000..3d2f5285f42 --- /dev/null +++ b/issues/build/the-toolchain-install-unpacks-an-asset-no-digest-vouches-for.md @@ -0,0 +1,25 @@ +--- +status: open +kind: tooling +opened: 2026-09-28 +--- + +# The toolchain install unpacks an asset no digest vouches for + +`release::install` (`src/release.rs`) downloads the `toyos-toolchain.tar.zst` +asset of the release its tree's tag names, unpacks it into `rust/build` and +links it as rustup's `toyos`, and checks nothing about its bytes: the tag is +the hash of the tarball's inputs (`trees`), not of the tarball, and the +`toyos-sysroot-witness` an installed toolchain is held to comes inside it. +Every guest job compiles and boots with what it installs. + +A job holding this repository's `contents: write` token can replace a +release asset, so any code such a job runs can replace the toolchain every +later job installs. The nightly's `build` job holds that token while it +bootstraps the toolchain. + +Owner: the release module (`src/release.rs`). + +**Exit condition.** `install` unpacks only an asset whose SHA-256 is one that +no job holding a write token can rewrite — committed to the tree it installs +for — and refuses any other by name. diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md index d1b5db93f37..69cd54e8ebb 100644 --- a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md +++ b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md @@ -1,5 +1,5 @@ --- -status: assigned +status: open kind: tooling opened: 2026-09-29 --- @@ -13,12 +13,12 @@ is tag `Ubuntu-6.8.0-142.142` (53e5d07aac028a1523ab0b115f079d6d1bc831ef) of config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890, and what it reads on the T14 and on the PR gate's TCG model are the fixtures of `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`. -Pull request #601 holds it. Ubuntu leaves the T14 only after this issue and +Ubuntu leaves the T14 only after this issue and `issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md` close. -**Exit**: both captures committed, and no Linux image; before the wipe the -T14's adds CPUID 5, 0x19 and 0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the split-lock line, and +**Exit**: before the wipe `toyos-cpuvuln/fixtures/t14/` +adds CPUID 5, 0x19 and 0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the split-lock line, and the config's `X86_KERNEL_IBT` and `X86_INTEL_MEMORY_PROTECTION_KEYS`. **Mutation**: a config hash off by one byte is refused. **Oracle**: that Linux. diff --git a/toyos-cpuvuln/fixtures/t14/SOURCE b/toyos-cpuvuln/fixtures/t14/SOURCE new file mode 100644 index 00000000000..7c87d32831d --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/SOURCE @@ -0,0 +1,21 @@ +Linux's readings of the ThinkPad T14 this repository is tested on, under that +machine's Ubuntu, read as root on the T14 by `toyos-t14linux/capture.sh` at +commit 44eb3c2e (pull request #601) before 06:50 UTC on 2026-09-29, when +../tcg/ booted the kernel and initramfs the same run copied off the T14. The +script ran only where /proc/version named 6.8.0-142-generic, both packages +were 6.8.0-142.142 and the config's sha256 was config-sha256.txt's, and it read +CPUID and the MSRs through the running kernel's /dev/cpu/*/cpuid and +/dev/cpu/*/msr, so an MSR holds what that kernel left in it. + + vulnerabilities.txt the run's `grep .` over the vulnerabilities directory, + committed as ../t14.txt + cpuid.txt CPU 0's leaves, one per line: + leaf subleaf eax ebx ecx edx + msr.txt one per line: msr cpu value; 0x122 and 0x10F are absent + because ARCH_CAPABILITIES bit 7 and CPUID.(7,0):EDX + bits 11 and 13 do not enumerate them + config-hardening.txt `grep -n` of the config for the options the script + names, so an option it did not name is absent, not unset + kernel-log.txt this boot's kernel lines from the journal that match, in + any case, mitigat, vulnerab, not affected, spectre, + microcode, x86/bugs or tsx, and no other diff --git a/toyos-cpuvuln/fixtures/t14/cmdline.txt b/toyos-cpuvuln/fixtures/t14/cmdline.txt new file mode 100644 index 00000000000..52137704fca --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/cmdline.txt @@ -0,0 +1 @@ +BOOT_IMAGE=/vmlinuz-6.8.0-142-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro diff --git a/toyos-cpuvuln/fixtures/t14/config-hardening.txt b/toyos-cpuvuln/fixtures/t14/config-hardening.txt new file mode 100644 index 00000000000..8c1cfb44cf6 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/config-hardening.txt @@ -0,0 +1,41 @@ +124:CONFIG_BPF_JIT_ALWAYS_ON=y +318:CONFIG_KEXEC_SIG=y +493:CONFIG_X86_UMIP=y +498:CONFIG_X86_INTEL_TSX_MODE_OFF=y +502:CONFIG_X86_USER_SHADOW_STACK=y +528:CONFIG_RANDOMIZE_BASE=y +532:CONFIG_RANDOMIZE_MEMORY=y +536:CONFIG_LEGACY_VSYSCALL_XONLY=y +554:CONFIG_CPU_MITIGATIONS=y +556:CONFIG_MITIGATION_RETPOLINE=y +557:CONFIG_MITIGATION_RETHUNK=y +564:CONFIG_SLS=y +566:CONFIG_MITIGATION_RFDS=y +567:CONFIG_MITIGATION_SPECTRE_BHI=y +568:CONFIG_MITIGATION_ITS=y +569:CONFIG_MITIGATION_TSA=y +570:CONFIG_MITIGATION_VMSCAPE=y +882:CONFIG_STACKPROTECTOR_STRONG=y +909:CONFIG_ARCH_MMAP_RND_BITS=32 +930:CONFIG_VMAP_STACK=y +933:CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y +935:CONFIG_STRICT_KERNEL_RWX=y +937:CONFIG_STRICT_MODULE_RWX=y +982:CONFIG_MODULE_SIG=y +1132:CONFIG_SLAB_FREELIST_RANDOM=y +1133:CONFIG_SLAB_FREELIST_HARDENED=y +1136:CONFIG_RANDOM_KMALLOC_CACHES=y +1139:CONFIG_SHUFFLE_PAGE_ALLOCATOR=y +2457:CONFIG_RESET_ATTACK_MITIGATION=y +9892:CONFIG_INTEL_IOMMU_DEFAULT_ON=y +11376:CONFIG_HARDENED_USERCOPY=y +11377:CONFIG_FORTIFY_SOURCE=y +11473:CONFIG_INIT_STACK_ALL_ZERO=y +11474:CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +11477:CONFIG_ZERO_CALL_USED_REGS=y +12040:CONFIG_UBSAN_BOUNDS=y +12042:CONFIG_UBSAN_SHIFT=y +12044:CONFIG_UBSAN_BOOL=y +12045:CONFIG_UBSAN_ENUM=y +12074:CONFIG_DEBUG_WX=y +12084:CONFIG_SCHED_STACK_END_CHECK=y diff --git a/toyos-cpuvuln/fixtures/t14/config-sha256.txt b/toyos-cpuvuln/fixtures/t14/config-sha256.txt new file mode 100644 index 00000000000..0b5f4afd73b --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/config-sha256.txt @@ -0,0 +1 @@ +3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890 /boot/config-6.8.0-142-generic diff --git a/toyos-cpuvuln/fixtures/t14/cpuid.txt b/toyos-cpuvuln/fixtures/t14/cpuid.txt new file mode 100644 index 00000000000..b4e53c2bb94 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/cpuid.txt @@ -0,0 +1,12 @@ +00000000 00000000 0000001b 756e6547 6c65746e 49656e69 +00000001 00000000 000806c1 00100800 7ffafbbf bfebfbff +00000006 00000000 0017eff7 00000002 00000009 00000000 +00000007 00000000 00000002 f3bfa7eb 18c05fde fc100710 +00000007 00000001 00000000 00000000 00000000 00040000 +00000007 00000002 00000000 00000000 00000000 00000001 +0000000d 00000000 000002e7 00000a88 00000a88 00000000 +0000000d 00000001 0000000f 00000998 00003900 00000000 +00000014 00000000 00000001 0000004f 00000007 00000000 +80000000 00000000 80000008 00000000 00000000 00000000 +80000008 00000000 00003027 00000000 00000000 00000000 +80000021 00000000 00000000 00000000 00000000 00000000 diff --git a/toyos-cpuvuln/fixtures/t14/cpuinfo.txt b/toyos-cpuvuln/fixtures/t14/cpuinfo.txt new file mode 100644 index 00000000000..15a6d57f5f3 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/cpuinfo.txt @@ -0,0 +1,224 @@ +processor : 0 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 627.581 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 0 +cpu cores : 4 +apicid : 0 +initial apicid : 0 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 1 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 855.097 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 1 +cpu cores : 4 +apicid : 2 +initial apicid : 2 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 2 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 3282.151 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 2 +cpu cores : 4 +apicid : 4 +initial apicid : 4 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 3 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 615.767 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 3 +cpu cores : 4 +apicid : 6 +initial apicid : 6 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 4 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 399.863 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 0 +cpu cores : 4 +apicid : 1 +initial apicid : 1 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 5 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 3673.333 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 1 +cpu cores : 4 +apicid : 3 +initial apicid : 3 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 6 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 3800.000 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 2 +cpu cores : 4 +apicid : 5 +initial apicid : 5 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + +processor : 7 +vendor_id : GenuineIntel +cpu family : 6 +model : 140 +model name : 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz +stepping : 1 +microcode : 0xbe +cpu MHz : 3162.755 +cache size : 8192 KB +physical id : 0 +siblings : 8 +core id : 3 +cpu cores : 4 +apicid : 7 +initial apicid : 7 +fpu : yes +fpu_exception : yes +cpuid level : 27 +wp : yes +flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req vnmi avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities +vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling +bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb gds bhi its its_native_only +bogomips : 4838.40 +clflush size : 64 +cache_alignment : 64 +address sizes : 39 bits physical, 48 bits virtual +power management: + diff --git a/toyos-cpuvuln/fixtures/t14/dmi.txt b/toyos-cpuvuln/fixtures/t14/dmi.txt new file mode 100644 index 00000000000..8f2ed5f08dd --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/dmi.txt @@ -0,0 +1,8 @@ +/sys/class/dmi/id/bios_date:05/09/2026 +/sys/class/dmi/id/bios_release:1.71 +/sys/class/dmi/id/bios_vendor:LENOVO +/sys/class/dmi/id/bios_version:N34ET71W (1.71 ) +/sys/class/dmi/id/ec_firmware_release:1.46 +/sys/class/dmi/id/sys_vendor:LENOVO +/sys/class/dmi/id/product_name:20W0003AMZ +/sys/class/dmi/id/product_version:ThinkPad T14 Gen 2i diff --git a/toyos-cpuvuln/fixtures/t14/kernel-log.txt b/toyos-cpuvuln/fixtures/t14/kernel-log.txt new file mode 100644 index 00000000000..8214d7a89ab --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/kernel-log.txt @@ -0,0 +1,10 @@ +Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +Spectre V2 : Spectre BHI mitigation: SW BHB clearing on vm exit +Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall +Spectre V2 : Mitigation: Enhanced / Automatic IBRS +Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT +Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier +Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl +GDS: Mitigation: Microcode +ITS: Mitigation: Aligned branch/return thunks +microcode: Current revision: 0x000000be diff --git a/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt b/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt new file mode 100644 index 00000000000..11a4111dcd8 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt @@ -0,0 +1 @@ +vm.mmap_rnd_bits = 32 diff --git a/toyos-cpuvuln/fixtures/t14/msr.txt b/toyos-cpuvuln/fixtures/t14/msr.txt new file mode 100644 index 00000000000..3fb193cb6b1 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/msr.txt @@ -0,0 +1,32 @@ +0000008b 0 000000be00000000 +0000008b 1 000000be00000000 +0000008b 2 000000be00000000 +0000008b 3 000000be00000000 +0000008b 4 000000be00000000 +0000008b 5 000000be00000000 +0000008b 6 000000be00000000 +0000008b 7 000000be00000000 +00000048 0 0000000000000001 +00000048 1 0000000000000001 +00000048 2 0000000000000001 +00000048 3 0000000000000001 +00000048 4 0000000000000001 +00000048 5 0000000000000001 +00000048 6 0000000000000001 +00000048 7 0000000000000001 +0000010a 0 000000000a005c6b +0000010a 1 000000000a005c6b +0000010a 2 000000000a005c6b +0000010a 3 000000000a005c6b +0000010a 4 000000000a005c6b +0000010a 5 000000000a005c6b +0000010a 6 000000000a005c6b +0000010a 7 000000000a005c6b +00000123 0 0000000000000000 +00000123 1 0000000000000000 +00000123 2 0000000000000000 +00000123 3 0000000000000000 +00000123 4 0000000000000000 +00000123 5 0000000000000000 +00000123 6 0000000000000000 +00000123 7 0000000000000000 diff --git a/toyos-cpuvuln/fixtures/t14/packages.txt b/toyos-cpuvuln/fixtures/t14/packages.txt new file mode 100644 index 00000000000..94d1f206ef8 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/packages.txt @@ -0,0 +1,2 @@ +linux-image-6.8.0-142-generic 6.8.0-142.142 +linux-modules-6.8.0-142-generic 6.8.0-142.142 diff --git a/toyos-cpuvuln/fixtures/t14/uname.txt b/toyos-cpuvuln/fixtures/t14/uname.txt new file mode 100644 index 00000000000..f57a77638b8 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/uname.txt @@ -0,0 +1 @@ +Linux t14 6.8.0-142-generic #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux diff --git a/toyos-cpuvuln/fixtures/t14/version.txt b/toyos-cpuvuln/fixtures/t14/version.txt new file mode 100644 index 00000000000..2ea613b2747 --- /dev/null +++ b/toyos-cpuvuln/fixtures/t14/version.txt @@ -0,0 +1 @@ +Linux version 6.8.0-142-generic (buildd@lcy02-amd64-049) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 diff --git a/toyos-cpuvuln/fixtures/tcg/SOURCE b/toyos-cpuvuln/fixtures/tcg/SOURCE new file mode 100644 index 00000000000..03d429eb5e9 --- /dev/null +++ b/toyos-cpuvuln/fixtures/tcg/SOURCE @@ -0,0 +1,17 @@ +The same Linux on the TCG model, booted on the development host by +`toyos-t14linux/tcg.sh` at commit 44eb3c2e (pull request #601) at 06:50 UTC on +2026-09-29, the time console.txt's RTC lines read, under QEMU 11.1.1 +(qemu-version.txt) as + + qemu-system-x86_64 -nodefaults -machine q35 + -cpu qemu64,+rdrand,+smap,+fsgsbase,+x2apic,+smep -smp 2 -m 4G + -kernel vmlinuz-6.8.0-142-generic -initrd s0.cpio + -append "console=ttyS0 panic=-1" -serial stdio -display none -no-reboot + +The kernel is the T14's /boot/vmlinuz-6.8.0-142-generic, and s0.cpio is the +T14's busybox with an init that mounts sysfs and proc, prints /proc/version and +`grep .` over /sys/devices/system/cpu/vulnerabilities/*, and powers off. Both +came off the T14 in the run that took ../t14/, and neither is committed. + + console.txt the serial port, CRLF as it arrived; ../tcg.txt is its + vulnerability lines without the CRs diff --git a/toyos-cpuvuln/fixtures/tcg/console.txt b/toyos-cpuvuln/fixtures/tcg/console.txt new file mode 100644 index 00000000000..937d5c44eed --- /dev/null +++ b/toyos-cpuvuln/fixtures/tcg/console.txt @@ -0,0 +1,397 @@ +[ 0.000000] Linux version 6.8.0-142-generic (buildd@lcy02-amd64-049) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 (Ubuntu 6.8.0-142.142-generic 6.8.12) +[ 0.000000] Command line: console=ttyS0 panic=-1 +[ 0.000000] KERNEL supported cpus: +[ 0.000000] Intel GenuineIntel +[ 0.000000] AMD AuthenticAMD +[ 0.000000] Hygon HygonGenuine +[ 0.000000] Centaur CentaurHauls +[ 0.000000] zhaoxin Shanghai +[ 0.000000] BIOS-provided physical RAM map: +[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable +[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved +[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff] usable +[ 0.000000] BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved +[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved +[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000017fffffff] usable +[ 0.000000] BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] reserved +[ 0.000000] NX (Execute Disable) protection: active +[ 0.000000] APIC: Static calls initialized +[ 0.000000] SMBIOS 2.8 present. +[ 0.000000] DMI: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 +[ 0.000000] tsc: Fast TSC calibration using PIT +[ 0.000000] tsc: Detected 999.836 MHz processor +[ 0.004886] AGP: No AGP bridge found +[ 0.005065] last_pfn = 0x180000 max_arch_pfn = 0x400000000 +[ 0.005607] MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs +[ 0.005782] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT +[ 0.006657] last_pfn = 0x7ffe0 max_arch_pfn = 0x400000000 +[ 0.024253] found SMP MP-table at [mem 0x000f54c0-0x000f54cf] +[ 0.028424] RAMDISK: [mem 0x7fdd9000-0x7ffdffff] +[ 0.028890] ACPI: Early table checksum verification disabled +[ 0.029267] ACPI: RSDP 0x00000000000F52C0 000014 (v00 BOCHS ) +[ 0.029509] ACPI: RSDT 0x000000007FFE232F 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030048] ACPI: FACP 0x000000007FFE211F 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030562] ACPI: DSDT 0x000000007FFE0040 0020DF (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030642] ACPI: FACS 0x000000007FFE0000 000040 +[ 0.030685] ACPI: APIC 0x000000007FFE2213 000080 (v03 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030709] ACPI: HPET 0x000000007FFE2293 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030732] ACPI: MCFG 0x000000007FFE22CB 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030753] ACPI: WAET 0x000000007FFE2307 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.030827] ACPI: Reserving FACP table memory at [mem 0x7ffe211f-0x7ffe2212] +[ 0.030849] ACPI: Reserving DSDT table memory at [mem 0x7ffe0040-0x7ffe211e] +[ 0.030858] ACPI: Reserving FACS table memory at [mem 0x7ffe0000-0x7ffe003f] +[ 0.030865] ACPI: Reserving APIC table memory at [mem 0x7ffe2213-0x7ffe2292] +[ 0.030871] ACPI: Reserving HPET table memory at [mem 0x7ffe2293-0x7ffe22ca] +[ 0.030877] ACPI: Reserving MCFG table memory at [mem 0x7ffe22cb-0x7ffe2306] +[ 0.030884] ACPI: Reserving WAET table memory at [mem 0x7ffe2307-0x7ffe232e] +[ 0.154458] No NUMA configuration found +[ 0.154525] Faking a node at [mem 0x0000000000000000-0x000000017fffffff] +[ 0.155066] NODE_DATA(0) allocated [mem 0x17ffd3000-0x17fffdfff] +[ 0.174522] Zone ranges: +[ 0.174584] DMA [mem 0x0000000000001000-0x0000000000ffffff] +[ 0.174670] DMA32 [mem 0x0000000001000000-0x00000000ffffffff] +[ 0.174683] Normal [mem 0x0000000100000000-0x000000017fffffff] +[ 0.174694] Device empty +[ 0.174715] Movable zone start for each node +[ 0.174741] Early memory node ranges +[ 0.174767] node 0: [mem 0x0000000000001000-0x000000000009efff] +[ 0.174881] node 0: [mem 0x0000000000100000-0x000000007ffdffff] +[ 0.174912] node 0: [mem 0x0000000100000000-0x000000017fffffff] +[ 0.175044] Initmem setup node 0 [mem 0x0000000000001000-0x000000017fffffff] +[ 0.214952] On node 0, zone DMA: 1 pages in unavailable ranges +[ 0.259966] On node 0, zone DMA: 97 pages in unavailable ranges +[ 0.306778] On node 0, zone Normal: 32 pages in unavailable ranges +[ 0.307281] ACPI: PM-Timer IO Port: 0x608 +[ 0.307692] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) +[ 0.308416] IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23 +[ 0.308662] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) +[ 0.309271] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) +[ 0.309442] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) +[ 0.309654] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) +[ 0.309704] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) +[ 0.310323] ACPI: Using ACPI (MADT) for SMP configuration information +[ 0.310428] ACPI: HPET id: 0x8086a201 base: 0xfed00000 +[ 0.310980] smpboot: Allowing 2 CPUs, 0 hotplug CPUs +[ 0.316917] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff] +[ 0.317049] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x000fffff] +[ 0.317077] PM: hibernation: Registered nosave memory: [mem 0x7ffe0000-0xffffffff] +[ 0.317271] [mem 0xc0000000-0xfed1bfff] available for PCI devices +[ 0.317395] Booting paravirtualized kernel on bare hardware +[ 0.317906] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns +[ 0.319350] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:2 nr_cpu_ids:2 nr_node_ids:1 +[ 0.320845] percpu: Embedded 86 pages/cpu s229376 r8192 d114688 u1048576 +[ 0.322058] Kernel command line: console=ttyS0 panic=-1 +[ 0.323259] random: crng init done +[ 0.324244] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes, linear) +[ 0.324711] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes, linear) +[ 0.326959] Fallback order for Node 0: 0 +[ 0.327327] Built 1 zonelists, mobility grouping on. Total pages: 1031904 +[ 0.327359] Policy zone: Normal +[ 0.327762] mem auto-init: stack:all(zero), heap alloc:on, heap free:off +[ 0.327875] AGP: Checking aperture... +[ 0.328781] AGP: No AGP bridge found +[ 0.329278] software IO TLB: area num 2. +[ 0.422990] Memory: 3998584K/4193784K available (22528K kernel code, 4441K rwdata, 14428K rodata, 4932K init, 4776K bss, 194940K reserved, 0K cma-reserved) +[ 0.431908] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 +[ 0.433784] ftrace: allocating 58336 entries in 228 pages +[ 0.483521] ftrace: allocated 228 pages with 4 groups +[ 0.501299] Dynamic Preempt: voluntary +[ 0.504172] rcu: Preemptible hierarchical RCU implementation. +[ 0.504225] rcu: RCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=2. +[ 0.504308] Trampoline variant of Tasks RCU enabled. +[ 0.504316] Rude variant of Tasks RCU enabled. +[ 0.504322] Tracing variant of Tasks RCU enabled. +[ 0.504424] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies. +[ 0.504447] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2 +[ 0.505387] RCU Tasks: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2. +[ 0.505417] RCU Tasks Rude: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2. +[ 0.505429] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2. +[ 0.526178] NR_IRQS: 524544, nr_irqs: 440, preallocated irqs: 16 +[ 0.572828] rcu: srcu_init: Setting srcu_struct sizes based on contention. +[ 0.605074] Console: colour *CGA 80x25 +[ 0.607687] printk: legacy console [ttyS0] enabled +[ 0.646169] ACPI: Core revision 20230628 +[ 0.666704] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns +[ 0.672419] APIC: Switch to symmetric I/O mode setup +[ 0.673423] x2apic: IRQ remapping doesn't support X2APIC mode +[ 0.677245] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 +[ 0.689734] tsc: Marking TSC unstable due to TSCs unsynchronized +[ 0.690356] Calibrating delay loop (skipped), value calculated using timer frequency.. 1999.67 BogoMIPS (lpj=999836) +[ 0.702762] process: using AMD E400 aware idle routine +[ 0.707552] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 +[ 0.707908] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 +[ 0.710931] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization +[ 0.711667] Spectre V2 : Mitigation: Retpolines +[ 0.712220] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT +[ 0.718397] x86/fpu: x87 FPU will use FXSAVE +[ 0.952113] Freeing SMP alternatives memory: 48K +[ 0.952776] pid_max: default: 32768 minimum: 301 +[ 0.959230] LSM: initializing lsm=lockdown,capability,landlock,yama,apparmor,integrity +[ 0.960113] landlock: Up and running. +[ 0.960113] Yama: becoming mindful. +[ 0.960113] AppArmor: AppArmor initialized +[ 0.967373] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) +[ 0.968113] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes, linear) +[ 1.071113] smpboot: CPU0: AMD QEMU Virtual CPU version 2.5+ (family: 0xf, model: 0x6b, stepping: 0x1) +[ 1.085052] Performance Events: PMU not available due to virtualization, using software events only. +[ 1.086330] signal: max sigframe size: 1440 +[ 1.091252] rcu: Hierarchical SRCU implementation. +[ 1.092554] rcu: Max phase no-delay instances is 400. +[ 1.106550] NMI watchdog: Perf NMI watchdog permanently disabled +[ 1.113447] smp: Bringing up secondary CPUs ... +[ 1.137181] smpboot: x86: Booting SMP configuration: +[ 1.137440] .... node #0, CPUs: #1 +[ 0.098321] calibrate_delay_direct() dropping max bogoMips estimate 3 = 15448800 +[ 0.098321] calibrate_delay_direct() dropping max bogoMips estimate 2 = 4961900 +[ 1.250933] smp: Brought up 1 node, 2 CPUs +[ 1.251113] smpboot: Max logical packages: 1 +[ 1.251194] smpboot: Total of 2 processors activated (4621.07 BogoMIPS) +[ 1.276697] devtmpfs: initialized +[ 1.281448] x86/mm: Memory block size: 128MB +[ 1.287820] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns +[ 1.290317] futex hash table entries: 512 (order: 3, 32768 bytes, linear) +[ 1.296225] pinctrl core: initialized pinctrl subsystem +[ 1.308211] PM: RTC time: 06:50:37, date: 2026-09-29 +[ 1.319113] NET: Registered PF_NETLINK/PF_ROUTE protocol family +[ 1.323443] DMA: preallocated 512 KiB GFP_KERNEL pool for atomic allocations +[ 1.324281] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations +[ 1.324845] DMA: preallocated 512 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations +[ 1.325113] audit: initializing netlink subsys (disabled) +[ 1.327450] audit: type=2000 audit(1790664635.646:1): state=initialized audit_enabled=0 res=1 +[ 1.335113] thermal_sys: Registered thermal governor 'fair_share' +[ 1.335241] thermal_sys: Registered thermal governor 'bang_bang' +[ 1.335824] thermal_sys: Registered thermal governor 'step_wise' +[ 1.335824] thermal_sys: Registered thermal governor 'user_space' +[ 1.335824] thermal_sys: Registered thermal governor 'power_allocator' +[ 1.339267] cpuidle: using governor ladder +[ 1.340410] cpuidle: using governor menu +[ 1.343467] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5 +[ 1.348317] PCI: ECAM [mem 0xb0000000-0xbfffffff] (base 0xb0000000) for domain 0000 [bus 00-ff] +[ 1.349113] PCI: ECAM [mem 0xb0000000-0xbfffffff] reserved as E820 entry +[ 1.351520] PCI: Using configuration type 1 for base access +[ 1.352292] mtrr: your CPUs had inconsistent fixed MTRR settings +[ 1.353704] mtrr: your CPUs had inconsistent variable MTRR settings +[ 1.354044] mtrr: your CPUs had inconsistent MTRRdefType settings +[ 1.354113] mtrr: probably your BIOS does not setup all CPUs. +[ 1.354183] mtrr: corrected configuration. +[ 1.357589] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible. +[ 1.478215] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages +[ 1.478518] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page +[ 1.497179] ACPI: Added _OSI(Module Device) +[ 1.497686] ACPI: Added _OSI(Processor Device) +[ 1.498056] ACPI: Added _OSI(Processor Aggregator Device) +[ 1.597862] ACPI: 1 ACPI AML tables successfully acquired and loaded +[ 1.657113] ACPI: _OSC evaluation for CPUs failed, trying _PDC +[ 1.661394] ACPI: Interpreter enabled +[ 1.663331] ACPI: PM: (supports S0 S3 S4 S5) +[ 1.663820] ACPI: Using IOAPIC for interrupt routing +[ 1.667486] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug +[ 1.667884] PCI: Using E820 reservations for host bridge windows +[ 1.670542] ACPI: Enabled 2 GPEs in block 00 to 3F +[ 1.725455] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) +[ 1.726102] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI EDR HPX-Type3] +[ 1.729113] acpi PNP0A08:00: _OSC: platform does not support [PCIeHotplug LTR DPC] +[ 1.732475] acpi PNP0A08:00: _OSC: OS now controls [SHPCHotplug PME AER PCIeCapability] +[ 1.742113] PCI host bridge to bus 0000:00 +[ 1.743041] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] +[ 1.743378] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] +[ 1.743576] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] +[ 1.743776] pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window] +[ 1.744020] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] +[ 1.744113] pci_bus 0000:00: root bus resource [mem 0x180000000-0x97fffffff window] +[ 1.744481] pci_bus 0000:00: root bus resource [bus 00-ff] +[ 1.749241] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint +[ 1.760477] pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 conventional PCI endpoint +[ 1.761319] pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO +[ 1.762113] pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 conventional PCI endpoint +[ 1.763113] pci 0000:00:1f.2: BAR 4 [io 0xc040-0xc05f] +[ 1.764132] pci 0000:00:1f.2: BAR 5 [mem 0xfebff000-0xfebfffff] +[ 1.765151] pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 conventional PCI endpoint +[ 1.765581] pci 0000:00:1f.3: BAR 4 [io 0x0700-0x073f] +[ 1.772603] ACPI: PCI: Interrupt link LNKA configured for IRQ 10 +[ 1.776494] ACPI: PCI: Interrupt link LNKB configured for IRQ 10 +[ 1.782917] ACPI: PCI: Interrupt link LNKC configured for IRQ 11 +[ 1.785790] ACPI: PCI: Interrupt link LNKD configured for IRQ 11 +[ 1.786912] ACPI: PCI: Interrupt link LNKE configured for IRQ 10 +[ 1.788846] ACPI: PCI: Interrupt link LNKF configured for IRQ 10 +[ 1.789550] ACPI: PCI: Interrupt link LNKG configured for IRQ 11 +[ 1.790150] ACPI: PCI: Interrupt link LNKH configured for IRQ 11 +[ 1.790440] ACPI: PCI: Interrupt link GSIA configured for IRQ 16 +[ 1.790655] ACPI: PCI: Interrupt link GSIB configured for IRQ 17 +[ 1.790858] ACPI: PCI: Interrupt link GSIC configured for IRQ 18 +[ 1.791057] ACPI: PCI: Interrupt link GSID configured for IRQ 19 +[ 1.791113] ACPI: PCI: Interrupt link GSIE configured for IRQ 20 +[ 1.791432] ACPI: PCI: Interrupt link GSIF configured for IRQ 21 +[ 1.792439] ACPI: PCI: Interrupt link GSIG configured for IRQ 22 +[ 1.793113] ACPI: PCI: Interrupt link GSIH configured for IRQ 23 +[ 1.801405] iommu: Default domain type: Translated +[ 1.801491] iommu: DMA domain TLB invalidation policy: lazy mode +[ 1.805653] SCSI subsystem initialized +[ 1.809113] ACPI: bus type USB registered +[ 1.809113] usbcore: registered new interface driver usbfs +[ 1.809113] usbcore: registered new interface driver hub +[ 1.809468] usbcore: registered new device driver usb +[ 1.810952] pps_core: LinuxPPS API ver. 1 registered +[ 1.811196] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti +[ 1.812113] PTP clock support registered +[ 1.813556] EDAC MC: Ver: 3.0.0 +[ 1.837252] NetLabel: Initializing +[ 1.837698] NetLabel: domain hash size = 128 +[ 1.838113] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO +[ 1.839682] NetLabel: unlabeled traffic allowed by default +[ 1.846847] mctp: management component transport protocol core +[ 1.847113] NET: Registered PF_MCTP protocol family +[ 1.847113] PCI: Using ACPI for IRQ routing +[ 1.857442] vgaarb: loaded +[ 1.861113] hpet: 3 channels of 0 reserved for per-cpu timers +[ 1.861397] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0 +[ 1.861645] hpet0: 3 comparators, 64-bit 100.000000 MHz counter +[ 1.868045] clocksource: Switched to clocksource hpet +[ 1.906810] VFS: Disk quotas dquot_6.6.0 +[ 1.908728] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) +[ 1.936455] AppArmor: AppArmor Filesystem Enabled +[ 1.939968] pnp: PnP ACPI init +[ 1.968926] ACPI: IRQ 4 override to edge(!), high(!) +[ 1.969401] system 00:04: [mem 0xb0000000-0xbfffffff window] has been reserved +[ 1.974719] pnp: PnP ACPI: found 5 devices +[ 2.130079] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns +[ 2.132247] NET: Registered PF_INET protocol family +[ 2.134093] IP idents hash table entries: 65536 (order: 7, 524288 bytes, linear) +[ 2.619084] tcp_listen_portaddr_hash hash table entries: 2048 (order: 3, 32768 bytes, linear) +[ 2.625541] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) +[ 2.635134] TCP established hash table entries: 32768 (order: 6, 262144 bytes, linear) +[ 2.635134] TCP bind hash table entries: 32768 (order: 8, 1048576 bytes, linear) +[ 2.637626] TCP: Hash tables configured (established 32768 bind 32768) +[ 2.640016] MPTCP token hash table entries: 4096 (order: 5, 98304 bytes, linear) +[ 2.640953] UDP hash table entries: 2048 (order: 4, 65536 bytes, linear) +[ 2.642151] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes, linear) +[ 2.643612] NET: Registered PF_UNIX/PF_LOCAL protocol family +[ 2.644098] NET: Registered PF_XDP protocol family +[ 2.644369] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] +[ 2.644369] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] +[ 2.644369] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] +[ 2.644369] pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window] +[ 2.645825] pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window] +[ 2.646023] pci_bus 0000:00: resource 9 [mem 0x180000000-0x97fffffff window] +[ 2.646788] PCI: CLS 0 bytes, default 64 +[ 2.647844] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) +[ 2.648047] software IO TLB: mapped [mem 0x000000007bdd9000-0x000000007fdd9000] (64MB) +[ 2.680966] Trying to unpack rootfs image as initramfs... +[ 2.694566] Initialise system trusted keyrings +[ 2.694566] Key type blacklist registered +[ 2.736580] workingset: timestamp_bits=36 max_order=20 bucket_order=0 +[ 2.737023] zbud: loaded +[ 2.772643] Freeing initrd memory: 2076K +[ 2.837656] squashfs: version 4.0 (2009/01/31) Phillip Lougher +[ 2.895486] fuse: init (API version 7.39) +[ 2.973686] integrity: Platform Keyring initialized +[ 2.974628] integrity: Machine keyring initialized +[ 3.295040] Key type asymmetric registered +[ 3.295411] Asymmetric key parser 'x509' registered +[ 3.296694] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243) +[ 3.307340] io scheduler mq-deadline registered +[ 3.378207] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 +[ 3.387681] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 +[ 3.391290] ACPI: button: Power Button [PWRF] +[ 3.412658] Serial: 8250/16550 driver, 32 ports, IRQ sharing enabled +[ 3.447742] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A +[ 3.830776] Linux agpgart interface v0.103 +[ 3.991184] loop: module loaded +[ 3.998015] ACPI: bus type drm_connector registered +[ 4.003909] tun: Universal TUN/TAP device driver, 1.6 +[ 4.012172] PPP generic driver version 2.4.2 +[ 4.022220] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 +[ 4.193670] serio: i8042 KBD port at 0x60,0x64 irq 1 +[ 4.195110] serio: i8042 AUX port at 0x60,0x64 irq 12 +[ 4.200640] mousedev: PS/2 mouse device common for all mice +[ 4.207620] rtc_cmos 00:03: RTC can wake from S4 +[ 4.212902] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1 +[ 4.213935] rtc_cmos 00:03: registered as rtc0 +[ 4.215489] rtc_cmos 00:03: setting system clock to 2026-09-29T06:50:40 UTC (1790664640) +[ 4.223983] rtc_cmos 00:03: alarms up to one day, y3k, 242 bytes nvram, hpet irqs +[ 4.282706] i2c_dev: i2c /dev entries driver +[ 4.287693] device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log. +[ 4.333982] device-mapper: uevent: version 1.0.3 +[ 4.406419] device-mapper: ioctl: 4.48.0-ioctl (2023-03-01) initialised: dm-devel@redhat.com +[ 4.410672] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled +[ 4.414474] ledtrig-cpu: registered to indicate activity on CPUs +[ 4.423670] drop_monitor: Initializing network drop monitor service +[ 4.424916] NET: Registered PF_INET6 protocol family +[ 4.520917] Segment Routing with IPv6 +[ 4.522232] In-situ OAM (IOAM) with IPv6 +[ 4.524806] NET: Registered PF_PACKET protocol family +[ 4.526814] Key type dns_resolver registered +[ 4.531227] IPI shorthand broadcast: enabled +[ 4.744574] registered taskstats version 1 +[ 4.752959] Loading compiled-in X.509 certificates +[ 4.839158] Loaded X.509 cert 'Build time autogenerated kernel key: aaf6cface807121d2b25f83f2288de5f0eb7acff' +[ 4.864624] Loaded X.509 cert 'Canonical Ltd. Live Patch Signing 2025 Kmod: d541cef61dc7e793b7eb7e899970a2eef0b5dc8c' +[ 4.871401] Loaded X.509 cert 'Canonical Ltd. Live Patch Signing: 14df34d1a87cf37625abec039ef2bf521249b969' +[ 4.901832] Loaded X.509 cert 'Canonical Ltd. Kernel Module Signing 2025 Kmod: 4627603d2357a2a3f81006370894c221175893e9' +[ 4.907559] Loaded X.509 cert 'Canonical Ltd. Kernel Module Signing: 88f752e560a1e0737e31163a466ad7b70a850c19' +[ 4.908180] blacklist: Loading compiled-in revocation X.509 certificates +[ 4.910125] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing: 61482aa2830d0ab2ad5af10b7250da9033ddcef0' +[ 4.910375] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2017): 242ade75ac4a15e50d50c84b0d45ff3eae707a03' +[ 4.910375] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (ESM 2018): 365188c1d374d6b07c3c8f240f8ef722433d6a8b' +[ 4.911584] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2019): c0746fd6c5da3ae827864651ad66ae47fe24b3e8' +[ 4.912009] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v1): a8d54bbb3825cfb94fa13c9f8a594a195c107b8d' +[ 4.912362] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v2): 4cf046892d6fd3c9a5b03f98d845f90851dc6a8c' +[ 4.912467] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (2021 v3): 100437bb6de6e469b581e61cd66bce3ef4ed53af' +[ 4.930151] Loaded X.509 cert 'Canonical Ltd. Secure Boot Signing (Ubuntu Core 2019): c1d57b8f6b743f23ee41f4f7ee292f06eecadfb9' +[ 5.212326] Key type .fscrypt registered +[ 5.212563] Key type fscrypt-provisioning registered +[ 5.245722] Key type encrypted registered +[ 5.246576] AppArmor: AppArmor sha256 policy hashing enabled +[ 5.247257] ima: No TPM chip found, activating TPM-bypass! +[ 5.247442] Loading compiled-in module X.509 certificates +[ 5.248860] Loaded X.509 cert 'Build time autogenerated kernel key: aaf6cface807121d2b25f83f2288de5f0eb7acff' +[ 5.248860] ima: Allocated hash algorithm: sha256 +[ 5.250754] ima: No architecture policies found +[ 5.253597] evm: Initialising EVM extended attributes: +[ 5.254134] evm: security.selinux +[ 5.254666] evm: security.SMACK64 +[ 5.254780] evm: security.SMACK64EXEC +[ 5.254875] evm: security.SMACK64TRANSMUTE +[ 5.254977] evm: security.SMACK64MMAP +[ 5.255066] evm: security.apparmor +[ 5.255149] evm: security.ima +[ 5.255225] evm: security.capability +[ 5.303128] evm: HMAC attrs: 0x1 +[ 5.363667] PM: Magic number: 10:620:823 +[ 5.368500] powernow_k8: Power state transitions not supported +[ 5.374692] powernow_k8: Power state transitions not supported +[ 5.638671] RAS: Correctable Errors collector initialized. +[ 5.644733] Unstable clock detected, switching default tracing clock to "global" +[ 5.644733] If you want to keep using the local clock, then add: +[ 5.644733] "trace_clock=local" +[ 5.644733] on the kernel command line +[ 5.732529] clk: Disabling unused clocks +[ 5.901153] Freeing unused decrypted memory: 2028K +[ 6.196336] Freeing unused kernel image (initmem) memory: 4932K +[ 6.196681] Write protecting the kernel read-only data: 38912k +[ 6.257481] Freeing unused kernel image (rodata/data gap) memory: 1956K +[ 6.992659] x86/mm: Checked W+X mappings: passed, no W+X pages found. +[ 6.996439] Run /init as init process +Linux version 6.8.0-142-generic (buildd@lcy02-amd64-049) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 +/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected +/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Not affected +/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected +/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected +/sys/devices/system/cpu/vulnerabilities/mds:Not affected +/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected +/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected +/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected +/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected +/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected +/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected +/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization +/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; STIBP: disabled; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected +/sys/devices/system/cpu/vulnerabilities/srbds:Not affected +/sys/devices/system/cpu/vulnerabilities/tsa:Not affected +/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected +/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected +[ 7.516080] ACPI: PM: Preparing to enter system sleep state S5 +[ 7.521893] reboot: Power down diff --git a/toyos-cpuvuln/fixtures/tcg/qemu-version.txt b/toyos-cpuvuln/fixtures/tcg/qemu-version.txt new file mode 100644 index 00000000000..6b0ae6180b7 --- /dev/null +++ b/toyos-cpuvuln/fixtures/tcg/qemu-version.txt @@ -0,0 +1,2 @@ +QEMU emulator version 11.1.1 +Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers From c8f718726a9724b25e2d83121f9d4cf5ac5b1dd9 Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 1 Oct 2026 14:57:09 +0200 Subject: [PATCH 2/2] Review round 2: toyos-cpuvuln reads the captures it keeps, and the rest go The T14's facts are now checked against what Linux read on that machine. the_t14s_facts_are_linuxs_reading_of_it reads fixtures/t14/cpuid.txt, msr.txt and cpuinfo.txt the way the Facts docs say Linux reads them: a leaf past its range reads as 0, and ARCH_CAPABILITIES counts only where CPUID.(7,0):EDX[29] enumerates it. It then compares every T14 field with that reading: the CPUID.0 vendor against cpuinfo's vendor_id, Ident::new against cpuinfo's family, model and stepping, and the microcode revision against both cpuinfo and MSR 0x8B. It also holds decide(&T14)'s vmx to cpuinfo's vmx flag and its spec_ctrl to MSR 0x48. Every MSR must read one value on every CPU, and so must every cpuinfo field the test reads. The comparison found no disagreement. The TCG model's facts are now checked against its console. the_tcg_models_signature_gives_its_lines takes TCG's vendor, family, model and stepping from console.txt's smpboot line, and its lines from console.txt's vulnerabilities lines. tcg.txt was a second copy of those lines, so it goes. Every capture file no test reads goes: t14/'s cmdline, config-hardening, config-sha256, dmi, kernel-log, mmap_rnd_bits, packages, uname and version, and tcg/qemu-version. None of them is a reading the classification must agree with. #601's head still holds them at 44eb3c2e. The REMOVE'd spans go from both SOURCE files, and so do the entries for deleted files. issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md becomes ...-lack-reads-owed-before-the-t14s-wipe.md, with the heading to match. Its four path citations move; a git grep for the bare old slug finds none. The body now names the fixtures and the two tests that read them. It no longer calls the TCG fixture the PR gate's model: the reader holds TCG to the CPU console.txt names, not to src/arch.rs or .github/qemu-version. The exit asks for each owed reading to come with the test that reads it, and for T14's feat_ctl to be held to 0x3A. The mutation is a one-bit change to an added reading, because no test reads a config hash now. The owner is named, as issues/filesystem/a-cached-read-from-a-file-server-is-measured-only-under-tcg.md names one. The loader defect from #556 goes: stage 2 of issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md already owns its fix and its exit. Stage 2 takes the one fact it lacked: every stick written from one image carries the same unique GUIDs, because src/image.rs's create_boot_image draws them once per image (:240-241). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L --- ...oes-only-what-must-precede-the-handover.md | 4 +- ...its-log-guid-not-the-one-it-booted-from.md | 24 --- ...t14-and-the-tcg-model-are-not-committed.md | 24 --- ...el-lack-reads-owed-before-the-t14s-wipe.md | 31 ++++ ...s-speculation-mitigations-as-linux-does.md | 2 +- ...-the-vulnerabilities-lines-linux-prints.md | 2 +- ...s-linux-on-every-machine-toyos-supports.md | 2 +- .../kernel/tsx-stays-as-firmware-left-it.md | 2 +- toyos-cpuvuln/fixtures/t14/SOURCE | 10 +- toyos-cpuvuln/fixtures/t14/cmdline.txt | 1 - .../fixtures/t14/config-hardening.txt | 41 ----- toyos-cpuvuln/fixtures/t14/config-sha256.txt | 1 - toyos-cpuvuln/fixtures/t14/dmi.txt | 8 - toyos-cpuvuln/fixtures/t14/kernel-log.txt | 10 -- toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt | 1 - toyos-cpuvuln/fixtures/t14/packages.txt | 2 - toyos-cpuvuln/fixtures/t14/uname.txt | 1 - toyos-cpuvuln/fixtures/t14/version.txt | 1 - toyos-cpuvuln/fixtures/tcg.txt | 17 --- toyos-cpuvuln/fixtures/tcg/SOURCE | 7 +- toyos-cpuvuln/fixtures/tcg/qemu-version.txt | 2 - toyos-cpuvuln/src/tests.rs | 140 ++++++++++++++++-- 22 files changed, 166 insertions(+), 167 deletions(-) delete mode 100644 issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md delete mode 100644 issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md create mode 100644 issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md delete mode 100644 toyos-cpuvuln/fixtures/t14/cmdline.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/config-hardening.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/config-sha256.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/dmi.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/kernel-log.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/packages.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/uname.txt delete mode 100644 toyos-cpuvuln/fixtures/t14/version.txt delete mode 100644 toyos-cpuvuln/fixtures/tcg.txt delete mode 100644 toyos-cpuvuln/fixtures/tcg/qemu-version.txt diff --git a/issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md b/issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md index 9ae21c395e8..cb9922628a2 100644 --- a/issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md +++ b/issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md @@ -86,7 +86,9 @@ Each stage lands on its own, in this order. - Every volume the loader opens (the slot's FAT partition, the log partition and the attempts file on it) is found on the boot disk, where exactly one match is taken. `loaderlog::volume_handle`'s machine-wide - first match goes. + first match goes. Every stick written from one image carries the same + unique GUIDs: `src/image.rs`'s `create_boot_image` draws them once per + image. - A pass asks firmware once: one `LoadedImage` open, one device-path walk, one `Disk::open` and slot-table read, and one file reader. `load_file_bytes`, `MAX_ESP_FILE` and the unsound `alloc_uninit` go. diff --git a/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md b/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md deleted file mode 100644 index 2206dd17513..00000000000 --- a/issues/boot-media/the-loader-writes-the-first-disk-carrying-its-log-guid-not-the-one-it-booted-from.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -status: open -kind: defect -opened: 2026-09-27 ---- - -# The loader writes the first disk carrying its log GUID, not the one it booted from - -`loaderlog::volume_handle` (`bootloader/src/loaderlog.rs`) takes the first -filesystem on the machine whose GPT partition's unique GUID is the log -partition's, and `loader.log` and the attempt records are written there. -`src/image.rs` draws every unique GUID once per image, so every stick written -from one image carries the same ones. With two such sticks plugged in, the -loader can write the log partition of the stick it did not boot from: a disk -it was not given. - -Owned by stage 2 of -`issues/boot-media/the-loader-does-only-what-must-precede-the-handover.md`, -which finds every volume the loader opens on the boot disk. - -**Exit condition.** The loader writes only the device it booted from: the log -volume is looked up on the device of the loaded image's own handle, and a boot -with two copies of one image attached writes the other copy's bytes not at -all. diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md deleted file mode 100644 index 69cd54e8ebb..00000000000 --- a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -status: open -kind: tooling -opened: 2026-09-29 ---- - -# Linux's readings of the T14 and the TCG model are not committed - -The floor of -`issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` -is tag `Ubuntu-6.8.0-142.142` (53e5d07aac028a1523ab0b115f079d6d1bc831ef) of -`https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble`, -config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890, -and what it reads on the T14 and on the PR gate's TCG model are the fixtures -of `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`. -Ubuntu leaves the T14 only after this issue and -`issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md` -close. - -**Exit**: before the wipe `toyos-cpuvuln/fixtures/t14/` -adds CPUID 5, 0x19 and 0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the split-lock line, and -the config's `X86_KERNEL_IBT` and `X86_INTEL_MEMORY_PROTECTION_KEYS`. -**Mutation**: a config hash off by one byte is refused. **Oracle**: that -Linux. diff --git a/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md new file mode 100644 index 00000000000..d5d7cf9ff2a --- /dev/null +++ b/issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md @@ -0,0 +1,31 @@ +--- +status: open +kind: tooling +opened: 2026-09-29 +--- + +# Linux's readings of the T14 and the TCG model lack reads owed before the T14's wipe + +The floor of +`issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md` +is tag `Ubuntu-6.8.0-142.142` (53e5d07aac028a1523ab0b115f079d6d1bc831ef) of +`https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble`, +config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890, +and what it reads on the T14 and on the TCG model are the fixtures +of `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`, +`toyos-cpuvuln/fixtures/`'s `t14.txt`, `t14/` and `tcg/`; +`the_t14s_facts_are_linuxs_reading_of_it` and +`the_tcg_models_signature_gives_its_lines` hold `T14` and `TCG` to them. +Ubuntu leaves the T14 only after this issue and +`issues/hardware/no-program-measures-toyos-against-linux-on-one-machine.md` +close. + +**Exit**: before the wipe the T14's readings add CPUID 5, 0x19 and +0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the +split-lock line, and the config's `X86_KERNEL_IBT` and +`X86_INTEL_MEMORY_PROTECTION_KEYS`, each committed with the test that reads +it, and `the_t14s_facts_are_linuxs_reading_of_it` holds `T14`'s `feat_ctl` +to 0x3A's. **Mutation**: an added reading off by one bit reds the test that +reads it. **Oracle**: that Linux. + +Owner: the orchestrator, which holds the T14 the exit runs on. diff --git a/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md b/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md index 532e0f201ed..e09ddc3efde 100644 --- a/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md +++ b/issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md @@ -12,7 +12,7 @@ selects, built by the kernel and by a host test. Pull request #602 holds it. **Exit**: each committed fixture's facts give its lines: the T14's and the TCG model's from -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md`, +`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, and each nightly EPYC guest's once its runner is captured. **Mutation**: `GDS` deleted from `cpu_vuln_blacklist`'s TIGERLAKE_L row reds the T14's fixture, and `SRSO` deleted from its family 0x19 row reds a family-0x19 EPYC guest's. diff --git a/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md b/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md index 8c04912bfe1..61f2d291ea6 100644 --- a/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md +++ b/issues/kernel/each-boot-prints-the-vulnerabilities-lines-linux-prints.md @@ -9,7 +9,7 @@ opened: 2026-09-29 **Exit**: each proving machine's ToyOS boot prints, for each vulnerabilities file, the line Linux at `Ubuntu-6.8.0-142.142` printed on that machine: the T14's from -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md`, +`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`, each EPYC guest's from its runner's capture. It omits only clauses about what ToyOS does not run: `spectre_v1`'s swapgs barriers while it runs no `swapgs`, the KVM and VM-exit clauses since it runs no guest, and `IBRS_FW` since the diff --git a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md b/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md index 6d7aa2f67a0..46ee0798305 100644 --- a/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md +++ b/issues/kernel/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md @@ -14,7 +14,7 @@ probe is a `boot-actuators` arm or a `test-actuators` `SYS_DEBUG` action. **Exit**: every issue below is closed, in the order listed. -- `issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md` +- `issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md` - `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` - `issues/kernel/spec-ctrl-and-gds-stay-as-firmware-left-them.md` - `issues/kernel/no-program-runs-with-speculative-store-bypass-disabled.md` diff --git a/issues/kernel/tsx-stays-as-firmware-left-it.md b/issues/kernel/tsx-stays-as-firmware-left-it.md index a2bd73517cd..dcce09494a3 100644 --- a/issues/kernel/tsx-stays-as-firmware-left-it.md +++ b/issues/kernel/tsx-stays-as-firmware-left-it.md @@ -21,6 +21,6 @@ T14's `CONFIG_X86_INTEL_TSX_MODE_OFF=y`, runs `tsx_init` `issues/kernel/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md` carries `tsx_init`'s decision and every CPU applies it; on the T14, ToyOS's reads of 0x122, 0x10F and 0x123 equal the Linux reads of -`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-are-not-committed.md` +`issues/hardware/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md` where each exists, and dropping the write leaves 0x122 or 0x10F at firmware's value and reds it. diff --git a/toyos-cpuvuln/fixtures/t14/SOURCE b/toyos-cpuvuln/fixtures/t14/SOURCE index 7c87d32831d..8e5f29ff538 100644 --- a/toyos-cpuvuln/fixtures/t14/SOURCE +++ b/toyos-cpuvuln/fixtures/t14/SOURCE @@ -1,9 +1,6 @@ Linux's readings of the ThinkPad T14 this repository is tested on, under that machine's Ubuntu, read as root on the T14 by `toyos-t14linux/capture.sh` at -commit 44eb3c2e (pull request #601) before 06:50 UTC on 2026-09-29, when -../tcg/ booted the kernel and initramfs the same run copied off the T14. The -script ran only where /proc/version named 6.8.0-142-generic, both packages -were 6.8.0-142.142 and the config's sha256 was config-sha256.txt's, and it read +commit 44eb3c2e (pull request #601), and it read CPUID and the MSRs through the running kernel's /dev/cpu/*/cpuid and /dev/cpu/*/msr, so an MSR holds what that kernel left in it. @@ -14,8 +11,3 @@ CPUID and the MSRs through the running kernel's /dev/cpu/*/cpuid and msr.txt one per line: msr cpu value; 0x122 and 0x10F are absent because ARCH_CAPABILITIES bit 7 and CPUID.(7,0):EDX bits 11 and 13 do not enumerate them - config-hardening.txt `grep -n` of the config for the options the script - names, so an option it did not name is absent, not unset - kernel-log.txt this boot's kernel lines from the journal that match, in - any case, mitigat, vulnerab, not affected, spectre, - microcode, x86/bugs or tsx, and no other diff --git a/toyos-cpuvuln/fixtures/t14/cmdline.txt b/toyos-cpuvuln/fixtures/t14/cmdline.txt deleted file mode 100644 index 52137704fca..00000000000 --- a/toyos-cpuvuln/fixtures/t14/cmdline.txt +++ /dev/null @@ -1 +0,0 @@ -BOOT_IMAGE=/vmlinuz-6.8.0-142-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro diff --git a/toyos-cpuvuln/fixtures/t14/config-hardening.txt b/toyos-cpuvuln/fixtures/t14/config-hardening.txt deleted file mode 100644 index 8c1cfb44cf6..00000000000 --- a/toyos-cpuvuln/fixtures/t14/config-hardening.txt +++ /dev/null @@ -1,41 +0,0 @@ -124:CONFIG_BPF_JIT_ALWAYS_ON=y -318:CONFIG_KEXEC_SIG=y -493:CONFIG_X86_UMIP=y -498:CONFIG_X86_INTEL_TSX_MODE_OFF=y -502:CONFIG_X86_USER_SHADOW_STACK=y -528:CONFIG_RANDOMIZE_BASE=y -532:CONFIG_RANDOMIZE_MEMORY=y -536:CONFIG_LEGACY_VSYSCALL_XONLY=y -554:CONFIG_CPU_MITIGATIONS=y -556:CONFIG_MITIGATION_RETPOLINE=y -557:CONFIG_MITIGATION_RETHUNK=y -564:CONFIG_SLS=y -566:CONFIG_MITIGATION_RFDS=y -567:CONFIG_MITIGATION_SPECTRE_BHI=y -568:CONFIG_MITIGATION_ITS=y -569:CONFIG_MITIGATION_TSA=y -570:CONFIG_MITIGATION_VMSCAPE=y -882:CONFIG_STACKPROTECTOR_STRONG=y -909:CONFIG_ARCH_MMAP_RND_BITS=32 -930:CONFIG_VMAP_STACK=y -933:CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y -935:CONFIG_STRICT_KERNEL_RWX=y -937:CONFIG_STRICT_MODULE_RWX=y -982:CONFIG_MODULE_SIG=y -1132:CONFIG_SLAB_FREELIST_RANDOM=y -1133:CONFIG_SLAB_FREELIST_HARDENED=y -1136:CONFIG_RANDOM_KMALLOC_CACHES=y -1139:CONFIG_SHUFFLE_PAGE_ALLOCATOR=y -2457:CONFIG_RESET_ATTACK_MITIGATION=y -9892:CONFIG_INTEL_IOMMU_DEFAULT_ON=y -11376:CONFIG_HARDENED_USERCOPY=y -11377:CONFIG_FORTIFY_SOURCE=y -11473:CONFIG_INIT_STACK_ALL_ZERO=y -11474:CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y -11477:CONFIG_ZERO_CALL_USED_REGS=y -12040:CONFIG_UBSAN_BOUNDS=y -12042:CONFIG_UBSAN_SHIFT=y -12044:CONFIG_UBSAN_BOOL=y -12045:CONFIG_UBSAN_ENUM=y -12074:CONFIG_DEBUG_WX=y -12084:CONFIG_SCHED_STACK_END_CHECK=y diff --git a/toyos-cpuvuln/fixtures/t14/config-sha256.txt b/toyos-cpuvuln/fixtures/t14/config-sha256.txt deleted file mode 100644 index 0b5f4afd73b..00000000000 --- a/toyos-cpuvuln/fixtures/t14/config-sha256.txt +++ /dev/null @@ -1 +0,0 @@ -3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890 /boot/config-6.8.0-142-generic diff --git a/toyos-cpuvuln/fixtures/t14/dmi.txt b/toyos-cpuvuln/fixtures/t14/dmi.txt deleted file mode 100644 index 8f2ed5f08dd..00000000000 --- a/toyos-cpuvuln/fixtures/t14/dmi.txt +++ /dev/null @@ -1,8 +0,0 @@ -/sys/class/dmi/id/bios_date:05/09/2026 -/sys/class/dmi/id/bios_release:1.71 -/sys/class/dmi/id/bios_vendor:LENOVO -/sys/class/dmi/id/bios_version:N34ET71W (1.71 ) -/sys/class/dmi/id/ec_firmware_release:1.46 -/sys/class/dmi/id/sys_vendor:LENOVO -/sys/class/dmi/id/product_name:20W0003AMZ -/sys/class/dmi/id/product_version:ThinkPad T14 Gen 2i diff --git a/toyos-cpuvuln/fixtures/t14/kernel-log.txt b/toyos-cpuvuln/fixtures/t14/kernel-log.txt deleted file mode 100644 index 8214d7a89ab..00000000000 --- a/toyos-cpuvuln/fixtures/t14/kernel-log.txt +++ /dev/null @@ -1,10 +0,0 @@ -Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization -Spectre V2 : Spectre BHI mitigation: SW BHB clearing on vm exit -Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall -Spectre V2 : Mitigation: Enhanced / Automatic IBRS -Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT -Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier -Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl -GDS: Mitigation: Microcode -ITS: Mitigation: Aligned branch/return thunks -microcode: Current revision: 0x000000be diff --git a/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt b/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt deleted file mode 100644 index 11a4111dcd8..00000000000 --- a/toyos-cpuvuln/fixtures/t14/mmap_rnd_bits.txt +++ /dev/null @@ -1 +0,0 @@ -vm.mmap_rnd_bits = 32 diff --git a/toyos-cpuvuln/fixtures/t14/packages.txt b/toyos-cpuvuln/fixtures/t14/packages.txt deleted file mode 100644 index 94d1f206ef8..00000000000 --- a/toyos-cpuvuln/fixtures/t14/packages.txt +++ /dev/null @@ -1,2 +0,0 @@ -linux-image-6.8.0-142-generic 6.8.0-142.142 -linux-modules-6.8.0-142-generic 6.8.0-142.142 diff --git a/toyos-cpuvuln/fixtures/t14/uname.txt b/toyos-cpuvuln/fixtures/t14/uname.txt deleted file mode 100644 index f57a77638b8..00000000000 --- a/toyos-cpuvuln/fixtures/t14/uname.txt +++ /dev/null @@ -1 +0,0 @@ -Linux t14 6.8.0-142-generic #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux diff --git a/toyos-cpuvuln/fixtures/t14/version.txt b/toyos-cpuvuln/fixtures/t14/version.txt deleted file mode 100644 index 2ea613b2747..00000000000 --- a/toyos-cpuvuln/fixtures/t14/version.txt +++ /dev/null @@ -1 +0,0 @@ -Linux version 6.8.0-142-generic (buildd@lcy02-amd64-049) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #142-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:24:27 UTC 2026 diff --git a/toyos-cpuvuln/fixtures/tcg.txt b/toyos-cpuvuln/fixtures/tcg.txt deleted file mode 100644 index 1019ef0e0c1..00000000000 --- a/toyos-cpuvuln/fixtures/tcg.txt +++ /dev/null @@ -1,17 +0,0 @@ -/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected -/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Not affected -/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected -/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected -/sys/devices/system/cpu/vulnerabilities/mds:Not affected -/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected -/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected -/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected -/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected -/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected -/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected -/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization -/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; STIBP: disabled; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected -/sys/devices/system/cpu/vulnerabilities/srbds:Not affected -/sys/devices/system/cpu/vulnerabilities/tsa:Not affected -/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected -/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected diff --git a/toyos-cpuvuln/fixtures/tcg/SOURCE b/toyos-cpuvuln/fixtures/tcg/SOURCE index 03d429eb5e9..fb15772189a 100644 --- a/toyos-cpuvuln/fixtures/tcg/SOURCE +++ b/toyos-cpuvuln/fixtures/tcg/SOURCE @@ -1,7 +1,5 @@ The same Linux on the TCG model, booted on the development host by -`toyos-t14linux/tcg.sh` at commit 44eb3c2e (pull request #601) at 06:50 UTC on -2026-09-29, the time console.txt's RTC lines read, under QEMU 11.1.1 -(qemu-version.txt) as +`toyos-t14linux/tcg.sh` at commit 44eb3c2e (pull request #601) as qemu-system-x86_64 -nodefaults -machine q35 -cpu qemu64,+rdrand,+smap,+fsgsbase,+x2apic,+smep -smp 2 -m 4G @@ -13,5 +11,4 @@ T14's busybox with an init that mounts sysfs and proc, prints /proc/version and `grep .` over /sys/devices/system/cpu/vulnerabilities/*, and powers off. Both came off the T14 in the run that took ../t14/, and neither is committed. - console.txt the serial port, CRLF as it arrived; ../tcg.txt is its - vulnerability lines without the CRs + console.txt the serial port, CRLF as it arrived diff --git a/toyos-cpuvuln/fixtures/tcg/qemu-version.txt b/toyos-cpuvuln/fixtures/tcg/qemu-version.txt deleted file mode 100644 index 6b0ae6180b7..00000000000 --- a/toyos-cpuvuln/fixtures/tcg/qemu-version.txt +++ /dev/null @@ -1,2 +0,0 @@ -QEMU emulator version 11.1.1 -Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers diff --git a/toyos-cpuvuln/src/tests.rs b/toyos-cpuvuln/src/tests.rs index ae728c5e091..f6b624a50ef 100644 --- a/toyos-cpuvuln/src/tests.rs +++ b/toyos-cpuvuln/src/tests.rs @@ -11,9 +11,8 @@ use super::*; const PREFIX: &str = "/sys/devices/system/cpu/vulnerabilities/"; -/// The T14's i5-1135G7 as S0 read it under the pinned Linux: PR #601's -/// `toyos-t14linux/s0/t14/cpuid.txt`, `msr.txt` and `cpuinfo.txt` at commit -/// 44eb3c2e. Every MSR reads the same on all eight CPUs. +/// The T14's i5-1135G7, held to the pinned Linux's reading of it by +/// [`the_t14s_facts_are_linuxs_reading_of_it`]. const T14: Facts = Facts { vendor: Vendor::from_id(b"GenuineIntel"), signature: 0x0008_06c1, @@ -28,9 +27,9 @@ const T14: Facts = Facts { cpuid_8000_0021_ecx: 0, arch_capabilities: 0x0a00_5c6b, mcu_opt_ctrl: Some(0), - // S0 did not read 0x3A. `cpuinfo.txt` lists `vmx` and its `vmx flags`, so - // Linux kept VMX (`feat_ctl.c:171-184`): these are the two bits that decide - // that, and no other bit is read. + // `fixtures/t14/` holds no 0x3A. `cpuinfo.txt` lists `vmx` and its + // `vmx flags`, so Linux kept VMX (`feat_ctl.c:171-184`): these are the two + // bits that decide that, and no other bit is read. feat_ctl: Some(FEAT_CTL_LOCKED | FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX), ls_cfg_readable: None, sbpb_write_accepted: None, @@ -38,9 +37,9 @@ const T14: Facts = Facts { smt: true, }; -/// The TCG model: `qemu64`, `AuthenticAMD` family 0xF model 0x6B stepping 1, -/// the signature S0's capture verifies; the bits `decide` reads in leaves 7 -/// and 0x80000008 are clear in that model, and it has no leaf 0x80000021. +/// The TCG model: `qemu64`, `AuthenticAMD` family 0xF model 0x6B stepping 1; +/// the bits `decide` reads in leaves 7 and 0x80000008 are clear in that model, +/// and it has no leaf 0x80000021. const TCG: Facts = Facts { vendor: Vendor::from_id(b"AuthenticAMD"), signature: 0x0006_0fb1, @@ -248,9 +247,7 @@ fn line(facts: &Facts, v: Vuln) -> String { #[test] fn the_t14s_facts_give_its_lines_and_its_spec_ctrl() { - assert_eq!(Ident::new(T14.vendor, T14.signature).model, 0x8C); let d = assert_capture(&T14, include_str!("../fixtures/t14.txt")); - // `spec_ctrl` against S0's `msr.txt`: 0x48 reads 0x1 on every CPU. assert_eq!( state(&d), State { @@ -266,19 +263,132 @@ fn the_t14s_facts_give_its_lines_and_its_spec_ctrl() { ); } -/// S0 verifies the TCG model's signature and nothing else it could read, so -/// its lines are held over either value of every other fact they could rest on. +/// [`T14`] against `fixtures/t14/`, each field read as [`Facts`] says Linux +/// reads it, and what `decide` makes of it against the VMX Linux kept and the +/// `IA32_SPEC_CTRL` it left. +#[test] +fn the_t14s_facts_are_linuxs_reading_of_it() { + let hex = |word: &str| u64::from_str_radix(word.trim_start_matches("0x"), 16).expect(word); + let leaves: Vec> = include_str!("../fixtures/t14/cpuid.txt") + .lines() + .map(|l| l.split(' ').map(hex).collect()) + .collect(); + // A leaf past its range's highest reads as 0, as Linux leaves it. + let leaf = |leaf: u32, subleaf: u32| { + let read = |leaf: u32, subleaf: u32| { + let l = leaves + .iter() + .find(|l| l[..2] == [u64::from(leaf), u64::from(subleaf)]) + .unwrap_or_else(|| panic!("CPUID {leaf:#x}.{subleaf} was not read")); + [l[2], l[3], l[4], l[5]].map(|r| r as u32) + }; + if leaf <= read(leaf & 0x8000_0000, 0)[0] { read(leaf, subleaf) } else { [0; 4] } + }; + let blocks: Vec> = include_str!("../fixtures/t14/cpuinfo.txt") + .split_terminator("\n\n") + .map(|b| { + b.lines().filter_map(|l| l.split_once(':')).map(|(k, v)| (k.trim(), v.trim())).collect() + }) + .collect(); + let cpuinfo = |key: &str| { + let mut each = blocks.iter().map(|b| b.iter().find(|f| f.0 == key).expect(key).1); + let first = each.next().expect("a CPU"); + assert!(each.all(|v| v == first), "{key} differs between CPUs"); + first + }; + let msrs: Vec<(u64, usize, u64)> = include_str!("../fixtures/t14/msr.txt") + .lines() + .map(|l| match l.split(' ').collect::>()[..] { + [index, cpu, value] => (hex(index), cpu.parse().expect(cpu), hex(value)), + _ => panic!("{l:?} is not `msr cpu value`"), + }) + .collect(); + let msr = |index: u64| { + let each: Vec<_> = msrs.iter().filter(|m| m.0 == index).collect(); + assert!(each.iter().map(|m| m.1).eq(0..blocks.len()), "MSR {index:#x} on every CPU"); + assert!(each.iter().all(|m| m.2 == each[0].2), "MSR {index:#x} differs between CPUs"); + each[0].2 + }; + + let [_, ebx0, ecx0, edx0] = leaf(0, 0); + let id: Vec = [ebx0, edx0, ecx0].iter().flat_map(|r| r.to_le_bytes()).collect(); + let [eax1, _, ecx1, _] = leaf(1, 0); + let [_, ebx7, _, edx7] = leaf(7, 0); + let [eax21, _, ecx21, _] = leaf(0x8000_0021, 0); + let arch = if edx7 & CPUID_7_0_EDX_ARCH_CAPABILITIES != 0 { msr(0x10a) } else { 0 }; + let Facts { + vendor, + signature, + microcode, + cpuid_1_ecx, + cpuid_7_0_ebx, + cpuid_7_0_edx, + cpuid_7_2_edx, + cpuid_8000_0008_ebx, + cpuid_8000_0021_eax, + cpuid_8000_0021_ecx, + arch_capabilities, + mcu_opt_ctrl, + // Stands in for 0x3A, which was not read: `decide`'s `vmx` is held below. + feat_ctl: _, + // Probed on AMD and Hygon alone. + ls_cfg_readable: _, + sbpb_write_accepted: _, + smt, + } = T14; + assert_eq!(cpuinfo("vendor_id").as_bytes(), &id[..]); + assert_eq!(vendor, Vendor::from_id(id[..].try_into().expect("12 bytes"))); + assert_eq!(signature, eax1); + let ident = Ident::new(vendor, signature); + assert_eq!( + [ident.family, ident.model, ident.stepping].map(|n| n.to_string()), + ["cpu family", "model", "stepping"].map(|key| cpuinfo(key).to_string()) + ); + assert_eq!(u64::from(microcode), hex(cpuinfo("microcode"))); + assert_eq!(u64::from(microcode), msr(0x8b) >> 32); + assert_eq!(cpuid_1_ecx, ecx1); + assert_eq!((cpuid_7_0_ebx, cpuid_7_0_edx), (ebx7, edx7)); + assert_eq!(cpuid_7_2_edx, leaf(7, 2)[3]); + assert_eq!(cpuid_8000_0008_ebx, leaf(0x8000_0008, 0)[1]); + assert_eq!((cpuid_8000_0021_eax, cpuid_8000_0021_ecx), (eax21, ecx21)); + assert_eq!(arch_capabilities, arch); + assert_eq!(mcu_opt_ctrl, (arch & ARCH_CAP_GDS_CTRL != 0).then(|| msr(0x123))); + let count = |key| cpuinfo(key).parse::().expect(key); + assert_eq!(smt, count("siblings") > count("cpu cores")); + + let d = decide(&T14); + assert_eq!(d.vmx, cpuinfo("flags").split(' ').any(|f| f == "vmx")); + assert_eq!(d.spec_ctrl, msr(0x48)); +} + +/// `fixtures/tcg/console.txt` verifies the TCG model's signature and nothing +/// else it could read, so its lines are held over either value of every other +/// fact they could rest on. #[test] fn the_tcg_models_signature_gives_its_lines() { + let console = include_str!("../fixtures/tcg/console.txt"); + // `print_cpu_info`: the vendor as its `cpu_dev` names it, the brand string, + // then the family, model and stepping. + let (name, identity) = console + .lines() + .find_map(|l| l.split_once("smpboot: CPU0: ")) + .and_then(|(_, cpu0)| cpu0.split_once(" (")) + .expect("Linux names CPU 0"); let id = Ident::new(TCG.vendor, TCG.signature); - assert_eq!((id.family, id.model, id.stepping), (15, 107, 1)); + assert_eq!((TCG.vendor, name.split(' ').next()), (Vendor::Amd, Some("AMD"))); + assert_eq!( + identity, + std::format!("family: {:#x}, model: {:#x}, stepping: {:#x})", id.family, id.model, id.stepping) + ); + let lines: String = + console.lines().filter(|l| l.starts_with(PREFIX)).flat_map(|l| [l, "\n"]).collect(); for hypervisor in [0, CPUID_1_ECX_HYPERVISOR] { for rdrand in [0, CPUID_1_ECX_RDRAND] { for microcode in [0, u32::MAX] { for smt in [false, true] { let facts = Facts { cpuid_1_ecx: hypervisor | rdrand, microcode, smt, ..TCG }; - let d = assert_capture(&facts, include_str!("../fixtures/tcg.txt")); + let d = assert_capture(&facts, &lines); assert_eq!( state(&d), State { spectre_v2: Some(SpectreV2::Retpoline), ..NONE }