Japabu · Oct 14, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 14, 2026 · Oct 14, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -26,7 +26,6 @@ members = [
     "build/ssh",
     "kernel",
     "kernel/amdvi",
-    "kernel/cpuvuln",
     "kernel/dma",
     "kernel/gicv3",
     "kernel/its",

diff --git a/issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md b/issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md
diff --git a/...re-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md b/...re-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md
@@ -0,0 +1,21 @@
+---
+status: open
+kind: track
+opened: 2026-09-29
+---
+
+# A pure function decides a CPU's speculation mitigations from its vendor's guidance
+
+Nothing decides which speculative-execution mitigations a CPU needs. The
+function to build maps a CPU's signature, microcode revision and enumeration
+words to the mitigations Intel's or AMD's published affected-processor guidance
+prescribes for it. Its enumeration words are CPUID 7.0 EDX, 0x80000008 EBX,
+0x80000021 EAX and `IA32_ARCH_CAPABILITIES` where enumerated. #915 deleted
+`toyos-cpuvuln`, which reproduced Linux's decision with no caller.
+
+**Exit**:
+- A host test holds the function's verdict, for each proving machine's words,
+  to the vendor's published row for that CPU, committed with its provenance.
+- Each proving machine's boot logs the words ToyOS read there.
+- **Mutation**: a vendor row dropped reds that machine's test.
+- **Oracle**: the vendor's table, and ToyOS's own read on the machine.
diff --git a/...amd-erratum-1386-is-assumed-where-no-public-amd-revision-guide-clears-a-part.md b/...amd-erratum-1386-is-assumed-where-no-public-amd-revision-guide-clears-a-part.md
@@ -0,0 +1,33 @@
+---
+status: open
+kind: tooling
+opened: 2026-10-11
+---
+
+# AMD erratum 1386 is assumed where no public AMD revision guide clears a part
+
+`kernel::xsave::erratum_1386` (`kernel/pure/xsave.rs`) refuses `XSAVES` to
+the parts AMD's public revision guides list erratum 1386 against, "No fix
+planned": ZP-B2 (55449 rev 1.21), Rome-B0 (56323 rev 1.01), Milan-B1 and -B2
+(56683 rev 1.08). It also refuses it to every other AMD family 17h and 19h part,
+and to a family 18h part of any vendor but Intel, unless a guide clears it.
+The cleared parts are ZP-B1 and PiR-B2 (55449) and Genoa-B1 (57095 rev 1.01,
+which does not list the erratum). The rule rests on the cost asymmetry, not on
+a document. With `IA32_XSS` 0, `XSAVEC` saves what `XSAVES` would, and only
+the modified optimisation is lost. A wrong no hands a thread an older XMM value
+of its own (orchestrator's ruling A on #915).
+
+Evidence, in [`amd-guides.md`](https://github.com/ToyOSOrg/evidence/blob/d4754efa08523eaddecf53dc8f9239b35e4b4268/design/amd-guides.md):
+- every guide the Internet Archive holds under AMD's `processor-tech-docs/revision-guides/` prefix, hashed;
+- 58251 and 58730, family 1Ah, are read too and do not list 1386;
+- the guide for family 17h models 60h-6Fh, which PPR 55922 names as docRevG, is not public;
+- `www.amd.com/system/files/TechDocs/` and `developer.amd.com/wp-content/resources/` were not searched.
+
+Family 1Ah models outside 00h-1Fh are unguided and not named: the ruling covers
+families 17h to 19h.
+
+Owner: the orchestrator.
+
+**Exit**: a separate reader's clean-room specification of AMD's own code for
+erratum 1386 settles the models no public guide covers, and the rule is
+corrected to it.
diff --git a/...amd-erratum-1386s-scope-rests-on-linux-where-amd-publishes-no-revision-guide.md b/...amd-erratum-1386s-scope-rests-on-linux-where-amd-publishes-no-revision-guide.md
diff --git a/issues/general-crates-are-published-and-toyos-consumes-them.md b/issues/general-crates-are-published-and-toyos-consumes-them.md
@@ -14,10 +14,9 @@ opened: 2026-10-11
 **Candidates** (scan of the restructured tree, 2026-10-11), best first:
 1. `toyos-fat32-check`: FAT32 checker written from Microsoft's fatgen103. No ToyOS dependencies, `no_std`.
 2. `toyos-fat32`: FAT32 read/write hardened against hostile volumes. It needs `toyos-wallclock` folded in, and its tests made self-contained.
-3. `toyos-cpuvuln`: Linux's CPU vulnerability verdicts from CPUID/MSR facts. Its parity is pinned to one Linux tag.
-4. The bcachefs `upstream` reader, split out of `lib/bcachefs`.
-5. `toyos-microcode` and `toyos-usbhid`.
-6. Later: the TCP stack (once `wire`'s grab-bag is factored out), the SSH server (once its track and defect issues close), and the AML interpreter (once it is decoupled from `toyos-acpi`).
+3. The bcachefs `upstream` reader, split out of `lib/bcachefs`.
+4. `toyos-microcode` and `toyos-usbhid`.
+5. Later: the TCP stack (once `wire`'s grab-bag is factored out), the SSH server (once its track and defect issues close), and the AML interpreter (once it is decoupled from `toyos-acpi`).
 
 **Not candidates:** sha2/sha2-hw, random, crc, wallclock and tmpdir. Widely used crates already do their jobs.
 

diff --git a/...s-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md b/...s-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md
@@ -6,27 +6,15 @@ opened: 2026-09-29
 
 # Linux's readings of the T14 and the TCG model lack reads owed before the T14's wipe
 
-The floor of
-`issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`
-is tag `Ubuntu-6.8.0-142.142` (53e5d07aac028a1523ab0b115f079d6d1bc831ef) of
-`https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble`,
-config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890,
-and what it reads on the T14 and on the TCG model are the fixtures
-of `issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`,
-`kernel/cpuvuln/fixtures/`'s `t14.txt`, `t14/` and `tcg/`;
-`the_t14s_facts_are_linuxs_reading_of_it` and
-`the_tcg_models_signature_gives_its_lines` hold `T14` and `TCG` to them.
+The CPU readings this issue owed went with `toyos-cpuvuln` (#915); the
+track's pin is in
+`issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`.
 Ubuntu leaves the T14 only after this issue and
 `issues/no-program-measures-toyos-against-linux-on-one-machine.md`
 close.
 
-**Exit**: before the wipe the T14's readings add CPUID 5, 0x19 and
-0x80000001, MSR 0xCF, MSR 0x3A (`rdmsr -a 0x3a`, IA32_FEAT_CTL), the
-split-lock line, and the config's `X86_KERNEL_IBT` and
-`X86_INTEL_MEMORY_PROTECTION_KEYS`, each committed with the test that reads
-it, and `the_t14s_facts_are_linuxs_reading_of_it` holds `T14`'s `feat_ctl`
-to 0x3A's. **Mutation**: an added reading off by one bit reds the test that
-reads it. **Oracle**: that Linux.
+**Exit**: `wt/toyos-linux-sweep`, which holds this section and this slug
+under #915's fence, settles the turbostat readings below.
 
 ## Linux's counter readings, read 2026-10-03
 
@@ -35,9 +23,7 @@ hardware counters (`issues/toyos-explains-itself.md`). Read as
 root under Ubuntu's `6.8.0-142-generic` from 16:22:37 UTC, one after the
 other, and committed whole with their commands in the `SOURCE` beside them:
 turbostat idle and under one `yes` per CPU in `tests/metal/t14-linux/`, which
-`counters_on_metal` prints ToyOS's reading beside, and `perf stat` over the
-msr PMU in `kernel/cpuvuln/fixtures/t14/perf-msr.txt`, which
-`the_t14_has_what_linux_counted_on_it` holds the T14's counter verdict to.
+`counters_on_metal` prints ToyOS's reading beside.
 Idle, per 10 s: busy 0.11 to 0.36%, busy clock 980 to 1668 MHz, TSC 2419
 MHz, SMI 0. Loaded: busy 99.77%, busy clock 3800 MHz for the first two
 intervals, 3555 MHz in the third, then 3075 to 3094 MHz; SMI 0.

diff --git a/issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md b/issues/no-entry-or-switch-clears-the-bhb-fills-the-rsb-or-issues-an-ibpb.md
@@ -20,7 +20,7 @@ the ask is the flag of
 `issues/no-gate-decodes-kernel-elfs-instructions.md`, matches it against
 both of Linux's sequences; on
 every proving machine probes count what
-`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
 selects for it: a clear per syscall where it selects the loop, a fill per
 switch where it selects filling, and two IBPBs over B, C, idle, B, A, idle, A,
 B. **Mutation**: either sequence edited, the clear's condition inverted, no

diff --git a/issues/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md b/issues/no-kvm-runner-has-had-its-cpuid-and-vulnerability-lines-captured.md
diff --git a/issues/no-kvm-runners-cpuid-has-been-read-by-toyos.md b/issues/no-kvm-runners-cpuid-has-been-read-by-toyos.md
@@ -0,0 +1,18 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-29
+---
+
+# No KVM runner's CPUID has been read by ToyOS
+
+The nightly guest suite's KVM shards run on EPYC 7763, 9V74 and 9V45 CPUs
+(nightly run 36496779560), each as `-cpu host,+rdrand,+smap,+fsgsbase,+x2apic,+smep`
+with `-smp cores=N`. Which bits KVM passes through, and whether it enumerates
+`IA32_ARCH_CAPABILITIES`, are unknown: no ToyOS boot on a runner has logged
+them.
+
+**Exit**: a ToyOS guest boot on each runner CPU model logs CPUID leaves 0, 1,
+7.0, 7.2, 0x80000000, 0x80000008 and 0x80000021, MSR 0x10A where it is
+enumerated, and the microcode revision. One fixture per model is committed for
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`.
diff --git a/issues/no-program-runs-with-speculative-store-bypass-disabled.md b/issues/no-program-runs-with-speculative-store-bypass-disabled.md
@@ -13,6 +13,6 @@ The kernel never sets SSBD, so no process can have it. Linux at
 
 **Exit**: on every proving machine a flagged program runs with SSBD set,
 through the control
-`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
 names for its CPU, and so does its child, while an unflagged one runs with it
 clear. **Mutation**: no inheritance. **Oracle**: the CPU's own register.
diff --git a/issues/no-rule-decides-l1tf-mitigation-for-an-affected-intel-cpu.md b/issues/no-rule-decides-l1tf-mitigation-for-an-affected-intel-cpu.md
@@ -0,0 +1,16 @@
+---
+status: open
+kind: defect
+opened: 2026-09-29
+---
+
+# No rule decides L1TF's mitigation for an affected Intel CPU
+
+Nothing in the kernel decides whether a CPU is affected by L1 Terminal Fault
+or what mitigates it. Intel's L1TF guidance prescribes the mitigation for the
+CPUs it lists as affected. No proving machine is known to be one.
+
+**Exit**: the function of
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
+decides L1TF's mitigation from Intel's L1TF guidance for every CPU Intel lists
+as affected. A host test holds that decision to the document.
diff --git a/issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md b/issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md
@@ -14,7 +14,7 @@ unmitigated if firmware left `GDS_MITG_DIS` set. Linux at
 (`arch/x86/kernel/cpu/bugs.c:89,777`).
 
 **Exit**: on every proving machine each CPU's 0x48 holds what
-`issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`
+`issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
 selects for it, on the T14 Linux's read less SSBD; on the T14, the one proving
 machine with GDS, a probe sets `GDS_MITG_DIS` and reads it clear after the
 kernel's write. **Mutation**: the clear deleted. **Oracle**: Linux's reads on

diff --git a/issues/t14-rows-hold-toyos-to-linuxs-choice-or-copy.md b/issues/t14-rows-hold-toyos-to-linuxs-choice-or-copy.md
@@ -8,17 +8,14 @@ opened: 2026-10-10
 
 `reviewer.md`'s **Tests**: a policy another OS chose is never an oracle for what ToyOS's own
 setting must be, and its copy of a fact a primary source states is never an oracle. Two metal
-rows in `tests/toyos.rs` use one:
+rows in `tests/toyos.rs` used one. `counters_on_metal`'s, the request Linux's governor chose,
+went in #915; the other remains:
 
-- `counters_on_metal` holds every CPU's read-back `IA32_HWP_REQUEST` equal to Linux's
-  (`tests/metal/t14-linux/hwp-request.txt`). That value is the request Linux's governor chose, a policy,
-  not a correctness truth.
 - `acpi_tables_on_metal` holds the number of definition blocks the server loaded to
   `T14_DEFINITION_BLOCKS`, the 14 Linux reports loading. The firmware's XSDT and FADT, which the
   kernel already reads, are the primary source of that count.
 
 Owner: the orchestrator, which dispatches the reshape.
 
-**Exit condition**: `counters_on_metal` holds the request to the value the kernel declares, with
-no reference to `hwp-request.txt`; `acpi_tables_on_metal` holds the count to the definition blocks
+**Exit condition**: `acpi_tables_on_metal` holds the count to the definition blocks
 the same boot's firmware tables list, and `T14_DEFINITION_BLOCKS` is deleted.
diff --git a/...es/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md b/...es/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md
@@ -6,7 +6,10 @@ opened: 2026-09-29
 
 # The kernel is at least as secure as Linux on every machine ToyOS supports
 
-Parity with Linux at `Ubuntu-6.8.0-142.142`, pinned by the first issue below,
+Parity with Linux at tag `Ubuntu-6.8.0-142.142`
+(53e5d07aac028a1523ab0b115f079d6d1bc831ef) of
+`https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble`,
+config sha256 3b8533dd9d235ca634ac58f82c5ce1ee35f12ef620693e17033184d2c9ca5890,
 is the floor on every CPU ToyOS supports, and the kernel also takes every
 security feature such a CPU offers. The proving machines are the T14 and
 AMD EPYC KVM guests; the PR gate's TCG model proves wiring only. A
@@ -16,10 +19,11 @@ One line of Linux's is declined, and ToyOS stays below it there: the
 firmware's memory-overwrite request, by the owner's "Keep crash records"
 (`issues/the-loader-never-sets-the-firmwares-memory-overwrite-request.md`).
 
-**Exit**: every issue below is closed, in the order listed.
+**Exit**: every issue below is closed, in the order listed. The T14's Linux
+readings issue is not among them: since #915 it owes no reading this track's
+work needs.
 
-- `issues/linuxs-readings-of-the-t14-and-the-tcg-model-lack-reads-owed-before-the-t14s-wipe.md`
-- `issues/a-pure-function-decides-a-cpus-speculation-mitigations-as-linux-does.md`
+- `issues/a-pure-function-decides-a-cpus-speculation-mitigations-from-its-vendors-guidance.md`
 - `issues/spec-ctrl-and-gds-stay-as-firmware-left-them.md`
 - `issues/no-program-runs-with-speculative-store-bypass-disabled.md`
 - `issues/no-gate-decodes-kernel-elfs-instructions.md`

diff --git a/issues/the-kernel-owns-cpu-performance-state.md b/issues/the-kernel-owns-cpu-performance-state.md
@@ -18,7 +18,7 @@ or read at boot by the declaration's own check before a read can reach it.
 
 Declared and read back: the HWP request, its package's and the energy/
 performance bias, on every CPU that has all of them
-(`toyos_cpuvuln::hwp`). Still to build:
+(`kernel::cpu::hwp`). Still to build:
 
 - **RAPL**: PL1, PL2 and their windows through `MSR_PKG_POWER_LIMIT` and the
   MMIO mirror in the host bridge's MCHBAR, at the bar's values; a limit

diff --git a/issues/the-perf-state-declaration-refuses-hybrid-intel-and-amd-cppc.md b/issues/the-perf-state-declaration-refuses-hybrid-intel-and-amd-cppc.md
@@ -11,14 +11,14 @@ performance controls through CPPC, not HWP. On both the kernel declares no
 performance request, firmware's values stand, and `SYS_COUNTERS` carries no
 power envelope.
 
-The refusals are `toyos_cpuvuln::hwp`'s (`kernel/cpuvuln/src/hwp.rs`):
-- `HwpRefusal::Hybrid`, for CPUID.(7,0):EDX[15]: the declared minimum is a
-  ratio (`MSR_PLATFORM_INFO[47:40]`), and a hybrid CPU's HWP scale is not its
-  ratio scale.
-- `HwpRefusal::NoHwp`, for CPUID.6:EAX[7] clear, which is where an AMD CPU
+The refusals are `kernel::cpu::hwp`'s (`kernel/pure/cpu.rs`):
+- `HwpRefusal::Hybrid`, for CPUID.(07H,0):EDX[15]. No bench ToyOS has is
+  hybrid, so the declaration cannot be measured on one, and the owner ruled
+  no design for a machine that cannot be measured (#915, ruling B).
+- `HwpRefusal::NoHwp`, for CPUID.06H:EAX[7] clear, which is where an AMD CPU
   with CPPC is refused; its controls are not read.
-- `HwpRefusal::NotIntel`, for HWP on any vendor but Intel, because the
-  minimum comes from `MSR_PLATFORM_INFO`, which is Intel's.
+- `HwpRefusal::NotIntel`, for HWP's bits on any vendor but Intel, where SDM
+  Vol. 1 §21.1.1 gives them no meaning.
 
 `control_regs::hwp_declared` logs the refusal once and declares nothing on
 any CPU.