osbench: the benches are each other's LAN peer, and the internet is an explicit evidence run

Cargo.toml

@@ -146,6 +146,7 @@ members = [
     "tests/guest/kernelprobe",
     "tests/guest/metalprobe",
     "tests/guest/osbench",
+    "tests/guest/osbench/compare",
     "tests/guest/osbench/lan",
     "tests/guest/osbench/rules",
     "tests/guest/pciholder",

issues/netstack-sends-tcp-at-a-third-of-what-the-t14s-wired-link-carries.md

@@ -0,0 +1,48 @@
+---
+status: open
+kind: defect
+opened: 2026-10-24
+---
+
+# netstack sends TCP at a third of what the T14's wired link carries
+
+On the T14's I219, a ToyOS TCP sender moves 41 MB/s where the same
+program under the bench's Linux moves 113 MB/s on the same path and the
+same peer. Received TCP is at parity on that path, so the link, the peer
+and the access point are not the limit.
+
+**Measured** on 2026-10-24 with `osbench lan` at `d99ef5a35`. The path is
+the T14's I219 at 1000 Mb/s, through the access point, to the AMD bench's
+Linux `osbench-peer` on its Wi-Fi. Each cell is one run's p50 of five 3 s
+rounds:
+
+| | ToyOS (3 runs) | Linux (4 runs) |
+|---|---|---|
+| `lan.wired.tcp.upload`, MB/s | 41, 48, 31 | 113, 113, 114, 113 |
+| `lan.wired.tcp.download`, MB/s | 112, 112, 109 | 112, 110, 109, 112 |
+
+- No ToyOS round reached a Linux one: ToyOS's rounds ran 31 to 59 MB/s and
+  Linux's 112 to 114. The exact rank test over the runs gives p = 1/35.
+- The same runs' HTTPS upload to the public internet took 1.40 times
+  Linux's time.
+
+Evidence: `ToyOSOrg/evidence` branch `pr-1065`, `r3/`.
+
+Where the time goes is not measured. These are candidates to measure first,
+not findings:
+
+- every sent byte's copies through a kernel pipe
+  (`issues/netstack-moves-every-byte-through-two-kernel-pipes.md`);
+- the I219 transmit path's `TXDCTL` and `TIDV` setup
+  (`issues/the-intel-driver-writes-txdctl-and-tidv-against-the-82574-datasheets-newer-revision.md`);
+- the send window and the ACK clocking.
+
+The clock does not separate the two systems. Each upload row's own
+readings, `mhz` just after it and `mhz_settled` before it, were about
+1.6 GHz under ToyOS (settled 1.6, 1.8 or 3.8 GHz). Under Linux they were
+1.5 GHz (settled 1.5 or 4.2 GHz), and Linux still moved 113 MB/s. At most,
+the clock matters through what ToyOS spends per byte sent.
+
+**Exit**: `osbench_lan` on the T14 reads `lan.wired.tcp.upload` within
+Linux's run-to-run range on the same path, or the cause is named and owned
+by its own issue.

issues/no-published-run-compares-toyos-with-linux-on-one-machine.md

@@ -24,11 +24,24 @@ its groups:
 - an idle minute's package energy: `energy.idle_60s.package`;
 - the machine's PCI, USB, NVMe and cpuidle identity: `identity`, with no
   serial number or network identifier;
-- the wired LAN's TCP round trip and throughput, and Wi-Fi's under Linux:
-  `lan.wired.*`, `lan.wifi.*`, against `osbench-peer` on another machine;
+- TCP connect, round trip and throughput between the two benches:
+  `lan.wired.*`, `lan.wifi.*`, the bench under test against the
+  `osbench-peer` the other bench's Linux runs, each way. ToyOS and Linux on
+  one path are the comparison, and Linux's runs on it its ceiling and its
+  noise; `osbench-compare` reads the runs, interleaved, four of each at least
+  for its exact test to resolve a difference. `lan` and `internet` run only
+  by name, each its own metal row, since they need another party;
 - a short CPU crunch, one thread then all, that stops at TjMax less 15 C
   where the package's temperature can be read: `crunch.*`.
 
+`internet.*`, HTTPS to Cloudflare's speed test, is exploratory evidence of a
+path neither system owns, run only when a pass names its row: no automated
+test depends on the public internet.
+
+The first paired session (`ToyOSOrg/evidence` branch `pr-1065`, `r3/`) put
+ToyOS's T14 LAN download and 64 B round trip at Linux's and its upload at
+a third of it (`issues/netstack-sends-tcp-at-a-third-of-what-the-t14s-wired-link-carries.md`).
+
 The cryptographic rows are not osbench's. AES-GCM, ChaCha20-Poly1305,
 SHA-256 and the rest were measured under Linux on both benches against ring,
 OpenSSL and AWS-LC by the crypto oracle probe, and that table is the
@@ -51,7 +64,9 @@ comparison until it can:
   1.7-1.9 GHz, which
   `issues/the-t14s-thermal-modes-do-not-move-its-package-power-limits.md`
   would explain: ToyOS refuses the firmware's PL1 and PL2 writes.
-- **Wi-Fi**: `issues/there-is-no-wifi.md`.
+- **Wi-Fi**: `issues/there-is-no-wifi.md`. The T14's `lan.wifi.*` and every
+  AMD bench `lan.*` and `internet.*` row, whose one network card is its
+  AX200, are measured under Linux alone.
 - **USB, NVMe and cpuidle identity**: their owners serve no program that
   reads them.
 - **Loopback** (`net.*`): netstack refuses 127/8 as a destination.

issues/toyos-crypto-is-in-the-tree-on-par-with-ring-and-secure.md

@@ -64,7 +64,7 @@ review has been done, and passing vectors does not show it is safer than ring.
 | `system/sshserver` | `toyos-ssh`, since the SSH track's stage 2 | none directly; it reaches the crate through `toyos-ssh` |
 | Image and package signing: `lib/update` (the loader, `/system/bin/update`, `build/signing.rs`, `build/root`, #892's repository keys) | the crate's Ed25519 and SHA-2, since #1019; signing and a seed's public key behind `sign`, on the host | stage 6's bench readings |
 | Every SHA-256: the build, `pkg`, `lib/swap`, `system/update`, `lib/update` and the loader | the crate, since #1016: SHA-NI on x86-64, the UEFI loader's in a block that saves the XMM registers it uses; the Armv8 SHA instructions where the target promises them. No slower than `toyos-sha2-hw`, which it replaces, on either bench: on the T14 4.6 times as fast at 64 B and 9 and 6 percent faster at 16 KiB and 1 MiB, on the AMD bench 2.8 times at 64 B, 2 percent at 16 KiB and equal at 1 MiB (#1016's evidence) | nothing |
-| ToyOS's own HTTPS clients. On the host: the build's `ureq` (`build/release.rs`) and doom's build script (`apps/doom/build.rs`). In a guest, none today: `https_tls13` and `pkg install <url>` are stages 3 and 5 of `issues/the-internet-clients-work-unchanged.md` | the host's two: the crate's rustls provider through ureq's `rustls-no-provider`, since #1020, its key exchange on X25519 and X25519MLKEM768 alone while the T14 finding stands. In a guest, none | the NIST groups back once the T14 finding is resolved |
+| ToyOS's own HTTPS clients. On the host: the build's `ureq` (`build/release.rs`) and doom's build script (`apps/doom/build.rs`). In a guest, `osbench internet` (`tests/guest/osbench/src/internet.rs`), on ToyOS and Linux alike; `https_tls13` and `pkg install <url>` are stages 3 and 5 of `issues/the-internet-clients-work-unchanged.md` | all three: the crate's rustls provider through ureq's `rustls-no-provider`, since #1020, its key exchange on X25519 and X25519MLKEM768 alone while the T14 finding stands. Each copies the provider's random source and that group filter | the NIST groups back once the T14 finding is resolved, in all three copies, or once in the crate if it comes to own the policy |
 | Wi-Fi's `wlan` (`issues/there-is-no-wifi.md` P6, W2) | nothing yet | PBKDF2-HMAC-SHA1, the 802.11i PRF and RFC 3394 unwrap, which the crate has. AES-CMAC-128, SAE over P-256 by hash-to-element, a public constant-time comparison and a public wiping secret, which it lacks |
 | Encrypted DATA storage (`issues/storage-is-layers-and-a-role-is-a-filesystem.md`): the bcachefs engine's `crypt` unlock and its key holder | nothing yet | scrypt (RFC 7914) at bcachefs's default and smallest costs, which the crate has; ChaCha20 at a chosen block counter and raw Poly1305 for the format's own AEAD composition, which it lacks publicly |
 | `issues/programs-hold-aes-keys-as-key-locker-handles.md` | blocked on a session-long AES key | a TLS client on the crate is that consumer: AES behind a Key Locker handle. SSH holds no AES key |

issues/toyos-uses-what-modern-hardware-offers-for-speed.md

@@ -70,6 +70,14 @@ is nothing to enable.
   `issues/idle-cpus-enter-the-c-states-cst-names.md`'s to answer; that the
   idle state reaches HWP's clock choice is inference. Next: a T14 scout whose
   idle CPUs wait in a deep C-state, read over the same windows.
+  #1065's network session on the T14 (`ToyOSOrg/evidence` branch
+  `pr-1065`, `r3/`) shows the same ceiling in `cpu.clock`, whose 200 probes
+  ramp from idle. Its maximum was 3789 MHz under ToyOS in every group that
+  reached its top, against 4188 to 4190 MHz in every Linux group. That
+  covers three ToyOS and four Linux runs of `osbench lan` and
+  `osbench internet`. The probes' p50, which reads idle and ramp policy
+  (`issues/osbench-times-cpus-leaving-idle-and-not-their-settled-clock.md`),
+  is no reading of this ceiling.
 - **Global-line contention** is bounded at 2 to 3 % of C0 on the T14 and not
   attributed; next, the HITM count attributed to its lines on both benches
   (`issues/per-cpu-scheduler-and-pmm-state-shares-lines-every-cpu-writes.md`).

tests/guest/osbench/Cargo.toml

@@ -8,8 +8,13 @@ license = "MIT OR Apache-2.0"
 [dependencies]
 # The work and crunch groups' compression, pure Rust and the same code on both systems.
 miniz_oxide = "0.9"
-# The crunch group's hashing: ToyOS's own SHA-256, which its ssh server runs.
-toyos-crypto = { path = "../../../lib/crypto" }
+# The crunch group's hashing: ToyOS's own SHA-256, which its ssh server runs;
+# and the internet group's TLS provider, with its types and its entropy.
+toyos-crypto = { path = "../../../lib/crypto", features = ["std", "rustls-provider"] }
+rustls = { version = "0.23.45", default-features = false }
+getrandom = "0.3"
+# The internet group's HTTPS, with webpki's roots, on toyos-crypto's provider.
+ureq = { version = "3", default-features = false, features = ["rustls-no-provider", "rustls-webpki-roots"] }
 # The crunch group's compile-like task: parsing Rust, with no compiler to load.
 syn = { version = "2", default-features = false, features = ["full", "parsing"] }
 # The LAN group's two ends, and the rules readings are judged by.

tests/guest/osbench/compare/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "osbench-compare"
+description = "Compares osbench runs of ToyOS and Linux on one machine: each benchmark's per-run medians, each system's run-to-run range, their ratio and an exact rank test."
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+publish = false
+
+# A package of its own because osbench builds for ToyOS and Linux alone, and
+# its runs are compared wherever they are collected.
+
+[lib]
+doctest = false
+
+[[bin]]
+name = "osbench-compare"
+path = "src/main.rs"