R5 tracking: A distribution, with systemd

The L4 distribution images boot to multi user mode with systemd.

Items

R5 systemd as PID 1: cgroup v2 controllers, namespaces and pidfds #536 systemd as PID 1: cgroup v2 with all controllers, all namespaces and pidfds. Exit: systemd boots and starts its default units.
R5 eBPF: the interpreter, maps and cgroup programs #537 The eBPF interpreter, maps and cgroup programs. Exit: systemd IP accounting and the device controller work.
R5 netlink: rules, nexthops, generic netlink and ethtool for networkd, resolved and udevd #538 The netlink families for networkd, resolved and udevd. Exit: networkd configures the network and udevd names the devices.
R5 uevents, the keyring, fanotify and inotify #539 uevents, the keyring, fanotify and inotify. Exit: Their LTP tests reach the pass set of the reference.
R5 AppArmor and SELinux: the LSM framework, permissive and then enforcing #540 AppArmor and SELinux, first in permissive mode and then in enforcing mode. Exit: Ubuntu boots with AppArmor enforcing. Fedora boots with SELinux enforcing.
R5 TPM: the CRB and TIS drivers, /dev/tpm0 and /dev/tpmrm0 #541 The TPM driver. Exit: systemd-cryptenroll binds a key to the virtual TPM.
R5 nftables: the hooks, nf_tables, conntrack and NAT #542 nftables. Exit: The nftables test suite reaches the pass set of the reference.
R5 the remaining /sys and /proc files that the images read #543 The remaining /sys and /proc files that the corpus reads. Exit: The L4 trace of each image shows no missing file.
Bench on KVM: will-it-scale for CortenMM and the huge page flush #533 Bench on KVM: will-it-scale for CortenMM and the huge page flush. Exit: The numbers for both backends on x86_64 and arm64 are in tools/bench, and open question 1 (Open question 1: CortenMM or VMAs as the source of truth for address spaces #22) is decided.

Exit criterion

The L4 images boot to multi user mode and pass their smoke tests on both tier 1 architectures: Debian 13, Ubuntu 26.04 and 26.10, Fedora 44, Arch, Alpine 3.22 and NixOS 26.05. The systemd TEST-* integration tests reach the pass set of the reference, apart from the listed exceptions.

If we stop here

We have a kernel that distributions can use in place of Linux in virtual machines.

Refer to spec/22-milestones.md.

Added #533: the bench on KVM for CortenMM and the huge page flush, moved from #405 and #435 in R4. It also decides open question 1 (#22).

Release 0.5.21 is out: https://github.com/tamnd/rukernel/releases/tag/v0.5.21 (#695). It has #691 to #694: the count of the victim of a memory.oom.group kill (#691), the throttle of a cgroup with a cpu.max debt (#692), the AppArmor namespaces and stacks with the regression tests in complain mode (#693), and /dev/tpmrm0, the resource manager of TPM 2.0 (#694).

Item 5 of #541 is partly done in #696: the event log of the firmware at /sys/kernel/security/tpm0/binary_bios_measurements, from the log area of the ACPI TPM2 table on x86-64 or linux,sml-base of the device tree on arm64, as drivers/char/tpm/eventlog of Linux.

x86_64 on server1 (load average 1.7 to 2.2): the log of SeaBIOS has 16 events. tpm2_eventlog replays PCRs 0 to 7, and they are the same as the SHA-256 PCRs of tpm2_pcrread.
arm64 on server2 (load average 11.4 to 18.2): the tpm test passes. QEMU virt with -kernel has no firmware, so there is no log.
Unit tests on server2: rk-drv-tpm 20, rk-frame fdt 6 and xtask 4 pass.

Not done: systemd-analyze pcrs in the systemd boot test with RK_TPM=1 did not run.

The full gate did not run.

#697 adds the flowtables of nf_tables and the flow_offload expression. On x86_64 and arm64, 45 of the 50 tests in the dirs flowtable, listing, owner and cache pass. Before this change, 29 passed. All 15 tests of flowtable now pass. No item is ticked: the item of sets and maps and the full run are still to do.

#698 merged: AppArmor enforce mode for the file and exec rules (#540, item 4). A denial of an open, a read, a write, a lock, a map or an exec gives EACCES and a DENIED record. The boot test apparmor passes on x86_64 and arm64.

#699 adds the crate rk-crypto with SHA-1, SHA-2, HMAC, AES and the modes ECB, CBC, CTR and XTS, as crypto/ of Linux, for #541 (the AF_ALG item). The 13 unit tests with the vectors of crypto/testmgr.h pass. AF_ALG comes in the next two PRs.

Release 0.5.22 is out: https://github.com/tamnd/rukernel/releases/tag/v0.5.22 (#700). It has #696 to #699: the event log of the TPM firmware (#696), the nf_tables flowtables (#697), the AppArmor enforce mode for the file and exec rules (#698), and the crate rk-crypto with SHA, HMAC and AES (#699).

#701 finishes the first part of the verifier. For each program of bpf/test_verifier of the program types of this issue (SOCKET_FILTER, CGROUP_SKB, CGROUP_SOCK, CGROUP_SOCK_ADDR and CGROUP_DEVICE), rukernel now accepts or refuses the program as Linux does, with the same message. It adds state pruning, the Linux rules for back edges with CAP_BPF, the bounds after BPF_JSET and BPF_JMP32, the alignment and context access rules, and BPF_PROG_TEST_RUN. tools/kselftest/bpf.md gives the result.

Test results:

cargo test -p rk-bpf -p rk-abi (server2): 80 and 7 passed. Clippy gives no new warnings. Load of server2: 14.6 to 18.5.
x86_64 kselftest with bpf/test_verifier (server1, load 2.6 to 3.3): Summary: 281 PASSED, 510 SKIPPED, 0 FAILED. Before, 259 passed and 22 failed. The skips are the unprivileged runs, the program types outside this issue, the bpf_loop inline that needs a JIT, and BPF_MAP_TYPE_PERF_EVENT_ARRAY.
x86_64 ltp (server1, load 0.18 to 0.44): bpf_map01, bpf_prog01, bpf_prog02, bpf_prog03 and bpf_prog04 pass. bpf_prog05, bpf_prog06 and bpf_prog07 give TCONF, as on Linux with kernel.unprivileged_bpf_disabled=2.
x86_64 boot-test init with -- only bpf (server1, load 0.03 to 0.11): exit 33, 94 checks ok.
arm64 boot-test aarch64 with RK_AARCH64_TESTS=init and -- only bpf (server2, load 5.4 to 5.7): pass, 94 checks ok.

#702 (#542, nft-26) adds the stateful expressions of sets and elements of nf_tables (counter, quota, limit and connlimit).

Result on x86_64: sets 78 of 93 pass (61 in the report), transactions 37 of 41 (34 in the report). json, maps, nft-f, optimizations and transactions: 105 of 129, 96 before. The inet boot tests pass on x86_64 and arm64.

No item is ticked. The sets and maps groups of the report have more work.

#703 adds the AF_ALG sockets with the type hash, as crypto/af_alg.c and crypto/algif_hash.c, for #541 (the AF_ALG item). LTP af_alg01 passes on x86_64 and arm64. af_alg02 to af_alg06 and af_alg08 give TCONF, as on Linux with the allow list. af_alg07 fails: fchownat on a closed socket does not give ENOENT yet. skcipher comes in the next PR.

Release 0.5.23 is out: https://github.com/tamnd/rukernel/releases/tag/v0.5.23 (#704). It has #701 to #703: the first part of the eBPF verifier, with the result of Linux for test_verifier (#701), the stateful expressions of nf_tables sets and elements and connlimit (#702), and AF_ALG sockets with the type hash (#703).

#705 adds the sdbpf boot test. It runs test-bpf-devices, test-bpf-firewall and test-bpf-foreign-programs of systemd, which use BPF_PROG_ATTACH, BPF_PROG_DETACH, BPF_PROG_QUERY and BPF_LINK_CREATE with the effective arrays. The kernel needed no change.

x86_64 sdbpf on server1: the three tests exit 0, rk-sdbpf: pass, QEMU exit 1. Load average 2.1 to 3.4.
x86_64 init -- only bpf on server1: exit 33, 94 ok. Load average 0.03 to 0.11.
arm64 init -- only bpf on server2: pass, 94 ok. Load average 5.4 to 5.7. xtask has no systemd tests on arm64.

Remaining: systemd logs "Failed to get cgroup ID ... Operation not supported", probably from name_to_handle_at on cgroupfs. systemd ignores it.

#706 adds FAN_REPORT_MNT: a fanotify group marks a mount namespace with FAN_MARK_MNTNS and gets FAN_MNT_ATTACH and FAN_MNT_DETACH with a FAN_EVENT_INFO_TYPE_MNT record. The focused init boot test passes on x86_64 and arm64. LTP fanotify21 passes, and fanotify20 gives TCONF as on Linux 7.3. This completes the fanotify item of #539.

#707 (#542, nft-27) makes the sets of nf_tables with ranges work as nft_set_rbtree.c and nft_set_pipapo.c of Linux: get of a range, overlaps, concatenated ranges, adjacent ranges and the dump order of nft_pipapo_walk.

Result on x86_64: sets 81 of 93 pass (78 before, 61 in the report) and maps 25 of 31, with nft-28 in the same kernel. The inet boot tests pass on x86_64 and arm64.

Release 0.5.24 is out: https://github.com/tamnd/rukernel/releases/tag/v0.5.24 (#708). It has #705 to #707: #705, #706 and #707.

#709 adds the AF_ALG sockets with the type skcipher, as crypto/algif_skcipher.c, for #541 (the AF_ALG item). The ciphers are ecb(aes), cbc(aes), ctr(aes) and xts(aes). LTP af_alg01 passes on x86_64 and arm64, and af_alg02 to af_alg06 and af_alg08 give TCONF, as on Linux 7.3 with the allow list. af_alg07 needs the owner of the inode of a socket, which comes in the next PR.

Navigation Menu

Repository navigation

R5 tracking: A distribution, with systemd #14

Items

Exit criterion

If we stop here

158 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

R5 tracking: A distribution, with systemd #14

Description

Items

Exit criterion

If we stop here

Activity

tamnd commented on Nov 1, 2026

158 remaining items

tamnd commented on Nov 11, 2026

tamnd commented on Nov 11, 2026

tamnd commented on Nov 11, 2026

tamnd commented on Nov 11, 2026

tamnd commented on Nov 11, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

tamnd commented on Nov 12, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions