- Spectrum Development - spectrum-os.org

[PATCH v4 0/2] Fix build of forwarder, then improve it
by Demi Marie Obenour 25 Oct '25

25 Oct '25

The first patch fixes the build of the XDP forwarder and ensures it does not include any libc headers. The second patch is a significant cleanup and also should improve performance a tiny amount. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Changes in v4: - Use find_program instead of passing clang path as Meson option. - Use path to Linux kernel package instead of path to include directory. - Split the patch into two parts: a minimal one that just fixes the build, and a bigger one that refactors the BPF programs. - Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20251008-fix-forwarde… Changes in v3: - Fix build. - Clean up XDP programs. - Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251006-fix-forwarde… Changes in v2: - Rewrite the programs to not use the helpers. - This doesn't build. Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251003-fix-forwarde… --- Demi Marie Obenour (2): tools/xdp-forwarder: Do not include libc headers in eBPF programs tools/xdp-forwarder: Simplify forwarder programs tools/default.nix | 11 +- tools/meson.options | 4 + tools/xdp-forwarder/helpers.h | 54 +++++++ tools/xdp-forwarder/meson.build | 11 +- tools/xdp-forwarder/parsing_helpers.h | 274 ---------------------------------- tools/xdp-forwarder/prog_physical.c | 52 ++++--- tools/xdp-forwarder/prog_router.c | 48 ++++-- tools/xdp-forwarder/rewrite_helpers.h | 146 ------------------ 8 files changed, 138 insertions(+), 462 deletions(-) --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251003-fix-forwarder-build-2889ea9aec91 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 4

Re: [systemd-devel] With UEFI secure boot and dm-verity, how does one find the user data partition?
by Demi Marie Obenour 20 Oct '25

20 Oct '25

On 10/20/25 14:20, Andrei Borzenkov wrote: > 20.10.2025 21:02, Demi Marie Obenour wrote: >> On 10/20/25 13:57, Andrei Borzenkov wrote: >>> 20.10.2025 20:33, Demi Marie Obenour wrote: >>>> On 10/19/25 11:36, Feli Flitzberg wrote: >>>>> Hi, long time watcher, first time poster. If the bootloader supports the Discoverable Partitions Specification, all that's needed is the correct partition GUID assigned to every partition. After that, you don't need to pass any partitions or use /etc/fstab as the bootloader will read the disk it came from to mount everything. The only major limitation is that your bootloader partition MUST live on the same disk as root and usr, otherwise they won't be found. Hope this helps! >>>> >>>> How can the OS know which block device the system was booted from? >>>> >>> >>> >>> Bootloader compliant with BLI sets the LoaderDevicePartUUID EFI >>> variable. Otherwise I assume it possible to get the current boot entry >>> number from the BootCurrent EFI variable and parse the corresponding >>> BootXXXX entry. >> >> Is this EFI variable the partition table UUID (which identifies a device) >> or a partition UUID (which does not)? > > It is what is printed by lsblk as partuuid. Unfortunately this isn't what is needed. Looks like UEFI variable storage is the best option. -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3

[PATCH] tools/xdp-forwarder: Fix build
by Demi Marie Obenour 18 Oct '25

18 Oct '25

Clang complains that it can't fine gnu-stubs32.h. Drop the ICMP parsing code to avoid this error. No functional change as the code is not actually used. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- tools/xdp-forwarder/parsing_helpers.h | 57 ----------------------------------- 1 file changed, 57 deletions(-) diff --git a/tools/xdp-forwarder/parsing_helpers.h b/tools/xdp-forwarder/parsing_helpers.h index da099346008bd58485af8308feb4d3391ceef8f5..1ea822100fdb9a75c2d28d34d93e6bb2b5d3ae26 100644 --- a/tools/xdp-forwarder/parsing_helpers.h +++ b/tools/xdp-forwarder/parsing_helpers.h @@ -26,8 +26,6 @@ #include <linux/if_packet.h> #include <linux/ip.h> #include <linux/ipv6.h> -#include <linux/icmp.h> -#include <linux/icmpv6.h> #include <linux/udp.h> #include <linux/tcp.h> @@ -46,16 +44,6 @@ struct vlan_hdr { __be16 h_vlan_encapsulated_proto; }; -/* - * Struct icmphdr_common represents the common part of the icmphdr and icmp6hdr - * structures. - */ -struct icmphdr_common { - __u8 type; - __u8 code; - __sum16 cksum; -}; - /* Allow users of header file to redefine VLAN max depth */ #ifndef VLAN_MAX_DEPTH #define VLAN_MAX_DEPTH 2 @@ -175,51 +163,6 @@ static __always_inline int parse_iphdr(struct hdr_cursor *nh, return iph->protocol; } -static __always_inline int parse_icmp6hdr(struct hdr_cursor *nh, - void *data_end, - struct icmp6hdr **icmp6hdr) -{ - struct icmp6hdr *icmp6h = nh->pos; - - if (icmp6h + 1 > data_end) - return -1; - - nh->pos = icmp6h + 1; - *icmp6hdr = icmp6h; - - return icmp6h->icmp6_type; -} - -static __always_inline int parse_icmphdr(struct hdr_cursor *nh, - void *data_end, - struct icmphdr **icmphdr) -{ - struct icmphdr *icmph = nh->pos; - - if (icmph + 1 > data_end) - return -1; - - nh->pos = icmph + 1; - *icmphdr = icmph; - - return icmph->type; -} - -static __always_inline int parse_icmphdr_common(struct hdr_cursor *nh, - void *data_end, - struct icmphdr_common **icmphdr) -{ - struct icmphdr_common *h = nh->pos; - - if (h + 1 > data_end) - return -1; - - nh->pos = h + 1; - *icmphdr = h; - - return h->type; -} - /* * parse_udphdr: parse the udp header and return the length of the udp payload */ --- base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9 change-id: 20251003-fix-forwarder-build-2889ea9aec91 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 6

Build failures against staging
by Yureka 12 Oct '25

12 Oct '25

Hello everyone, I attempted to build a spectrum (rev. c5d5786d3dc938af0b279c542d1e43bce381b4b9) image against nixpkgs staging (rev eb681f8139a93020f51b8256fc7dfe057b44747f) on x86_64. Here are the derivations which failed to build, for further investigation: - /nix/store/cbjmszj7r5r0abka3jsr6pijxba0sd2q-iproute2-6.17.0.drv (pkgsMusl.iproute2) - /nix/store/f1cc5abbfjslqvy6wkzrzsmsjj4hpk6h-openssl-static-x86_64-unknown-linux-musl-3.6.0.drv (pkgsStatic.openssl) The following also fail, but seem to have no specific connection spectrum or pkgsMusl/pkgsStatic (the GNU counterparts are broken on staging with the same error): - /nix/store/g0bklsp2daxxq74pkb3mqjcrb919194i-python3.13-inkex-1.4.2.drv (python3.pkgs.inkex) - /nix/store/nfwcjnbp6rv4cgzrxdqljc1k1h72z3kk-python3.13-cryptography-vectors-46.0.1.drv (python3.pkgs.cryptography.vectors) - /nix/store/36674wi2rkanm2ds2bx1183w7knj9mr0-wasilibc-static-wasm32-unknown-wasi-27.drv (pkgsCross.wasi32.stdenv.cc.libc, needed for firefox) I hope this is useful to catch any problems affecting spectrum before the following staging-next cycle. — Yureka

2 2

[PATCH 0/4] Generate file lists from a script
by Demi Marie Obenour 03 Oct '25

03 Oct '25

Right now, the makefiles in host/rootfs, vm/sys/net, and img/app have manually-maintained lists of files and symlinks. These duplicate the information in the git repository and can easily get out of sync or cause unnecessary merge conflicts. Avoid this problem by moving the files used in the erofs images to an image/ directory and using what Git knows about this directory to generate the lists via a script. This makes maintenance easier and avoids conflating code used in the build (anything not in image/) and code for the image (anything that is in image/). This reveals that there is a lot of duplicated make logic around image generation, so consolidate it in a single makefile that is included by all three of the makefiles. This, in turn, makes tree-wide changes easier, as shown by the final patch in this series. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Demi Marie Obenour (4): Move all files for the image into a subdirectory Generate makefile file lists from a script Common make rules for building erofs images Use /etc/s6-rc/compiled for compiled s6-rc directory Documentation/development/built-in-vms.adoc | 7 + host/rootfs/Makefile | 144 +-------------------- host/rootfs/default.nix | 1 + host/rootfs/file-list.mk | 100 ++++++++++++++ host/rootfs/{ => image}/bin | 0 host/rootfs/{ => image}/etc/fonts/fonts.conf | 0 host/rootfs/{ => image}/etc/fstab | 0 host/rootfs/{ => image}/etc/group | 0 host/rootfs/{ => image}/etc/group.license | 0 host/rootfs/{ => image}/etc/init | 0 host/rootfs/{ => image}/etc/login | 0 host/rootfs/{ => image}/etc/mdev.conf | 0 host/rootfs/{ => image}/etc/mdev/listen | 0 host/rootfs/{ => image}/etc/mdev/net/add | 0 host/rootfs/{ => image}/etc/mdev/wait | 0 host/rootfs/{ => image}/etc/parse-devname | 0 host/rootfs/{ => image}/etc/passwd | 0 host/rootfs/{ => image}/etc/passwd.license | 0 .../etc/s6-linux-init/env/WAYLAND_DISPLAY | 0 .../etc/s6-linux-init/env/WAYLAND_DISPLAY.license | 0 .../etc/s6-linux-init/env/XDG_RUNTIME_DIR | 0 .../etc/s6-linux-init/env/XDG_RUNTIME_DIR.license | 0 .../etc/s6-linux-init/run-image/opengl-driver | 0 .../run-image/service/dbus/notification-fd | 0 .../run-image/service/dbus/notification-fd.license | 0 .../etc/s6-linux-init/run-image/service/dbus/run | 0 .../service/dbus/template/notification-fd | 0 .../service/dbus/template/notification-fd.license | 0 .../run-image/service/dbus/template/run | 0 .../s6-linux-init/run-image/service/getty-tty1/run | 0 .../s6-linux-init/run-image/service/getty-tty2/run | 0 .../s6-linux-init/run-image/service/getty-tty3/run | 0 .../s6-linux-init/run-image/service/getty-tty4/run | 0 .../service/s6-svscan-log/notification-fd | 0 .../service/s6-svscan-log/notification-fd.license | 0 .../run-image/service/s6-svscan-log/run | 0 .../run-image/service/serial-getty-generator/run | 0 .../run-image/service/serial-getty/notification-fd | 0 .../service/serial-getty/notification-fd.license | 0 .../run-image/service/serial-getty/run | 0 .../run-image/service/serial-getty/template/run | 0 .../service/vhost-user-fs/notification-fd | 0 .../service/vhost-user-fs/notification-fd.license | 0 .../run-image/service/vhost-user-fs/run | 0 .../service/vhost-user-fs/template/notification-fd | 0 .../vhost-user-fs/template/notification-fd.license | 0 .../run-image/service/vhost-user-fs/template/run | 0 .../service/vhost-user-gpu/notification-fd | 0 .../service/vhost-user-gpu/notification-fd.license | 0 .../run-image/service/vhost-user-gpu/run | 0 .../service/vhost-user-gpu/template/data/check | 0 .../vhost-user-gpu/template/notification-fd | 0 .../template/notification-fd.license | 0 .../run-image/service/vhost-user-gpu/template/run | 0 .../run-image/service/vhost-user-gpu/template/type | 0 .../service/vhost-user-gpu/template/type.license | 0 .../run-image/service/vmm/notification-fd | 0 .../run-image/service/vmm/notification-fd.license | 0 .../etc/s6-linux-init/run-image/service/vmm/run | 0 .../run-image/service/vmm/template/notification-fd | 0 .../service/vmm/template/notification-fd.license | 0 .../run-image/service/vmm/template/run | 0 .../notification-fd | 0 .../notification-fd.license | 0 .../service/xdg-desktop-portal-spectrum-host/run | 0 .../template/notification-fd | 0 .../template/notification-fd.license | 0 .../xdg-desktop-portal-spectrum-host/template/run | 0 .../{ => image}/etc/s6-linux-init/scripts/rc.init | 2 +- host/rootfs/{ => image}/etc/s6-rc/card0/type | 0 .../{ => image}/etc/s6-rc/card0/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/card0/up | 0 host/rootfs/{ => image}/etc/s6-rc/core/type | 0 .../rootfs/{ => image}/etc/s6-rc/core/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/core/up | 0 host/rootfs/{ => image}/etc/s6-rc/kvm/timeout-up | 0 .../{ => image}/etc/s6-rc/kvm/timeout-up.license | 0 host/rootfs/{ => image}/etc/s6-rc/kvm/type | 0 host/rootfs/{ => image}/etc/s6-rc/kvm/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/kvm/up | 0 .../etc/s6-rc/mdevd-coldplug/dependencies | 0 .../{ => image}/etc/s6-rc/mdevd-coldplug/type | 0 .../etc/s6-rc/mdevd-coldplug/type.license | 0 .../rootfs/{ => image}/etc/s6-rc/mdevd-coldplug/up | 0 .../{ => image}/etc/s6-rc/mdevd/notification-fd | 0 .../etc/s6-rc/mdevd/notification-fd.license | 0 host/rootfs/{ => image}/etc/s6-rc/mdevd/run | 0 host/rootfs/{ => image}/etc/s6-rc/mdevd/type | 0 .../{ => image}/etc/s6-rc/mdevd/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/ok-all/contents | 0 host/rootfs/{ => image}/etc/s6-rc/ok-all/type | 0 .../{ => image}/etc/s6-rc/ok-all/type.license | 0 .../rootfs/{ => image}/etc/s6-rc/static-nodes/type | 0 .../etc/s6-rc/static-nodes/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/static-nodes/up | 0 .../{ => image}/etc/s6-rc/sys-vmms/dependencies | 0 host/rootfs/{ => image}/etc/s6-rc/sys-vmms/type | 0 .../{ => image}/etc/s6-rc/sys-vmms/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/sys-vmms/up | 0 host/rootfs/{ => image}/etc/s6-rc/vm-env/contents | 0 host/rootfs/{ => image}/etc/s6-rc/vm-env/type | 0 .../{ => image}/etc/s6-rc/vm-env/type.license | 0 host/rootfs/{ => image}/etc/s6-rc/vmm-env/contents | 0 host/rootfs/{ => image}/etc/s6-rc/vmm-env/type | 0 .../{ => image}/etc/s6-rc/vmm-env/type.license | 0 .../{ => image}/etc/s6-rc/weston/dependencies | 0 .../{ => image}/etc/s6-rc/weston/notification-fd | 0 .../etc/s6-rc/weston/notification-fd.license | 0 host/rootfs/{ => image}/etc/s6-rc/weston/run | 0 host/rootfs/{ => image}/etc/s6-rc/weston/type | 0 .../{ => image}/etc/s6-rc/weston/type.license | 0 host/rootfs/{ => image}/etc/xdg/weston/autolaunch | 0 host/rootfs/{ => image}/etc/xdg/weston/weston.ini | 0 host/rootfs/{ => image}/lib | 0 host/rootfs/{ => image}/sbin | 0 host/rootfs/{ => image}/usr/bin/assign-devices | 0 .../{ => image}/usr/bin/create-vm-dependencies | 0 host/rootfs/{ => image}/usr/bin/run-appimage | 0 host/rootfs/{ => image}/usr/bin/run-vmm | 0 host/rootfs/{ => image}/usr/bin/vm-console | 0 host/rootfs/{ => image}/usr/bin/vm-import | 0 host/rootfs/{ => image}/usr/bin/vm-start | 0 host/rootfs/{ => image}/usr/bin/vm-stop | 0 host/rootfs/{ => image}/usr/bin/xdg-open | 0 .../org.freedesktop.portal.Documents.service | 0 img/app/Makefile | 98 +------------- img/app/default.nix | 1 + img/app/file-list.mk | 65 ++++++++++ img/app/{ => image}/bin | 0 img/app/{ => image}/etc/dbus-1/session.conf | 0 img/app/{ => image}/etc/fonts/fonts.conf | 0 img/app/{ => image}/etc/fstab | 0 img/app/{ => image}/etc/init | 0 img/app/{ => image}/etc/mdev.conf | 0 img/app/{ => image}/etc/mdev/iface | 0 img/app/{ => image}/etc/mdev/listen | 0 img/app/{ => image}/etc/mdev/virtiofs | 0 img/app/{ => image}/etc/mdev/wait | 0 img/app/{ => image}/etc/passwd | 0 img/app/{ => image}/etc/passwd.license | 0 img/app/{ => image}/etc/pipewire/pipewire.conf | 0 img/app/{ => image}/etc/resolv.conf | 0 .../etc/s6-linux-init/env/DBUS_SESSION_BUS_ADDRESS | 0 .../env/DBUS_SESSION_BUS_ADDRESS.license | 0 img/app/{ => image}/etc/s6-linux-init/env/DISPLAY | 0 .../etc/s6-linux-init/env/DISPLAY.license | 0 .../etc/s6-linux-init/env/GTK_USE_PORTAL | 0 .../etc/s6-linux-init/env/GTK_USE_PORTAL.license | 0 .../s6-linux-init/env/NIX_XDG_DESKTOP_PORTAL_DIR | 0 .../env/NIX_XDG_DESKTOP_PORTAL_DIR.license | 0 .../etc/s6-linux-init/env/WAYLAND_DISPLAY | 0 .../etc/s6-linux-init/env/WAYLAND_DISPLAY.license | 0 .../etc/s6-linux-init/env/XDG_RUNTIME_DIR | 0 .../etc/s6-linux-init/env/XDG_RUNTIME_DIR.license | 0 .../s6-linux-init/run-image/service/getty-hvc0/run | 0 .../s6-linux-init-shutdownd/notification-fd | 0 .../notification-fd.license | 0 .../run-image/service/s6-linux-init-shutdownd/run | 0 .../{ => image}/etc/s6-linux-init/scripts/rc.init | 2 +- .../etc/s6-linux-init/scripts/rc.shutdown | 0 .../etc/s6-linux-init/scripts/rc.shutdown.final | 0 .../{ => image}/etc/s6-rc/app/dependencies.d/dbus | 0 .../etc/s6-rc/app/dependencies.d/pipewire | 0 .../s6-rc/app/dependencies.d/wayland-proxy-virtwl | 0 img/app/{ => image}/etc/s6-rc/app/run | 0 img/app/{ => image}/etc/s6-rc/app/type | 0 img/app/{ => image}/etc/s6-rc/app/type.license | 0 img/app/{ => image}/etc/s6-rc/dbus/notification-fd | 0 .../etc/s6-rc/dbus/notification-fd.license | 0 img/app/{ => image}/etc/s6-rc/dbus/run | 0 img/app/{ => image}/etc/s6-rc/dbus/type | 0 img/app/{ => image}/etc/s6-rc/dbus/type.license | 0 .../etc/s6-rc/mdevd-coldplug/dependencies | 0 img/app/{ => image}/etc/s6-rc/mdevd-coldplug/type | 0 .../etc/s6-rc/mdevd-coldplug/type.license | 0 img/app/{ => image}/etc/s6-rc/mdevd-coldplug/up | 0 .../{ => image}/etc/s6-rc/mdevd/notification-fd | 0 .../etc/s6-rc/mdevd/notification-fd.license | 0 img/app/{ => image}/etc/s6-rc/mdevd/run | 0 img/app/{ => image}/etc/s6-rc/mdevd/type | 0 img/app/{ => image}/etc/s6-rc/mdevd/type.license | 0 img/app/{ => image}/etc/s6-rc/ok-all/contents | 0 img/app/{ => image}/etc/s6-rc/ok-all/type | 0 img/app/{ => image}/etc/s6-rc/ok-all/type.license | 0 .../{ => image}/etc/s6-rc/pipewire/notification-fd | 0 .../etc/s6-rc/pipewire/notification-fd.license | 0 img/app/{ => image}/etc/s6-rc/pipewire/run | 0 img/app/{ => image}/etc/s6-rc/pipewire/type | 0 .../{ => image}/etc/s6-rc/pipewire/type.license | 0 .../etc/s6-rc/wayland-proxy-virtwl/notification-fd | 0 .../wayland-proxy-virtwl/notification-fd.license | 0 .../{ => image}/etc/s6-rc/wayland-proxy-virtwl/run | 0 .../etc/s6-rc/wayland-proxy-virtwl/type | 0 .../etc/s6-rc/wayland-proxy-virtwl/type.license | 0 .../etc/s6-rc/wireplumber/dependencies.d/dbus | 0 .../etc/s6-rc/wireplumber/dependencies.d/pipewire | 0 img/app/{ => image}/etc/s6-rc/wireplumber/run | 0 img/app/{ => image}/etc/s6-rc/wireplumber/type | 0 .../{ => image}/etc/s6-rc/wireplumber/type.license | 0 .../{ => image}/etc/ssl/certs/ca-certificates.crt | 0 .../wireplumber.conf.d/99_spectrum.conf | 0 .../etc/xdg/xdg-desktop-portal/portals.conf | 0 img/app/{ => image}/sbin | 0 lib/common.mk | 1 + lib/erofs.mk | 51 ++++++++ scripts/genfiles.awk | 115 ++++++++++++++++ vm/sys/net/Makefile | 68 +--------- vm/sys/net/default.nix | 1 + vm/sys/net/file-list.mk | 41 ++++++ vm/sys/net/{ => image}/bin | 0 vm/sys/net/{ => image}/etc/dbus-1/system.conf | 0 vm/sys/net/{ => image}/etc/fstab | 0 vm/sys/net/{ => image}/etc/init | 0 vm/sys/net/{ => image}/etc/mdev.conf | 0 vm/sys/net/{ => image}/etc/mdev/iface | 0 vm/sys/net/{ => image}/etc/nftables.conf | 0 vm/sys/net/{ => image}/etc/passwd | 0 vm/sys/net/{ => image}/etc/passwd.license | 0 .../s6-linux-init/run-image/service/getty-hvc0/run | 0 .../{ => image}/etc/s6-linux-init/scripts/rc.init | 2 +- .../net/{ => image}/etc/s6-rc/connman/dependencies | 0 vm/sys/net/{ => image}/etc/s6-rc/connman/run | 0 vm/sys/net/{ => image}/etc/s6-rc/connman/type | 0 .../net/{ => image}/etc/s6-rc/connman/type.license | 0 .../net/{ => image}/etc/s6-rc/dbus/notification-fd | 0 .../etc/s6-rc/dbus/notification-fd.license | 0 vm/sys/net/{ => image}/etc/s6-rc/dbus/run | 0 vm/sys/net/{ => image}/etc/s6-rc/dbus/type | 0 vm/sys/net/{ => image}/etc/s6-rc/dbus/type.license | 0 .../etc/s6-rc/mdevd-coldplug/dependencies | 0 .../net/{ => image}/etc/s6-rc/mdevd-coldplug/type | 0 .../etc/s6-rc/mdevd-coldplug/type.license | 0 vm/sys/net/{ => image}/etc/s6-rc/mdevd-coldplug/up | 0 .../{ => image}/etc/s6-rc/mdevd/notification-fd | 0 .../etc/s6-rc/mdevd/notification-fd.license | 0 vm/sys/net/{ => image}/etc/s6-rc/mdevd/run | 0 vm/sys/net/{ => image}/etc/s6-rc/mdevd/type | 0 .../net/{ => image}/etc/s6-rc/mdevd/type.license | 0 vm/sys/net/{ => image}/etc/s6-rc/nftables/type | 0 .../{ => image}/etc/s6-rc/nftables/type.license | 0 vm/sys/net/{ => image}/etc/s6-rc/nftables/up | 0 vm/sys/net/{ => image}/etc/s6-rc/ok-all/contents | 0 vm/sys/net/{ => image}/etc/s6-rc/ok-all/type | 0 .../net/{ => image}/etc/s6-rc/ok-all/type.license | 0 vm/sys/net/{ => image}/etc/s6-rc/sysctl/type | 0 .../net/{ => image}/etc/s6-rc/sysctl/type.license | 0 vm/sys/net/{ => image}/etc/s6-rc/sysctl/up | 0 vm/sys/net/{ => image}/etc/sysctl.conf | 0 vm/sys/net/{ => image}/lib | 0 vm/sys/net/{ => image}/sbin | 0 vm/sys/net/{ => image}/var/run | 0 251 files changed, 400 insertions(+), 299 deletions(-) --- base-commit: 0ac65013a1a29e91ea8476f39113e3598eb0e535 change-id: 20250831-genfiles-46787fc10869 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 50

[PATCH 0/2] scripts/make-erofs.sh: run mkdir/chmod less
by Alyssa Ross 30 Sep '25

30 Sep '25

This is an alternative to Demi's proposal[1] to speed this up. This implementation has the advantage that it does not impose an ordering requirement on the inputs. Nevertheless, it runs just as fast, if not faster (first commit is main; second is Demi's patch; third is this series): | Command | Mean [s] | Min [s] | Max [s] | Relative | |---------------------------+----------------+---------+---------+-------------| | =make (commit = 2551f9e)= | 13.275 ± 0.853 | 11.881 | 16.074 | 1.18 ± 0.11 | | =make (commit = 28fc640)= | 11.467 ± 0.729 | 10.063 | 14.588 | 1.02 ± 0.09 | | =make (commit = 6c3d020)= | 11.215 ± 0.720 | 9.947 | 15.616 | 1.00 | Link: https://spectrum-os.org/lists/archives/spectrum-devel/20250919-less-dirname… [1] Alyssa Ross (2): scripts/make-erofs.sh: run chmod less scripts/make-erofs.sh: run mkdir less scripts/make-erofs.sh | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) base-commit: 2551f9eb1a6c9245699ff5cf77f9957d1e2d14be -- 2.51.0

3 6

This Week in Spectrum, 2025-W39
by Alyssa Ross 29 Sep '25

29 Sep '25

The big news this week is that review of Yureka's XDP forwarding program is complete, and has now been committed to the Spectrum repo[1]. We also saw the usual couple of small cleanups from Demi, several new versions of her script to automatically generate file lists for Makefiles[2], and just a few hours ago, a new version of the udev switch[3]. [1]: https://spectrum-os.org/git/spectrum/commit/?id=535b6bec89a1aae6b0ee9579f9b… [2]: https://spectrum-os.org/lists/archives/spectrum-devel/20250927-genfiles-v6-… [3]: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-0-60… On Friday I gave a talk at the Qubes OS Summit called "Rethinking the Compartmentalization Experience"[4]. Tomorrow (Tuesday, 08:30 UTC) I'll be doing another talk at XDC called "An Upstream-first Approach to Application Virtualization", which will be streamed[5], and on the way back home I'll be stopping by Systems Meetup Dresden[6], where I'll do a lightning talk. [4]: https://www.youtube.com/live/HwisqKFEQ0g?feature=shared&t=16880 [5]: https://live.video.tuwien.ac.at/watch?l=hsJNWfHvxZPnonNLxYNU5Z [6]: https://ukvly.org/

1 0

[PATCH v6 0/4] xdp-forwarder
by Yureka Lilian 27 Sep '25

27 Sep '25

The patches up to and including "vm/sys/net: build against pkgsMusl" can be applied right away, while the last commit ("vm/sys/net: integrate xdp-forwarder") does not make sense without the router. Changes since v5: - fix pkg-tests clang-tidy - re-add hardeningDisable which was accidentally removed in v5 Changes since v4: - Ensure all patches have my Signed-off-by - add native: true to the find_prog(clang) - Remove merge conflicts artifacts in the integration commit Changes since v3: - Apply suggestions from Demi in meson recipe, prog_*.c - Split out the appSupport -> guestSupport rename into a seperate commit - Split out the switch to pkgsMusl into a separate commit with reasoning - rename set_router_iface to set-router-iface Changes since v2: - Switch xdp-forwarder build to meson - Add guest build variant of spectrum-tools Changes since v1: - rebased - apply new uncrustify config - moved xdp-forwarder to tools/ - split integration into separate commit - use linuxHeaders instead of vmlinux.h - use original xdp-tutorial {parsing,rewrite}_helpers.h - inlined the load scripts into /etc/iface/mdev, using /usr/lib/xdp as fixed prefix for finding the XDP progs - removed the README, added a paragraph to architecture doc instead Yureka Lilian (4): tools: add xdp-forwarder docs/architecture: add paragraph about networking vm/sys/net: build against pkgsMusl vm/sys/net: integrate xdp-forwarder Documentation/about/architecture.adoc | 20 ++ pkgs/default.nix | 4 + release/checks/pkg-tests.nix | 1 + tools/default.nix | 21 +- tools/meson.build | 4 + tools/meson_options.txt | 3 + tools/xdp-forwarder/meson.build | 48 +++ tools/xdp-forwarder/parsing_helpers.h | 274 ++++++++++++++++++ tools/xdp-forwarder/prog_physical.c | 39 +++ tools/xdp-forwarder/prog_router.c | 42 +++ tools/xdp-forwarder/rewrite_helpers.h | 146 ++++++++++ tools/xdp-forwarder/set_router_iface.c | 30 ++ vm/sys/net/Makefile | 8 +- vm/sys/net/default.nix | 23 +- vm/sys/net/image/etc/fstab | 2 + vm/sys/net/image/etc/mdev/iface | 27 +- vm/sys/net/image/etc/nftables.conf | 8 - vm/sys/net/image/etc/s6-rc/connman/type | 1 - .../net/image/etc/s6-rc/connman/type.license | 2 - .../net/image/etc/s6-rc/mdevd-coldplug/type | 1 - .../net/image/etc/s6-rc/nftables/type.license | 2 - vm/sys/net/image/etc/s6-rc/nftables/up | 6 - 22 files changed, 652 insertions(+), 60 deletions(-) create mode 100644 tools/xdp-forwarder/meson.build create mode 100644 tools/xdp-forwarder/parsing_helpers.h create mode 100644 tools/xdp-forwarder/prog_physical.c create mode 100644 tools/xdp-forwarder/prog_router.c create mode 100644 tools/xdp-forwarder/rewrite_helpers.h create mode 100644 tools/xdp-forwarder/set_router_iface.c delete mode 100644 vm/sys/net/image/etc/nftables.conf delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type delete mode 100644 vm/sys/net/image/etc/s6-rc/connman/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/mdevd-coldplug/type delete mode 100644 vm/sys/net/image/etc/s6-rc/nftables/type.license delete mode 100644 vm/sys/net/image/etc/s6-rc/nftables/up -- 2.51.0

5 14

[PATCH] Use contents.d for bundles
by Demi Marie Obenour 27 Sep '25

27 Sep '25

contents files are deprecated. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/Makefile | 12 ++++++++---- host/rootfs/image/etc/s6-rc/ok-all/contents | 6 ------ host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug | 0 host/rootfs/image/etc/s6-rc/ok-all/contents.d/sys-vmms | 0 host/rootfs/image/etc/s6-rc/ok-all/contents.d/vm-env | 0 host/rootfs/image/etc/s6-rc/vm-env/contents | 5 ----- host/rootfs/image/etc/s6-rc/vm-env/contents.d/static-nodes | 0 host/rootfs/image/etc/s6-rc/vm-env/contents.d/weston | 0 host/rootfs/image/etc/s6-rc/vmm-env/contents | 6 ------ host/rootfs/image/etc/s6-rc/vmm-env/contents.d/core | 0 host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm | 0 host/rootfs/image/etc/s6-rc/vmm-env/contents.d/static-nodes | 0 img/app/Makefile | 4 +++- img/app/image/etc/s6-rc/ok-all/contents | 6 ------ img/app/image/etc/s6-rc/ok-all/contents.d/app | 0 img/app/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug | 0 img/app/image/etc/s6-rc/ok-all/contents.d/wireplumber | 0 vm/sys/net/Makefile | 3 ++- vm/sys/net/image/etc/s6-rc/ok-all/contents | 5 ----- vm/sys/net/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug | 0 vm/sys/net/image/etc/s6-rc/ok-all/contents.d/sysctl | 0 21 files changed, 13 insertions(+), 34 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 1c6220031ed727c3a3686a43ead37aada6e15b4f..7652515ca27c8feb87e77d0fd79750eda9675c97 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -142,22 +142,26 @@ S6_RC_FILES = \ image/etc/s6-rc/mdevd/notification-fd \ image/etc/s6-rc/mdevd/run \ image/etc/s6-rc/mdevd/type \ - image/etc/s6-rc/ok-all/contents \ + image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug \ + image/etc/s6-rc/ok-all/contents.d/sys-vmms \ + image/etc/s6-rc/ok-all/contents.d/vm-env \ image/etc/s6-rc/ok-all/type \ image/etc/s6-rc/static-nodes/type \ image/etc/s6-rc/static-nodes/up \ image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env \ image/etc/s6-rc/sys-vmms/type \ image/etc/s6-rc/sys-vmms/up \ - image/etc/s6-rc/vm-env/contents \ + image/etc/s6-rc/vm-env/contents.d/static-nodes \ + image/etc/s6-rc/vm-env/contents.d/weston \ image/etc/s6-rc/vm-env/type \ - image/etc/s6-rc/vmm-env/contents \ + image/etc/s6-rc/vmm-env/contents.d/core \ + image/etc/s6-rc/vmm-env/contents.d/kvm \ + image/etc/s6-rc/vmm-env/contents.d/static-nodes \ image/etc/s6-rc/vmm-env/type \ image/etc/s6-rc/weston/dependencies.d/card0 \ image/etc/s6-rc/weston/notification-fd \ image/etc/s6-rc/weston/run \ image/etc/s6-rc/weston/type - # s6-rc-compile's input is a directory, but that doesn't play nice # with Make, because it won't know to update if some file in the # directory is changed, or a file is created or removed in a diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents b/host/rootfs/image/etc/s6-rc/ok-all/contents deleted file mode 100644 index 9f8b0ed66ceedd591ed2f1a7e164d9abcc54cc53..0000000000000000000000000000000000000000 --- a/host/rootfs/image/etc/s6-rc/ok-all/contents +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -# -mdevd-coldplug -sys-vmms -vm-env diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug b/host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents.d/sys-vmms b/host/rootfs/image/etc/s6-rc/ok-all/contents.d/sys-vmms new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents.d/vm-env b/host/rootfs/image/etc/s6-rc/ok-all/contents.d/vm-env new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents deleted file mode 100644 index 580795b1b02bb7a8dff7f872723c678141d4bb70..0000000000000000000000000000000000000000 --- a/host/rootfs/image/etc/s6-rc/vm-env/contents +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -# -static-nodes -weston diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents.d/static-nodes b/host/rootfs/image/etc/s6-rc/vm-env/contents.d/static-nodes new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents.d/weston b/host/rootfs/image/etc/s6-rc/vm-env/contents.d/weston new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents deleted file mode 100644 index ee1e3cfc39d1a6545bbefc3692782b9de6b3ade3..0000000000000000000000000000000000000000 --- a/host/rootfs/image/etc/s6-rc/vmm-env/contents +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -# -core -kvm -static-nodes diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/core b/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/core new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm b/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/static-nodes b/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/static-nodes new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/img/app/Makefile b/img/app/Makefile index 8b9ecf990fe10adb7aa19b46935826d684f10686..db9b53e434b2d018d76d92f7672bdd0718180fbd 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -100,7 +100,9 @@ VM_S6_RC_FILES = \ image/etc/s6-rc/mdevd/notification-fd \ image/etc/s6-rc/mdevd/run \ image/etc/s6-rc/mdevd/type \ - image/etc/s6-rc/ok-all/contents \ + image/etc/s6-rc/ok-all/contents.d/app \ + image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug \ + image/etc/s6-rc/ok-all/contents.d/wireplumber \ image/etc/s6-rc/ok-all/type \ image/etc/s6-rc/pipewire/notification-fd \ image/etc/s6-rc/pipewire/run \ diff --git a/img/app/image/etc/s6-rc/ok-all/contents b/img/app/image/etc/s6-rc/ok-all/contents deleted file mode 100644 index 6788e54384f065890d00d77378ea5c45ec89f61c..0000000000000000000000000000000000000000 --- a/img/app/image/etc/s6-rc/ok-all/contents +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -# -mdevd-coldplug -wireplumber -app diff --git a/img/app/image/etc/s6-rc/ok-all/contents.d/app b/img/app/image/etc/s6-rc/ok-all/contents.d/app new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/img/app/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug b/img/app/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/img/app/image/etc/s6-rc/ok-all/contents.d/wireplumber b/img/app/image/etc/s6-rc/ok-all/contents.d/wireplumber new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/vm/sys/net/Makefile b/vm/sys/net/Makefile index 0277b16f5acfac6c9eaed5f128333d1545e7c9ab..38a9af765683f287d621d5a2107a78c84b9b166e 100644 --- a/vm/sys/net/Makefile +++ b/vm/sys/net/Makefile @@ -73,7 +73,8 @@ VM_S6_RC_FILES = \ image/etc/s6-rc/mdevd/type \ image/etc/s6-rc/nftables/type \ image/etc/s6-rc/nftables/up \ - image/etc/s6-rc/ok-all/contents \ + image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug \ + image/etc/s6-rc/ok-all/contents.d/sysctl \ image/etc/s6-rc/ok-all/type \ image/etc/s6-rc/sysctl/type \ image/etc/s6-rc/sysctl/up diff --git a/vm/sys/net/image/etc/s6-rc/ok-all/contents b/vm/sys/net/image/etc/s6-rc/ok-all/contents deleted file mode 100644 index 221d1429a8293738125f150dfaf5370672814b52..0000000000000000000000000000000000000000 --- a/vm/sys/net/image/etc/s6-rc/ok-all/contents +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -# -mdevd-coldplug -sysctl diff --git a/vm/sys/net/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug b/vm/sys/net/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/vm/sys/net/image/etc/s6-rc/ok-all/contents.d/sysctl b/vm/sys/net/image/etc/s6-rc/ok-all/contents.d/sysctl new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 --- base-commit: 2a6f0ff71f78a19d3227efc460d519cf9c9dfd39 change-id: 20250926-contents-d-21e21701fd35 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

Non-idempotent RUN+= scripts
by Demi Marie Obenour 25 Sep '25

25 Sep '25

There are cases where a RUN+= script needs to do something exactly once each time a device appears, such as binding a different driver to the device. If the udev rule matches based on a property (such as PCI device information) that is set only by the kernel, is it okay to use ACTION=="add" in the rule? The only other options I know of are to either 1. Add additional code to the script to make sure it is idempotent. This might require adding a lock. 2. Use a persistent daemon. Which of these approaches is best? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 3