Zainium OS kernel
=================

This repository holds what boots Zainium OS: the Linux kernel, the boot
loader and the firmware.

    linux-kernel/     Linux 7.3.1, from the vanilla sources on kernel.org
    limine/           the limine tool, and limine-boot with its boot files
    linux-firmware/   firmware for laptops and desktops
    sof-firmware/     Intel laptop sound
    wireless-regdb/   the WiFi regulatory database

The recipe in linux-kernel/ makes three packages from one tree:

    linux-kernel           the kernel (linux-zainium) and its fallback copy
                           (linux-panic), installed on the EFI partition
    linux-kernel-modules   the modules, in /overlayer/syshub/drivers/modules
    linux-headers          the userspace API headers, for the userland

The kernel's name is set once, as _kernel in the recipe. Its release is
that name and the series, for example linux-zainium-7.3, so the module
directory stays the same across point releases.

What the recipe changes
-----------------------

    0001-zainium-system-paths.patch   firmware, script interpreters, init,
                                      modprobe, reboot and depmod under
                                      /overlayer/syshub
    0002-zainium-module-dir.patch     modules in /overlayer/syshub/drivers/modules
    0003-ovl-sealed-mount.patch       the "sealed" OverlayFS mount option
    zainium.config                    Zainium's kernel configuration (Rust, BTF)
    zainium-ipe.pol                   the IPE policy built into the kernel

The kernel is built for generic x86-64, so it runs on any 64-bit CPU.
The build adds -O3, transparent hugepages and zstd for zram.

The sealed overlay
------------------

/overlayer/syshub is an overlay of the base with the installed software on
top. A plain read-only overlay can be remounted writable by root, and its
upper layer must not change while it is mounted. A sealed overlay is
read-only for good, while zex installs straight into its upper layer: new,
replaced and removed files show through at once, and programs already
running keep working. See Documentation/filesystems/overlayfs.rst in the
patch, and https://zainiumdynamics.tech/docs/kernel

Signed modules
--------------

Modules are signed during the build and lockdown refuses any other, so a
kernel only loads the modules of its own build. linux-kernel and
linux-kernel-modules always go out and are installed as a pair.

Building and testing
--------------------

CI builds every pull request and boots the kernel in QEMU with a test
init. A push to master is built, tested and published; installed systems
get it with "elevate zex kernel --u".

Staying current
---------------

Every Thursday at 10:00 Pakistan time, kernel-bump.yml checks kernel.org.
A newer release of the same series is taken at once, a new series from
its first point release. If every patch still applies, the recipe is
bumped on master ("linux-kernel: bump to <version>") and CI builds it. If
a patch no longer applies, the job fails and the patch is updated by hand.
It can also be started from the Actions tab.

License
-------

The patches are GPL-2.0, like the kernel.