linux: land the Linux lane on main; terminal linux command, signals to running threads, pipe waits, madvise, VFS store, Process Manager

.github/actions/nonos-setup/action.yml

@@ -89,10 +89,10 @@ runs:
         for t in "${tgts[@]}"; do
           t="$(echo "${t}" | xargs)"
           [ -z "${t}" ] && continue
-          # x86_64-nonos is a JSON build-std target, not a rustup target.
+          # The *-nonos targets are JSON build-std targets, not rustup targets.
           # Only `rustup target add` the registered tier-2/3 targets.
           case "${t}" in
-            x86_64-nonos|x86_64-nonos-user) echo "skip rustup target add ${t} (json build-std target)"; continue ;;
+            x86_64-nonos|x86_64-nonos-user|aarch64-nonos|aarch64-nonos-user) echo "skip rustup target add ${t} (json build-std target)"; continue ;;
           esac
           echo "rustup target add ${t}"
           rustup target add "${t}"

.github/workflows/ci-boot-aarch64.yml

@@ -0,0 +1,93 @@
+name: ci-boot-aarch64
+
+# Reusable aarch64 boot proof. Each cell builds one image through the make
+# target a developer runs, boots it under QEMU virt with a GICv3 and `-cpu max`,
+# and holds the serial log to that cell's claims with
+# scripts/check_aarch64_boot.py:
+#
+#   core               the core profile reaches [KSEC] 4/4, Core ready,
+#                      Entering userspace and [INIT] Starting, in that order,
+#                      with no trap, boot refusal or panic line on the way
+#   trap-sp0           an exception in the SP_EL0 vector group, taken with the
+#                      MMU off, prints one [TRAP] line whose ESR, saved SPSR,
+#                      SP and ELR are the ones the architecture defines for the
+#                      `brk #0x5350` the image carries
+#   trap-kernel-abort  a kernel read of an unmapped address, taken with the MMU
+#                      on, prints the trap contract's report with a same-EL data
+#                      abort, a level 0 translation fault and the address read
+#
+# The runner is x86_64, so QEMU emulates the CPU (TCG). A core boot reaches
+# [INIT] Starting in seconds, so the deadline only bounds a hung boot.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+concurrency:
+  group: ci-boot-aarch64-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  boot-aarch64:
+    name: boot-aarch64 (${{ matrix.cell }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - cell: core
+            target: nonos-mk-arm
+          - cell: trap-sp0
+            target: nonos-mk-arm-trap-sp0
+          - cell: trap-kernel-abort
+            target: nonos-mk-arm-trap-kernel-abort
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
+        with:
+          submodules: recursive
+          persist-credentials: false
+      - uses: ./.github/actions/nonos-setup
+        with:
+          targets: aarch64-nonos
+          module: boot-aarch64
+      - name: Install QEMU for aarch64
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y qemu-system-arm
+          qemu-system-aarch64 --version | head -1
+      - name: Prove the asserter rejects what it must
+        run: python3 scripts/check_aarch64_boot.py --self-test
+      - name: Provision a scratch signing key
+        # The fork dev seed signs the manifest; this lane proves the boot path,
+        # not the trust chain, and the image never leaves the runner.
+        run: bash nonos-ci/setup-signing-key.sh
+      - name: Build the ${{ matrix.cell }} image
+        run: make ${{ matrix.target }} SIGNING_KEY=.keys/signing_key_v1.bin
+      - name: Check the image is a loadable AArch64 kernel
+        run: python3 scripts/check_kernel_elf.py --arch aarch64 --elf target/aarch64-nonos/release/nonos-kernel
+      # The log goes under runner.temp, which starts empty in every job, rather
+      # than under target/, which the setup action restores from cache: a log
+      # left by an earlier run must never be what gets uploaded.
+      - name: Boot the ${{ matrix.cell }} cell
+        run: |
+          set -euo pipefail
+          mkdir -p "${{ runner.temp }}/boot-aarch64"
+          python3 scripts/check_aarch64_boot.py --cell ${{ matrix.cell }} \
+            --elf target/aarch64-nonos/release/nonos-kernel \
+            --log "${{ runner.temp }}/boot-aarch64/${{ matrix.cell }}.log" --deadline 300
+      - name: Upload the serial log
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: boot-aarch64-${{ matrix.cell }}
+          path: ${{ runner.temp }}/boot-aarch64/${{ matrix.cell }}.log
+          retention-days: 14
+          if-no-files-found: error

.github/workflows/ci-build-aarch64.yml

@@ -0,0 +1,50 @@
+name: ci-build-aarch64
+
+# Reusable aarch64 compile proof. Builds the kernel for aarch64-nonos.json with
+# the core profile through the same make target a developer runs, then checks
+# the output is a loadable AArch64 image rather than only that cargo exited 0.
+#
+# What it checks:
+#   - the crate, the arch assembly and the link all succeed for aarch64
+#   - the ELF is an AArch64 static executable whose entry is `_start`
+#   - the entry lies in an executable PT_LOAD and no PT_LOAD is W+X
+#   - the signed manifest and signature sections are present
+# It does not boot the image. That is ci-boot-aarch64.yml's job.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+concurrency:
+  group: ci-build-aarch64-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build-aarch64:
+    name: build-aarch64
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
+        with:
+          submodules: recursive
+          persist-credentials: false
+      - uses: ./.github/actions/nonos-setup
+        with:
+          targets: aarch64-nonos
+          module: build-aarch64
+      - name: Provision a scratch signing key
+        # The build embeds an Ed25519 signature over the kernel manifest, so it
+        # needs a seed. This lane proves compilation, not the trust chain; the
+        # fork dev seed is enough and never reaches a release.
+        run: bash nonos-ci/setup-signing-key.sh
+      - name: Build the aarch64 kernel (microkernel-core + nonos-arch-preview)
+        run: make nonos-mk-arm SIGNING_KEY=.keys/signing_key_v1.bin
+      - name: Check the image is a loadable AArch64 kernel
+        run: python3 scripts/check_kernel_elf.py --arch aarch64 --elf target/aarch64-nonos/release/nonos-kernel

.github/workflows/ci-iso.yml

@@ -88,7 +88,7 @@ jobs:
 
       # Build the flashable image. This drives, in order: build and sign every
       # capsule, enroll the whole set under one STARK policy root and emit each
-      # NZKSTRK1 trailer, build and dual-sign the kernel, enroll the kernel and
+      # NZKSTRK2 trailer, build and dual-sign the kernel, enroll the kernel and
       # embed its STARK self-attestation trailer, build the bootloader with the
       # stark-kernel-attest check and the enrolled kernel root, and package the
       # GPT/FAT32 image.

.github/workflows/ci.yml

@@ -24,6 +24,12 @@ jobs:
   build:
     uses: ./.github/workflows/ci-build.yml
 
+  build-aarch64:
+    uses: ./.github/workflows/ci-build-aarch64.yml
+
+  boot-aarch64:
+    uses: ./.github/workflows/ci-boot-aarch64.yml
+
   # The baked trust ledger must verify on every checkout, not only on a
   # release tag. The keystore re-enrollment shipped with a stale ledger
   # and nothing between merges and the tag ever looked, so the first

.github/workflows/verify.yml

@@ -120,6 +120,18 @@ jobs:
         run: python3 scripts/check_service_caps.py
       - name: Attestation parameters live in one place
         run: python3 scripts/check_attest_params.py
+      - name: Every assumption the security rests on is registered
+        run: python3 tools/nonos-assumptions
+      - name: No new control that exists and does not run
+        run: python3 scripts/check_unenforced.py && python3 scripts/check_unenforced.py --self-test
+      - name: Linux syscall coverage does not fall
+        run: python3 tools/nonos-linux-coverage --baseline scripts/baselines/linux-syscalls.txt
+      - name: Wayland coverage does not fall
+        run: python3 tools/nonos-wayland-coverage --baseline scripts/baselines/wayland-globals.txt
+      - name: Every served Linux call says what it discloses
+        run: python3 tools/ratchets/disclosure.py
+      - name: Every mutant still removes the control it names
+        run: python3 tools/nonos-mutant --check
 
   # The committed verification/evidence/EVIDENCE.json is a machine-readable inventory of
   # everything NONOS proves. Regenerate it from the source tree and fail if it
@@ -353,6 +365,8 @@ jobs:
           - audio_proto_proofs
           - capsule_crypto_proofs
           - aes_proofs
+          - capsule_linux_proofs
+          - market_proofs
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
         with:

.keys/marketplace_operator_ed25519.pub

@@ -0,0 +1,2 @@
+)_„É|b
<C‹Ê=Á€˜Ÿ
+;¡úâT­êŽc

Cargo.toml

@@ -60,6 +60,12 @@ nonos-arch-preview = []
 # no reason to spend it on, and the benchmark lane turns them on.
 nonos-bench-micro = []
 
+# aarch64 boot lane only. Each compiles one deliberate exception into the boot
+# path so the lane can assert the line the kernel prints for it. No profile
+# enables them; a kernel built with one stops at that exception by design.
+nonos-trap-proof-sp0 = []
+nonos-trap-proof-kernel-abort = []
+
 # Bootstrap. `kernel` switches malloc/free to Rust `alloc`; `standalone`
 # brings in the panic handler and global allocator.
 kernel     = []
@@ -113,6 +119,7 @@ nonos-capsule-video-player      = []
 nonos-capsule-about             = []
 nonos-capsule-install           = []
 nonos-capsule-install-cli       = []
+nonos-capsule-app-store         = []
 nonos-capsule-audio-player      = []
 nonos-capsule-hello             = []
 nonos-capsule-boot-splash       = []
@@ -556,6 +563,8 @@ microkernel-desktop-base = [
   "nonos-capsule-about",
   "nonos-capsule-install",
   "nonos-capsule-install-cli",
+  "nonos-capsule-app-store",
+  "nonos-capsule-market",
   "nonos-capsule-linux",
   "nonos-capsule-audio",
   "nonos-capsule-driver-hda",
@@ -824,8 +833,10 @@ nonos-arch-iommu     = []   # src/arch/x86_64/iommu/*
 # machine has with no IOMMU at all. Split from `nonos-arch-iommu` because that
 # flag only decides whether the code compiles; this one decides whether the
 # hardware is put in charge. Part of `microkernel-core`: a build that omits it
-# says so on the console at boot, and the DMA API refuses to hand out a
-# device address it cannot back with a translation.
+# says so on the console at boot, and IommuDomain refuses to allocate, map or
+# attach while no unit translates. MkDmaMap and the direct memory::dma
+# allocators do not ask: they hand out host-physical device addresses with or
+# without a translation.
 nonos-iommu-enforce  = ["nonos-arch-iommu"]
 
 # In-tree crypto, audit-anchored constant-time implementations.
@@ -873,7 +884,9 @@ x25519-dalek     = { version = "2",     default-features = false, features = ["s
 sha3             = { version = "0.10",  default-features = false, optional = true }
 
 # Hashing.
-blake3 = { version = "1.0",  default-features = false }
+# Portable only: the SSE and AVX assembly would use vector registers in the
+# kernel, which runs before a thread's are saved.
+blake3 = { version = "1.0",  default-features = false, features = ["pure"] }
 sha2   = { version = "0.10", default-features = false, features = ["force-soft"] }
 
 # Core utilities used in the kernel tree.
@@ -886,9 +899,6 @@ smoltcp = { version = "0.11", default-features = false, features = ["alloc", "so
 [target.'cfg(target_arch = "x86_64")'.dependencies]
 x86_64 = { version = "0.14", default-features = false, features = ["abi_x86_interrupt", "instructions"] }
 
-[target.'cfg(not(target_arch = "x86_64"))'.dependencies]
-blake3 = { version = "1.0", default-features = false, features = ["pure"] }
-
 [build-dependencies]
 blake3        = { version = "1.5",  default-features = false }
 cc            = "1.1"

Makefile

@@ -116,8 +116,9 @@ qemu-serial: nonos-mk-run-serial-log
 qemu-smp: nonos-mk-run-smp-serial-log
 .PHONY: qemu-smp
 # The same boot with DMA remapping hardware present. Every other lane gives
-# QEMU no IOMMU, so the kernel reports "DMA is unrestricted" and the VT-d
-# bring-up compiled into every image never executes. Slow: VT-d needs TCG.
+# QEMU no IOMMU, so the kernel reports "[IOMMU] vendor=none enforcing=0" and
+# the VT-d bring-up compiled into every image never executes. Slow: VT-d
+# needs TCG.
 qemu-iommu: nonos-mk-run-iommu-serial-log
 .PHONY: qemu-iommu
 # The installer, end to end. `make qemu-install` boots the desktop with a blank
@@ -197,6 +198,11 @@ doctor:
 	else echo "  MISS  rust $(TOOLCHAIN)   (rustup toolchain install $(TOOLCHAIN))"; ok=0; fi; \
 	if [ -n "$(OVMF)" ] && [ -f "$(OVMF)" ]; then echo "  ok    OVMF $(OVMF)"; \
 	else echo "  MISS  OVMF UEFI firmware"; ok=0; fi; \
+	if ! $(QEMU) -accel help 2>/dev/null | grep -qx "$(QEMU_ACCEL)"; then \
+		echo "  MISS  accel $(QEMU_ACCEL)   ($(QEMU) does not offer it; set QEMU_ACCEL)"; ok=0; \
+	elif [ "$(QEMU_ACCEL)" = tcg ]; then \
+		echo "  ok    accel tcg   (no /dev/kvm or hvf: the CPU is emulated and boots are slow)"; \
+	else echo "  ok    accel $(QEMU_ACCEL)"; fi; \
 	echo; \
 	if [ $$ok = 1 ]; then echo "  This host can build and boot NONOS."; \
 	else \