src-up · src-up · Jun 22, 2026 · Jul 2, 2026 · Jun 30, 2026 · Jun 30, 2026
diff --git a/.github/workflows/build-test.sh b/.github/workflows/build-test.sh
@@ -12,10 +12,10 @@ success() { echo >&2 -e "\033[32;1m$1\033[0m"; }
 ARGS=(
     "--optimization=0 -Dopenssl=disabled -Dtpm=true -Dtpm2=enabled"
     "--optimization=s -Dutmp=false -Dc_args='-DOPENSSL_NO_UI_CONSOLE=1'"
-    "--optimization=2 -Ddns-over-tls=openssl"
+    "--optimization=2 -Ddns-over-tls=openssl -Dc_args='-DOPENSSL_NO_DEPRECATED'"
     "--optimization=3 -Db_lto=true -Ddns-over-tls=false"
     "--optimization=3 -Db_lto=false -Dtpm2=disabled -Dlibfido2=disabled -Dp11kit=disabled -Defi=false -Dbootloader=disabled"
-    "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true"
+    "--optimization=3 -Dfexecve=true -Dstandalone-binaries=true -Dstatic-libsystemd=true -Dstatic-libudev=true -Dsystemd-multicall-binary=true"
     "-Db_ndebug=true"
     "--auto-features=disabled -Dcompat-mutable-uid-boundaries=true"
 )

diff --git a/TODO.md b/TODO.md
@@ -938,16 +938,6 @@ SPDX-License-Identifier: LGPL-2.1-or-later
 
 - drop nss-myhostname in favour of nss-resolve?
 
-- drop NV_ORDERLY flag from the product uuid nvpcr. Effect of the flag is that
-  it pushes the thing into TPM RAM, but a TPM usually has very little of that,
-  less than NVRAM. hence setting the flag amplifies space issues. Unsetting the
-  flag increases wear issues on the NVRAM, however, but this should be limited
-  for the product uuid nvpcr, since its only changed once per boot. this needs
-  to be configurable by nvpcr however, as other nvpcrs are different,
-  i.e. verity one receives many writes during system uptime quite
-  possibly. (also, NV_ORDERLY makes stuff faster, and dropping it costs
-  possibly up to 100ms supposedly)
-
 - **EFI:**
   - honor timezone efi variables for default timezone selection (if there are any?)
 

diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
@@ -76,6 +76,10 @@ All tools:
   `/etc/veritytab`. Only useful for debugging. Currently only supported by
   `systemd-veritysetup-generator`.
 
+* `$SYSTEMD_CLONETAB` — if set, use this path instead of
+  `/etc/clonetab`. Only useful for debugging. Currently only supported by
+  `systemd-clonesetup-generator`.
+
 * `$SYSTEMD_DEFAULT_HOSTNAME` — override the compiled-in fallback hostname
   (relevant in particular for the system manager and `systemd-hostnamed`).
   Must be a valid hostname (either a single label or a FQDN).

diff --git a/docs/TPM2_PCR_MEASUREMENTS.md b/docs/TPM2_PCR_MEASUREMENTS.md
@@ -74,6 +74,18 @@ fields are:
   least important ones are skipped gracefully rather than the allocation failing
   arbitrarily. Ties are broken by name. Priority does not affect the NV index,
   the algorithm, or anything measured into the NvPCR.
+* `orderly` — a boolean, defaulting to `true`. It controls whether the NV index
+  is allocated with the `TPMA_NV_ORDERLY` attribute set, which selects whether
+  the TPM keeps the NV index in RAM or in persistent memory (NVRAM). On
+  physical TPMs RAM is typically much more constrained than persistent memory,
+  but persistent memory is subject to wear. We hence prefer `TPMA_NV_ORDERLY`
+  disabled (i.e. NVRAM) for NvPCRs that are written only once each boot — which
+  translates into a conservative number of write cycles over the lifetime of a
+  TPM — but enabled (i.e. RAM) for NvPCRs we expect to be written many times
+  during runtime, so that we minimize wear. This reflects real-life experience
+  where the RAM in TPMs is so constrained that allocating many NvPCRs in TPM
+  RAM simply doesn't work. For now, only the `hardware` NvPCR (which is written
+  just once, early at boot) sets this flag to false.
 
 There's one complication: these NV indexes (like any NV indexes) can be deleted
 by anyone with access to the TPM, and then be recreated. This could be used to

diff --git a/hwdb.d/60-keyboard.hwdb b/hwdb.d/60-keyboard.hwdb
@@ -1432,6 +1432,10 @@ evdev:input:b0005v046DpB317*
  KEYBOARD_KEY_70047=brightnessdown
  KEYBOARD_KEY_70048=brightnessup
 
+# Logitech K950
+evdev:input:b0005v046DpB388*
+ KEYBOARD_KEY_100e1=micmute                             # Mic-mute key emits BTN_0
+
 # iTouch
 evdev:input:b0003v046DpC308*
  KEYBOARD_KEY_90001=shop                                # Shopping

diff --git a/hwdb.d/70-debug-appliance.hwdb b/hwdb.d/70-debug-appliance.hwdb
@@ -5,6 +5,16 @@
 # Permitted keys:
 #   ID_DEBUG_APPLIANCE=?*
 
+# Amlogic devices in burn mode
+# Used to interact with devices over Worldcup / ADNL protocol, see:
+# https://wiki.coreelec.org/coreelec:aml_usb_tool
+#
+# The idVendor and idProduct used are documented in source code here:
+# https://github.com/superna9999/pyamlboot/blob/d2857f4371bcdb7a90d885f24987e03b6d647a8a/PROTOCOL.md?plain=1#L17
+usb:v1B8EpC003*
+usb:v1B8EpC004*
+ ID_DEBUG_APPLIANCE=aml_burn_mode
+
 # Samsung devices in download mode
 # Used to interact with devices over Odin protocol, see:
 # https://en.wikipedia.org/wiki/Odin_(firmware_flashing_software)

diff --git a/man/clonetab.xml b/man/clonetab.xml
@@ -0,0 +1,121 @@
+<?xml version="1.0"?>
+<!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!--
+  SPDX-License-Identifier: LGPL-2.1-or-later
+-->
+<refentry id="clonetab" xmlns:xi="http://www.w3.org/2001/XInclude">
+
+  <refentryinfo>
+    <title>clonetab</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>clonetab</refentrytitle>
+    <manvolnum>5</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>clonetab</refname>
+    <refpurpose>Configuration for dm-clone block devices</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para><filename>/etc/clonetab</filename></para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para>The <filename>/etc/clonetab</filename> file describes
+    dm-clone block devices that are set up during system boot.</para>
+
+    <para>Empty lines and lines starting with the <literal>#</literal>
+    character are ignored. Each of the remaining lines describes one
+    dm-clone device. Fields are delimited by white space.</para>
+
+    <para>Each line is in the form<programlisting><replaceable>name</replaceable> <replaceable>source-device</replaceable> <replaceable>destination-device</replaceable> <replaceable>metadata-device</replaceable> [<replaceable>options</replaceable>]</programlisting>
+    The first four fields are mandatory, the fifth is optional.</para>
+
+    <para>The five fields of <filename>/etc/clonetab</filename> are defined as follows:</para>
+
+    <orderedlist>
+
+      <listitem><para>The first field contains the name of the resulting dm-clone device; its
+      block device is set up below <filename>/dev/mapper/</filename>.</para></listitem>
+
+      <listitem><para>The second field contains a path to the read-only source block device.
+      This is the device whose data is cloned to the destination device. Reads to regions not
+      yet hydrated are served directly from this device.</para></listitem>
+
+      <listitem><para>The third field contains a path to the writable destination block device.
+      The source device's data is copied here in the background. It must be at least as
+      large as the source device.</para></listitem>
+
+      <listitem><para>The fourth field contains a path to the metadata block device. This
+      small device tracks which regions of the destination have been hydrated and is managed
+      exclusively by dm-clone.</para></listitem>
+
+      <listitem><para>The fifth field, if present, contains comma-separated <literal>key=value</literal>
+      options. The following option is supported:</para>
+
+      <variablelist>
+        <varlistentry>
+          <term><option>region_size=<replaceable>BYTES</replaceable></option></term>
+          <listitem><para>Controls the granularity of background hydration copying — how much
+          data is copied at a time. Region size is specified in bytes (standard suffixes like
+          <literal>K</literal>, <literal>M</literal>, <literal>G</literal> are supported), and must
+          correspond to a power of two between 4 KiB and 1 GiB. For example,
+          <literal>region_size=4K</literal> or <literal>region_size=4096</literal> sets a 4 KiB region size.</para>
+
+        <para>
+          One region is the atomic unit dm-clone tracks: it is either fully hydrated (copied to the destination)
+          or not, never partially. If a copy is interrupted mid-region, that whole region is
+          retried from scratch on next boot. Smaller regions mean finer progress tracking;
+          larger regions reduce metadata overhead. Defaults to <literal>4K</literal>. For background, see
+          <ulink url="https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/dm-clone.html">dm-clone kernel documentation</ulink>.
+        </para>
+
+          <xi:include href="version-info.xml" xpointer="v262"/></listitem>
+        </varlistentry>
+      </variablelist>
+
+      <para>If no options are needed, the field may be omitted entirely or
+      <literal>-</literal> may be used as a placeholder.</para>
+      </listitem>
+
+    </orderedlist>
+
+    <para>At early boot and when the system manager configuration is reloaded, this file is
+    translated into native systemd units by
+    <citerefentry><refentrytitle>systemd-clonesetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>Examples</title>
+
+    <example>
+      <title>Simple clone without options</title>
+      <para>Clone a source device to a destination, using a separate metadata device:</para>
+      <programlisting>mydevice /dev/sdb /dev/sdc /dev/sdd</programlisting>
+    </example>
+
+    <example>
+      <title>Clone with custom region size</title>
+      <para>Clone a source device to a destination with a custom region size of 8 KiB:</para>
+      <programlisting>mydevice /dev/sdb /dev/sdc /dev/sdd region_size=8K</programlisting>
+    </example>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-clonesetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry project='die-net'><refentrytitle>dmsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
+</refentry>
diff --git a/man/rules/meson.build b/man/rules/meson.build
@@ -15,6 +15,7 @@ manpages = [
  ['bootup', '7', [], ''],
  ['busctl', '1', [], ''],
  ['capsule@.service', '5', [], ''],
+ ['clonetab', '5', [], ''],
  ['coredump.conf', '5', ['coredump.conf.d'], 'ENABLE_COREDUMP'],
  ['coredumpctl', '1', [], 'ENABLE_COREDUMP'],
  ['crypttab', '5', [], 'HAVE_LIBCRYPTSETUP'],
@@ -1024,6 +1025,11 @@ manpages = [
  ['systemd-cat', '1', [], ''],
  ['systemd-cgls', '1', [], ''],
  ['systemd-cgtop', '1', [], ''],
+ ['systemd-clonesetup',
+  '8',
+  ['systemd-clonesetup@.service'],
+  ''],
+ ['systemd-clonesetup-generator', '8', [], ''],
  ['systemd-coredump',
   '8',
   ['systemd-coredump.socket', 'systemd-coredump@.service'],

diff --git a/man/systemd-clonesetup-generator.xml b/man/systemd-clonesetup-generator.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+<refentry id="systemd-clonesetup-generator" xmlns:xi="http://www.w3.org/2001/XInclude">
+
+  <refentryinfo>
+    <title>systemd-clonesetup-generator</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>systemd-clonesetup-generator</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>systemd-clonesetup-generator</refname>
+    <refpurpose>Unit generator for <filename>/etc/clonetab</filename></refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para><filename>/usr/lib/systemd/system-generators/systemd-clonesetup-generator</filename></para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><filename>systemd-clonesetup-generator</filename> is a generator that translates
+    <filename>/etc/clonetab</filename> into native systemd units early at boot and when
+    configuration of the system manager is reloaded. This will create
+    <citerefentry><refentrytitle>systemd-clonesetup@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    units as necessary.</para>
+
+    <para><filename>systemd-clonesetup-generator</filename> implements
+    <citerefentry><refentrytitle>systemd.generator</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>clonetab</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-clonesetup@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry project='die-net'><refentrytitle>dmsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
+</refentry>
diff --git a/man/systemd-clonesetup.xml b/man/systemd-clonesetup.xml
@@ -0,0 +1,76 @@
+<?xml version="1.0"?>
+<!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+  "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+<refentry id="systemd-clonesetup" xmlns:xi="http://www.w3.org/2001/XInclude">
+
+  <refentryinfo>
+    <title>systemd-clonesetup</title>
+    <productname>systemd</productname>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>systemd-clonesetup</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+
+  <refnamediv>
+    <refname>systemd-clonesetup</refname>
+    <refname>systemd-clonesetup@.service</refname>
+    <refpurpose>Set up and tear down dm-clone devices</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <cmdsynopsis>
+      <command>systemd-clonesetup</command>
+      <arg choice="plain">add</arg>
+      <arg choice="plain">NAME</arg>
+      <arg choice="plain">SOURCE-DEVICE</arg>
+      <arg choice="plain">DEST-DEVICE</arg>
+      <arg choice="plain">META-DEVICE</arg>
+      <arg choice="opt">OPTIONS</arg>
+    </cmdsynopsis>
+
+    <cmdsynopsis>
+      <command>systemd-clonesetup</command>
+      <arg choice="plain">remove</arg>
+      <arg choice="plain">NAME</arg>
+    </cmdsynopsis>
+
+    <para><filename>systemd-clonesetup@.service</filename></para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>Description</title>
+
+    <para><command>systemd-clonesetup</command> is used to set up (with <command>add</command>) and tear down
+    (with <command>remove</command>) dm-clone devices. It is primarily used via
+    <filename>systemd-clonesetup@.service</filename> units generated from
+    <filename>/etc/clonetab</filename> by
+    <citerefentry><refentrytitle>systemd-clonesetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+    </para>
+
+    <para>The positional arguments <parameter>NAME</parameter>, <parameter>SOURCE-DEVICE</parameter>,
+    <parameter>DEST-DEVICE</parameter>, <parameter>META-DEVICE</parameter>, and <parameter>OPTIONS</parameter>
+    have the same meaning as the fields in
+    <citerefentry><refentrytitle>clonetab</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
+
+    <para>Currently, the supported option in <parameter>OPTIONS</parameter> is
+    <varname>region_size=</varname><replaceable>BYTES</replaceable>, where
+    <replaceable>BYTES</replaceable> is measured in bytes (standard suffixes like
+    <literal>K</literal>, <literal>M</literal>, <literal>G</literal> are supported).</para>
+  </refsect1>
+
+  <refsect1>
+    <title>See Also</title>
+    <para><simplelist type="inline">
+      <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>clonetab</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-clonesetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd.generator</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
+      <member><citerefentry project='die-net'><refentrytitle>dmsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+    </simplelist></para>
+  </refsect1>
+
+</refentry>