Downloads — prebuilt RT kernel

The only expensive part of the patch is the toolchain. Building natively on a Pi 4 takes hours; cross-compiling needs an x86 box and a setup session. So here’s the artifact.

Current release: 6.18.38-rt-cuckoo+ — Raspberry Pi’s rpi-6.18.y, bcm2711_defconfig, PREEMPT_RT, plus the IRQF_NO_THREAD patch.

Read this before you download

• Raspberry Pi 4 / arm64 only. The installer refuses to run on anything else, because a bcm2711 kernel on a Pi 5 doesn’t boot — and a black screen on a headless box is exactly the outcome we’re trying to prevent.
• Unsigned, community-built. There is no chain of trust here beyond published checksums and a reproducible recipe. For some environments that is correctly not good enough. Build it yourself — it’s forty minutes, and kernel/build.sh in the repo does the whole thing.
• Verify the checksums. The installer does it for you if SHA256SUMS is present. Don’t skip it.

Artifacts

On the releases page:

File
kernel-rt-6.18.38-rt-cuckoo+.img.gz	The kernel, gzipped (Pi OS’s own format) — 9.8 MB
rt-modules-6.18.38-rt-cuckoo+.tar.gz	Matching modules — 22 MB. Must be installed with the image.
install-rt-kernel.sh	Installer. Adds a new image; never replaces kernel8.img.
SHA256SUMS	Checksums

97533ea81ec56ef090908560e88bccfb2a3f7dfcc3d33a5a1cbe4bbf15163b55  kernel-rt-6.18.38-rt-cuckoo+.img.gz
6af126711eef2ae1651ac48e19353e6830f12fb0ef9a7e265f54c27206a4f0eb  rt-modules-6.18.38-rt-cuckoo+.tar.gz

Install

sha256sum -c SHA256SUMS
sudo ./install-rt-kernel.sh
sudo reboot

Then confirm the patch is actually live. This is the check that matters:

$ uname -a
Linux … 6.18.38-rt-cuckoo+ #1 SMP PREEMPT_RT … aarch64

$ ps -eo comm | grep irq/.*pps
(nothing)

That empty output is the whole point. If an irq/NN-pps@… thread appears, the handler is being force-threaded and your timestamp is being taken behind the scheduler.

Rollback is one line

The installer appends exactly one line to config.txt and never touches kernel8.img. If the Pi doesn’t come back: pull the SD card, open config.txt on any machine (it’s a FAT partition — a Windows laptop will do), delete the kernel=kernel-rt.img line, put the card back. The stock kernel boots.

It also leaves a config.txt.before-rt next to it.

What we actually tested

Not “it compiled.” This exact artifact, installed by that exact script, on a Pi 4:

Boots	yes
uname	6.18.38-rt-cuckoo+ SMP PREEMPT_RT
PPS handler threaded	no — patch confirmed live
chrony	Stratum 1, ref PPS
System offset	273 ns
Raw PPS jitter	952 ns σ over 62 s

One window is not a benchmark

That 952 ns is a single 62-second sample, on a fresh boot under a clear sky, and it is better than the 2568 ns in the measurements. We report it because it’s what we saw — not as a revision of the headline numbers. Those came from an A/B/A protocol, and one lucky window doesn’t overturn them. Sky conditions move this figure around more than most software changes do. Measure your own board.

Reproducing it

git clone https://git.supported.systems/warehack.ing/cuckoo-escapement
cd cuckoo-escapement/kernel && ./build.sh

KBUILD_BUILD_USER, KBUILD_BUILD_HOST and KBUILD_BUILD_TIMESTAMP are pinned in that script. Without them a kernel bakes the builder’s user@hostname and the wall-clock build time into /proc/version — which publishes whoever built it and makes the output unreproducible. Pinned, you should be able to rebuild this and compare bytes. For an unsigned kernel from a website, that’s the only trust story we can honestly offer.

Pinned to a tested version

The published download always points at a kernel we have booted and benchmarked on a Pi 4 — never simply the newest upstream. Shipping a stranger an unvalidated kernel, for a machine they may not be able to physically reach, is not something we’re willing to do.