- Spectrum Development - spectrum-os.org

[PATCH] tools: mark start-vmm test as requiring KVM
by Alyssa Ross 14 Jul '25

14 Jul '25

This will tell Nix (on a correctly configured system) that if it doesn't have KVM, it can't build the package, allowing it to fall back to outsourcing it to a remote builder in that case. Ideally, we don't want to have any part of the Spectrum build requiring KVM, but until that's fixed, occurences should at least be correctly marked. Fixes: a4e3a40 ("host/start-vmm: actually run "run" test") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, if you find other occurences of derivations requiring KVM to build, please send a patch like this. :) tools/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/default.nix b/tools/default.nix index 7a2926d..908ec0d 100644 --- a/tools/default.nix +++ b/tools/default.nix @@ -142,7 +142,9 @@ stdenv.mkDerivation (finalAttrs: { } ); - run = runCommand "start-vmm-test" {} '' + run = runCommand "start-vmm-test" { + requiredSystemFeatures = [ "kvm" ]; + } '' ${run-spectrum-vm.override { spectrum-host-tools = finalAttrs.finalPackage; }} > $out base-commit: 9090caebe25310caa80a13787ef58b1f81658a78 -- 2.49.0

1 0

Better FD for the host-side portal code?
by Demi Marie Obenour 14 Jul '25

14 Jul '25

I saw that the host-side portal code uses FD 0 for the listening socket. Would it be better to use a different file descriptor for that? Alternatively, I can dup() /dev/null over stdin. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

Re: [PATCH v9 0/1] virtio-media: Add device specification
by Demi Marie Obenour 09 Jul '25

09 Jul '25

On 7/9/25 05:34, Albert Esteve wrote: > New attempt of including virtio-media > device specification. > > v8->v9: > - Rebased to virtio-1.4 > > v7->v8: > - Merged DQBUF and DQEVENT into the same > item for unsupported ioctls > - Rewrote/clarified a couple paragraphs > based on previous version reviews. > > Virtio-media came from a discussion on virtio-dev > mailing list, which lead to Alex Courbot presenting > virtio-v4l2[1] specification as an alternative to > virtio-video. > > Later, virtio-v4l2 was renamed to virtio-media[2] > and published at: > > https://github.com/chromeos/virtio-media > > The repository above includes a virtio-media driver able > to pass v4l2-compliance when proxying the vivid/vicodec > virtual devices or an actual UVC camera using the > V4L2 vhost device (available in the repository). > It also includes a FFmpeg-based video encoder > device. Steps to reproduce are also detailed[3]. > > Recently, virtio-media has landed in AOSP[4]. > Also the driver patch has been sent to the > kernel, currently in its v2 [5]. > > Furthermore, virtio-media got a proposal to reserve > device ID 48, which was finally approved for > inclusion in v1.4. > > There is some overlap with virtio-video in regards > to which devices it can handle. However, they take > different approaches, potentially making them > the preferable choice for different scenarios. > Furthermore, virtio-media has matured since it > was first presented, and there are public efforts > to have upstream driver and devices. > > But mainly, given that virtio-media will be the virtualization > solution for media devices for ChromeOS, Android, and > possibly others, I think is important that it gets > standardized and included in the specification, > despite the aforementioned overlap. > > Full PDF: https://drive.google.com/file/d/1sDZXWVlvPbHKKguhekCXMzkpNZZ0g3hV/view?usp=… > PDF with the media section only: https://drive.google.com/file/d/1JjOIzecnkFFlpFBRjPQEUyAOD3BDHAdw/view?usp=… > > [1] https://mail.google.com/mail/u/0?ui=2&ik=73ebd65ebd&attid=0.1&permmsgid=msg… > [2] https://www.mail-archive.com/virtio-dev@lists.oasis-open.org/msg12665.html > [3] https://github.com/chromeos/virtio-media/blob/main/TRY_IT_OUT.md > [4] https://cs.android.com/android/platform/superproject/main/+/main:external/v… > [5] https://lore.kernel.org/lkml/20250201-virtio-media-v2-1-ac840681452d@gmail.… > > Albert Esteve (1): > virtio-media: Add virtio media device specification > > conformance.tex | 6 + > content.tex | 1 + > device-types/media/description.tex | 639 ++++++++++++++++++++++ > device-types/media/device-conformance.tex | 15 + > device-types/media/driver-conformance.tex | 11 + > 5 files changed, 672 insertions(+) > create mode 100644 device-types/media/description.tex > create mode 100644 device-types/media/device-conformance.tex > create mode 100644 device-types/media/driver-conformance.tex It's probably too late, but I have some serious concerns about this device. Specifically: 1. I don't see a reasonable way to support untrusted virtio-media devices. v4l2 has too many ioctls and I can't realistically see a way to enforce that the return values from all of them are consistent with each other. It is possible to only allow a fixed format (such as uncompressed ARGB) and only allow the video source and/or sink to provide resolutions and frame rates, but this means losing a lot of performance and abandoning any attempt at zero-copy. The use-case for untrusted virtio-media devices is not confidential computing, but rather disaggregated systems where video sources (like webcams) may be attached to untrusted virtual machines. 2. v4l2 is a chatty protocol and using it implies a lot of guest <=> host round-trips. This is bad for performance. Is this overhead actually significant, and if so, are there plans to reduce it? -- Sincerely, Demi Marie Obenour (she/her/hers)

2 2

Building image fails on btrfs due to mkfs.erofs xattr limitation
by Demi Marie Obenour 05 Jul '25

05 Jul '25

Unless extended attributes are disabled (with -x-1), mkfs.erofs fails when the source is a BTRFS filesystem. This prevents the Spectrum image from being built. Using -x-1 seems to produce a working installer, though I only smoke tested it (by trying the example VMs). -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

[PATCH] Run PipeWire and WirePlumber in the VMs
by Demi Marie Obenour 04 Jul '25

04 Jul '25

WirePlumber is completely overkill as a session manager here, and ideally a trivial session manager would be used instead. I did build a Spectrum OS image and found that PipeWire and WirePlumber both successfully started. This does *not* start pipewire-pulse, so programs using PulseAudio won't work. That will come later. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/Makefile | 16 +++++++++++++-- img/app/default.nix | 5 ++++- img/app/etc/fstab | 5 +++-- .../etc/s6-rc/app/dependencies.d/wireplumber | 0 .../app/dependencies.d/wireplumber.license | 2 ++ img/app/etc/s6-rc/directories/type | 1 + img/app/etc/s6-rc/directories/type.license | 2 ++ img/app/etc/s6-rc/directories/up | 11 ++++++++++ .../s6-rc/pipewire/dependencies.d/directories | 0 .../dependencies.d/directories.license | 2 ++ img/app/etc/s6-rc/pipewire/notification-fd | 1 + .../s6-rc/pipewire/notification-fd.license | 2 ++ img/app/etc/s6-rc/pipewire/run | 20 +++++++++++++++++++ img/app/etc/s6-rc/pipewire/type | 1 + img/app/etc/s6-rc/pipewire/type.license | 2 ++ .../dependencies.d/directories | 0 .../dependencies.d/directories.license | 2 ++ img/app/etc/s6-rc/wayland-proxy-virtwl/run | 11 ---------- .../etc/s6-rc/wireplumber/dependencies.d/dbus | 0 .../wireplumber/dependencies.d/dbus.license | 2 ++ .../s6-rc/wireplumber/dependencies.d/pipewire | 0 .../dependencies.d/pipewire.license | 2 ++ img/app/etc/s6-rc/wireplumber/run | 4 ++++ img/app/etc/s6-rc/wireplumber/type | 1 + img/app/etc/s6-rc/wireplumber/type.license | 2 ++ 25 files changed, 78 insertions(+), 16 deletions(-) create mode 100644 img/app/etc/s6-rc/app/dependencies.d/wireplumber create mode 100644 img/app/etc/s6-rc/app/dependencies.d/wireplumber.license create mode 100644 img/app/etc/s6-rc/directories/type create mode 100644 img/app/etc/s6-rc/directories/type.license create mode 100644 img/app/etc/s6-rc/directories/up create mode 100644 img/app/etc/s6-rc/pipewire/dependencies.d/directories create mode 100644 img/app/etc/s6-rc/pipewire/dependencies.d/directories.license create mode 100644 img/app/etc/s6-rc/pipewire/notification-fd create mode 100644 img/app/etc/s6-rc/pipewire/notification-fd.license create mode 100644 img/app/etc/s6-rc/pipewire/run create mode 100644 img/app/etc/s6-rc/pipewire/type create mode 100644 img/app/etc/s6-rc/pipewire/type.license create mode 100644 img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories create mode 100644 img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories.license create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/dbus create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/dbus.license create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire.license create mode 100644 img/app/etc/s6-rc/wireplumber/run create mode 100644 img/app/etc/s6-rc/wireplumber/type create mode 100644 img/app/etc/s6-rc/wireplumber/type.license diff --git a/img/app/Makefile b/img/app/Makefile index c827fd3..07fdf6f 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -83,22 +83,34 @@ build/rootfs.erofs: ../../scripts/make-erofs.sh $(VM_FILES) $(VM_BUILD_FILES) bu VM_S6_RC_FILES = \ etc/s6-rc/app/dependencies.d/dbus \ etc/s6-rc/app/dependencies.d/wayland-proxy-virtwl \ + etc/s6-rc/app/dependencies.d/wireplumber \ etc/s6-rc/app/run \ etc/s6-rc/app/type \ etc/s6-rc/dbus/notification-fd \ etc/s6-rc/dbus/run \ etc/s6-rc/dbus/type \ + etc/s6-rc/directories/type \ + etc/s6-rc/directories/up \ etc/s6-rc/mdevd-coldplug/dependencies \ etc/s6-rc/mdevd-coldplug/type \ etc/s6-rc/mdevd-coldplug/up \ etc/s6-rc/mdevd/notification-fd \ etc/s6-rc/mdevd/run \ etc/s6-rc/mdevd/type \ + etc/s6-rc/ok-all/contents \ + etc/s6-rc/ok-all/type \ + etc/s6-rc/pipewire/dependencies.d/directories \ + etc/s6-rc/pipewire/notification-fd \ + etc/s6-rc/pipewire/run \ + etc/s6-rc/pipewire/type \ + etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories \ etc/s6-rc/wayland-proxy-virtwl/notification-fd \ etc/s6-rc/wayland-proxy-virtwl/run \ etc/s6-rc/wayland-proxy-virtwl/type \ - etc/s6-rc/ok-all/contents \ - etc/s6-rc/ok-all/type + etc/s6-rc/wireplumber/dependencies.d/dbus \ + etc/s6-rc/wireplumber/dependencies.d/pipewire \ + etc/s6-rc/wireplumber/run \ + etc/s6-rc/wireplumber/type build/etc/s6-rc: $(VM_S6_RC_FILES) mkdir -p $$(dirname $@) diff --git a/img/app/default.nix b/img/app/default.nix index a196205..32ddb67 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -8,7 +8,7 @@ pkgsStatic.callPackage ( { lib, stdenvNoCC, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux , busybox, cacert, dejavu_fonts, execline, kmod, linux_latest, mdevd, s6 -, s6-linux-init, xdg-desktop-portal-spectrum, +, s6-linux-init, xdg-desktop-portal-spectrum }: let @@ -48,6 +48,9 @@ let pkgs.xwayland pkgs.xdg-desktop-portal pkgs.xdg-desktop-portal-gtk + # Depends on pulseaudio libs + pkgs.pipewire + pkgs.wireplumber ]; })).fhsenv; in diff --git a/img/app/etc/fstab b/img/app/etc/fstab index a95088b..40aa3bd 100644 --- a/img/app/etc/fstab +++ b/img/app/etc/fstab @@ -1,7 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> proc /proc proc defaults 0 0 -devpts /dev/pts devpts defaults,gid=4,mode=620 0 0 +devpts /dev/pts devpts defaults,gid=4,mode=620 0 0 tmpfs /dev/shm tmpfs defaults 0 0 sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 +tmpfs /tmp tmpfs defaults,mode=1755 0 0 +tmpfs /run tmpfs defaults 0 0 diff --git a/img/app/etc/s6-rc/app/dependencies.d/wireplumber b/img/app/etc/s6-rc/app/dependencies.d/wireplumber new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/app/dependencies.d/wireplumber.license b/img/app/etc/s6-rc/app/dependencies.d/wireplumber.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/app/dependencies.d/wireplumber.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/directories/type b/img/app/etc/s6-rc/directories/type new file mode 100644 index 0000000..bdd22a1 --- /dev/null +++ b/img/app/etc/s6-rc/directories/type @@ -0,0 +1 @@ +oneshot diff --git a/img/app/etc/s6-rc/directories/type.license b/img/app/etc/s6-rc/directories/type.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/directories/type.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/directories/up b/img/app/etc/s6-rc/directories/up new file mode 100644 index 0000000..2396fad --- /dev/null +++ b/img/app/etc/s6-rc/directories/up @@ -0,0 +1,11 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# +# Directory creation (if it's copyrightable): +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2022 Unikie + +if { mkdir -m 1755 /tmp/.X11-unix } +if { mkdir -m 0755 /run/user } +if { mkdir -m 0700 /run/user/0 } diff --git a/img/app/etc/s6-rc/pipewire/dependencies.d/directories b/img/app/etc/s6-rc/pipewire/dependencies.d/directories new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/pipewire/dependencies.d/directories.license b/img/app/etc/s6-rc/pipewire/dependencies.d/directories.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/dependencies.d/directories.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/pipewire/notification-fd b/img/app/etc/s6-rc/pipewire/notification-fd new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/notification-fd @@ -0,0 +1 @@ +5 diff --git a/img/app/etc/s6-rc/pipewire/notification-fd.license b/img/app/etc/s6-rc/pipewire/notification-fd.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/pipewire/run b/img/app/etc/s6-rc/pipewire/run new file mode 100644 index 0000000..c0b55a1 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/run @@ -0,0 +1,20 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> + +s6-ipcserver-socketbinder -B /run/user/0/pipewire-0 +fdmove -c 3 0 + +s6-ipcserver-socketbinder -B /run/user/0/pipewire-0-manager +fdmove -c 4 0 + +redirfd -r 0 /dev/null + +# Notify readiness. +if { fdmove 1 5 echo } +fdclose 5 + +export LISTEN_FDS 2 +getpid LISTEN_PID +pipewire diff --git a/img/app/etc/s6-rc/pipewire/type b/img/app/etc/s6-rc/pipewire/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/type @@ -0,0 +1 @@ +longrun diff --git a/img/app/etc/s6-rc/pipewire/type.license b/img/app/etc/s6-rc/pipewire/type.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/type.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories b/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories.license b/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/etc/s6-rc/wayland-proxy-virtwl/run index 7b80343..c1e0e08 100755 --- a/img/app/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/etc/s6-rc/wayland-proxy-virtwl/run @@ -1,17 +1,6 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> -# -# Directory creation (if it's copyrightable): -# SPDX-License-Identifier: MIT -# SPDX-FileCopyrightText: 2022 Unikie - -foreground { mkdir /tmp/.X11-unix } -foreground { mkdir /run/user } -foreground { - umask 077 - mkdir /run/user/0 -} s6-ipcserver-socketbinder -B /run/user/0/wayland-0 fdmove -c 3 0 diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus b/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus.license b/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire b/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire.license b/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> diff --git a/img/app/etc/s6-rc/wireplumber/run b/img/app/etc/s6-rc/wireplumber/run new file mode 100644 index 0000000..e721d8d --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/run @@ -0,0 +1,4 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +wireplumber diff --git a/img/app/etc/s6-rc/wireplumber/type b/img/app/etc/s6-rc/wireplumber/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/type @@ -0,0 +1 @@ +longrun diff --git a/img/app/etc/s6-rc/wireplumber/type.license b/img/app/etc/s6-rc/wireplumber/type.license new file mode 100644 index 0000000..c4a0586 --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/type.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> base-commit: 979bd3090215048fc6815abb2189b4d1809c98ef -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

Re: [PATCH] Documentation: request patches not to be PGP signed
by Alyssa Ross 28 Jun '25

28 Jun '25

This patch has been committed as dc112f871ccf037c918b90d813b807259b4a3ba1, which can be viewed online at https://spectrum-os.org/git/spectrum/commit/?id=dc112f871ccf037c918b90d813b…. This is an automated message. Send comments/questions/requests to: Alyssa Ross <hi(a)alyssa.is>

1 0

[PATCH 0/8] Change serial getty instances dynamically
by Alyssa Ross 28 Jun '25

28 Jun '25

The host system is supposed to provide a shell on whatever serial devices are configured as the active kernel consoles. Previously, the system made the assumption that the active console would never change after boot, but in reality devices can be added and removed later than that. One situation in which this happened is when a serial device was configured whose driver was not built in to the kernel, but loaded as a module after the console was checked by rc.init. This series fixes that by creating and destroying instances of the serial-getty service whenever the active kernel consoles change, and adds a regression test. Since this is the second test that involves running a full Spectrum system in a VM, most of the series has ended up being refactoring the first such test, so that code can be shared with this new one. Yureka, I don't know whether this is the issue you were encountering when you tried debugging the Weston issue over serial, but maybe worth a try? I suspect not though, because if I recall correctly you weren't even getting kernel logs? This was the only issue I could find trying to reproduce the problem in QEMU. Alyssa Ross (8): host/rootfs: poll active consoles for serial getty release/checks/integration: init from networking release/checks/integration: use default Meson timeout release/checks/integration: extract config struct release/checks/integration: run from tmpdir release/checks/integration: name QEMU arg pointers release/checks/integration: extract library release/checks/integration: test late serial host/rootfs/Makefile | 1 + host/rootfs/default.nix | 8 +- .../service/serial-getty-generator/run | 43 +++ host/rootfs/etc/s6-linux-init/scripts/rc.init | 9 - release/checks/default.nix | 4 +- release/checks/integration/default.nix | 88 +++++ release/checks/integration/late-serial.c | 15 + release/checks/integration/lib.c | 221 ++++++++++++ release/checks/integration/lib.h | 20 ++ release/checks/integration/meson.build | 21 ++ release/checks/integration/meson_options.txt | 6 + release/checks/integration/networking.c | 138 +++++++ release/checks/networking/default.nix | 62 ---- release/checks/networking/test.c | 337 ------------------ release/checks/pkg-tests.nix | 2 +- 15 files changed, 560 insertions(+), 415 deletions(-) create mode 100755 host/rootfs/etc/s6-linux-init/run-image/service/serial-getty-generator/run create mode 100644 release/checks/integration/default.nix create mode 100644 release/checks/integration/late-serial.c create mode 100644 release/checks/integration/lib.c create mode 100644 release/checks/integration/lib.h create mode 100644 release/checks/integration/meson.build create mode 100644 release/checks/integration/meson_options.txt create mode 100644 release/checks/integration/networking.c delete mode 100644 release/checks/networking/default.nix delete mode 100644 release/checks/networking/test.c base-commit: 42887a0331fd058ee0930fd5209fc3265565c3a8 -- 2.49.0

2 14

Virtio-IOMMU interrupt remapping design
by Demi Marie Obenour 17 Jun '25

17 Jun '25

Virtio-IOMMU interrupt remapping turned out to be much harder than I realized. The main problem is that interrupt remapping is set up very early in boot. In fact, Linux calls the interrupt remapping probe function from the APIC initialization code: x86_64_probe_apic -> enable_IR_x2apic -> irq_remapping_prepare(). This is almost certainly much before PCI has been initialized. Also, the order in which devices will be initialized is not something Linux guarantees at all, which is a problem because interrupt remapping must be initialized before drivers start setting up interrupts. Otherwise, the interrupt remapping table won't include entries for already-existing interrupts, and things will either break badly, not get the benefit of interrupt remapping security-wise, or both. The reason I expect this doesn't cause problems for address translation is that the IOMMU probably starts in bypass mode by default, meaning that all DMA is permitted. If the IOMMU is only used by VFIO or IOMMUFD, it will not be needed until userspace starts up, which is after the IOMMU has been initialized. This isn't ideal, though, as it means that kernel drivers operate without DMA protection. Is a paravirtualized IOMMU with interrupt remapping something that makes sense? Absolutely! However, the IOMMU should be considered a platform device that must be initialized very early in boot. Using virtio-IOMMU with MMIO transport as the interface might be a reasonable option, but the IOMMU needs to be enumerated via ACPI, device tree, or kernel command line argument. This allows it to be brought up before anything capable of DMA is initialized. Is this the right path to go down? What do others think about this? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 8

[RFC PATCH] Run PipeWire and WirePlumber in the VMs
by Demi Marie Obenour 17 Jun '25

17 Jun '25

WirePlumber is completely overkill as a session manager here, and ideally a trivial session manager would be used instead. Also, this code has seen absolutely no testing beyond "it builds", not least because there is no way to add a virtio-sound device to Cloud Hypervisor yet and I haven't tried using QEMU TCG. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/default.nix | 5 ++++- img/app/etc/fstab | 5 +++-- .../etc/s6-rc/app/dependencies.d/wireplumber | 0 img/app/etc/s6-rc/directories/type | 1 + img/app/etc/s6-rc/directories/up | 11 ++++++++++ .../s6-rc/pipewire/dependencies.d/directories | 0 img/app/etc/s6-rc/pipewire/notification-fd | 1 + img/app/etc/s6-rc/pipewire/run | 20 +++++++++++++++++++ img/app/etc/s6-rc/pipewire/type | 1 + .../dependencies.d/directories | 0 img/app/etc/s6-rc/wayland-proxy-virtwl/run | 11 ---------- .../etc/s6-rc/wireplumber/dependencies.d/dbus | 0 .../s6-rc/wireplumber/dependencies.d/pipewire | 0 img/app/etc/s6-rc/wireplumber/run | 16 +++++++++++++++ img/app/etc/s6-rc/wireplumber/type | 1 + 15 files changed, 58 insertions(+), 14 deletions(-) create mode 100644 img/app/etc/s6-rc/app/dependencies.d/wireplumber create mode 100644 img/app/etc/s6-rc/directories/type create mode 100644 img/app/etc/s6-rc/directories/up create mode 100644 img/app/etc/s6-rc/pipewire/dependencies.d/directories create mode 100644 img/app/etc/s6-rc/pipewire/notification-fd create mode 100644 img/app/etc/s6-rc/pipewire/run create mode 100644 img/app/etc/s6-rc/pipewire/type create mode 100644 img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/dbus create mode 100644 img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire create mode 100644 img/app/etc/s6-rc/wireplumber/run create mode 100644 img/app/etc/s6-rc/wireplumber/type diff --git a/img/app/default.nix b/img/app/default.nix index a196205..32ddb67 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -8,7 +8,7 @@ pkgsStatic.callPackage ( { lib, stdenvNoCC, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux , busybox, cacert, dejavu_fonts, execline, kmod, linux_latest, mdevd, s6 -, s6-linux-init, xdg-desktop-portal-spectrum, +, s6-linux-init, xdg-desktop-portal-spectrum }: let @@ -48,6 +48,9 @@ let pkgs.xwayland pkgs.xdg-desktop-portal pkgs.xdg-desktop-portal-gtk + # Depends on pulseaudio libs + pkgs.pipewire + pkgs.wireplumber ]; })).fhsenv; in diff --git a/img/app/etc/fstab b/img/app/etc/fstab index a95088b..40aa3bd 100644 --- a/img/app/etc/fstab +++ b/img/app/etc/fstab @@ -1,7 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi(a)alyssa.is> proc /proc proc defaults 0 0 -devpts /dev/pts devpts defaults,gid=4,mode=620 0 0 +devpts /dev/pts devpts defaults,gid=4,mode=620 0 0 tmpfs /dev/shm tmpfs defaults 0 0 sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 +tmpfs /tmp tmpfs defaults,mode=1755 0 0 +tmpfs /run tmpfs defaults 0 0 diff --git a/img/app/etc/s6-rc/app/dependencies.d/wireplumber b/img/app/etc/s6-rc/app/dependencies.d/wireplumber new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/directories/type b/img/app/etc/s6-rc/directories/type new file mode 100644 index 0000000..bdd22a1 --- /dev/null +++ b/img/app/etc/s6-rc/directories/type @@ -0,0 +1 @@ +oneshot diff --git a/img/app/etc/s6-rc/directories/up b/img/app/etc/s6-rc/directories/up new file mode 100644 index 0000000..2396fad --- /dev/null +++ b/img/app/etc/s6-rc/directories/up @@ -0,0 +1,11 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# +# Directory creation (if it's copyrightable): +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2022 Unikie + +if { mkdir -m 1755 /tmp/.X11-unix } +if { mkdir -m 0755 /run/user } +if { mkdir -m 0700 /run/user/0 } diff --git a/img/app/etc/s6-rc/pipewire/dependencies.d/directories b/img/app/etc/s6-rc/pipewire/dependencies.d/directories new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/pipewire/notification-fd b/img/app/etc/s6-rc/pipewire/notification-fd new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/notification-fd @@ -0,0 +1 @@ +5 diff --git a/img/app/etc/s6-rc/pipewire/run b/img/app/etc/s6-rc/pipewire/run new file mode 100644 index 0000000..c0b55a1 --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/run @@ -0,0 +1,20 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> + +s6-ipcserver-socketbinder -B /run/user/0/pipewire-0 +fdmove -c 3 0 + +s6-ipcserver-socketbinder -B /run/user/0/pipewire-0-manager +fdmove -c 4 0 + +redirfd -r 0 /dev/null + +# Notify readiness. +if { fdmove 1 5 echo } +fdclose 5 + +export LISTEN_FDS 2 +getpid LISTEN_PID +pipewire diff --git a/img/app/etc/s6-rc/pipewire/type b/img/app/etc/s6-rc/pipewire/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/img/app/etc/s6-rc/pipewire/type @@ -0,0 +1 @@ +longrun diff --git a/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories b/img/app/etc/s6-rc/wayland-proxy-virtwl/dependencies.d/directories new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/etc/s6-rc/wayland-proxy-virtwl/run index 7b80343..c1e0e08 100755 --- a/img/app/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/etc/s6-rc/wayland-proxy-virtwl/run @@ -1,17 +1,6 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> -# -# Directory creation (if it's copyrightable): -# SPDX-License-Identifier: MIT -# SPDX-FileCopyrightText: 2022 Unikie - -foreground { mkdir /tmp/.X11-unix } -foreground { mkdir /run/user } -foreground { - umask 077 - mkdir /run/user/0 -} s6-ipcserver-socketbinder -B /run/user/0/wayland-0 fdmove -c 3 0 diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus b/img/app/etc/s6-rc/wireplumber/dependencies.d/dbus new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire b/img/app/etc/s6-rc/wireplumber/dependencies.d/pipewire new file mode 100644 index 0000000..e69de29 diff --git a/img/app/etc/s6-rc/wireplumber/run b/img/app/etc/s6-rc/wireplumber/run new file mode 100644 index 0000000..6d6a549 --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/run @@ -0,0 +1,16 @@ +#!/bin/execlineb -P +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2023-2024 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# +# Directory creation (if it's copyrightable): +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2022 Unikie + +foreground { mkdir /tmp/.X11-unix } +foreground { mkdir /run/user } +foreground { + umask 077 + mkdir /run/user/0 +} + diff --git a/img/app/etc/s6-rc/wireplumber/type b/img/app/etc/s6-rc/wireplumber/type new file mode 100644 index 0000000..5883cff --- /dev/null +++ b/img/app/etc/s6-rc/wireplumber/type @@ -0,0 +1 @@ +longrun -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

Virtio interrupt remapping
by Demi Marie Obenour 16 Jun '25

16 Jun '25

I’m working on virtio-IOMMU interrupt remapping for Spectrum OS [1], and am running into a problem. All of the current interrupt remapping drivers use __init code during initialization, and I’m not sure how to plumb the struct virtio_device * into the IOMMU initialization code. What is the proper way to do this, where “proper” means that it doesn’t do something disgusting like “stuff the virtio device in a global variable”? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 4