- Spectrum Development - spectrum-os.org

[PATCH] rootfs: support default package list extension
by Ivan Nikolaenko 09 Jan '23

09 Jan '23

This patch will allow users to add their packages to the Spectrum OS rootfs. To do so, the user needs to declare a variable "additionalPackages" in his overlay with the list of required packages. Please, note that static packages need to be taken from pkgsStatic list, since additionalPackages are added from pkgs list. Signed-off-by: Ivan Nikolaenko <ivan.nikolaenko(a)unikie.com> --- host/rootfs/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 0a84f55..37c820b 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -75,7 +75,8 @@ let CONFIG_RMMOD n ''; }) - ] ++ (with pkgsGui; [ foot westonLite ]); + ] ++ (with pkgsGui; [ foot westonLite ]) + ++ (pkgs.additionalPackages or []); nixosAllHardware = nixos ({ modulesPath, ... }: { imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; -- 2.34.1

1 0

[PATCH] Documentation: Architecture Decision Record
by Ville Ilvonen 06 Jan '23

06 Jan '23

* ADRs based on discussions with Alyssa * A note on ADRs to architecture.adoc Signed-off-by: Ville Ilvonen <ville.ilvonen(a)unikie.com> --- Documentation/architecture.adoc | 13 ++++++++++ ...architecture-decision-record-template.adoc | 13 ++++++++++ .../decisions/001-host-update-mechanism.adoc | 19 ++++++++++++++ .../decisions/002-install-options.adoc | 18 +++++++++++++ Documentation/decisions/003-partitioning.adoc | 25 +++++++++++++++++++ .../004-data-at-rest-encryption.adoc | 16 ++++++++++++ .../005-virtual-machine-manager.adoc | 24 ++++++++++++++++++ .../decisions/006-drivers-on-host.adoc | 17 +++++++++++++ .../decisions/007-USB-virtual-machine.adoc | 14 +++++++++++ ...008-Inter-VM-communication-mechanisms.adoc | 18 +++++++++++++ 10 files changed, 177 insertions(+) create mode 100644 Documentation/decisions/000-lightweight-architecture-decision-record-template.adoc create mode 100644 Documentation/decisions/001-host-update-mechanism.adoc create mode 100644 Documentation/decisions/002-install-options.adoc create mode 100644 Documentation/decisions/003-partitioning.adoc create mode 100644 Documentation/decisions/004-data-at-rest-encryption.adoc create mode 100644 Documentation/decisions/005-virtual-machine-manager.adoc create mode 100644 Documentation/decisions/006-drivers-on-host.adoc create mode 100644 Documentation/decisions/007-USB-virtual-machine.adoc create mode 100644 Documentation/decisions/008-Inter-VM-communication-mechanisms.adoc diff --git a/Documentation/architecture.adoc b/Documentation/architecture.adoc index 157907f..185740c 100644 --- a/Documentation/architecture.adoc +++ b/Documentation/architecture.adoc @@ -20,6 +20,19 @@ devices and provides network services to application VMs). Refer to xref:creating-vms.adoc[Creating VMs] and xref:running-vms.adoc[Running VMs] for more information about using VMs in Spectrum. +== Architecture Decision Record (ADR) + +https://adr.github.io/[Architecturally significant decisions] are +recorded as https://github.com/joelparkerhenderson/architecture-decision-record/blob/ma… ADRs] + +Status of Spectrum OS ADRs: +Accepted - Implemented and likely not to change. +Proposed - Designed and possibly partially implmented. May change. +Other - Not yet in use. + +Comments and contributions to ADRs are welcome. ADRs can be found at +Documentation/decisions + == The Spectrum host system Compartmentalization is implemented using diff --git a/Documentation/decisions/000-lightweight-architecture-decision-record-template.adoc b/Documentation/decisions/000-lightweight-architecture-decision-record-template.adoc new file mode 100644 index 0000000..087ec44 --- /dev/null +++ b/Documentation/decisions/000-lightweight-architecture-decision-record-template.adoc @@ -0,0 +1,13 @@ +# Title + +## Status +What is the status, such as proposed, accepted, rejected, deprecated, superseded, etc.? + +## Context +What is the issue that we're seeing that is motivating this decision or change? + +## Decision +What is the change that we're proposing and/or doing? + +## Consequences +What becomes easier or more difficult to do because of this change? diff --git a/Documentation/decisions/001-host-update-mechanism.adoc b/Documentation/decisions/001-host-update-mechanism.adoc new file mode 100644 index 0000000..03bbae2 --- /dev/null +++ b/Documentation/decisions/001-host-update-mechanism.adoc @@ -0,0 +1,19 @@ +# Host update mechanism + +## Status +Proposed + +## Context +Spectrum OS has no implementation for software update. The host - consisting of +Linux kernel, KVM, cloud-hypervisor and minimal user space tools - software +updates are required to support feature development and security fixes. + +## Decision +A-B partitioning created by Spectrum installer Installer sets up the system on +partition A of the block device A-B update scheme where user (or installer) +writes the update image to partition B Bootloader provides four boot options: +A, A mutable, B, B mutable + +## Consequences +Default boot selection, incremental updates (e.g. overlays), network update +postponed for later. diff --git a/Documentation/decisions/002-install-options.adoc b/Documentation/decisions/002-install-options.adoc new file mode 100644 index 0000000..f5857c5 --- /dev/null +++ b/Documentation/decisions/002-install-options.adoc @@ -0,0 +1,18 @@ +# Install options + +## Status +Proposed + +## Context +Based on identified different audiences for the Spectrum OS release it is +proposed we support three base configurations to use with Spectrum OS in the +first boot. + +## Decision +* Minimal - Spectrum OS host + system VMs: netvm, guivm, usbvm + home-directory +(optionally encrypted - see 004-disk-encryption.md) +* Common - Minimal + browser app VM + 2-3 selected app VMs +* Power - Common + NixOS VM + +## Consequences +Requires first-boot-vm (like wizard) to support user to get started. diff --git a/Documentation/decisions/003-partitioning.adoc b/Documentation/decisions/003-partitioning.adoc new file mode 100644 index 0000000..345619f --- /dev/null +++ b/Documentation/decisions/003-partitioning.adoc @@ -0,0 +1,25 @@ +# Partitioning + +## Status +Proposed + +## Context +Partitions are required to install the Spectrum OS, VMs and store user data. + +## Decision +---- +<blockdevice> # EFI system partition +<blockdevice> # XBOOTLDR +<blockdevice> # A +<blockdevice> # B +# first 32 GB are reserved for Spectrum system +# rest of the disk is reserved for user data +<blockdevice>n-1 # bootstrap user data +<blockdevice>n to the end of disk # user data +---- + +## Consequences +LVM may support resizing - both increasing and decreasing with some limitation +when there's alreay data on volume(s). Does LVM work with all disk types? We +have to implement XBOOTLDR to support EFI system partition created by Windows - +to support dual boot diff --git a/Documentation/decisions/004-data-at-rest-encryption.adoc b/Documentation/decisions/004-data-at-rest-encryption.adoc new file mode 100644 index 0000000..3ed9abb --- /dev/null +++ b/Documentation/decisions/004-data-at-rest-encryption.adoc @@ -0,0 +1,16 @@ +# Data at rest encryption + +## Status +Proposed + +## Context +To support user data and privacy protection, encryption of data at rest is +required. + +## Decision +User data is encrypted. + +## Consequences +Spectrum OS needs to come with enough SW to get the encryption key via different +methods (password, usb, fido, etc.) Can we use dm-crypt for everything instead +of LUKS? diff --git a/Documentation/decisions/005-virtual-machine-manager.adoc b/Documentation/decisions/005-virtual-machine-manager.adoc new file mode 100644 index 0000000..b4af595 --- /dev/null +++ b/Documentation/decisions/005-virtual-machine-manager.adoc @@ -0,0 +1,24 @@ +# Virtual Machine Manager + +## Status +Accepted + +## Context +rust-vmm-based VMM provides memory and concurrency safe solution. +cloud-hypervisor was chosen because firecrack does not support other +virtio-devices than net or block. crosvm was not chosen because cloud-hypervisor +has more flexible IPC mechanisms, more engaging community as LF-project. +cloud-hypervisor has more core features - such as snapshotting, live migration +and more general hot plugging. crosvm supports more devices we will also need. +It was seen easier to port devices from crosvm to cloud-hypervisor than to port +core features from cloud-hypervisor to crosvm. + +## Decision +Spectrum OS design and implementation decision is to use cloud-hypervisor as the +primary VMM. + +## Consequences +We gotta port some stuff from crosvm to cloud-hypervisor. It's easier for +Spectrum to handle virtualization dynamically with cloud-hypervisor. If the +primary VMM, cloud-hypervisor, is exchanged for trials etc. functionality is +expected to break or not supported. diff --git a/Documentation/decisions/006-drivers-on-host.adoc b/Documentation/decisions/006-drivers-on-host.adoc new file mode 100644 index 0000000..052b596 --- /dev/null +++ b/Documentation/decisions/006-drivers-on-host.adoc @@ -0,0 +1,17 @@ +# Drivers on host + +## Status +Accepted + +## Context +To harden the trusted computing base and make it more minimal, the target is to +minimize the amount of drivers on the Spectrum host kernel. + +## Decision +We are aiming to have as few drivers as possible on the host. + +## Consequences +No networking on the host. Responsibilities of the host are expected to get +smaller over time. More flexible management of devices. We need to decouple +device classes - like net, usb, bluetooth and gui - from host to their +respective VMs. diff --git a/Documentation/decisions/007-USB-virtual-machine.adoc b/Documentation/decisions/007-USB-virtual-machine.adoc new file mode 100644 index 0000000..2072427 --- /dev/null +++ b/Documentation/decisions/007-USB-virtual-machine.adoc @@ -0,0 +1,14 @@ +# USB Virtual Machine + +## Status +Proposed + +## Context +To support specific USB devices on specific VMs + +## Decision +The decision is to pass-through USB controller to a VM with authorization +controls inside the VMs to forward a specific USB device using USBIP. + +## Consequences +We need to modify the upstream USBIP daemon to support authorization. diff --git a/Documentation/decisions/008-Inter-VM-communication-mechanisms.adoc b/Documentation/decisions/008-Inter-VM-communication-mechanisms.adoc new file mode 100644 index 0000000..1007037 --- /dev/null +++ b/Documentation/decisions/008-Inter-VM-communication-mechanisms.adoc @@ -0,0 +1,18 @@ +### Inter VM communication mechanisms + +### Status +Proposed + +### Context +Guest VM software needs to communicate with software in other guest VMs + +### Decision +Spectrum provides two mechanism +- TCP/IP with virtio-net +- Wayland with virtio-gpu (nevermind the semantics) for streamed IPC protocol to + send references to shared memory + + +### Consequences +- Examples required on how to write applications which communicate over + virtio-gpu -- 2.36.0

4 9

Overriding Linux kernel in host/rootfs/default.nix
by Ivan Nikolaenko 21 Dec '22

21 Dec '22

Hello everyone. Recently I faced an issue with overriding Linux kernel in rootfs recipe: Rootfs has an attribute kernel in the `let ... in` section, which is used for setting up correct paths to kernel modules in rootfs derivation. But this attribute is also used by the derivation `packagesSysroot` which is used by the derivation `packagesTar`, whiсh, in its turn, used by rootfs derivation. All that derivations introduced in the scope of rootfs derivation (the same `let ... in` section) and are anonymous. What happens when I override kernel attribute of the rootfs derivation: 1. Nix evaluates original host/rootfs/default.nix file and replaces all ${kernel} occurences with the actual value of kernel attribute (which is linux_latest at this moment). 2. Nix sets linux_latest as the input for rootfs and packagesSysroot derivations. 3. Nix evaluates overlay with kernel override and overrides (in fact, introduces new) kernel attribute. 4. Nothing happens after that. Now we have: - `kernel` attribute of rootfs derivation pointing to the imx8 kernel. - `MODULES_ALIAS` and `MODULES_ORDER` variables of rootfs derivation are pointing to linux_latest modules. The root of the issue - line `ln -s ${kernel}/lib/modules ${firmware}/lib/firmware $out/lib` from `packagesSysroot` derivation build command, which creates the /lib link in the rootfs pointing to linux_latest modules. As I found, kernel attribure is not even passed as an attribute to the rootfs derivation file. But it is possible to override MODULES_ALIAS and MODULES_ORDER with correct kernel modules path instead. This also touches initramfs The possible solution is just to override linux_latest, but in this case all VMs will use host kernel version, and we need to avoid this. I would propose something like this for rootfs' default.nix, because this approach solves all kernel issues in an easy and clear way: diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index ad6ea1f..7bf16d2 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -7,7 +7,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeReferencesToFile, s6-rc, tar2ext4 , busybox, cloud-hypervisor, cryptsetup, execline, jq, kmod -, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg +, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg, kernel ? linux_latest }: let @@ -73,8 +73,6 @@ let imports = [ (modulesPath + "/profiles/all-hardware.nix") ]; }); - kernel = pkgs.linux_latest; - appvm = import ../../img/app { inherit config; inherit (foot) terminfo; I played a bit with this, and seems that it worked. Thanks.

2 1

[PATCH 1/2] Add flakes support
by Valentin Kharin 21 Dec '22

21 Dec '22

Signed-off-by: Valentin Kharin <valentin.kharin(a)unikie.com> --- flake.lock | 43 +++++++++++++++++++++++++++++++++ flake.nix | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 114 insertions(+) create mode 100644 flake.lock create mode 100644 flake.nix diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..aa4ee5e --- /dev/null +++ b/flake.lock @@ -0,0 +1,43 @@ +{ + "nodes": { + "flake-utils": { + "locked": { + "lastModified": 1667395993, + "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1669635185, + "narHash": "sha256-vYg6GjnsEWNWt/4TmfFN9WtQmSXb4S796J2UOfyTcW0=", + "ref": "refs/heads/rootfs", + "rev": "3176ddef4b4cec85faa2f49d29ce74816d452dc0", + "revCount": 429673, + "type": "git", + "url": "https://spectrum-os.org/git/nixpkgs/" + }, + "original": { + "ref": "refs/heads/rootfs", + "type": "git", + "url": "https://spectrum-os.org/git/nixpkgs/" + } + }, + "root": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..6e77006 --- /dev/null +++ b/flake.nix @@ -0,0 +1,71 @@ +{ + description = "A compartmentalized operating system"; + + # NOTE: Revision specification format is ?ref=refs%2fheads%2f<BRANCH>&rev=<COMMIT_REVISION> + inputs.nixpkgs.url = + "git+https://spectrum-os.org/git/nixpkgs/?ref=refs%2fheads%2frootfs"; + inputs.flake-utils.url = "github:numtide/flake-utils"; + + outputs = { self, nixpkgs, flake-utils }: + flake-utils.lib.eachDefaultSystem (system: + let + pkgs = nixpkgs.legacyPackages.${system}; + config = { inherit pkgs; }; + lib = pkgs.lib; + + mkEntryPoint = { name ? builtins.baseNameOf path, path + , enableShell ? true, enablePackage ? true }: + let + shell = { + # NOTE: https://stackoverflow.com/a/43850372 + devShells.${name} = + import (path + "/shell.nix") { inherit config; }; + }; + package = { packages.${name} = import path { inherit config; }; }; + in (if enableShell then shell else { }) + // (if enablePackage then package else { }); + + # Entry point is a directory with shell.nix and default.nix + # This function maps every entry point to corresponding devShell and package + mapEntryPoints = epoints: + builtins.foldl' lib.recursiveUpdate { } (map mkEntryPoint epoints); + in lib.recursiveUpdate (mapEntryPoints [ + { + path = ./.; + enablePackage = false; + } + { path = ./host/initramfs; } + { path = ./host/rootfs; } + { path = ./host/start-vm; } + { path = ./img/app; } + { path = ./release/live; } + { path = ./vm/sys/net; } + ]) { + # Add some other flake schema related stuff here. + # NOTE: flake-utils.lib.eachDefaultSystem automagically adds ${system}. + devShells.documentation = import ./Documentation { inherit config; }; + packages.documentation = import ./Documentation { inherit config; }; + + nixosModules = let + substituters = [ "https://cache.dataaturservice.se/spectrum/" ]; + trusted-public-keys = [ + "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" + "spectrum-os.org-1:rnnSumz3+Dbs5uewPlwZSTP0k3g/5SRG4hD7Wbr9YuQ=" + ]; + in { + # NOTE: See https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-substit… + # and https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-trusted… + # to understand difference between these two modules. + binary-cache = { ... }: { + nix.settings = { inherit trusted-public-keys substituters; }; + }; + # Doesn't enabled by + trusted-binary-cache = { ... }: { + nix.settings = { + inherit trusted-public-keys; + trusted-substituters = substituters; + }; + }; + }; + }); +} -- 2.38.1

2 3

Attempting to use virtio-gpu on Apple Silicon
by Alyssa Ross 09 Dec '22

09 Dec '22

Just a quick write-up of my most recent attempt to use virtio-gpu on my M2 MacBook Pro, so I (or anybody else) has something to refer to when trying again in future. I decided to try again today because Asahi Linux just released their GPU driver[1]. The result of the experiment was the discovery that virglrenderer requires OpenGL (ES) 3.1[2], but Asahi's driver currently only supports OpenGL (ES) 2. Quoting the release announcement: > What’s next? Supporting more applications. While OpenGL (ES) 2 > suffices for some applications, newer ones (especially games) demand > more OpenGL features. OpenGL (ES) 3 brings with it a slew of new > features, like multiple render targets, multisampling, and transform > feedback. Work on these features is well under way, but they will each > take a great deal of additional development effort, and all are needed > before OpenGL (ES) 3.0 is available. So for us, it sounds like the thing to do is to wait until newer OpenGL (ES) is supported, and then try again. Anyway, here's what I did: First, I installed installed the GPU drivers on my Asahi install following the instructions in the release announcement. Then, I checked out the wayland branches for Spectrum and Spectrum's Nixpkgs, and grabbed the CARGO_TARGET_*_LINKER and PKG_CONFIG_WAYLAND_PROTOCOLS_PKGDATADIR fixes from commit fb60a5c9473b0796738aa1b1443b8ee5e5ecd1cb to fix the crosvm build on ARM. Then I checked the AsahiLinux/PKGBUILDs repository to see where their mesa sources lived, and found them using commit af7db4903008b012bca13558261d552ed0828b7d from https://gitlab.freedesktop.org/asahi/mesa.git. This Mesa tree was more recent than the one in our Wayland branch, so I needed to backport some Nixpkgs changes to be able to build it. I cherry-picked the following commits: 952dbf0a4ae mesa: build more Vulkan drivers on aarch64-linux 906947555d2 mesa: 22.2.2 -> 22.2.3 7a222ffee31 mesa: fix build on darwin 8d7db0597f9 mesa: rm unused attributes aa8d873a4eb mesa: 22.2.1 -> 22.2.2 33a5279d620 mesa: add vulkanLayers option and default it to device-select, overlay b4b99f16da9 mesa: re-enable video-codecs 445887f636e mesa: 22.1.7 -> 22.2.1 dd3fc581129 mesa: Install radv override configs into $out 40ee116f25a spirv-llvm-translator_14: init at 14.0.0 ea2ca5e6394 spirv-llvm-translator: version depends on llvm version And then I applied Nixpkgs PR #204125, which at the time of writing is still a draft. At this point, I was able to build Mesa 22.3, and then swap in the asahi sources. To get the right drivers to build, I set galliumDrivers to ["swrast" "virgl" "kmsro" "asahi"] and enableGalliumNine to false. Finally, I set up /run/opengl-driver to be a symlink to mesa's drivers output, since that path doesn't usually exist on non-NixOS. To debug why it wasn't working, on Puck's advice I ran the VM in the img/app development shell like this: nix-shell --arg run ../../vm/app/hello-wayland.nix \ --run 'make clean && LIBGL_DEBUG=verbose MESA_DEBUG=1 EGL_LOG_LEVEL=debug make -j4 run VMM=crosvm' This produced (among others) the following message: libEGL debug: context api is 0x40 while config supports 0xd Puck looked up the value of these constants, and determined that it means it doesn't find the required OpenGL (ES) version. [1]: https://asahilinux.org/2022/12/gpu-drivers-now-in-asahi-linux/ [2]: https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/202

2 2

Firefox appVM patches and appVM refactoring
by Vadim Likholetov 07 Dec '22

07 Dec '22

I've made an Firefox appVM for wayland using my waypipe patches. To make this appVM I have had to refactor Spectrum OS appvm infrastructure. The main idea of refactoring is enabling appvm to have a user with normal priviledges, not superuser. Running everything from root is not the best idea for secure OS :-) So now the .nix file for appvm has two sections, one that is executed as root and one as user. Here is the sample of this definitions: { config ? import ../../../nix/eval-config.nix {} }: import ../make-vm.nix { inherit config; } { providers.net = [ "netvm" ]; run = config.pkgs.pkgsStatic.callPackage ( { writeScript }: writeScript "run-root-shell" '' #!/bin/execlineb -P /bin/sh '' ) { }; run-as-user = config.pkgs.pkgsStatic.callPackage ( { writeScript, lynx }: writeScript "run-lynx" '' #!/bin/execlineb -P ${lynx}/bin/lynx https://spectrum-os.org '' ) { }; } Cloud-hypervisor has virtual hardware limitations -- it supports only one console device and only one serial device. SpectrumOS is using serial device for kernel logs of appVM and console device as a console. To have access both to root-executed part and to user-executed part of the VM payload, I installed a tmux on console. Now, when you're running vm-console command you get access to the tmux and have the ability to switch between root and user consoles, that can be useful during debugging VM payload. To run Firefox appVM use vm-start-way command: vm-start-way appvm-firefox :) I beleive that as soon as SpectrumOS features will cover basic user needs it's popularity and community will grow and this will make positive impact on SpectrumOS itself. Using appvm-firefox prototype you may build another wayland-enabled appVMs.

5 17

[PATCH 1/2] Enables forwarding Wayland from appVM to host with waypipe
by vadim likholetov 04 Dec '22

04 Dec '22

Signed-off-by: vadim likholetov <vadim.likholetov(a)unikie.com> --- host/initramfs/extfs.nix | 4 +++- host/rootfs/Makefile | 1 + host/rootfs/default.nix | 4 ++-- host/rootfs/usr/bin/vm-start-way | 10 ++++++++++ img/app/default.nix | 3 +++ vm/app/hello-waypipe.nix | 23 +++++++++++++++++++++++ 6 files changed, 42 insertions(+), 3 deletions(-) create mode 100755 host/rootfs/usr/bin/vm-start-way create mode 100644 vm/app/hello-waypipe.nix diff --git a/host/initramfs/extfs.nix b/host/initramfs/extfs.nix index 5c5850f..f49e519 100644 --- a/host/initramfs/extfs.nix +++ b/host/initramfs/extfs.nix @@ -11,12 +11,13 @@ let appvm-catgirl = import ../../vm/app/catgirl.nix { inherit config; }; appvm-lynx = import ../../vm/app/lynx.nix { inherit config; }; + appvm-hello-waypipe = import ../../vm/app/hello-waypipe.nix { inherit config; }; in runCommand "ext.ext4" { nativeBuildInputs = [ e2fsprogs ]; } '' - mkdir -p root/svc/data/appvm-{catgirl,lynx} + mkdir -p root/svc/data/appvm-{catgirl,lynx,hello-waypipe} cd root tar -C ${netvm} -c data | tar -C svc -x @@ -24,6 +25,7 @@ runCommand "ext.ext4" { tar -C ${appvm-catgirl} -c . | tar -C svc/data/appvm-catgirl -x tar -C ${appvm-lynx} -c . | tar -C svc/data/appvm-lynx -x + tar -C ${appvm-hello-waypipe} -c . | tar -C svc/data/appvm-hello-waypipe -x mkfs.ext4 -d . $out 16T resize2fs -M $out diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 9559c06..06e3e8e 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -39,6 +39,7 @@ FILES = \ usr/bin/lsvm \ usr/bin/vm-console \ usr/bin/vm-start \ + usr/bin/vm-start-way \ usr/bin/vm-stop DIRS = dev etc/s6-linux-init/env ext run proc sys diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 0a84f55..de4a6b6 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -7,7 +7,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeReferencesToFile, s6-rc, tar2ext4 , busybox, cloud-hypervisor, cryptsetup, execline, e2fsprogs, jq, kmod -, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg +, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg, waypipe }: let @@ -49,7 +49,7 @@ let packages = [ cloud-hypervisor e2fsprogs execline jq kmod mdevd s6 s6-linux-init s6-rc - socat start-vm + socat start-vm waypipe (cryptsetup.override { programs = { diff --git a/host/rootfs/usr/bin/vm-start-way b/host/rootfs/usr/bin/vm-start-way new file mode 100755 index 0000000..bda9934 --- /dev/null +++ b/host/rootfs/usr/bin/vm-start-way @@ -0,0 +1,10 @@ +#!/bin/sh +# SPDX-License-Identifier: EUPL-1.2+ + +s6-rc -bu change ext-rc +s6-rc -l /run/s6-rc.ext -u change $1 +ch-remote --api-socket /run/service/ext-${1}/env/cloud-hypervisor.sock add-vsock cid=4,socket=/run/u.${1}.socket +cd /run +nohup waypipe --socket /run/waypipe.sock client & +nohup socat unix-listen:/run/u.${1}.socket_5000,reuseaddr,fork unix-connect:/run/waypipe.sock & + diff --git a/img/app/default.nix b/img/app/default.nix index e7d5366..80f23c2 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -59,6 +59,9 @@ let DRM_BOCHS = yes; DRM = yes; AGP = yes; + VSOCKETS = yes; + VIRTIO_VSOCKETS = yes; + VIRTIO_VSOCKETS_COMMON = yes; }; }; in diff --git a/vm/app/hello-waypipe.nix b/vm/app/hello-waypipe.nix new file mode 100644 index 0000000..601b638 --- /dev/null +++ b/vm/app/hello-waypipe.nix @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> + +{ config ? import ../../../nix/eval-config.nix {} }: + +import ../make-vm.nix { inherit config; } { + providers.net = [ "netvm" ]; + run = config.pkgs.callPackage ( + { writeScript, waypipe, havoc, foot, hello-wayland, socat}: + writeScript "run-waypipe-app" '' + #!/bin/sh + mkdir /run/0 + export XDG_RUNTIME_DIR=/run/0 + ${socat}/bin/socat unix-listen:/run/waypipe.sock,reuseaddr,fork vsock-connect:2:5000 & + sleep 1 + ${waypipe}/bin/waypipe --display wayland-local --socket /run/waypipe.sock server -- sleep inf & + export WAYLAND_DISPLAY=wayland-local + ${havoc}/bin/havoc + ${hello-wayland}/bin/hello-wayland + ${foot}/bin/foot + '' + ) { }; +} -- 2.36.2

1 1

Enabling forwarding Wayland from appVM to host with waypipe
by Vadim Likholetov 30 Nov '22

30 Nov '22

This patchset enables forwarding Wayland connections from appVM to the host with the help of waypipe tool. It doesn't reqire major changes in Spectrum and tries to utilise existing packages and solutions. Main idea is to create VSOCK virtual device on the start of appVM and use this virtual socket to connect host and guest. On the host side I implement vm-start-way tool that is based on vm-start, but does necessary preparations for wayland forwarfing. The guest VM is appvm-hello-waypipe and described in hello-waypipe.nix file. To test it boot the Spectrum and do 'vm-start-way appvm-hello-waypipe'. Be patient and in couple of seconds will appear a terminal window from appVM. This patches are for test the concept, so possibly redisign is needed for production use. ps sorry for mess in the mailing list

2 7

[PATCH] Patches to waypipe package to enable static build with the cost of fancy feature
by vadim likholetov 30 Nov '22

30 Nov '22

Signed-off-by: vadim likholetov <vadim.likholetov(a)unikie.com> --- .../applications/networking/remote/waypipe/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/remote/waypipe/default.nix b/pkgs/applications/networking/remote/waypipe/default.nix index ec94d504b9d..bcc3770ecf7 100644 --- a/pkgs/applications/networking/remote/waypipe/default.nix +++ b/pkgs/applications/networking/remote/waypipe/default.nix @@ -20,7 +20,15 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ meson ninja pkg-config scdoc ]; buildInputs = [ # Optional dependencies: - mesa lz4 zstd ffmpeg libva + # mesa lz4 zstd ffmpeg libva # TODO: one day recompile with acceleration + lz4 zstd + ]; + + mesonFlags = [ + "-Dwith_video=disabled" + "-Dwith_systemtap=false" + "-Dwith_vaapi=disabled" + "-Dwith_dmabuf=disabled" ]; meta = with lib; { -- 2.36.2

3 2

[PATCH] Enables forwarding Wayland from appVM to host with waypipe
by vadim likholetov 30 Nov '22

30 Nov '22

Signed-off-by: vadim likholetov <vadim.likholetov(a)unikie.com> --- host/initramfs/extfs.nix | 4 +++- host/rootfs/Makefile | 1 + host/rootfs/default.nix | 4 ++-- host/rootfs/usr/bin/vm-start-way | 10 ++++++++++ img/app/default.nix | 3 +++ vm/app/hello-waypipe.nix | 23 +++++++++++++++++++++++ 6 files changed, 42 insertions(+), 3 deletions(-) create mode 100755 host/rootfs/usr/bin/vm-start-way create mode 100644 vm/app/hello-waypipe.nix diff --git a/host/initramfs/extfs.nix b/host/initramfs/extfs.nix index 5c5850f..f49e519 100644 --- a/host/initramfs/extfs.nix +++ b/host/initramfs/extfs.nix @@ -11,12 +11,13 @@ let appvm-catgirl = import ../../vm/app/catgirl.nix { inherit config; }; appvm-lynx = import ../../vm/app/lynx.nix { inherit config; }; + appvm-hello-waypipe = import ../../vm/app/hello-waypipe.nix { inherit config; }; in runCommand "ext.ext4" { nativeBuildInputs = [ e2fsprogs ]; } '' - mkdir -p root/svc/data/appvm-{catgirl,lynx} + mkdir -p root/svc/data/appvm-{catgirl,lynx,hello-waypipe} cd root tar -C ${netvm} -c data | tar -C svc -x @@ -24,6 +25,7 @@ runCommand "ext.ext4" { tar -C ${appvm-catgirl} -c . | tar -C svc/data/appvm-catgirl -x tar -C ${appvm-lynx} -c . | tar -C svc/data/appvm-lynx -x + tar -C ${appvm-hello-waypipe} -c . | tar -C svc/data/appvm-hello-waypipe -x mkfs.ext4 -d . $out 16T resize2fs -M $out diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 9559c06..06e3e8e 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -39,6 +39,7 @@ FILES = \ usr/bin/lsvm \ usr/bin/vm-console \ usr/bin/vm-start \ + usr/bin/vm-start-way \ usr/bin/vm-stop DIRS = dev etc/s6-linux-init/env ext run proc sys diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 0a84f55..de4a6b6 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -7,7 +7,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeReferencesToFile, s6-rc, tar2ext4 , busybox, cloud-hypervisor, cryptsetup, execline, e2fsprogs, jq, kmod -, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg +, mdevd, s6, s6-linux-init, socat, util-linuxMinimal, xorg, waypipe }: let @@ -49,7 +49,7 @@ let packages = [ cloud-hypervisor e2fsprogs execline jq kmod mdevd s6 s6-linux-init s6-rc - socat start-vm + socat start-vm waypipe (cryptsetup.override { programs = { diff --git a/host/rootfs/usr/bin/vm-start-way b/host/rootfs/usr/bin/vm-start-way new file mode 100755 index 0000000..bda9934 --- /dev/null +++ b/host/rootfs/usr/bin/vm-start-way @@ -0,0 +1,10 @@ +#!/bin/sh +# SPDX-License-Identifier: EUPL-1.2+ + +s6-rc -bu change ext-rc +s6-rc -l /run/s6-rc.ext -u change $1 +ch-remote --api-socket /run/service/ext-${1}/env/cloud-hypervisor.sock add-vsock cid=4,socket=/run/u.${1}.socket +cd /run +nohup waypipe --socket /run/waypipe.sock client & +nohup socat unix-listen:/run/u.${1}.socket_5000,reuseaddr,fork unix-connect:/run/waypipe.sock & + diff --git a/img/app/default.nix b/img/app/default.nix index e7d5366..80f23c2 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -59,6 +59,9 @@ let DRM_BOCHS = yes; DRM = yes; AGP = yes; + VSOCKETS = yes; + VIRTIO_VSOCKETS = yes; + VIRTIO_VSOCKETS_COMMON = yes; }; }; in diff --git a/vm/app/hello-waypipe.nix b/vm/app/hello-waypipe.nix new file mode 100644 index 0000000..601b638 --- /dev/null +++ b/vm/app/hello-waypipe.nix @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: MIT +# SPDX-FileCopyrightText: 2021-2022 Alyssa Ross <hi(a)alyssa.is> + +{ config ? import ../../../nix/eval-config.nix {} }: + +import ../make-vm.nix { inherit config; } { + providers.net = [ "netvm" ]; + run = config.pkgs.callPackage ( + { writeScript, waypipe, havoc, foot, hello-wayland, socat}: + writeScript "run-waypipe-app" '' + #!/bin/sh + mkdir /run/0 + export XDG_RUNTIME_DIR=/run/0 + ${socat}/bin/socat unix-listen:/run/waypipe.sock,reuseaddr,fork vsock-connect:2:5000 & + sleep 1 + ${waypipe}/bin/waypipe --display wayland-local --socket /run/waypipe.sock server -- sleep inf & + export WAYLAND_DISPLAY=wayland-local + ${havoc}/bin/havoc + ${hello-wayland}/bin/hello-wayland + ${foot}/bin/foot + '' + ) { }; +} -- 2.36.2

1 0