Skip to content

qemu: add user space emulator only variant#314998

Merged
alyssais merged 9 commits intoNixOS:masterfrom
jcaesar:pr-6
Aug 13, 2024
Merged

qemu: add user space emulator only variant#314998
alyssais merged 9 commits intoNixOS:masterfrom
jcaesar:pr-6

Conversation

@jcaesar
Copy link
Contributor

@jcaesar jcaesar commented May 27, 2024

Description of changes

This adds a variant of qemu that builds in pkgsStatic. The goal is using it as a binfmt interpreter that works across mount namespaces (e.g. enabling docker run --platform …).

This PR takes out only the changes to pkgs/ from #300070, which itself is a fix and resubmission of #160802. Additionally, it makes the following changes:

You can convince yourself that this works by starting a VM

nix run -vL --expr 'let
  nixpkgs = builtins.getFlake "github:NixOS/nixpkgs/d57f30155eb628f27f12d24c3e1fd6a30ee7fee7";
  sys = nixpkgs.lib.nixosSystem {
    system = "x86_64-linux";
    modules = [
      "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"
      (
        { pkgs, ... }:
        {
          services.getty.autologinUser = "root";
          virtualisation.docker.enable = true;
          virtualisation.graphics = false;
          boot.binfmt.emulatedSystems = ["aarch64-linux"];
          boot.binfmt.registrations.aarch64-linux = {
            interpreter = "${pkgs.pkgsStatic.qemu-user}/bin/qemu-aarch64";
            wrapInterpreterInShell = false;
            fixBinary = true;
            openBinary = true; # debatable, see https://github.com/NixOS/nixpkgs/pull/314998#issuecomment-2237347334
            matchCredentials = true;
            preserveArgvZero = true;
          };
        }
      )
    ];
  };
in sys.config.system.build.vm'

and then running

docker run --rm --platform linux/arm64  alpine uname -m

inside of it. (docker run as a demonstration. The real benefit is being able to build multi-platform docker images on one host.)

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@ofborg ofborg bot added the 8.has: package (new) This PR adds a new package label May 27, 2024
@ofborg ofborg bot requested review from alyssais and edolstra May 27, 2024 04:17
@ofborg ofborg bot added 10.rebuild-darwin: 11-100 This PR causes between 11 and 100 packages to rebuild on Darwin. 10.rebuild-linux: 11-100 This PR causes between 11 and 100 packages to rebuild on Linux. labels May 27, 2024
@jcaesar
Copy link
Contributor Author

jcaesar commented May 27, 2024

cot (Python 3.12) and virtualbox builds fail, but that seems to be the same on master. If there's a correct way of naming this kind of PR, please do tell.


Result of nixpkgs-review pr 314998 run on x86_64-linux 1

1 package marked as broken and skipped:
  • ocamlPackages.ocaml-freestanding
6 packages failed to build:
  • linuxKernel.packages.linux_6_9.virtualbox
  • linuxKernel.packages.linux_6_9_hardened.virtualbox
  • linuxKernel.packages.linux_latest_libre.virtualbox
  • linuxKernel.packages.linux_zen.virtualbox
  • python312Packages.cot
  • python312Packages.cot.dist
79 packages built:
  • OVMFFull
  • OVMFFull.fd
  • alpine-make-vm-image
  • cloud-init
  • cloud-init.dist
  • cloud-utils
  • cloud-utils.guest
  • colima
  • cot (python311Packages.cot)
  • cot.dist (python311Packages.cot.dist)
  • diffoscope
  • diffoscope.dist
  • diffoscope.man
  • gnome.gnome-boxes
  • guestfs-tools
  • libguestfs
  • libguestfs-with-appliance
  • lima
  • lima-bin
  • linuxKernel.packages.linux_4_19.virtualbox
  • linuxKernel.packages.linux_4_19_hardened.virtualbox
  • linuxKernel.packages.linux_5_10.virtualbox
  • linuxKernel.packages.linux_5_10_hardened.virtualbox
  • linuxKernel.packages.linux_5_15.virtualbox
  • linuxKernel.packages.linux_5_15_hardened.virtualbox
  • linuxKernel.packages.linux_5_4.virtualbox
  • linuxKernel.packages.linux_5_4_hardened.virtualbox
  • linuxKernel.packages.linux_6_1.virtualbox
  • linuxKernel.packages.linux_6_1_hardened.virtualbox
  • linuxKernel.packages.linux_6_6.virtualbox
  • linuxKernel.packages.linux_hardened.virtualbox (linuxKernel.packages.linux_6_6_hardened.virtualbox)
  • linuxKernel.packages.linux_6_8.virtualbox
  • linuxKernel.packages.linux_6_8_hardened.virtualbox
  • linuxKernel.packages.linux_libre.virtualbox
  • linuxKernel.packages.linux_lqx.virtualbox
  • linuxKernel.packages.linux_xanmod.virtualbox
  • linuxKernel.packages.linux_xanmod_latest.virtualbox (linuxKernel.packages.linux_xanmod_stable.virtualbox)
  • lxd-lts
  • multipass
  • nemu
  • open-watcom-bin
  • open-watcom-bin-unwrapped
  • out-of-tree
  • python311Packages.guestfs
  • python311Packages.guestfs.dist
  • python312Packages.guestfs
  • python312Packages.guestfs.dist
  • qemu
  • qemu-user
  • qemu-user.debug
  • qemu-utils
  • qemu-utils.debug
  • qemu.debug
  • qemu.ga
  • qemu_full
  • qemu_full.debug
  • qemu_full.ga
  • qemu_kvm
  • qemu_kvm.debug
  • qemu_kvm.ga
  • qemu_test
  • qemu_test.debug
  • qemu_test.ga
  • qtemu
  • quickemu
  • quickgui
  • solo5
  • solo5.debug
  • vagrant
  • virtualbox
  • virtualbox.modsrc
  • virtualboxHardened
  • virtualboxHardened.modsrc
  • virtualboxHeadless
  • virtualboxHeadless.modsrc
  • virtualboxKvm
  • virtualboxWithExtpack
  • virtualboxWithExtpack.modsrc
  • zpool-auto-expand-partitions

@jcaesar jcaesar marked this pull request as ready for review May 27, 2024 06:28
@jcaesar jcaesar changed the title qemu-user: init (as statically compilable variant of userspace qemu) qemu: add user space emulator only variant May 27, 2024
@github-actions github-actions bot added the 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS label May 28, 2024
@jcaesar jcaesar force-pushed the pr-6 branch 2 times, most recently from f5b9bff to d57f301 Compare May 28, 2024 04:15
@github-actions github-actions bot removed the 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS label May 28, 2024
@TECHNOFAB11
Copy link

Tried this and it works great btw!
Will try this on my servers to see if it works in Kubernetes aswell, but as podman works it should work with containerd aswell.

# input:
    nixpkgs-qemu-patch.url = "github:jcaesar/fork2pr-nixpkgs/pr-6";

# config:
    binfmt.emulatedSystems = ["aarch64-linux"];
    binfmt.registrations.aarch64-linux = let
      pkgs_patch = import inputs.nixpkgs-qemu-patch {
        inherit system;
      };
    in {
      interpreter = "${pkgs_patch.pkgsStatic.qemu-user}/bin/qemu-aarch64";
      wrapInterpreterInShell = false;
      fixBinary = true;
      openBinary = true;
      matchCredentials = true;
      preserveArgvZero = true;
    };

Copy link
Member

@alyssais alyssais left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs to be rebased. There shouldn't be a commit like b7c0c9f — updates that need to be made should just be folded into the appropriate commits.

I'd like to do a more thorough review when I have time and #299623 is done.

@jcaesar
Copy link
Contributor Author

jcaesar commented Jun 5, 2024

I'd like to do a more thorough review when I have time and #299623 is done.

Fortunately, #299623 is no longer a dependency for building this PR (i.e. building pkgsStatic.qemu-user). You can safely ignore it. (I guess the commit messages didn't make this clear, sorry.)
Please give this a look when you find the time and motivation.

Needs to be rebased. There shouldn't be a commit like b7c0c9f — updates that need to be made should just be folded into the appropriate commits.

I decided to take this a step further and squash all commits and rewrote the commit message accordingly, since they didn't made sense in isolation. Do tell if you want me to undo this.


This caused all kinds of changes, which are hard to understand with force-push + rebase. Here's the diff between "after rebase" and "now":
diff --git a/pkgs/applications/virtualization/qemu/aio-find-static-library.patch b/pkgs/applications/virtualization/qemu/aio-find-static-library.patch
deleted file mode 100644
index 5faf0693dc10..000000000000
--- a/pkgs/applications/virtualization/qemu/aio-find-static-library.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/meson.build b/meson.build
-index c9c3217ba4..1a8de03f4e 100644
---- a/meson.build
-+++ b/meson.build
-@@ -986,7 +986,8 @@ zlib = dependency('zlib', required: true)
- libaio = not_found
- if not get_option('linux_aio').auto() or have_block
-   libaio = cc.find_library('aio', has_headers: ['libaio.h'],
--                           required: get_option('linux_aio'))
-+                           required: get_option('linux_aio'),
-+                           dirs: [get_option('linux_aio_path')])
- endif
- 
- linux_io_uring_test = '''
-diff --git a/meson_options.txt b/meson_options.txt
-index 0a99a059ec..84d2449de9 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -186,6 +186,7 @@ option('libusb', type : 'feature', value : 'auto',
-        description: 'libusb support for USB passthrough')
- option('linux_aio', type : 'feature', value : 'auto',
-        description: 'Linux AIO support')
-+option('linux_aio_path', type: 'string', value: '', description: 'Path for libaio.a')
- option('linux_io_uring', type : 'feature', value : 'auto',
-        description: 'Linux io_uring support')
- option('lzfse', type : 'feature', value : 'auto',
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 82c59d0ad52c..92c9d0d56a8b 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -5,45 +5,53 @@
 , makeWrapper, removeReferencesTo
 , attr, libcap, libcap_ng, socat, libslirp
 , CoreServices, Cocoa, Hypervisor, rez, setfile, vmnet
-, guestAgentSupport ? (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !toolsOnly
-, numaSupport ? stdenv.isLinux && !stdenv.isAarch32 && !toolsOnly, numactl
-, seccompSupport ? stdenv.isLinux && !toolsOnly, libseccomp
-, alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner && !toolsOnly
-, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, libpulseaudio
-, pipewireSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, pipewire
-, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, SDL2, SDL2_image
-, jackSupport ? !stdenv.isDarwin && !nixosTestRunner && !toolsOnly, libjack2
-, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner && !toolsOnly, gtk3, gettext, vte, wrapGAppsHook3
-, vncSupport ? !nixosTestRunner && !toolsOnly, libjpeg, libpng
-, smartcardSupport ? !nixosTestRunner && !toolsOnly, libcacard
-, spiceSupport ? true && !nixosTestRunner && !toolsOnly, spice, spice-protocol
-, ncursesSupport ? !nixosTestRunner && !toolsOnly, ncurses
+, guestAgentSupport ? (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal
+, numaSupport ? stdenv.isLinux && !stdenv.isAarch32 && !minimal, numactl
+, seccompSupport ? stdenv.isLinux && !minimal, libseccomp
+, alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner && !minimal
+, pulseSupport ? !stdenv.isDarwin && !nixosTestRunner && !minimal, libpulseaudio
+, pipewireSupport ? !stdenv.isDarwin && !nixosTestRunner && !minimal, pipewire
+, sdlSupport ? !stdenv.isDarwin && !nixosTestRunner && !minimal, SDL2, SDL2_image
+, jackSupport ? !stdenv.isDarwin && !nixosTestRunner && !minimal, libjack2
+, gtkSupport ? !stdenv.isDarwin && !xenSupport && !nixosTestRunner && !minimal, gtk3, gettext, vte, wrapGAppsHook3
+, vncSupport ? !nixosTestRunner && !minimal, libjpeg, libpng
+, smartcardSupport ? !nixosTestRunner && !minimal, libcacard
+, spiceSupport ? true && !nixosTestRunner && !minimal, spice, spice-protocol
+, ncursesSupport ? !nixosTestRunner && !minimal, ncurses
 , usbredirSupport ? spiceSupport, usbredir
 , xenSupport ? false, xen
 , cephSupport ? false, ceph
 , glusterfsSupport ? false, glusterfs, libuuid
 , openGLSupport ? sdlSupport, mesa, libepoxy, libdrm
-, rutabagaSupport ? openGLSupport && !toolsOnly && lib.meta.availableOn stdenv.hostPlatform rutabaga_gfx, rutabaga_gfx
+, rutabagaSupport ? openGLSupport && !minimal && lib.meta.availableOn stdenv.hostPlatform rutabaga_gfx, rutabaga_gfx
 , virglSupport ? openGLSupport, virglrenderer
-, libiscsiSupport ? !toolsOnly, libiscsi
+, libiscsiSupport ? !minimal, libiscsi
 , smbdSupport ? false, samba
-, tpmSupport ? !toolsOnly
-, uringSupport ? stdenv.isLinux, liburing
-, canokeySupport ? !toolsOnly, canokey-qemu
-, capstoneSupport ? !toolsOnly, capstone
+, tpmSupport ? !minimal
+, uringSupport ? stdenv.isLinux && !userOnly, liburing
+, canokeySupport ? !minimal, canokey-qemu
+, capstoneSupport ? !minimal, capstone
 , pluginsSupport ? !stdenv.hostPlatform.isStatic
-, enableDocs ? true
-, enableTools ? true
-, enableBlobs ? true
+, enableDocs ? !minimal || toolsOnly
+, enableTools ? !minimal || toolsOnly
+, enableBlobs ? !minimal || toolsOnly
 , hostCpuOnly ? false
 , hostCpuTargets ? (if toolsOnly
                     then [ ]
                     else if hostCpuOnly
                     then (lib.optional stdenv.isx86_64 "i386-softmmu"
                           ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
-                    else null)
+                    else if userOnly
+                    then map (system: (lib.systems.elaborate { inherit system; }).qemuArch + "-linux-user") [
+                      "aarch64-linux" "armv7l-linux"
+                      "i386-linux" "x86_64-linux"
+                      "powerpc-linux" "powerpc64-linux" "powerpc64le-linux"
+                      "riscv32-linux" "riscv64-linux"
+                    ] else null)
 , nixosTestRunner ? false
 , toolsOnly ? false
+, userOnly ? false
+, minimal ? toolsOnly || userOnly
 , gitUpdater
 , qemu-utils # for tests attribute
 }:
@@ -70,21 +78,21 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeWrapper removeReferencesTo
-    pkg-config flex bison dtc meson ninja
+    pkg-config flex bison meson ninja
 
     # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
     python3Packages.python
   ]
     ++ lib.optionals gtkSupport [ wrapGAppsHook3 ]
-    ++ lib.optionals enableDocs [ python3Packages.sphinx python3Packages.sphinx-rtd-theme ]
+    ++ lib.optionals enableDocs [ texinfo python3Packages.sphinx python3Packages.sphinx-rtd-theme ]
     ++ lib.optionals hexagonSupport [ glib ]
-    ++ lib.optionals stdenv.isDarwin [ sigtool ];
+    ++ lib.optionals stdenv.isDarwin [ sigtool ]
+    ++ lib.optionals (!userOnly) [ dtc ];
 
-  buildInputs = [ dtc zlib glib pixman
+  buildInputs = [ zlib glib pixman
     vde2 lzo snappy libtasn1
     gnutls nettle curl libslirp
   ]
-    ++ lib.optionals enableDocs [ texinfo ]
     ++ lib.optionals ncursesSupport [ ncurses ]
     ++ lib.optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile vmnet ]
     ++ lib.optionals seccompSupport [ libseccomp ]
@@ -99,7 +107,8 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals smartcardSupport [ libcacard ]
     ++ lib.optionals spiceSupport [ spice-protocol spice ]
     ++ lib.optionals usbredirSupport [ usbredir ]
-    ++ lib.optionals stdenv.isLinux [ libaio libcap_ng libcap attr ]
+    ++ lib.optionals stdenv.isLinux [ libcap_ng libcap attr ]
+    ++ lib.optionals (stdenv.isLinux && !userOnly) [ libaio ]
     ++ lib.optionals xenSupport [ xen ]
     ++ lib.optionals cephSupport [ ceph ]
     ++ lib.optionals glusterfsSupport [ glusterfs libuuid ]
@@ -110,7 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals smbdSupport [ samba ]
     ++ lib.optionals uringSupport [ liburing ]
     ++ lib.optionals canokeySupport [ canokey-qemu ]
-    ++ lib.optionals capstoneSupport [ capstone ];
+    ++ lib.optionals capstoneSupport [ capstone ]
+    ++ lib.optionals (!userOnly) [ dtc ];
 
   dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
   dontAddStaticConfigureFlags = true;
@@ -142,13 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
       revert = true;
     })
   ]
-  ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch
-
-  ## FIXME: libaio does not provide a pkg-info file;
-  # and meson does not support static libraries lookup path using -L, relying on LIBRARY_PATH (https://github.com/mesonbuild/meson/issues/10172);
-  # and musl-gcc does not support LIBRARY_PATH overrides (https://www.openwall.com/lists/musl/2017/02/22/7);
-  # so we have to patch the meson.build to add the libaio path to the search path manually.
-  ++ lib.optional stdenv.hostPlatform.isStatic ./aio-find-static-library.patch;
+  ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 
   postPatch = ''
     # Otherwise tries to ensure /var/run exists.
@@ -184,7 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional usbredirSupport "--enable-usb-redir"
     ++ lib.optional (hostCpuTargets != null) "--target-list=${lib.concatStringsSep "," hostCpuTargets}"
     ++ lib.optionals stdenv.isDarwin [ "--enable-cocoa" "--enable-hvf" ]
-    ++ lib.optional stdenv.isLinux "--enable-linux-aio"
+    ++ lib.optional (stdenv.isLinux && !userOnly) "--enable-linux-aio"
     ++ lib.optional gtkSupport "--enable-gtk"
     ++ lib.optional xenSupport "--enable-xen"
     ++ lib.optional cephSupport "--enable-rbd"
@@ -199,12 +203,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional capstoneSupport "--enable-capstone"
     ++ lib.optional (!pluginsSupport) "--disable-plugins"
     ++ lib.optional (!enableBlobs) "--disable-install-blobs"
-    ++ lib.optionals stdenv.hostPlatform.isStatic [
-      "--static"
-      # FIXME: "multiple definition of `strtoll'" with libnbcompat
-      "--extra-ldflags=-Wl,--allow-multiple-definition"
-      "-Dlinux_aio_path=${libaio}/lib"
-    ];
+    ++ lib.optional stdenv.hostPlatform.isStatic "--static";
 
   dontWrapGApps = true;
 
@@ -228,6 +227,11 @@ stdenv.mkDerivation (finalAttrs: {
     for f in $out/bin/qemu-system-*; do
       wrapGApp $f
     done
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    # HACK: Otherwise the result will have the entire buildinput closure
+    # injected by the pkgsStatic stdenv
+    # <https://github.com/NixOS/nixpkgs/issues/83667>
+    rm -f $out/nix-support/propagated-build-inputs
   '';
   preBuild = "cd build";
 
@@ -267,10 +271,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
-  postInstall = lib.optionalString (!toolsOnly) ''
-    if [ -f $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} ]; then
-      ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
-    fi
+  postInstall = lib.optionalString (!minimal) ''
+    ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
   passthru = {
@@ -298,7 +300,13 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = platforms.unix;
   }
   # toolsOnly: Does not have qemu-kvm and there's no main support tool
-  // lib.optionalAttrs (!toolsOnly) {
+  # userOnly: There's one qemu-<arch> for every architecture
+  // lib.optionalAttrs (!toolsOnly && !userOnly) {
     mainProgram = "qemu-kvm";
+  }
+  # userOnly: Only meaningful on linux
+  // lib.optionalAttrs userOnly {
+    platforms = lib.platforms.linux;
+    description = "QEMU User space emulator - launch executables compiled for one CPU on another CPU";
   };
 })
diff --git a/pkgs/applications/virtualization/qemu/user.nix b/pkgs/applications/virtualization/qemu/user.nix
deleted file mode 100644
index eeb9199ec6d4..000000000000
--- a/pkgs/applications/virtualization/qemu/user.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-# When used from pkgsStatic, this provides qemu-user-static
-{
-  lib,
-  qemu,
-}:
-
-let
-
-  qemuUserPlatforms = [
-    "aarch64-linux"
-    "armv7l-linux"
-    "i386-linux"
-    "powerpc-linux"
-    "powerpc64-linux"
-    "powerpc64le-linux"
-    "riscv32-linux"
-    "riscv64-linux"
-    "x86_64-linux"
-  ];
-
-  qemuTargets = map (system: (lib.systems.elaborate { inherit system; }).qemuArch + "-linux-user") qemuUserPlatforms;
-
-  qemuUser = (qemu.override {
-    guestAgentSupport = false;
-    numaSupport = false;
-    seccompSupport = false;
-    alsaSupport = false;
-    pulseSupport = false;
-    sdlSupport = false;
-    jackSupport = false;
-    pipewireSupport = false;
-    gtkSupport = false;
-    vncSupport = false;
-    smartcardSupport = false;
-    spiceSupport = false;
-    ncursesSupport = false;
-    libiscsiSupport = false;
-    smbdSupport = false;
-    tpmSupport = false;
-    uringSupport = false;
-    capstoneSupport = false;
-    enableDocs = false;
-    enableTools = false;
-    enableBlobs = false;
-    hostCpuTargets = qemuTargets;
-  }).overrideAttrs (old: {
-    # HACK: Otherwise the result will have the entire buildinput closure
-    # injected by the pkgsStatic stdenv
-    # <https://github.com/NixOS/nixpkgs/issues/83667>
-    postFixup = (old.postFixup or "") + ''
-      rm -f $out/nix-support/propagated-build-inputs
-    '';
-
-    meta = old.meta // {
-      platforms = lib.platforms.linux;
-      description = "QEMU User space emulator - launch executables compiled for one CPU on another CPU";
-    };
-  });
-in qemuUser // {
-  passthru = (qemuUser.passthru or {}) // {
-    inherit qemuUserPlatforms;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9331dcac3146..ee5901d479d1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33863,7 +33863,9 @@ with pkgs;
   };
 
   # variant of qemu building user space emulator only - intended to be used from pkgsStatic
-  qemu-user = callPackage ../applications/virtualization/qemu/user.nix {};
+  qemu-user = qemu.override {
+    userOnly = true;
+  };
 
   canokey-qemu = callPackage ../applications/virtualization/qemu/canokey-qemu.nix { };
 

@alyssais
Copy link
Member

alyssais commented Jun 5, 2024

I decided to take this a step further and squash all commits and rewrote the commit message accordingly, since they didn't made sense in isolation.

Oh, I liked all the separate commits. They made reviewing easier.

@jcaesar
Copy link
Contributor Author

jcaesar commented Jun 5, 2024

Oh, I liked all the separate commits. They made reviewing easier.

There you go. (I had to reorganize things a bit because the newly added flags and disabled dependencies mean that some of the commits in the middle stopped making sense.)

Copy link
Member

@Cryolitia Cryolitia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Result of nixpkgs-review pr 314998 run on x86_64-linux 1

15 packages marked as broken and skipped:
  • diffoscope
  • diffoscope.dist
  • diffoscope.man
  • qemu_xen
  • qemu_xen-light
  • qemu_xen-light.debug
  • qemu_xen-light.ga
  • qemu_xen.debug
  • qemu_xen.ga
  • qemu_xen_4_15
  • qemu_xen_4_15-light
  • qemu_xen_4_15-light.debug
  • qemu_xen_4_15-light.ga
  • qemu_xen_4_15.debug
  • qemu_xen_4_15.ga
35 packages failed to build:
  • cot (python312Packages.cot)
  • cot.dist (python312Packages.cot.dist)
  • lima-bin
  • linuxKernel.packages.linux_4_19.virtualbox
  • linuxPackages_4_19_hardened.virtualbox (linuxKernel.packages.linux_4_19_hardened.virtualbox)
  • linuxKernel.packages.linux_5_10.virtualbox
  • linuxPackages_5_10_hardened.virtualbox (linuxKernel.packages.linux_5_10_hardened.virtualbox)
  • linuxKernel.packages.linux_5_15.virtualbox
  • linuxPackages_5_15_hardened.virtualbox (linuxKernel.packages.linux_5_15_hardened.virtualbox)
  • linuxKernel.packages.linux_5_4.virtualbox
  • linuxPackages_5_4_hardened.virtualbox (linuxKernel.packages.linux_5_4_hardened.virtualbox)
  • linuxKernel.packages.linux_6_1.virtualbox
  • linuxPackages_6_1_hardened.virtualbox (linuxKernel.packages.linux_6_1_hardened.virtualbox)
  • linuxPackages.virtualbox (linuxKernel.packages.linux_6_6.virtualbox)
  • linuxPackages_hardened.virtualbox (linuxPackages_6_6_hardened.virtualbox)
  • linuxKernel.packages.linux_6_8.virtualbox
  • linuxPackages_6_8_hardened.virtualbox (linuxKernel.packages.linux_6_8_hardened.virtualbox)
  • linuxPackages_latest.virtualbox (linuxKernel.packages.linux_6_9.virtualbox)
  • linuxPackages_6_9_hardened.virtualbox (linuxKernel.packages.linux_6_9_hardened.virtualbox)
  • linuxPackages_latest-libre.virtualbox (linuxKernel.packages.linux_latest_libre.virtualbox)
  • linuxPackages-libre.virtualbox (linuxKernel.packages.linux_libre.virtualbox)
  • linuxPackages_lqx.virtualbox (linuxKernel.packages.linux_lqx.virtualbox)
  • linuxPackages_xanmod.virtualbox (linuxKernel.packages.linux_xanmod.virtualbox)
  • linuxPackages_xanmod_latest.virtualbox (linuxKernel.packages.linux_xanmod_latest.virtualbox ,linuxPackages_xanmod_stable.virtualbox)
  • linuxPackages_zen.virtualbox (linuxKernel.packages.linux_zen.virtualbox)
  • nemu
  • virtualbox
  • virtualbox.modsrc
  • virtualboxHardened
  • virtualboxHardened.modsrc
  • virtualboxHeadless
  • virtualboxHeadless.modsrc
  • virtualboxKvm
  • virtualboxWithExtpack
  • virtualboxWithExtpack.modsrc
50 packages built:
  • OVMFFull
  • OVMFFull.fd
  • alpine-make-vm-image
  • cloud-init
  • cloud-init.dist
  • cloud-utils
  • cloud-utils.guest
  • colima
  • gnome.gnome-boxes
  • guestfs-tools
  • libguestfs
  • lima
  • lxd-lts
  • multipass
  • open-watcom-bin
  • open-watcom-bin-unwrapped
  • out-of-tree
  • python311Packages.cot
  • python311Packages.cot.dist
  • python311Packages.guestfs
  • python311Packages.guestfs.dist
  • python312Packages.guestfs
  • python312Packages.guestfs.dist
  • qemu
  • qemu-user
  • qemu-user.debug
  • qemu-utils
  • qemu-utils.debug
  • qemu.debug
  • qemu.ga
  • qemu_full
  • qemu_full.debug
  • qemu_full.ga
  • qemu_kvm
  • qemu_kvm.debug
  • qemu_kvm.ga
  • qemu_test
  • qemu_test.debug
  • qemu_test.ga
  • qtemu
  • quickemu
  • quickgui
  • solo5
  • solo5.debug
  • tests.testers.lycheeLinkCheck.network
  • tests.testers.nixosTest-example
  • tests.testers.runNixOSTest-example
  • tests.trivial-builders.references
  • vagrant
  • zpool-auto-expand-partitions

Tested running archlinux-riscv64 on nixos-x86_64, LGTM

@Cryolitia Cryolitia added the 12.approvals: 1 This PR was reviewed and approved by one person. label Jul 9, 2024
Copy link
Member

@Aleksanaa Aleksanaa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes lgtm. @alyssais could you give a final review?

@dramforever
Copy link
Contributor

This isn't a blocker to this PR at all since it concerns only the example in the top post but

            openBinary = true;
            matchCredentials = true;

These two break coreutils make check which depends on being able to close stdin / fd 0. Removing these two options seem to be all that's needed to fix the problem

(It's openBinary that causes the problem but matchCredentials requires that.)

Posting this so that people having this problem can search "coreutils" on this page and find this post.

@jcaesar
Copy link
Contributor Author

jcaesar commented Jul 19, 2024

@dramforever Thank you, that's interesting to know. I was thinking about submitting a PR next that changes the binfmt module to make that the default, but I guess I have to think about that.

Just FYI, not setting matchCredentials breaks e.g. emulated sudo:

sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

and I'm not sure it doesn't possibly have security implications.

(Looking around, multiarch/qemu-user-static doesn't set it, debian's qemu-user-static does. I'll have to dig. But yeah, after this PR gets merged.)

@ofborg ofborg bot requested a review from alyssais August 3, 2024 14:09
Copy link
Member

@alyssais alyssais left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be nice to append something to pname for userOnly?

jcaesar and others added 7 commits August 4, 2024 20:25
The plugin .so's do not build statically.
Not needed for a minimal qemu-user-static build.
Not needed for a minimal qemu-user-static build.
When used from pkgsStatic, this is synonymous with the "qemu-user-static"
packages available in other distros.
@jcaesar
Copy link
Contributor Author

jcaesar commented Aug 4, 2024

Might be nice to append something to pname for userOnly?

Absoutey. Added -user.

nix eval --raw .#legacyPackages.x86_64-linux.pkgsStatic.qemu-user.drvPath
/nix/store/ris5n3d5jd3x2vm1i4fiw0sp382qz7d9-qemu-user-static-x86_64-unknown-linux-musl-9.0.2.drv

Falls into place nicely. :) (Did require a rebase on master though.)

Copy link
Member

@alyssais alyssais left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your persistence!

@ofborg ofborg bot requested a review from alyssais August 5, 2024 14:32
@wegank wegank added 12.approvals: 3+ This PR was reviewed and approved by three or more persons. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Aug 10, 2024
@jcaesar
Copy link
Contributor Author

jcaesar commented Aug 13, 2024

I assume we're waiting on aarch64-darwin? x86_64-darwin timed out. Should I do something about that? (Not I'd know what…)

@alyssais
Copy link
Member

Darwin timing out running the tests is sadly expected. I think a lot of aarch64-darwin builds got dropped, but it's unlikely this would break on just one Darwin.

@alyssais alyssais merged commit aa4e349 into NixOS:master Aug 13, 2024
katexochen added a commit to edgelesssys/contrast that referenced this pull request Aug 19, 2024
Adapting to changes made in NixOS/nixpkgs#314998

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
katexochen added a commit to edgelesssys/contrast that referenced this pull request Aug 19, 2024
Adapting to changes made in NixOS/nixpkgs#314998

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
katexochen added a commit to edgelesssys/contrast that referenced this pull request Aug 20, 2024
Adapting to changes made in NixOS/nixpkgs#314998

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
katexochen added a commit to edgelesssys/contrast that referenced this pull request Aug 20, 2024
Adapting to changes made in NixOS/nixpkgs#314998

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

8.has: package (new) This PR adds a new package 10.rebuild-darwin: 11-100 This PR causes between 11 and 100 packages to rebuild on Darwin. 10.rebuild-linux: 11-100 This PR causes between 11 and 100 packages to rebuild on Linux. 12.approvals: 3+ This PR was reviewed and approved by three or more persons. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants