diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index b6d3bedb..6bf7d739 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -16,16 +16,17 @@ obsolete workarounds get rolled back instead of lingering. A version or revision pinned for a reason that can go away. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ---------- | ---------------------- | ------ | -| WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | -| WA-002 | `nixpkgs-2505` — `flake.nix`; consumer `home/base/tui/container.nix` | `kubernetes-helm` regressed in newer nixpkgs | Drop the input and its consumer once helm works again in current nixpkgs | 2025-12-03 | when helm is revisited | active | -| WA-003 | `rust-overlay` follow — `flake.nix` | lanzaboote v1.1.0's pinned rust-overlay uses the deprecated `stdenv.isLinux`/`stdenv.isDarwin` | Drop the follow once lanzaboote updates its pin (or we drop the lanzaboote pin) | 2026-09-25 | on lanzaboote bump | active | -| WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | -| WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | -| WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | -| WA-007 | WeChat from `nixpkgs-master` — `hardening/bwraps/default.nix` | newest builds; the pinned channel lags | Fall back to the stable channel once it has a good build | 2026-10-03 | on nixpkgs bump | active | -| WA-020 | `fcitx5-vinput` pinned to release tag `v2.4.0` — `flake.nix`; consumer `home/linux/gui/base/vinput/default.nix` | Tracks a release tag instead of a branch, so `just up` stays on that release | Bump to a newer release tag when its changes are wanted | 2026-10-04 | on vinput release | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------- | -------------------------- | ------ | +| WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | +| WA-002 | `nixpkgs-2505` — `flake.nix`; consumer `home/base/tui/container.nix` | `kubernetes-helm` regressed in newer nixpkgs | Drop the input and its consumer once helm works again in current nixpkgs | 2025-12-03 | when helm is revisited | active | +| WA-003 | `rust-overlay` follow — `flake.nix` | lanzaboote v1.1.0's pinned rust-overlay uses the deprecated `stdenv.isLinux`/`stdenv.isDarwin` | Drop the follow once lanzaboote updates its pin (or we drop the lanzaboote pin) | 2026-09-25 | on lanzaboote bump | active | +| WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | +| WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | +| WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | +| WA-007 | WeChat from `nixpkgs-master` — `hardening/bwraps/default.nix` | newest builds; the pinned channel lags | Fall back to the stable channel once it has a good build | 2026-10-03 | on nixpkgs bump | active | +| WA-020 | `fcitx5-vinput` pinned to release tag `v2.4.0` — `flake.nix`; consumer `home/linux/gui/base/vinput/default.nix` | Tracks a release tag instead of a branch, so `just up` stays on that release | Bump to a newer release tag when its changes are wanted | 2026-10-04 | on vinput release | active | +| WA-021 | `nix-x86-on-aarch64` input — our fork of rowanG077's patched FEX + muvm runtime — `flake.nix`; `hosts/12kingdoms-shoukei/game/` | FEX does not support 16K pages, so x86/x86_64 apps and games on shoukei need this pinned flake's 4K-page microVM runtime; our fork lets upstream changes be reviewed before use | Drop once FEX supports 16K pages directly, or nixpkgs/nixos-apple-silicon ships an equivalent runtime | 2026-10-07 | on FEX/nixpkgs/muvm update | active | ## Workarounds @@ -39,7 +40,7 @@ A setting that works around a bug or a hardware quirk. | WA-011 | Kernel module blacklist (`esp4`, `esp6`, `rxrpc`) — `hardening/kernel-hardening.nix` | attack surface for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500) | Kept as defence in depth; drop only if something needs those modules | 2026-10-03 | rarely | active | | WA-017 | keyd right-hand modifier passthrough — `modules/nixos/desktop/peripherals.nix` | keyd folds right Ctrl/Shift/Meta into their left keys | Drop once keyd or fcitx5 keeps right-hand modifiers distinct | 2026-10-05 | on keyd bump | active | | WA-018 | user-owned `~/.ssh/config` + disabled systemd ssh-proxy include — `home/base/tui/ssh.nix`, `modules/nixos/base/ssh.nix` | bwrap exposes root-owned store files as `nobody` | Drop once sandboxes preserve store ownership | 2026-10-06 | when sandbox layout changes | active | -| WA-019 | programs.steam.extraCompatPackages = [ pkgs-x64.dwproton-bin pkgs-x64.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | +| WA-019 | programs.steam.extraCompatPackages = [ pkgs.dwproton-bin pkgs.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | If WA-008 freezes recur, the fallback is to restore `nvme_core.default_ps_max_latency_us=0 nvme_core.io_timeout=4294967295 pcie_aspm=off`; this is a @@ -49,10 +50,10 @@ recovery procedure, not its removal condition. A known limitation with no fix yet. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------- | ------ | -| WA-012 | `muvm` (x86_64 apps/games via microVM) disabled — `hosts/12kingdoms-shoukei/apple-silicon.nix` | Apple Silicon's 16k page size means x86_64 apps need `muvm`; it is off because it does not build/run on nixos-apple-silicon yet ([nixos-apple-silicon#237](https://github.com/nix-community/nixos-apple-silicon/issues/237)) | Re-enable once `muvm` builds and works | — | on nixos-apple-silicon or muvm updates | active | -| WA-016 | subscription rule snapshots — `modules/nixos/desktop/networking/mihomo/` (`rules_from:`) | mihomo's `proxy-providers` imports proxies only, so the `rules` and `proxy-groups` a subscription ships with are dropped by the core; the generator re-imports them from a local YAML copy that has to be refreshed by hand when the provider changes its routing policy | Drop the snapshots once mihomo can import rules from a proxy-provider, or the providers publish their rules as rule-providers | 2026-10-04 | when mihomo gains rule import | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------------------------------- | ------ | +| WA-016 | subscription rule snapshots — `modules/nixos/desktop/networking/mihomo/` (`rules_from:`) | mihomo's `proxy-providers` imports proxies only, so the `rules` and `proxy-groups` a subscription ships with are dropped by the core; the generator re-imports them from a local YAML copy that has to be refreshed by hand when the provider changes its routing policy | Drop the snapshots once mihomo can import rules from a proxy-provider, or the providers publish their rules as rule-providers | 2026-10-04 | when mihomo gains rule import | active | +| WA-022 | qemu-user binfmt removed — `hosts/12kingdoms-shoukei/hardware-configuration.nix` | the x86-on-arm module owns the x86 ELF handlers and this host does not need riscv64, but dropping `boot.binfmt.emulatedSystems` also drops `nix.settings.extra-platforms` and qemu-user, so `podman run --platform=linux/amd64`, x86 chroots and local builds of uncached x86 derivations need a remote x86_64 builder | Restore `boot.binfmt.emulatedSystems` (without x86_64/i686, which the module asserts against) if such a workload is needed | 2026-10-07 | when an amd64 container/chroot or uncached x86 build is needed | active | ## WIP diff --git a/flake.lock b/flake.lock index 9990819a..0fc8af43 100644 --- a/flake.lock +++ b/flake.lock @@ -732,6 +732,27 @@ "type": "github" } }, + "nix-x86-on-aarch64": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1790210091, + "narHash": "sha256-ZM9kDVJNjFHVHR1Osx+6SdG2Lufnfx2Ek0Wcxc3KX00=", + "owner": "ryan4yin", + "repo": "nix-x86-on-aarch64", + "rev": "5d69793a1c8b31d724fccd9b6acaa33587c923b3", + "type": "github" + }, + "original": { + "owner": "ryan4yin", + "repo": "nix-x86-on-aarch64", + "rev": "5d69793a1c8b31d724fccd9b6acaa33587c923b3", + "type": "github" + } + }, "nixos-apple-silicon": { "inputs": { "flake-compat": "flake-compat_4", @@ -1050,6 +1071,7 @@ "mysecrets": "mysecrets", "nix-darwin": "nix-darwin", "nix-gaming": "nix-gaming", + "nix-x86-on-aarch64": "nix-x86-on-aarch64", "nixos-apple-silicon": "nixos-apple-silicon", "nixpak": "nixpak", "nixpkgs": "nixpkgs_2", diff --git a/flake.nix b/flake.nix index 86a296a4..090cbc88 100644 --- a/flake.nix +++ b/flake.nix @@ -152,6 +152,20 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + # x86/x86_64 emulation on 16K-page ARM64 (Apple Silicon). FEX cannot run + # natively with 16K pages, so this wraps FEX in a 4K-page muvm microVM and + # exposes an `x86pkgs` set plus Steam/Wine launchers. Used by shoukei; see + # hosts/12kingdoms-shoukei and WORKAROUNDS.md (WA-021). + # + # Pinned to our fork of rowanG077/nix-x86-on-aarch64 at the reviewed commit + # 5d69793a. To update, fetch upstream into the fork, review the new commits, + # then bump the rev here deliberately. Do not track the fork's default branch: + # a GitHub "Sync fork" fast-forward would pull unreviewed changes. + nix-x86-on-aarch64 = { + url = "github:ryan4yin/nix-x86-on-aarch64/5d69793a1c8b31d724fccd9b6acaa33587c923b3"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + ######################## Some non-flake repositories ######################################### nu_scripts = { diff --git a/hosts/12kingdoms-shoukei/README.md b/hosts/12kingdoms-shoukei/README.md index 7b103e27..02be51fe 100644 --- a/hosts/12kingdoms-shoukei/README.md +++ b/hosts/12kingdoms-shoukei/README.md @@ -5,6 +5,25 @@ This is NixOS's configuration for my Macbook Pro 2022 M2, 16G RAM. This laptop joins untrusted networks and uses DHCP instead of a static IP, so it has no entry in `vars/networking.nix`. +## x86/x86_64 applications + +The M2 uses 16 KiB pages, and FEX does not emulate 4 KiB guest pages, so x86/x86_64 binaries cannot +run directly on this kernel. [`game/`](./game/default.nix) enables `programs.x86-on-arm` from +[our fork](https://github.com/ryan4yin/nix-x86-on-aarch64) of +[rowanG077/nix-x86-on-aarch64](https://github.com/rowanG077/nix-x86-on-aarch64), which runs FEX +inside a 4 KiB `muvm` microVM and registers both ELF handlers: + +- run an x86/x86_64 ELF directly, or use `x86-arm run `; +- `nix-shell -p x86pkgs.hello --run hello` for the x86 package set; +- `steam` and `x86-arm-wine` for games and Windows programs. + +The microVM is capped at 6 GiB (`memoryMiB`) on this 16 GiB machine, and needs `/dev/kvm` plus a +running systemd user session. See [WORKAROUNDS.md](../../WORKAROUNDS.md) WA-021. + +Because the host no longer registers qemu-user binfmt, `podman run --platform=linux/amd64`, x86 +chroots, and local builds of uncached x86 derivations need a remote x86_64 builder (see +[WORKAROUNDS.md](../../WORKAROUNDS.md) WA-022). + Related: - [M2 Series Feature Support - Asahi Linux](https://asahilinux.org/docs/platform/feature-support/m2/) diff --git a/hosts/12kingdoms-shoukei/apple-silicon.nix b/hosts/12kingdoms-shoukei/apple-silicon.nix index f57eea1f..eed4a371 100644 --- a/hosts/12kingdoms-shoukei/apple-silicon.nix +++ b/hosts/12kingdoms-shoukei/apple-silicon.nix @@ -26,10 +26,6 @@ ]; }; - environment.systemPackages = with pkgs; [ - box64 # Linux Userspace x86 and x86_64 Emulator, run x86_64 apps(such as games, gui apps) on aarch64. - ]; - # configures the network interface(include wireless) via `nmcli` & `nmtui` networking.networkmanager.enable = true; diff --git a/hosts/12kingdoms-shoukei/default.nix b/hosts/12kingdoms-shoukei/default.nix index aff64541..4a1f005d 100644 --- a/hosts/12kingdoms-shoukei/default.nix +++ b/hosts/12kingdoms-shoukei/default.nix @@ -14,6 +14,7 @@ in { imports = [ ./hardware-configuration.nix + ./game # shoukei reuses ai's preservation layout; no host-specific overrides yet ../idols-ai/preservation.nix ]; diff --git a/hosts/12kingdoms-shoukei/game/default.nix b/hosts/12kingdoms-shoukei/game/default.nix new file mode 100644 index 00000000..ab0111d6 --- /dev/null +++ b/hosts/12kingdoms-shoukei/game/default.nix @@ -0,0 +1,17 @@ +# x86/x86_64 applications and games on this Apple Silicon host. +# +# FEX cannot run on the 16K pages this machine boots with, so +# nix-x86-on-aarch64 runs FEX inside a 4K-page muvm microVM and owns the +# x86_64/i686 ELF handlers. Pinned to our fork; see WORKAROUNDS.md WA-021. +{ nix-x86-on-aarch64, ... }: +{ + imports = [ nix-x86-on-aarch64.nixosModules.default ]; + + programs.x86-on-arm = { + enable = true; + steam.enable = true; + wine.enable = true; + # 16 GiB machine: cap what the guest may demand instead of muvm's 80% default. + memoryMiB = 6144; + }; +} diff --git a/hosts/12kingdoms-shoukei/hardware-configuration.nix b/hosts/12kingdoms-shoukei/hardware-configuration.nix index 73b9dbe0..699d56dc 100644 --- a/hosts/12kingdoms-shoukei/hardware-configuration.nix +++ b/hosts/12kingdoms-shoukei/hardware-configuration.nix @@ -23,14 +23,9 @@ in # depending on how you configured your disk mounts, change this to /boot or /boot/efi. boot.loader.efi.efiSysMountPoint = "/boot"; - # Enable binfmt emulation of aarch64-linux, this is required for cross compilation. - boot.binfmt.emulatedSystems = [ - "x86_64-linux" - "riscv64-linux" - ]; - # This enables the kernel to preload the emulator binaries when the binfmt registrations are added, - # obviating the need to make the emulator binaries available inside chroots and chroot-like sandboxes. - boot.binfmt.preferStaticEmulators = true; # required to work with podman + # Foreign-architecture emulation is not used on this host: x86/x86_64 programs + # run through `./game` (FEX inside a muvm microVM), which owns the x86_64/i686 + # ELF handlers, and qemu-user cannot run them on 16K pages anyway. nixpkgs.overlays = [ (final: previous: { # https://github.com/NixOS/nixpkgs/issues/392673