[PATCH 0/3] Switch from mdevd to systemd-udevd in root filesystem

[PATCH 0/3] Switch from mdevd to systemd-udevd in root filesystem

[Demi Marie Obenour]

systemd-udevd provides support for significantly more hardware than
mdevd does.  Therefore, switch to it.

The last patch intentionally uses some packages built with glibc to
avoid having to build the world from source.  The use of glibc isn't
essential and is just because not using the binary cache to build is
very, very slow.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Demi Marie Obenour (3):
      host/rootfs: Add early serial output
      tools: Add adapter tool for services using sd_notify
      host/rootfs: switch to systemd-udevd

 host/rootfs/Makefile                               |  18 +-
 host/rootfs/default.nix                            |  94 +---
 host/rootfs/etc/init                               |   2 +-
 host/rootfs/etc/mdev.conf                          |   7 -
 host/rootfs/etc/mdev/listen                        |   2 +-
 host/rootfs/etc/mdev/net/add                       |   1 +
 host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |   4 -
 host/rootfs/etc/s6-rc/mdevd-coldplug/up            |   4 -
 host/rootfs/etc/s6-rc/mdevd/run                    |   5 -
 host/rootfs/etc/s6-rc/ok-all/contents              |   2 +-
 .../dependencies.d/systemd-udevd                   |   0
 .../type                                           |   0
 .../type.license                                   |   0
 host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |   3 +
 host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |   0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../notification-fd.license                        |   0
 host/rootfs/etc/s6-rc/systemd-udevd/run            |  10 +
 .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 host/rootfs/etc/s6-rc/vmm-env/contents             |   1 +
 host/rootfs/etc/s6-rc/weston/dependencies          |   4 -
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 host/rootfs/etc/udev/rules.d/99-spectrum.rules     |   5 +
 tools/default.nix                                  |   1 +
 tools/meson.build                                  |   1 +
 tools/sd-notify-adapter/meson.build                |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c        | 490 +++++++++++++++++++++
 28 files changed, 552 insertions(+), 106 deletions(-)
---
base-commit: 31121b718d94229809b53c31bfbb0353b6c3d0d1
change-id: 20250911-udev-24cf4bf68fbe
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[PATCH 1/3] host/rootfs: Add early serial output

[Demi Marie Obenour]

This makes debugging early boot much easier.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
I believe this breaks the integration tests somehow, but I have no idea
how.  Help debugging this would be appreciated.

The subsequent patches don't depend on this one.
---
 host/rootfs/Makefile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index e96458dba06ae31129b115b2b649962f8d88187a..22cdee17a3c878131ea9145fdcafbbbb4ba40db5 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -223,7 +223,6 @@ run: build/live.img $(EXT_FS) build/rootfs.verity.roothash
 	    -qmp unix:build/vmm.sock,server,nowait \
 	    -monitor vc \
 	    -parallel none \
-	    -serial none \
 	    -chardev vc,id=virtiocon0 \
 	    -device virtio-serial \
 	    -device virtconsole,chardev=virtiocon0 \

-- 
2.51.0

Re: [PATCH 1/3] host/rootfs: Add early serial output

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This makes debugging early boot much easier.

Even though console=hvc0?

> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> I believe this breaks the integration tests somehow, but I have no idea
> how.  Help debugging this would be appreciated.
>
> The subsequent patches don't depend on this one.
> ---
>  host/rootfs/Makefile | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
> index e96458dba06ae31129b115b2b649962f8d88187a..22cdee17a3c878131ea9145fdcafbbbb4ba40db5 100644
> --- a/host/rootfs/Makefile
> +++ b/host/rootfs/Makefile
> @@ -223,7 +223,6 @@ run: build/live.img $(EXT_FS) build/rootfs.verity.roothash
>  	    -qmp unix:build/vmm.sock,server,nowait \
>  	    -monitor vc \
>  	    -parallel none \
> -	    -serial none \
>  	    -chardev vc,id=virtiocon0 \
>  	    -device virtio-serial \
>  	    -device virtconsole,chardev=virtiocon0 \
>
> -- 
> 2.51.0

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH 1/3] host/rootfs: Add early serial output

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 351 bytes --]

On 9/17/25 07:45, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This makes debugging early boot much easier.
> 
> Even though console=hvc0?
I believe so, yes.  If the virtio console is a module
while the serial console is built in it would explain
what I saw.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 1/3] host/rootfs: Add early serial output

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 471 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This makes debugging early boot much easier.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> I believe this breaks the integration tests somehow, but I have no idea
> how.  Help debugging this would be appreciated.

Doesn't seem to for me (and I can't imagine why it would — the tests
don't touch make run).

I'll tweak this so the same change is made for initramfs and apply it.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH 1/3] host/rootfs: Add early serial output

[Alyssa Ross]

This patch has been committed as 1c471fc4191958dfbffbdb5ad2de404e19b31287,
which can be viewed online at
https://spectrum-os.org/git/spectrum/commit/?id=1c471fc4191958dfbffbdb5ad2de404e19b31287.

This is an automated message.  Send comments/questions/requests to:
Alyssa Ross <hi@alyssa.is>

[PATCH 2/3] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

This adapts programs using sd_notify for use with s6 readiness
notification.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
The amount of code in sd-notify-adapter is significantly less than that
of s6-supervise itself.  Furthermore, it duplicates a lot of the
functionality in that tool.  Therefore, I think that s6-supervise is
actually the correct place for this.  In particular, this allows
reliable reloading of services: send a SIGHUP and wait for RELOADING=1
and then READY=1.
---
 tools/default.nix                           |   1 +
 tools/meson.build                           |   1 +
 tools/sd-notify-adapter/meson.build         |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c | 490 ++++++++++++++++++++++++++++
 4 files changed, 496 insertions(+)

diff --git a/tools/default.nix b/tools/default.nix
index 95d76a12c5d2cdc0f47134f36dc8ac326bd8aff1..88556e6fbae6584d03e67da5b74fbac306acb16e 100644
--- a/tools/default.nix
+++ b/tools/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
       ./lsvm
       ./start-vmm
       ./subprojects
+      ./sd-notify-adapter
     ]));
   };
   sourceRoot = "source/tools";
diff --git a/tools/meson.build b/tools/meson.build
index 9cebd03e323531fca7600cacf120161a98de16c5..91cb54e4e7472f8fc225bc75b82442d5600a3a9c 100644
--- a/tools/meson.build
+++ b/tools/meson.build
@@ -21,6 +21,7 @@ if get_option('host')
 
   subdir('lsvm')
   subdir('start-vmm')
+  subdir('sd-notify-adapter')
 endif
 
 if get_option('guest')
diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
new file mode 100644
index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
--- /dev/null
+++ b/tools/sd-notify-adapter/meson.build
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: ISC
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
new file mode 100644
index 0000000000000000000000000000000000000000..d5356e2957bad8a15a5dd45e32db6bbac915c2c6
--- /dev/null
+++ b/tools/sd-notify-adapter/sd-notify-adapter.c
@@ -0,0 +1,490 @@
+// SPDX-License-Identifier: ISC
+// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+// check_posix and check_posix_bool are based on code with following license:
+//
+// Copyright  2014 Daniel Micay
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#define _GNU_SOURCE 1
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <getopt.h>
+#include <fcntl.h>
+#include <sys/syscall.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <sysexits.h>
+#include <err.h>
+#include <poll.h>
+
+/* TODO: does this need to have credit given to Daniel Micay? */
+__attribute__((format(printf, 2, 3)))
+intmax_t check_posix(intmax_t arg, const char *fmt, ...) {
+	if (arg >= 0)
+		return arg;
+	assert(arg == -1);
+	va_list a;
+	va_start(a, fmt);
+	verr(EX_OSERR, fmt, a);
+	__builtin_unreachable();
+}
+
+#define check_posix(arg, message, ...) \
+	((__typeof__(arg))check_posix(arg, message, ## __VA_ARGS__))
+
+/* And same here */
+__attribute__((format(printf, 2, 3)))
+void check_posix_bool(intmax_t arg, const char *fmt, ...) {
+	if (arg != -1) {
+		assert(arg == 0);
+		return;
+	}
+	va_list a;
+	va_start(a, fmt);
+	verr(EX_OSERR, fmt, a);
+	va_end(a); /* not reached */
+}
+
+/* And same here */
+void check_posix_bool_no_atexit(intmax_t arg, const char *msg) {
+	if (arg != -1) {
+		assert(arg == 0);
+		return;
+	}
+	perror(msg);
+	_exit(EX_OSERR);
+}
+
+static volatile siginfo_t sig_info;
+static pid_t child_pid;
+
+/* Interrupts a call to ppoll(), which is AS-safe */
+static void handler(int signum, siginfo_t *info, void *data)
+{
+	(void)data;
+	switch (signum) {
+	case SIGCHLD:
+		switch (info->si_code) {
+		case CLD_EXITED:
+		case CLD_KILLED:
+		case CLD_DUMPED:
+			if (info->si_pid == child_pid)
+				sig_info = *info;
+			break;
+		}
+		break;
+	case SIGTERM:
+	case SIGINT:
+	case SIGWINCH:
+	case SIGHUP:
+	case SIGUSR1:
+	case SIGUSR2:
+	case SIGQUIT:
+		kill(child_pid, signum);
+		break;
+	default:
+		abort();
+	}
+}
+
+/* too_low is 1 below the lower bound; this prevents the final negation
+ * from overflowing if too_low and the result are INT_MIN */
+static int parse_int(const char *arg, int too_low) {
+	char *end = (char *)arg;
+	if (*arg == '0') {
+		if (arg[1] == '\0' && too_low < 0)
+			return 0;
+		return INT_MIN;
+	}
+	int negative = *arg == '-';
+	if (negative) {
+		arg++;
+	}
+	if (*arg < '1' || *arg > '9') {
+		return INT_MIN;
+	}
+	errno = 0;
+	long v = strtol(arg, &end, 10);
+	if (v <= too_low || v > INT_MAX || errno || *end != '\0') {
+		return INT_MIN;
+	}
+	return negative ? -(int)v : (int)v;
+}
+
+const struct option longopts[] = {
+	{ "oom-score-adj", required_argument, NULL, 'o' },
+	{ "help", no_argument, NULL, 'h' },
+	{ NULL, 0, NULL, 0 },
+};
+
+static _Noreturn void usage(int arg) {
+	errx(arg, "Usage: notification-fd [[-o|--oom-score-adj] adjustment] -- notify-socket program argv0 args...\n");
+}
+
+#if O_RDONLY != 0 || O_WRONLY != 1 || O_RDWR != 2
+# error unsupported O_* constants
+#endif
+
+static void check_fd_usable(int fd, bool writable) {
+	int raw_flags = fcntl(fd, F_GETFL);
+	if (raw_flags == -1) {
+		err(errno == EBADF ? EX_USAGE : EX_OSERR, "fcntl(%d, F_GETFD)", fd);
+	}
+	int flags = raw_flags & 3;
+	if (flags != O_RDWR && flags != (writable ? O_WRONLY : O_RDONLY)) {
+		errx(EX_USAGE, "File descriptor %d is not %s (flags 0x%x)", fd, writable ? "writable" : "readable", raw_flags);
+	}
+}
+
+static void check_pipe(int fd) {
+	struct stat buf;
+	check_posix_bool(fstat(fd, &buf), "fstat");
+	if (!S_ISFIFO(buf.st_mode)) {
+		errx(EX_USAGE, "notification fd %d is not a pipe", fd);
+	}
+	if (buf.st_mode & 066) {
+		errx(EX_USAGE, "notification fd %d is accessible by group or other", fd);
+	}
+}
+
+static pid_t process_cmsg(struct msghdr *const msg) {
+	pid_t sender_pid = -1;
+	for (struct cmsghdr *cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+		size_t data_len = cmsg->cmsg_len - sizeof(struct cmsghdr);
+		if (cmsg->cmsg_level != SOL_SOCKET) {
+		       continue;
+		}
+		if (cmsg->cmsg_type == SCM_RIGHTS) {
+			int received_fd;
+			for (size_t i = 0; data_len - i >= sizeof(received_fd); i += sizeof(received_fd)) {
+				memcpy(&received_fd, CMSG_DATA(cmsg) + i, sizeof(received_fd));
+				(void)close(received_fd);
+			}
+		}
+		if (cmsg->cmsg_type == SCM_CREDENTIALS) {
+			struct ucred creds;
+			assert(data_len >= sizeof(creds));
+			memcpy(&creds, CMSG_DATA(cmsg), sizeof(creds));
+			sender_pid = creds.pid;
+		}
+	}
+	return sender_pid;
+}
+static pid_t own_pid;
+
+void kill_process_group(void) {
+	if (own_pid != -1)
+		kill(0, SIGKILL);
+}
+
+int main(int argc, char **argv) {
+	own_pid = getpid();
+	int oom_score_adj = INT_MIN;
+	if (argc < 1) {
+		errx(EX_USAGE, "argv[0] is NULL");
+	}
+	if (own_pid < 2) {
+		errx(EX_USAGE, "cannot run as PID 1");
+	}
+	for (int i = 0; i < 3; ++i) {
+		check_fd_usable(i, i != 0);
+	}
+
+	for (;;) {
+		int longindex = -1;
+		const char *lastopt = argv[optind];
+		int res = getopt_long(argc, argv, "+o:h", longopts, &longindex);
+		if (res == -1) {
+			if (argc - optind < 4) {
+				usage(EX_USAGE);
+			}
+			if (strcmp(lastopt, "--") != 0) {
+				errx(EX_USAGE, "no -- before non-option arguments");
+			}
+			break;
+		}
+		if (res == '?') {
+			usage(EX_USAGE);
+		}
+		/* getopt_long accepts abbreviated options. Disable this misfeature. */
+		if (lastopt[0] == '-' && lastopt[1] == '-') {
+			const char *optname = lastopt + 2;
+			assert(longindex >= 0 && longindex < (int)(sizeof(longopts)/sizeof(longopts[0])));
+			const char *expected = longopts[longindex].name;
+			if (strncmp(expected, optname, strlen(expected)) != 0) {
+				char *equal = strchr(optname, '=');
+				errx(EX_USAGE,
+				     "Option --%.*s must be written as --%s",
+				     equal ? (int)(equal - optname) : INT_MAX,
+				     optname, expected);
+			}
+		}
+		switch (res) {
+		case 'o':
+			oom_score_adj = parse_int(optarg, INT_MIN);
+			if (oom_score_adj < -1000 || oom_score_adj > 1000) {
+				errx(EX_USAGE, "Invalid OOM score adjustment %s", optarg);
+			}
+			break;
+		case 'h':
+			usage(0);
+		default:
+			assert(0); /* not reached */
+		}
+	}
+
+	union {
+		struct sockaddr_un un;
+		struct sockaddr addr;
+	} a = {};
+	int notification_fd = parse_int(argv[optind], 2);
+	const char *const socket_path = argv[optind + 1];
+	const char *const progname = argv[optind + 2];
+	char **const args_to_exec = argv + optind + 3;
+
+	if (notification_fd < 3) {
+		errx(EX_USAGE, "Invalid notification descriptor %s\n", argv[optind]);
+	}
+	check_fd_usable(notification_fd, true);
+	check_pipe(notification_fd);
+	check_posix_bool(chdir("/"), "chdir(/)");
+
+	mode_t old_mask = umask(0077);
+	size_t len = strlen(socket_path);
+	if (len >= sizeof(a.un.sun_path)) {
+		/* TODO: use stravis() */
+		errx(EX_USAGE, "Path %s is too long", socket_path);
+	}
+	if (socket_path[0] != '/') {
+		/* TODO: use stravis() */
+		errx(EX_USAGE, "Path %s is not absolute", socket_path);
+	}
+
+	if (check_posix(getpgrp(), "getpgrp()") != own_pid) {
+		check_posix_bool(setsid(), "setsid");
+	}
+
+	memcpy(a.un.sun_path, socket_path, len + 1);
+	a.un.sun_family = AF_UNIX;
+	int fd = check_posix(socket(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0), "socket");
+	{
+		int flag = 1;
+		check_posix_bool(setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &flag, (socklen_t)sizeof(flag)),
+				 "setsockopt(SO_REUSEADDR)");
+		check_posix_bool(setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &flag, (socklen_t)sizeof(flag)),
+				 "setsockopt(SO_PASSCRED)");
+	}
+	for (;;) {
+		int status;
+		do {
+			status = bind(fd, &a.addr, (socklen_t)(len + 1 + offsetof(struct sockaddr_un, sun_path)));
+		} while (status == -1 && errno == EINTR);
+		if (!(status == -1 && errno == EADDRINUSE)) {
+			check_posix_bool(status, "bind(%s)", socket_path);
+			break;
+		}
+		check_posix_bool(unlink(socket_path), "unlink(%s)", socket_path);
+	}
+	umask(old_mask);
+
+	/* TODO: support commands */
+	sigset_t sigset;
+	sigemptyset(&sigset);
+	const int sigs[] = { SIGCHLD, SIGQUIT, SIGTERM, SIGINT, SIGWINCH, SIGHUP, SIGUSR1, SIGUSR2 };
+	for (size_t i = 0; i < sizeof(sigs)/sizeof(sigs[0]); ++i) {
+		check_posix_bool(sigaddset(&sigset, sigs[i]), "sigaddset(%d)", sigs[i]);
+	}
+	check_posix_bool(sigprocmask(SIG_BLOCK, &sigset, NULL), "sigprocmask");
+	struct sigaction act = { };
+	/* systemd ignores SIGPIPE, so emulate this */
+	act.sa_handler = SIG_IGN;
+	check_posix_bool(sigaction(SIGPIPE, &act, NULL), "sigaction(SIGPIPE)");
+	/* add handlers */
+	act.sa_sigaction = handler;
+	act.sa_mask = sigset; /* these are already blocked but that is harmless */
+	act.sa_flags = SA_SIGINFO;
+	for (size_t i = 0; i < sizeof(sigs)/sizeof(sigs[0]); ++i) {
+		check_posix_bool(sigaction(sigs[i], &act, NULL), "sigaction(%d)", sigs[i]);
+	}
+	static_assert(EOF == -1, "bad EOF definition");
+	check_posix_bool(fflush(NULL), "fflush");
+	if (oom_score_adj != INT_MIN) {
+		char *p;
+		int fd = check_posix(open("/proc/self/oom_score_adj",
+		                          O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW),
+		                     "open(\"/proc/self/oom_score_adj\")");
+		int to_write = check_posix(asprintf(&p, "%d\n", oom_score_adj), "asprintf");
+		ssize_t written = check_posix(write(fd, p, (size_t)to_write), "write(\"/proc/self/oom_score_adj\")");
+		assert(written == to_write);
+		free(p);
+	}
+	pid_t pid = fork();
+	if (pid < 0) {
+		assert(pid == -1);
+		err(EX_OSERR, "fork()");
+	}
+	child_pid = pid;
+
+	if (atexit(kill_process_group)) {
+		errx(EX_OSERR, "atexit()");
+	}
+	if (pid == 0) {
+		check_posix_bool_no_atexit(syscall(SYS_close_range, 3L, ~0UL, 0L), "close_range()");
+		check_posix_bool_no_atexit(setenv("NOTIFY_SOCKET", a.un.sun_path, 1), "setenv");
+		check_posix_bool_no_atexit(execve(progname, args_to_exec, environ), "execve");
+		abort(); /* not reached */
+	}
+	char buf[sizeof("RELOADING=1\n") - 1];
+	struct iovec v[1] = {
+		{
+			.iov_base = buf,
+			.iov_len = sizeof(buf),
+		},
+	};
+	union {
+		struct cmsghdr hdr;
+		char buf[CMSG_SPACE(sizeof(struct ucred)) + CMSG_SPACE(sizeof(int) * 253)];
+	} cmsg_buffer;
+
+	struct msghdr msg = {
+		.msg_name = NULL,
+		.msg_namelen = 0,
+		.msg_iov = v,
+		.msg_iovlen = sizeof(v)/sizeof(v[0]),
+		.msg_control = cmsg_buffer.buf,
+		.msg_controllen = sizeof(cmsg_buffer.buf),
+		.msg_flags = 0,
+	};
+	sigemptyset(&sigset);
+
+	struct pollfd p[] = {
+		{
+			.fd = fd,
+			.events = POLLIN | POLLPRI | POLLRDHUP,
+			.revents = 0,
+		},
+	};
+	bool ready = false;
+	bool reloading = false;
+
+	for (;;) {
+		/* Main event loop */
+		if (sig_info.si_pid) {
+			int status;
+			int r = waitpid(sig_info.si_pid, &status, 0);
+			if (r == -1)
+				err(EX_OSERR, "waitpid(%jd)", (intmax_t)sig_info.si_pid);
+			if (WIFSIGNALED(status)) {
+				for (;;) {
+					(void)signal(WTERMSIG(status), SIG_DFL);
+					(void)kill(getpid(), WTERMSIG(status));
+				}
+			} else if (WIFEXITED(status)) {
+				own_pid = -1;
+				return WEXITSTATUS(status);
+			} else {
+				abort(); /* cannot happen */
+			}
+		}
+		int r = ppoll(p, sizeof(p)/sizeof(p[0]), NULL, &sigset);
+		if (r < -1 || r > (int)(sizeof(p)/sizeof(p[0]))) {
+			abort();
+		}
+		if (r == -1) {
+			if (errno == ENOMEM) {
+				fprintf(stderr, "Kernel out of memory in ppoll()\n");
+				continue; /* todo: use epoll(7) instead */
+			}
+			if (errno == EINTR) {
+				fprintf(stderr, "ppoll() interrupted by signal\n");
+				continue;
+			}
+			err(EX_OSERR, "poll");
+		}
+		fprintf(stderr, "Returned from poll()\n");
+		if (p[0].revents) {
+			ssize_t data = recvmsg(fd, &msg, MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
+			if (data == -1) {
+				if (errno == EINTR) {
+					fprintf(stderr, "recvmsg() interrupted by signal");
+					continue; /* signal caught */
+				}
+				if (errno == EAGAIN || errno == EWOULDBLOCK) {
+					fprintf(stderr, "ppoll() spurious wakeup\n");
+					continue; /* spurious wakeup */
+				}
+			}
+			size_t size = (size_t)check_posix(data, "recvmsg");
+			pid_t sender_pid = process_cmsg(&msg);
+			if (msg.msg_flags & MSG_TRUNC) {
+				char *b = (v[0].iov_base == buf) ? malloc(size) : realloc(v[0].iov_base, size);
+				if (b != NULL) {
+					v[0].iov_base = b;
+					v[0].iov_len = size;
+				}
+			}
+			size = (size_t)check_posix(recvmsg(fd, &msg, MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC), "recvmsg");
+			sender_pid = process_cmsg(&msg);
+			if (sender_pid != child_pid) {
+				fprintf(stderr, "%jd cannot notify\n", (intmax_t)sender_pid);
+				continue; /* cannot notify */
+			}
+			const char *cursor = v[0].iov_base;
+			const char *end = cursor + size;
+			for (;;) {
+				char *next = memchr(cursor, '\n', (size_t)(end - cursor));
+				size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
+				if (message_size == sizeof("READY=1") - 1 && memcmp(cursor, "READY=1", sizeof("READY=1") - 1) == 0) {
+					if (!ready) {
+						if (check_posix(write(notification_fd, "Ready\n", sizeof("Ready")), "write") != sizeof("Ready")) {
+							errx(EX_OSERR, "cannot notify parent of readiness");
+						}
+					}
+					ready = true;
+					if (reloading) {
+						fprintf(stderr, "Configuration reload complete\n");
+					} else {
+						fprintf(stderr, "Program ready\n");
+					}
+					reloading = false;
+				} else if (message_size == sizeof("RELOADING=1") - 1 && memcmp(cursor, "RELOADING=1", sizeof("RELOADING=1") - 1) == 0) {
+					reloading = true;
+				}
+				if (next == NULL) {
+					break;
+				}
+				cursor = next + 1;
+			}
+		}
+	}
+}

-- 
2.51.0

[PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

This replaces the mdevd uevent daemon with systemd-udevd, which supports
much more hardware and is therefore to be preferred for a full desktop
environment.  Various Wayland compositors integrate with systemd-udevd,
allowing them to discover devices as they appear rather than having to
only use devices plugged in when the compositor is started.
Additionally, systemd-udevd has quirks for various devices that are
needed to support the wide variety of hardware end-users have.

The dependency on /dev/dri/card0 being present is eliminated, and
whatever devices the user has are now picked up by the compositor.  New
dependencies are added to ensure that udev coldplug has finished before
any non-trivial services are started.  systemd-udev-trigger.service runs
'udevadm trigger' and has Before=sysinit.target, so anything that is not
an early boot service can assume 'udevadm trigger' has run.

systemd-udevd doesn't set PATH to anything useful, presumably because
under NixOS this is handled some other way.  Therefore, explicitly set
it to /usr/bin in the scripts systemd-udevd calls.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
The changes to default.nix are so that I could use the binary cache,
which was necessary to test this in a reasonable amount of time.  I'm
also not sure what changes you (Alyssa) want in this file.  Feel free to
fix it up on commit.
---
 host/rootfs/Makefile                               | 17 ++--
 host/rootfs/default.nix                            | 94 ++++++----------------
 host/rootfs/etc/init                               |  2 +-
 host/rootfs/etc/mdev.conf                          |  7 --
 host/rootfs/etc/mdev/listen                        |  2 +-
 host/rootfs/etc/mdev/net/add                       |  1 +
 host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |  4 -
 host/rootfs/etc/s6-rc/mdevd-coldplug/up            |  4 -
 host/rootfs/etc/s6-rc/mdevd/run                    |  5 --
 host/rootfs/etc/s6-rc/ok-all/contents              |  2 +-
 .../dependencies.d/systemd-udevd                   |  0
 .../type                                           |  0
 .../type.license                                   |  0
 host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |  3 +
 host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |  0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |  0
 .../notification-fd.license                        |  0
 host/rootfs/etc/s6-rc/systemd-udevd/run            | 10 +++
 .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |  0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |  0
 host/rootfs/etc/s6-rc/vmm-env/contents             |  1 +
 host/rootfs/etc/s6-rc/weston/dependencies          |  4 -
 .../weston/dependencies.d/systemd-udevd-coldplug   |  0
 host/rootfs/etc/udev/rules.d/99-spectrum.rules     |  5 ++
 24 files changed, 56 insertions(+), 105 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 22cdee17a3c878131ea9145fdcafbbbb4ba40db5..ed3937c5665273bb0a5ba7c1dfeaf6b887763c59 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -13,7 +13,6 @@ FILES = \
 	etc/group \
 	etc/init \
 	etc/login \
-	etc/mdev.conf \
 	etc/mdev/listen \
 	etc/mdev/net/add \
 	etc/mdev/wait \
@@ -52,6 +51,7 @@ FILES = \
 	etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/notification-fd \
 	etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/run \
 	etc/s6-linux-init/scripts/rc.init \
+	etc/udev/rules.d/99-spectrum.rules \
 	etc/xdg/weston/autolaunch \
 	etc/xdg/weston/weston.ini \
 	usr/bin/assign-devices \
@@ -136,12 +136,6 @@ S6_RC_FILES = \
 	etc/s6-rc/kvm/timeout-up \
 	etc/s6-rc/kvm/type \
 	etc/s6-rc/kvm/up \
-	etc/s6-rc/mdevd-coldplug/dependencies \
-	etc/s6-rc/mdevd-coldplug/type \
-	etc/s6-rc/mdevd-coldplug/up \
-	etc/s6-rc/mdevd/notification-fd \
-	etc/s6-rc/mdevd/run \
-	etc/s6-rc/mdevd/type \
 	etc/s6-rc/ok-all/contents \
 	etc/s6-rc/ok-all/type \
 	etc/s6-rc/static-nodes/type \
@@ -149,11 +143,18 @@ S6_RC_FILES = \
 	etc/s6-rc/sys-vmms/dependencies \
 	etc/s6-rc/sys-vmms/type \
 	etc/s6-rc/sys-vmms/up \
+	etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd \
+	etc/s6-rc/systemd-udevd-coldplug/type \
+	etc/s6-rc/systemd-udevd-coldplug/up \
+	etc/s6-rc/systemd-udevd/flag-essential \
+	etc/s6-rc/systemd-udevd/notification-fd \
+	etc/s6-rc/systemd-udevd/run \
+	etc/s6-rc/systemd-udevd/type \
 	etc/s6-rc/vm-env/contents \
 	etc/s6-rc/vm-env/type \
 	etc/s6-rc/vmm-env/contents \
 	etc/s6-rc/vmm-env/type \
-	etc/s6-rc/weston/dependencies \
+	etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug \
 	etc/s6-rc/weston/notification-fd \
 	etc/s6-rc/weston/run \
 	etc/s6-rc/weston/type
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 20692ba75e9c1f3b93b16d6e47ee777a1965ff8d..ba605588afb2b69adfec59b41af09e8c11a70d79 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -3,7 +3,7 @@
 # SPDX-FileCopyrightText: 2022 Unikie
 
 import ../../lib/call-package.nix (
-{ callSpectrumPackage, lseek, src, pkgsMusl, pkgsStatic, linux_latest }:
+{ callSpectrumPackage, lseek, src, pkgsMusl, pkgsStatic, linux_latest, pkgs }:
 pkgsStatic.callPackage (
 
 { spectrum-host-tools
@@ -12,6 +12,11 @@ pkgsStatic.callPackage (
 , inkscape, iproute2, inotify-tools, jq, kmod, mdevd, s6, s6-linux-init, socat
 , util-linuxMinimal, virtiofsd, xorg, xdg-desktop-portal-spectrum-host
 }:
+pkgs.callPackage (
+{ systemdMinimal, foot, cosmic-files, crosvm
+, mesa, dejavu_fonts, westonLite, xdg-desktop-portal
+, xdg-desktop-portal-gtk
+}:
 
 let
   inherit (nixosAllHardware.config.hardware) firmware;
@@ -19,68 +24,9 @@ let
     concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs
     mapAttrsToList systems trivial;
 
-  pkgsGui = pkgsMusl.extend (
-    final: super:
-    (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
-      flatpak = super.flatpak.override {
-        withMalcontent = false;
-      };
-
-      libgudev = super.libgudev.overrideAttrs ({ ... }: {
-        # Tests use umockdev, which is not compatible with libudev-zero.
-        doCheck = false;
-      });
-
-      qt6 = super.qt6.overrideScope (_: prev: {
-        qttranslations = prev.qttranslations.override {
-          qttools = prev.qttools.override {
-            qtbase = prev.qtbase.override {
-              qttranslations = null;
-              systemdSupport = false;
-            };
-            qtdeclarative = null;
-          };
-        };
-
-        qtbase = prev.qtbase.override {
-          systemdSupport = false;
-        };
-      });
-
-      systemd = super.systemd.overrideAttrs ({ meta ? { }, ... }: {
-        meta = meta // {
-          platforms = [ ];
-        };
-      });
-
-      upower = super.upower.override {
-        # Not ideal, but it's the best way to get rid of an installed
-        # test that needs umockdev.
-        withIntrospection = false;
-      };
-
-      udev = final.libudev-zero;
-
-      weston = super.weston.overrideAttrs ({ mesonFlags ? [], ... }: {
-        mesonFlags = mesonFlags ++ [
-          "-Dsystemd=false"
-        ];
-      });
-
-      xdg-desktop-portal = (super.xdg-desktop-portal.override {
-        enableSystemd = false;
-      }).overrideAttrs ({ ... }: {
-        # Tests use umockdev.
-        doCheck = false;
-      });
-    })
-  );
-
-  foot = pkgsGui.foot.override { allowPgo = false; };
-
   packages = [
-    bcachefs-tools cloud-hypervisor dbus execline inotify-tools
-    iproute2 jq kmod mdevd s6 s6-linux-init s6-rc socat
+    bcachefs-tools cloud-hypervisor cosmic-files crosvm dbus execline
+    foot inotify-tools iproute2 jq kmod s6 s6-linux-init s6-rc socat
     spectrum-host-tools virtiofsd xdg-desktop-portal-spectrum-host
 
     (cryptsetup.override {
@@ -96,6 +42,7 @@ let
         CONFIG_CHATTR n
         CONFIG_DEPMOD n
         CONFIG_FINDFS n
+        CONFIG_HALT n
         CONFIG_INIT n
         CONFIG_INSMOD n
         CONFIG_IP n
@@ -106,10 +53,13 @@ let
         CONFIG_MODINFO n
         CONFIG_MODPROBE n
         CONFIG_MOUNT n
+        CONFIG_POWEROFF n
+        CONFIG_REBOOT n
         CONFIG_RMMOD n
+        CONFIG_SHUTDOWN n
       '';
     })
-  ] ++ (with pkgsGui; [ cosmic-files crosvm foot ]);
+  ];
 
   nixosAllHardware = nixos ({ modulesPath, ... }: {
     imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
@@ -126,7 +76,7 @@ let
   # (not just their bin/* files).
   usrPackages = [
     appvm kernel.modules firmware netvm
-  ] ++ (with pkgsGui; [ mesa dejavu_fonts westonLite ]);
+    mesa dejavu_fonts westonLite ];
 
   appvms = {
     appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {};
@@ -144,16 +94,16 @@ let
     # Weston doesn't support SVG icons.
     inkscape -w 20 -h 20 \
         -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \
-        ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
+        ${cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
 
     ln -st $out/usr/bin \
         ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \
-        ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \
-        ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
+        ${xdg-desktop-portal}/libexec/xdg-document-portal \
+        ${xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
     ln -st $out/usr/share/dbus-1 \
         ${dbus}/share/dbus-1/session.conf
     ln -st $out/usr/share/dbus-1/services \
-        ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
+        ${xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
 
     for pkg in ${escapeShellArgs usrPackages}; do
         lndir -ignorelinks -silent "$pkg" "$out/usr"
@@ -167,6 +117,10 @@ let
     # programs we want.
     # https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
     ln -s ${util-linuxMinimal}/bin/{findfs,uuidgen,lsblk,mount} $out/usr/bin
+
+    # TODO: this is another hack and it should be possible
+    # to build systemd without this.
+    ln -s -- ${lib.escapeShellArg systemdMinimal}/bin/udevadm "$out/usr/bin"
   '';
 in
 
@@ -203,7 +157,7 @@ stdenvNoCC.mkDerivation {
   unsafeDiscardReferences = { out = true; };
 
   passthru = {
-    inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui;
+    inherit appvm firmware kernel nixosAllHardware packagesSysroot;
   };
 
   meta = with lib; {
@@ -211,4 +165,4 @@ stdenvNoCC.mkDerivation {
     platforms = platforms.linux;
   };
 }
-) {}) (_: {})
+) {}) {}) (_: {})
diff --git a/host/rootfs/etc/init b/host/rootfs/etc/init
index 4085fa55545e7309004967e443e47fc2b82b0663..22b38017234e9b042c4c239377e80477aca5f5fa 100755
--- a/host/rootfs/etc/init
+++ b/host/rootfs/etc/init
@@ -2,4 +2,4 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi@alyssa.is>
 
-/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@
+/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -p /usr/bin -- $@
diff --git a/host/rootfs/etc/mdev.conf b/host/rootfs/etc/mdev.conf
deleted file mode 100644
index bddcfdc44ec2a8b1aa95e84cb88fdde625c766d8..0000000000000000000000000000000000000000
--- a/host/rootfs/etc/mdev.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021-2022, 2024 Alyssa Ross <hi@alyssa.is>
-
-$PCI_CLASS=^2....$ 0:0 660 +/etc/mdev/net/add
--$MODALIAS=.* 0:0 660 +importas -Siu MODALIAS modprobe -q $MODALIAS
-kvm 0:0 660 +background { /etc/mdev/listen kvm }
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
diff --git a/host/rootfs/etc/mdev/listen b/host/rootfs/etc/mdev/listen
index ab50ee8c5ed1139d1129bac56afa7263af150745..20969cab2106efc010cff7cd3aa3f1edc6037dbb 100755
--- a/host/rootfs/etc/mdev/listen
+++ b/host/rootfs/etc/mdev/listen
@@ -8,4 +8,4 @@ foreground {
 }
 
 redirfd -w 1 /run/wait/${1}
-echo
+/usr/bin/echo
diff --git a/host/rootfs/etc/mdev/net/add b/host/rootfs/etc/mdev/net/add
index f343779dcab6ca10c1661e40d3f5bfb8f6080e38..a964376abb75cdd7b07d608c1b76c25c802bcf49 100755
--- a/host/rootfs/etc/mdev/net/add
+++ b/host/rootfs/etc/mdev/net/add
@@ -5,6 +5,7 @@
 # Assign the whole IOMMU group containing this device to the network
 # VM.
 
+export PATH /usr/bin
 if { modprobe vfio-pci }
 
 importas -i devpath DEVPATH
diff --git a/host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies b/host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies
deleted file mode 100644
index 59b02b7356ea0d88ac446cea74791a9cd3303de4..0000000000000000000000000000000000000000
--- a/host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2020 Alyssa Ross <hi@alyssa.is>
-#
-mdevd
diff --git a/host/rootfs/etc/s6-rc/mdevd-coldplug/up b/host/rootfs/etc/s6-rc/mdevd-coldplug/up
deleted file mode 100644
index 8698f7d7988a017786fb91a584eafbfb23b3165d..0000000000000000000000000000000000000000
--- a/host/rootfs/etc/s6-rc/mdevd-coldplug/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-
-mdevd-coldplug
diff --git a/host/rootfs/etc/s6-rc/mdevd/run b/host/rootfs/etc/s6-rc/mdevd/run
deleted file mode 100644
index 55899bbe674426e4591e866a4d0617361ba34305..0000000000000000000000000000000000000000
--- a/host/rootfs/etc/s6-rc/mdevd/run
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/execlineb -P
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi@alyssa.is>
-
-mdevd -D3 -O4 -b134217728
diff --git a/host/rootfs/etc/s6-rc/ok-all/contents b/host/rootfs/etc/s6-rc/ok-all/contents
index 9f8b0ed66ceedd591ed2f1a7e164d9abcc54cc53..c76a5af336c7f1c3f4b81bf1f6244a53e0399fe8 100644
--- a/host/rootfs/etc/s6-rc/ok-all/contents
+++ b/host/rootfs/etc/s6-rc/ok-all/contents
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
 #
-mdevd-coldplug
+systemd-udevd-coldplug
 sys-vmms
 vm-env
diff --git a/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd b/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/etc/s6-rc/mdevd-coldplug/type b/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/type
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd-coldplug/type
rename to host/rootfs/etc/s6-rc/systemd-udevd-coldplug/type
diff --git a/host/rootfs/etc/s6-rc/mdevd-coldplug/type.license b/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/type.license
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd-coldplug/type.license
rename to host/rootfs/etc/s6-rc/systemd-udevd-coldplug/type.license
diff --git a/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up
new file mode 100644
index 0000000000000000000000000000000000000000..5cf329c5b32f44ab8b48dc10239542a982c68d14
--- /dev/null
+++ b/host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: CC0-1.0
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+/usr/bin/udevadm trigger
diff --git a/host/rootfs/etc/s6-rc/systemd-udevd/flag-essential b/host/rootfs/etc/s6-rc/systemd-udevd/flag-essential
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/etc/s6-rc/mdevd/notification-fd b/host/rootfs/etc/s6-rc/systemd-udevd/notification-fd
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd/notification-fd
rename to host/rootfs/etc/s6-rc/systemd-udevd/notification-fd
diff --git a/host/rootfs/etc/s6-rc/mdevd/notification-fd.license b/host/rootfs/etc/s6-rc/systemd-udevd/notification-fd.license
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd/notification-fd.license
rename to host/rootfs/etc/s6-rc/systemd-udevd/notification-fd.license
diff --git a/host/rootfs/etc/s6-rc/systemd-udevd/run b/host/rootfs/etc/s6-rc/systemd-udevd/run
new file mode 100644
index 0000000000000000000000000000000000000000..a7290b8c7185aea2b8faae4fd6c2aaf1ca9f1ab3
--- /dev/null
+++ b/host/rootfs/etc/s6-rc/systemd-udevd/run
@@ -0,0 +1,10 @@
+#!/bin/execlineb -P
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# systemd-udevd is a multi-call binary, and
+# the third argument to sd-notify-adapter is
+# passed as argv[0], so this invokes systemd-udevd
+# despite looking like it does not.
+sd-notify-adapter --oom-score-adj=-1000 --
+3 /run/udev-notify/notify-sock /usr/bin/udevadm systemd-udevd
diff --git a/host/rootfs/etc/s6-rc/mdevd/type b/host/rootfs/etc/s6-rc/systemd-udevd/type
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd/type
rename to host/rootfs/etc/s6-rc/systemd-udevd/type
diff --git a/host/rootfs/etc/s6-rc/mdevd/type.license b/host/rootfs/etc/s6-rc/systemd-udevd/type.license
similarity index 100%
rename from host/rootfs/etc/s6-rc/mdevd/type.license
rename to host/rootfs/etc/s6-rc/systemd-udevd/type.license
diff --git a/host/rootfs/etc/s6-rc/vmm-env/contents b/host/rootfs/etc/s6-rc/vmm-env/contents
index ee1e3cfc39d1a6545bbefc3692782b9de6b3ade3..6f4c16d17c1cb23ebf059e50d59b4c1c7d963706 100644
--- a/host/rootfs/etc/s6-rc/vmm-env/contents
+++ b/host/rootfs/etc/s6-rc/vmm-env/contents
@@ -4,3 +4,4 @@
 core
 kvm
 static-nodes
+systemd-udevd-coldplug
diff --git a/host/rootfs/etc/s6-rc/weston/dependencies b/host/rootfs/etc/s6-rc/weston/dependencies
deleted file mode 100644
index 8470c0fabc5c85b2529ee26ad82d3910e95f23cb..0000000000000000000000000000000000000000
--- a/host/rootfs/etc/s6-rc/weston/dependencies
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-#
-card0
diff --git a/host/rootfs/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug b/host/rootfs/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
new file mode 100644
index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
--- /dev/null
+++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
+ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
+ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"

-- 
2.51.0

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 4190 bytes --]

I'm pleasantly surprised by how straightforward this is (mostly)!

Demi Marie Obenour <demiobenour@gmail.com> writes:

> The dependency on /dev/dri/card0 being present is eliminated, and
> whatever devices the user has are now picked up by the compositor.  New
> dependencies are added to ensure that udev coldplug has finished before
> any non-trivial services are started.  systemd-udev-trigger.service runs
> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
> an early boot service can assume 'udevadm trigger' has run.

If software is expected to integrate with udev to discover new devices
at runtime, why do we need to introduce new dependencies?

> systemd-udevd doesn't set PATH to anything useful, presumably because
> under NixOS this is handled some other way.  Therefore, explicitly set
> it to /usr/bin in the scripts systemd-udevd calls.

It empties it, or it just passes it through?  The former would be very
strange to me, but why isn't adding -p /usr/bin to the s6-linux-init
invocation enough?

> ---
>  host/rootfs/Makefile                               | 17 ++--
>  host/rootfs/default.nix                            | 94 ++++++----------------
>  host/rootfs/etc/init                               |  2 +-
>  host/rootfs/etc/mdev.conf                          |  7 --
>  host/rootfs/etc/mdev/listen                        |  2 +-
>  host/rootfs/etc/mdev/net/add                       |  1 +

We probably ought to rename /etc/mdev… is there an idiomatic place to
put these sorts of things with udev?

>  host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |  4 -
>  host/rootfs/etc/s6-rc/mdevd-coldplug/up            |  4 -
>  host/rootfs/etc/s6-rc/mdevd/run                    |  5 --
>  host/rootfs/etc/s6-rc/ok-all/contents              |  2 +-
>  .../dependencies.d/systemd-udevd                   |  0
>  .../type                                           |  0
>  .../type.license                                   |  0
>  host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |  3 +
>  host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |  0

Is it really that essential in comparison to other system services?  Why
would we need to keep udevd around but not all other services?

>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |  0
>  .../notification-fd.license                        |  0
>  host/rootfs/etc/s6-rc/systemd-udevd/run            | 10 +++
>  .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |  0
>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |  0
>  host/rootfs/etc/s6-rc/vmm-env/contents             |  1 +
>  host/rootfs/etc/s6-rc/weston/dependencies          |  4 -
>  .../weston/dependencies.d/systemd-udevd-coldplug   |  0
>  host/rootfs/etc/udev/rules.d/99-spectrum.rules     |  5 ++
>  24 files changed, 56 insertions(+), 105 deletions(-)
>
> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
> new file mode 100644
> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
> --- /dev/null
> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
> @@ -0,0 +1,5 @@
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"

Can't we rely on the default rule in 80-drivers.rules to load modules
based on modalias?

Would ACTION=="add" be more appropriate for the PCI devices?  I don't
think we'd want to re-add them to a VM on any other action?

Is there some standard tool to block until a device becomes available in
udev, that we could use to replace the kvm service?  (Can be follow-up.)

Can we remove our own static-nodes implementation?

You're more familiar with it that me: usually we do CC0 for plain config
files, but EUPL for anything (except Nix) that's more like programming.
Are udev rules more programming-y than they are plain config?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 5095 bytes --]

On 9/19/25 10:12, Alyssa Ross wrote:
> I'm pleasantly surprised by how straightforward this is (mostly)!
> 
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> The dependency on /dev/dri/card0 being present is eliminated, and
>> whatever devices the user has are now picked up by the compositor.  New
>> dependencies are added to ensure that udev coldplug has finished before
>> any non-trivial services are started.  systemd-udev-trigger.service runs
>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>> an early boot service can assume 'udevadm trigger' has run.
> 
> If software is expected to integrate with udev to discover new devices
> at runtime, why do we need to introduce new dependencies?

I believe 'udevadm trigger' is needed to process devices that are
already plugged when systemd-udevd starts.  Otherwise, they will
never appear.

>> systemd-udevd doesn't set PATH to anything useful, presumably because
>> under NixOS this is handled some other way.  Therefore, explicitly set
>> it to /usr/bin in the scripts systemd-udevd calls.
> 
> It empties it, or it just passes it through?  The former would be very
> strange to me, but why isn't adding -p /usr/bin to the s6-linux-init
> invocation enough?

I will do some more debugging here, but I distinctly remember this being
the case.

>> ---
>>  host/rootfs/Makefile                               | 17 ++--
>>  host/rootfs/default.nix                            | 94 ++++++----------------
>>  host/rootfs/etc/init                               |  2 +-
>>  host/rootfs/etc/mdev.conf                          |  7 --
>>  host/rootfs/etc/mdev/listen                        |  2 +-
>>  host/rootfs/etc/mdev/net/add                       |  1 +
> 
> We probably ought to rename /etc/mdev… is there an idiomatic place to
> put these sorts of things with udev?

/usr/lib/spectrum is the idiomatic place for this stuff.

>>  host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |  4 -
>>  host/rootfs/etc/s6-rc/mdevd-coldplug/up            |  4 -
>>  host/rootfs/etc/s6-rc/mdevd/run                    |  5 --
>>  host/rootfs/etc/s6-rc/ok-all/contents              |  2 +-
>>  .../dependencies.d/systemd-udevd                   |  0
>>  .../type                                           |  0
>>  .../type.license                                   |  0
>>  host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |  3 +
>>  host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |  0
> 
> Is it really that essential in comparison to other system services?  Why
> would we need to keep udevd around but not all other services?
systemd-udevd.service doesn't have RefuseManualStop=,
so I will drop this.

>>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |  0
>>  .../notification-fd.license                        |  0
>>  host/rootfs/etc/s6-rc/systemd-udevd/run            | 10 +++
>>  .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |  0
>>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |  0
>>  host/rootfs/etc/s6-rc/vmm-env/contents             |  1 +
>>  host/rootfs/etc/s6-rc/weston/dependencies          |  4 -
>>  .../weston/dependencies.d/systemd-udevd-coldplug   |  0
>>  host/rootfs/etc/udev/rules.d/99-spectrum.rules     |  5 ++
>>  24 files changed, 56 insertions(+), 105 deletions(-)
>>
>> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
>> --- /dev/null
>> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>> @@ -0,0 +1,5 @@
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
>> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
> 
> Can't we rely on the default rule in 80-drivers.rules to load modules
> based on modalias?

I will see if this is necessary.  It might be that this was broken due
to wrong permissions or something like that.

> Would ACTION=="add" be more appropriate for the PCI devices?  I don't
> think we'd want to re-add them to a VM on any other action?
> 
> Is there some standard tool to block until a device becomes available in
> udev, that we could use to replace the kvm service?  (Can be follow-up.)

I believe 'udevadm wait' does the job.

> Can we remove our own static-nodes implementation?

Yes, and I think it was never needed anyway as
the kernel populates devtmpfs automatically.

> You're more familiar with it that me: usually we do CC0 for plain config
> files, but EUPL for anything (except Nix) that's more like programming.
> Are udev rules more programming-y than they are plain config?

Udev rules are a programming language.
They even have goto statements 🤣.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1908 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 9/19/25 10:12, Alyssa Ross wrote:
>> I'm pleasantly surprised by how straightforward this is (mostly)!
>> 
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> The dependency on /dev/dri/card0 being present is eliminated, and
>>> whatever devices the user has are now picked up by the compositor.  New
>>> dependencies are added to ensure that udev coldplug has finished before
>>> any non-trivial services are started.  systemd-udev-trigger.service runs
>>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>>> an early boot service can assume 'udevadm trigger' has run.
>> 
>> If software is expected to integrate with udev to discover new devices
>> at runtime, why do we need to introduce new dependencies?
>
> I believe 'udevadm trigger' is needed to process devices that are
> already plugged when systemd-udevd starts.  Otherwise, they will
> never appear.

Right, I get why we need to run it, but why do we need to block other
services on it?

>>> ---
>>>  host/rootfs/Makefile                               | 17 ++--
>>>  host/rootfs/default.nix                            | 94 ++++++----------------
>>>  host/rootfs/etc/init                               |  2 +-
>>>  host/rootfs/etc/mdev.conf                          |  7 --
>>>  host/rootfs/etc/mdev/listen                        |  2 +-
>>>  host/rootfs/etc/mdev/net/add                       |  1 +
>> 
>> We probably ought to rename /etc/mdev… is there an idiomatic place to
>> put these sorts of things with udev?
>
> /usr/lib/spectrum is the idiomatic place for this stuff.

Sounds good.

>> Can we remove our own static-nodes implementation?
>
> Yes, and I think it was never needed anyway as
> the kernel populates devtmpfs automatically.

It doesn't create static nodes though!  It's very annoying.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 2369 bytes --]

On 9/21/25 08:18, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 9/19/25 10:12, Alyssa Ross wrote:
>>> I'm pleasantly surprised by how straightforward this is (mostly)!
>>>
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> The dependency on /dev/dri/card0 being present is eliminated, and
>>>> whatever devices the user has are now picked up by the compositor.  New
>>>> dependencies are added to ensure that udev coldplug has finished before
>>>> any non-trivial services are started.  systemd-udev-trigger.service runs
>>>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>>>> an early boot service can assume 'udevadm trigger' has run.
>>>
>>> If software is expected to integrate with udev to discover new devices
>>> at runtime, why do we need to introduce new dependencies?
>>
>> I believe 'udevadm trigger' is needed to process devices that are
>> already plugged when systemd-udevd starts.  Otherwise, they will
>> never appear.
> 
> Right, I get why we need to run it, but why do we need to block other
> services on it?

systemd uses this ordering and libudev and/or libsystemd might rely
on it.  I don't know if it does, but I also don't want to risk problems.

>>>> ---
>>>>  host/rootfs/Makefile                               | 17 ++--
>>>>  host/rootfs/default.nix                            | 94 ++++++----------------
>>>>  host/rootfs/etc/init                               |  2 +-
>>>>  host/rootfs/etc/mdev.conf                          |  7 --
>>>>  host/rootfs/etc/mdev/listen                        |  2 +-
>>>>  host/rootfs/etc/mdev/net/add                       |  1 +
>>>
>>> We probably ought to rename /etc/mdev… is there an idiomatic place to
>>> put these sorts of things with udev?
>>
>> /usr/lib/spectrum is the idiomatic place for this stuff.
> 
> Sounds good.

Unfortunately it conflicts with the current build system,
which assumes that /usr/lib only has kernel modules.  I'll
use /usr/libexec/spectrum for now.

>>> Can we remove our own static-nodes implementation?
>>
>> Yes, and I think it was never needed anyway as
>> the kernel populates devtmpfs automatically.
> 
> It doesn't create static nodes though!  It's very annoying.

That really stinks!
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 4554 bytes --]

On 9/19/25 15:32, Demi Marie Obenour wrote:
> On 9/19/25 10:12, Alyssa Ross wrote:
>> I'm pleasantly surprised by how straightforward this is (mostly)!
>>
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>
>>> The dependency on /dev/dri/card0 being present is eliminated, and
>>> whatever devices the user has are now picked up by the compositor.  New
>>> dependencies are added to ensure that udev coldplug has finished before
>>> any non-trivial services are started.  systemd-udev-trigger.service runs
>>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>>> an early boot service can assume 'udevadm trigger' has run.
>>
>> If software is expected to integrate with udev to discover new devices
>> at runtime, why do we need to introduce new dependencies?
> 
> I believe 'udevadm trigger' is needed to process devices that are
> already plugged when systemd-udevd starts.  Otherwise, they will
> never appear.
> 
>>> systemd-udevd doesn't set PATH to anything useful, presumably because
>>> under NixOS this is handled some other way.  Therefore, explicitly set
>>> it to /usr/bin in the scripts systemd-udevd calls.
>>
>> It empties it, or it just passes it through?  The former would be very
>> strange to me, but why isn't adding -p /usr/bin to the s6-linux-init
>> invocation enough?
> 
> I will do some more debugging here, but I distinctly remember this being
> the case.
> 
>>> ---
>>>  host/rootfs/Makefile                               | 17 ++--
>>>  host/rootfs/default.nix                            | 94 ++++++----------------
>>>  host/rootfs/etc/init                               |  2 +-
>>>  host/rootfs/etc/mdev.conf                          |  7 --
>>>  host/rootfs/etc/mdev/listen                        |  2 +-
>>>  host/rootfs/etc/mdev/net/add                       |  1 +
>>
>> We probably ought to rename /etc/mdev… is there an idiomatic place to
>> put these sorts of things with udev?
> 
> /usr/lib/spectrum is the idiomatic place for this stuff.
> 
>>>  host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |  4 -
>>>  host/rootfs/etc/s6-rc/mdevd-coldplug/up            |  4 -
>>>  host/rootfs/etc/s6-rc/mdevd/run                    |  5 --
>>>  host/rootfs/etc/s6-rc/ok-all/contents              |  2 +-
>>>  .../dependencies.d/systemd-udevd                   |  0
>>>  .../type                                           |  0
>>>  .../type.license                                   |  0
>>>  host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |  3 +
>>>  host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |  0
>>
>> Is it really that essential in comparison to other system services?  Why
>> would we need to keep udevd around but not all other services?
> systemd-udevd.service doesn't have RefuseManualStop=,
> so I will drop this.
> 
>>>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |  0
>>>  .../notification-fd.license                        |  0
>>>  host/rootfs/etc/s6-rc/systemd-udevd/run            | 10 +++
>>>  .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |  0
>>>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |  0
>>>  host/rootfs/etc/s6-rc/vmm-env/contents             |  1 +
>>>  host/rootfs/etc/s6-rc/weston/dependencies          |  4 -
>>>  .../weston/dependencies.d/systemd-udevd-coldplug   |  0
>>>  host/rootfs/etc/udev/rules.d/99-spectrum.rules     |  5 ++
>>>  24 files changed, 56 insertions(+), 105 deletions(-)
>>>
>>> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>> new file mode 100644
>>> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
>>> --- /dev/null
>>> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>> @@ -0,0 +1,5 @@
>>> +# SPDX-License-Identifier: EUPL-1.2+
>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
>>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
>>> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
>>
>> Can't we rely on the default rule in 80-drivers.rules to load modules
>> based on modalias?
> 
> I will see if this is necessary.  It might be that this was broken due
> to wrong permissions or something like that.

I tested this and it does not work.  I suspect that
this has a dependency on the service manager.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 4229 bytes --]

On 9/19/25 10:12, Alyssa Ross wrote:
> I'm pleasantly surprised by how straightforward this is (mostly)!
> 
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> The dependency on /dev/dri/card0 being present is eliminated, and
>> whatever devices the user has are now picked up by the compositor.  New
>> dependencies are added to ensure that udev coldplug has finished before
>> any non-trivial services are started.  systemd-udev-trigger.service runs
>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>> an early boot service can assume 'udevadm trigger' has run.
> 
> If software is expected to integrate with udev to discover new devices
> at runtime, why do we need to introduce new dependencies?
> 
>> systemd-udevd doesn't set PATH to anything useful, presumably because
>> under NixOS this is handled some other way.  Therefore, explicitly set
>> it to /usr/bin in the scripts systemd-udevd calls.
> 
> It empties it, or it just passes it through?  The former would be very
> strange to me, but why isn't adding -p /usr/bin to the s6-linux-init
> invocation enough?
> 
>> ---
>>  host/rootfs/Makefile                               | 17 ++--
>>  host/rootfs/default.nix                            | 94 ++++++----------------
>>  host/rootfs/etc/init                               |  2 +-
>>  host/rootfs/etc/mdev.conf                          |  7 --
>>  host/rootfs/etc/mdev/listen                        |  2 +-
>>  host/rootfs/etc/mdev/net/add                       |  1 +
> 
> We probably ought to rename /etc/mdev… is there an idiomatic place to
> put these sorts of things with udev?
> 
>>  host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies  |  4 -
>>  host/rootfs/etc/s6-rc/mdevd-coldplug/up            |  4 -
>>  host/rootfs/etc/s6-rc/mdevd/run                    |  5 --
>>  host/rootfs/etc/s6-rc/ok-all/contents              |  2 +-
>>  .../dependencies.d/systemd-udevd                   |  0
>>  .../type                                           |  0
>>  .../type.license                                   |  0
>>  host/rootfs/etc/s6-rc/systemd-udevd-coldplug/up    |  3 +
>>  host/rootfs/etc/s6-rc/systemd-udevd/flag-essential |  0
> 
> Is it really that essential in comparison to other system services?  Why
> would we need to keep udevd around but not all other services?
> 
>>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |  0
>>  .../notification-fd.license                        |  0
>>  host/rootfs/etc/s6-rc/systemd-udevd/run            | 10 +++
>>  .../rootfs/etc/s6-rc/{mdevd => systemd-udevd}/type |  0
>>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |  0
>>  host/rootfs/etc/s6-rc/vmm-env/contents             |  1 +
>>  host/rootfs/etc/s6-rc/weston/dependencies          |  4 -
>>  .../weston/dependencies.d/systemd-udevd-coldplug   |  0
>>  host/rootfs/etc/udev/rules.d/99-spectrum.rules     |  5 ++
>>  24 files changed, 56 insertions(+), 105 deletions(-)
>>
>> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
>> --- /dev/null
>> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>> @@ -0,0 +1,5 @@
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
>> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
> 
> Can't we rely on the default rule in 80-drivers.rules to load modules
> based on modalias?
> 
> Would ACTION=="add" be more appropriate for the PCI devices?  I don't
> think we'd want to re-add them to a VM on any other action?

'udevadm trigger' generates change events.  Generally, one should only
distinguish between ACTION=="remove" and ACTION!="remove", and make rules
idempotent so that it is okay if they are triggered more than once.
Anything else is considered a bug by upstream.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1835 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 9/19/25 10:12, Alyssa Ross wrote:
>> I'm pleasantly surprised by how straightforward this is (mostly)!
>> 
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>> new file mode 100644
>>> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
>>> --- /dev/null
>>> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>> @@ -0,0 +1,5 @@
>>> +# SPDX-License-Identifier: EUPL-1.2+
>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
>>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
>>> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
>> 
>> Can't we rely on the default rule in 80-drivers.rules to load modules
>> based on modalias?
>> 
>> Would ACTION=="add" be more appropriate for the PCI devices?  I don't
>> think we'd want to re-add them to a VM on any other action?
>
> 'udevadm trigger' generates change events.  Generally, one should only
> distinguish between ACTION=="remove" and ACTION!="remove", and make rules
> idempotent so that it is okay if they are triggered more than once.
> Anything else is considered a bug by upstream.

Got a link to somewhere I can read more about that?

Would not currently be good to re-run /etc/mdev/net/add, because it
would unplug and replug the device.  I can probably take a look at that
if you want.

It's not ideal to run /etc/mdev/listen multiple times either, but if I
understood one of your other messages correctly there's some better udev
thing we can switch to for that anyway.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH 3/3] host/rootfs: switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 2502 bytes --]

On 9/23/25 14:39, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 9/19/25 10:12, Alyssa Ross wrote:
>>> I'm pleasantly surprised by how straightforward this is (mostly)!
>>>
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> diff --git a/host/rootfs/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>>> new file mode 100644
>>>> index 0000000000000000000000000000000000000000..199397bc26874a261c9e1ea1778207fdb0d8ad39
>>>> --- /dev/null
>>>> +++ b/host/rootfs/etc/udev/rules.d/99-spectrum.rules
>>>> @@ -0,0 +1,5 @@
>>>> +# SPDX-License-Identifier: EUPL-1.2+
>>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>>> +ACTION!="remove", KERNEL=="kvm", RUN+="/etc/mdev/listen kvm"
>>>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/etc/mdev/net/add"
>>>> +ACTION!="remove", ENV{MODALIAS}=="?*", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
>>>
>>> Can't we rely on the default rule in 80-drivers.rules to load modules
>>> based on modalias?
>>>
>>> Would ACTION=="add" be more appropriate for the PCI devices?  I don't
>>> think we'd want to re-add them to a VM on any other action?
>>
>> 'udevadm trigger' generates change events.  Generally, one should only
>> distinguish between ACTION=="remove" and ACTION!="remove", and make rules
>> idempotent so that it is okay if they are triggered more than once.
>> Anything else is considered a bug by upstream.
> 
> Got a link to somewhere I can read more about that?

https://lists.freedesktop.org/archives/systemd-devel/2023-December/049873.html

> Would not currently be good to re-run /etc/mdev/net/add, because it
> would unplug and replug the device.  I can probably take a look at that
> if you want.

That's definitely not great.  I think the expectation of upstream is to
use a persistent daemon for this, sadly.  Qubes OS uses scripts of various
types and has run into multiple bugs as a result.  A daemon can respond
not only to events, but also know the overall state of the system.
As far as I can tell, everything upstream provides takes this approach.

> It's not ideal to run /etc/mdev/listen multiple times either, but if I
> understood one of your other messages correctly there's some better udev
> thing we can switch to for that anyway.

'udevadm wait' does the job.  /etc/mdev/listen and /etc/mdev/wait can
 be removed.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH v2 0/3] Switch from mdevd to systemd-udevd in root filesystem

[Demi Marie Obenour]

systemd-udevd provides support for significantly more hardware than
mdevd does.  Therefore, switch to it.

All of the non-Nix code has been tested.  However, this was done using
an alternate default.nix (see v1) that used glibc.  NixOS's binary cache
doesn't include many packages built with musl, and Spectrum OS's binary
cache doesn't include packages built with systemd's libudev, so a huge
number of packages need to be built from source.  This still has not
finished.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes in v2:
- Use more optional arguments instead of positional parameters in
  sd-notify-wrapper.
- Explain why explicit modprobe is needed.
- Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-eade4ab8f2b4@gmail.com

---
Demi Marie Obenour (3):
      tools: Add adapter tool for services using sd_notify
      host/rootfs: Switch to systemd-udevd
      host/rootfs: Simplify s6-rc dependencies

 host/rootfs/Makefile                               |  35 ++--
 host/rootfs/default.nix                            | 112 ++++-------
 host/rootfs/image/etc/mdev.conf                    |   7 -
 host/rootfs/image/etc/mdev/listen                  |  11 --
 host/rootfs/image/etc/mdev/wait                    |  14 --
 host/rootfs/image/etc/s6-rc/basic/contents         |  18 ++
 .../rootfs/image/etc/s6-rc/{vmm-env => basic}/type |   0
 .../etc/s6-rc/{vmm-env => basic}/type.license      |   0
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   5 +-
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 host/rootfs/image/etc/s6-rc/ok-all/contents        |  19 +-
 .../mdevd => sys-vmms/dependencies.d/vm-env}       |   0
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   3 +
 .../card0 => systemd-udevd/flag-essential}         |   0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  14 ++
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 host/rootfs/image/etc/s6-rc/vm-env/contents        |  12 +-
 host/rootfs/image/etc/s6-rc/vm-env/type.license    |   2 -
 host/rootfs/image/etc/s6-rc/vmm-env/contents       |   6 -
 .../image/etc/s6-rc/weston/dependencies.d/basic    |   0
 .../image/etc/udev/rules.d/99-spectrum.rules       |   9 +
 host/rootfs/image/usr/bin/vm-start                 |   2 +-
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 tools/default.nix                                  |   1 +
 tools/meson.build                                  |   1 +
 tools/sd-notify-adapter/meson.build                |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c        | 206 +++++++++++++++++++++
 38 files changed, 342 insertions(+), 159 deletions(-)
---
base-commit: 0fcf508e884944a2875fb52dbf58a977aa5df6e8
change-id: 20250911-udev-24cf4bf68fbe
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[PATCH v2 1/3] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

This adapts programs using sd_notify for use with s6 readiness
notification.

I chose to use Linux-specific epoll(7).  It makes the code simpler and
more readable.  Also, stdin and stdout are hardcoded.  This is in the
interest of simplicity.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
systemd readiness notification has two
strict advantages over the s6 version:

1. It allows reliable reloading.
2. It allows providing a status message that the service manager
   can show in status output.

s6 would actually benefit from both of these features.
---
Changes since v1:

- Hard-code file descriptors.
- Run wrapper as background process.
- Massively reduce code size.
- Use // instead of /* */ for comments.
- Check that the notification FD is a pipe and that the listening socket
  is a socket.
- Rely on s6-ipc-socketbinder to create the listening socket.
- Do not unlink the listening socket.
---
 tools/default.nix                           |   1 +
 tools/meson.build                           |   1 +
 tools/sd-notify-adapter/meson.build         |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c | 206 ++++++++++++++++++++++++++++
 4 files changed, 212 insertions(+)

diff --git a/tools/default.nix b/tools/default.nix
index 201afaee3c0610b62484aec9e493c3f597a8ccce..cf27ecb31d552c6223b6d332619ceeedee227aab 100644
--- a/tools/default.nix
+++ b/tools/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
       ./lsvm
       ./start-vmm
       ./subprojects
+      ./sd-notify-adapter
     ]));
   };
   sourceRoot = "source/tools";
diff --git a/tools/meson.build b/tools/meson.build
index 1fb07f02a1305883777e34d1dc2c8ceae87bf828..2393e3279f562239ece1f4d62bb4f4d5bca473ed 100644
--- a/tools/meson.build
+++ b/tools/meson.build
@@ -23,6 +23,7 @@ if get_option('host')
 
   subdir('lsvm')
   subdir('start-vmm')
+  subdir('sd-notify-adapter')
 endif
 
 if get_option('app')
diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
new file mode 100644
index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
--- /dev/null
+++ b/tools/sd-notify-adapter/meson.build
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: ISC
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
new file mode 100644
index 0000000000000000000000000000000000000000..661e3f41e57dae97a5cfaeb3a7088b0c67235563
--- /dev/null
+++ b/tools/sd-notify-adapter/sd-notify-adapter.c
@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+// check_posix and check_posix_bool are based on playpen.c, which has
+// the license:
+//
+// Copyright  2014 Daniel Micay
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+#define _GNU_SOURCE 1
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <err.h>
+#include <fcntl.h>
+#include <sys/epoll.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
+
+// TODO: does this need to have credit given to Daniel Micay?
+[[gnu::format(printf, 2, 3), gnu::warn_unused_result]]
+static intmax_t check_posix(intmax_t arg, const char *fmt, ...) {
+	if (arg >= 0)
+		return arg;
+	assert(arg == -1);
+	va_list a;
+	va_start(a, fmt);
+	verr(EX_OSERR, fmt, a);
+}
+
+#define check_posix(arg, message, ...) \
+	((__typeof__(arg))check_posix(arg, message, ## __VA_ARGS__))
+
+// And same here
+[[gnu::format(printf, 2, 3)]]
+static void check_posix_bool(intmax_t arg, const char *fmt, ...) {
+	if (arg != -1) {
+		assert(arg == 0);
+		return;
+	}
+	va_list a;
+	va_start(a, fmt);
+	verr(EX_OSERR, fmt, a);
+	va_end(a); // Not reached
+}
+
+static bool ready;
+
+enum {
+	socket_fd,
+	notification_fd,
+};
+
+static void
+process_notification(struct iovec *const msg, const char *const initial_buffer) {
+	ssize_t data = recv(socket_fd, msg->iov_base, msg->iov_len,
+	                    MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
+	if (data == -1) {
+		if (errno == EINTR) {
+			return; // signal caught
+		}
+		if (errno == EAGAIN || errno == EWOULDBLOCK) {
+			return; // spurious wakeup
+		}
+	}
+	size_t size = (size_t)check_posix(data, "recv");
+	if (size > (size_t)INT_MAX) {
+		// cannot happen on Linux, don't bother implementing
+		size = (size_t)INT_MAX;
+	}
+	if (size > msg->iov_len) {
+		char *b = (msg->iov_base == initial_buffer) ?
+			malloc(size) : realloc(msg->iov_base, size);
+		if (b != NULL) {
+			msg->iov_base = b;
+			msg->iov_len = size;
+		}
+	}
+	size = (size_t)check_posix(recv(socket_fd, msg->iov_base, msg->iov_len,
+	                                MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC),
+	                           "recv");
+	const char *cursor = msg->iov_base;
+	const char *const end = cursor + size;
+	for (char *next; cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
+		next = memchr(cursor, '\n', (size_t)(end - cursor));
+		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
+
+		// TODO: avoid repeating sizeof(string)
+		if (message_size == sizeof("READY=1") - 1 &&
+		    memcmp(cursor, "READY=1", sizeof("READY=1") - 1) == 0) {
+			if (check_posix(write(notification_fd, "\n", 1), "write") != 1)
+				assert(0);
+			exit(0);
+		}
+	}
+}
+
+int main(int argc, char **argv [[gnu::unused]]) {
+	if (argc != 1) {
+		errx(EX_USAGE, "stdin is listening socket, stdout is notification pipe");
+	}
+	struct stat info;
+	check_posix_bool(fstat(notification_fd, &info), "fstat");
+	if (!S_ISFIFO(info.st_mode)) {
+		errx(EX_USAGE, "notification descriptor is not a pipe");
+	}
+	int value;
+	socklen_t len = sizeof(value);
+	int status = getsockopt(socket_fd, SOL_SOCKET, SO_DOMAIN, &value, &len);
+	if (status == -1 && errno == ENOTSOCK) {
+		errx(EX_USAGE, "socket fd is not a socket");
+	}
+	check_posix_bool(status, "getsockopt");
+	assert(len == sizeof(value));
+	if (value != AF_UNIX) {
+		errx(EX_USAGE, "socket fd must be AF_UNIX socket");
+	}
+	check_posix_bool(getsockopt(socket_fd, SOL_SOCKET, SO_TYPE, &value, &len),
+	                 "getsockopt");
+	assert(len == sizeof(value));
+	if (value != SOCK_DGRAM) {
+		errx(EX_USAGE, "socket must be datagram socket");
+	}
+
+	// Ignore SIGPIPE.
+	struct sigaction act = { };
+	act.sa_handler = SIG_IGN;
+	check_posix_bool(sigaction(SIGPIPE, &act, NULL), "sigaction(SIGPIPE)");
+
+	// Open file descriptors.
+	int epoll_fd = check_posix(epoll_create1(EPOLL_CLOEXEC), "epoll_create1");
+	if (epoll_fd < 3) {
+		errx(EX_USAGE, "Invoked with file descriptor 0, 1, or 2 closed");
+	}
+	struct epoll_event event = { .events = EPOLLIN, .data.u64 = socket_fd };
+	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, socket_fd, &event),
+	                 "epoll_ctl");
+	event = (struct epoll_event) { .events = 0, .data.u64 = notification_fd };
+	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, notification_fd, &event),
+	                 "epoll_ctl");
+
+	// Main event loop.
+	char buf[sizeof("READY=1\n") - 1];
+	struct iovec v = {
+		.iov_base = buf,
+		.iov_len = sizeof(buf),
+	};
+	for (;;) {
+		struct epoll_event out_event[2] = {};
+		int epoll_wait_result =
+			check_posix(epoll_wait(epoll_fd, out_event, ARRAY_SIZE(out_event), -1),
+			            "epoll_wait");
+		for (int i = 0; i < epoll_wait_result; ++i) {
+			switch (out_event[i].data.u64) {
+			case socket_fd:
+				if (out_event[i].events != EPOLLIN) {
+					errx(EX_PROTOCOL, "Unexpected event from epoll() on notification socket");
+				}
+				process_notification(&v, buf);
+				break;
+			case notification_fd:
+				if (out_event[i].events != EPOLLERR) {
+					errx(EX_SOFTWARE, "Unexpected event from epoll() on supervison pipe");
+				}
+				if (ready) {
+					// Normal exit
+					return 0;
+				}
+				errx(EX_PROTOCOL, "s6 closed its pipe before the child was ready");
+				break;
+			default:
+				assert(0); // Not reached
+			}
+		}
+	}
+}

-- 
2.51.0

Re: [PATCH v2 1/3] tools: Add adapter tool for services using sd_notify

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 10513 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This adapts programs using sd_notify for use with s6 readiness
> notification.
>
> I chose to use Linux-specific epoll(7).  It makes the code simpler and
> more readable.  Also, stdin and stdout are hardcoded.  This is in the
> interest of simplicity.

I personally find poll to be more readable when working with a fixed set
of descriptors, but it's up to you!

>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> systemd readiness notification has two
> strict advantages over the s6 version:
>
> 1. It allows reliable reloading.
> 2. It allows providing a status message that the service manager
>    can show in status output.
>
> s6 would actually benefit from both of these features.
> ---
> Changes since v1:
>
> - Hard-code file descriptors.
> - Run wrapper as background process.
> - Massively reduce code size.
> - Use // instead of /* */ for comments.
> - Check that the notification FD is a pipe and that the listening socket
>   is a socket.
> - Rely on s6-ipc-socketbinder to create the listening socket.
> - Do not unlink the listening socket.
> ---
>  tools/default.nix                           |   1 +
>  tools/meson.build                           |   1 +
>  tools/sd-notify-adapter/meson.build         |   4 +
>  tools/sd-notify-adapter/sd-notify-adapter.c | 206 ++++++++++++++++++++++++++++
>  4 files changed, 212 insertions(+)
>
> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
> new file mode 100644
> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
> --- /dev/null
> +++ b/tools/sd-notify-adapter/meson.build
> @@ -0,0 +1,4 @@
> +# SPDX-License-Identifier: ISC
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)

Why the non-standard license?

> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..661e3f41e57dae97a5cfaeb3a7088b0c67235563
> --- /dev/null
> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
> @@ -0,0 +1,206 @@
> +// SPDX-License-Identifier: MIT
> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +// check_posix and check_posix_bool are based on playpen.c, which has
> +// the license:
> +//
> +// Copyright  2014 Daniel Micay
> +//
> +// Permission is hereby granted, free of charge, to any person obtaining a
> +// copy of this software and associated documentation files (the
> +// "Software"), to deal in the Software without restriction, including
> +// without limitation the rights to use, copy, modify, merge, publish,
> +// distribute, sublicense, and/or sell copies of the Software, and to
> +// permit persons to whom the Software is furnished to do so, subject to
> +// the following conditions:
> +//
> +// The above copyright notice and this permission notice shall be included
> +// in all copies or substantial portions of the Software.
> +//
> +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
> +// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
> +// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
> +// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
> +// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
> +// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
> +// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
> +
> +#define _GNU_SOURCE 1
> +#include <assert.h>
> +#include <errno.h>
> +#include <limits.h>
> +#include <signal.h>
> +#include <stdarg.h>
> +#include <stddef.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +
> +#include <err.h>
> +#include <fcntl.h>
> +#include <sys/epoll.h>
> +#include <sys/socket.h>
> +#include <sys/stat.h>
> +#include <sys/un.h>
> +#include <sysexits.h>
> +#include <unistd.h>
> +
> +#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
> +
> +// TODO: does this need to have credit given to Daniel Micay?
> +[[gnu::format(printf, 2, 3), gnu::warn_unused_result]]
> +static intmax_t check_posix(intmax_t arg, const char *fmt, ...) {
> +	if (arg >= 0)
> +		return arg;
> +	assert(arg == -1);
> +	va_list a;
> +	va_start(a, fmt);
> +	verr(EX_OSERR, fmt, a);
> +}
> +
> +#define check_posix(arg, message, ...) \
> +	((__typeof__(arg))check_posix(arg, message, ## __VA_ARGS__))
> +
> +// And same here
> +[[gnu::format(printf, 2, 3)]]
> +static void check_posix_bool(intmax_t arg, const char *fmt, ...) {
> +	if (arg != -1) {
> +		assert(arg == 0);
> +		return;
> +	}
> +	va_list a;
> +	va_start(a, fmt);
> +	verr(EX_OSERR, fmt, a);
> +	va_end(a); // Not reached
> +}

I would prefer that we do manual error checks in the style of other C
code in Spectrum.  Then we don't have to worry about licensing of these
helpers, and also don't have the problem of how to share them between
multiple files later on.  It's likely that readers are also going to be
more familiar with simple error checks.

> +
> +static bool ready;
> +
> +enum {
> +	socket_fd,
> +	notification_fd,
> +};
> +
> +static void
> +process_notification(struct iovec *const msg, const char *const initial_buffer) {
> +	ssize_t data = recv(socket_fd, msg->iov_base, msg->iov_len,
> +	                    MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
> +	if (data == -1) {
> +		if (errno == EINTR) {
> +			return; // signal caught
> +		}
> +		if (errno == EAGAIN || errno == EWOULDBLOCK) {
> +			return; // spurious wakeup
> +		}
> +	}
> +	size_t size = (size_t)check_posix(data, "recv");
> +	if (size > (size_t)INT_MAX) {
> +		// cannot happen on Linux, don't bother implementing
> +		size = (size_t)INT_MAX;
> +	}

If it can't happen, why do we branch on it?

> +	if (size > msg->iov_len) {
> +		char *b = (msg->iov_base == initial_buffer) ?
> +			malloc(size) : realloc(msg->iov_base, size);
> +		if (b != NULL) {
> +			msg->iov_base = b;
> +			msg->iov_len = size;
> +		}
> +	}

Wouldn't it be simpler to pass an empty iov, then allocate whatever size
we need here, than to have to handle sometimes having a stack-allocated
buffer and sometimes not?

> +	size = (size_t)check_posix(recv(socket_fd, msg->iov_base, msg->iov_len,
> +	                                MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC),
> +	                           "recv");
> +	const char *cursor = msg->iov_base;
> +	const char *const end = cursor + size;
> +	for (char *next; cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
> +		next = memchr(cursor, '\n', (size_t)(end - cursor));
> +		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
> +
> +		// TODO: avoid repeating sizeof(string)

Yeah, let's maybe pull the message we're looking for out into a constant.

> +		if (message_size == sizeof("READY=1") - 1 &&
> +		    memcmp(cursor, "READY=1", sizeof("READY=1") - 1) == 0) {
> +			if (check_posix(write(notification_fd, "\n", 1), "write") != 1)
> +				assert(0);
> +			exit(0);
> +		}
> +	}
> +}
> +
> +int main(int argc, char **argv [[gnu::unused]]) {
> +	if (argc != 1) {
> +		errx(EX_USAGE, "stdin is listening socket, stdout is notification pipe");
> +	}
> +	struct stat info;
> +	check_posix_bool(fstat(notification_fd, &info), "fstat");
> +	if (!S_ISFIFO(info.st_mode)) {
> +		errx(EX_USAGE, "notification descriptor is not a pipe");
> +	}
> +	int value;
> +	socklen_t len = sizeof(value);
> +	int status = getsockopt(socket_fd, SOL_SOCKET, SO_DOMAIN, &value, &len);
> +	if (status == -1 && errno == ENOTSOCK) {
> +		errx(EX_USAGE, "socket fd is not a socket");
> +	}
> +	check_posix_bool(status, "getsockopt");
> +	assert(len == sizeof(value));
> +	if (value != AF_UNIX) {
> +		errx(EX_USAGE, "socket fd must be AF_UNIX socket");
> +	}
> +	check_posix_bool(getsockopt(socket_fd, SOL_SOCKET, SO_TYPE, &value, &len),
> +	                 "getsockopt");
> +	assert(len == sizeof(value));
> +	if (value != SOCK_DGRAM) {
> +		errx(EX_USAGE, "socket must be datagram socket");
> +	}
> +

I think these checks are overly defensive.  It's going to be very
difficult to use this program wrong given it's always going to be used
in the same way in run scripts.  I'd rather have less code, which will
make it easier to understand what the actual functionality of the
program is.

> +	// Ignore SIGPIPE.
> +	struct sigaction act = { };
> +	act.sa_handler = SIG_IGN;
> +	check_posix_bool(sigaction(SIGPIPE, &act, NULL), "sigaction(SIGPIPE)");

Wouldn't SIGPIPE be useful here?  Isn't the default behavior of exiting
on SIGPIPE exactly what we'd want to do?

> +
> +	// Open file descriptors.
> +	int epoll_fd = check_posix(epoll_create1(EPOLL_CLOEXEC), "epoll_create1");
> +	if (epoll_fd < 3) {
> +		errx(EX_USAGE, "Invoked with file descriptor 0, 1, or 2 closed");
> +	}
> +	struct epoll_event event = { .events = EPOLLIN, .data.u64 = socket_fd };
> +	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, socket_fd, &event),
> +	                 "epoll_ctl");
> +	event = (struct epoll_event) { .events = 0, .data.u64 = notification_fd };
> +	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, notification_fd, &event),
> +	                 "epoll_ctl");
> +
> +	// Main event loop.
> +	char buf[sizeof("READY=1\n") - 1];
> +	struct iovec v = {
> +		.iov_base = buf,
> +		.iov_len = sizeof(buf),
> +	};
> +	for (;;) {
> +		struct epoll_event out_event[2] = {};
> +		int epoll_wait_result =
> +			check_posix(epoll_wait(epoll_fd, out_event, ARRAY_SIZE(out_event), -1),
> +			            "epoll_wait");
> +		for (int i = 0; i < epoll_wait_result; ++i) {
> +			switch (out_event[i].data.u64) {
> +			case socket_fd:
> +				if (out_event[i].events != EPOLLIN) {
> +					errx(EX_PROTOCOL, "Unexpected event from epoll() on notification socket");
> +				}
> +				process_notification(&v, buf);
> +				break;
> +			case notification_fd:
> +				if (out_event[i].events != EPOLLERR) {
> +					errx(EX_SOFTWARE, "Unexpected event from epoll() on supervison pipe");
> +				}
> +				if (ready) {
> +					// Normal exit
> +					return 0;
> +				}
> +				errx(EX_PROTOCOL, "s6 closed its pipe before the child was ready");
> +				break;

Why do we need to poll on notification_fd at all?  If it closes early,
we get a write fail or a SIGPIPE, and we exit with a failure or are
killed, which is fine, right?

> +			default:
> +				assert(0); // Not reached
> +			}
> +		}
> +	}
> +}

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v2 1/3] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 11489 bytes --]

On 9/25/25 06:29, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This adapts programs using sd_notify for use with s6 readiness
>> notification.
>>
>> I chose to use Linux-specific epoll(7).  It makes the code simpler and
>> more readable.  Also, stdin and stdout are hardcoded.  This is in the
>> interest of simplicity.
> 
> I personally find poll to be more readable when working with a fixed set
> of descriptors, but it's up to you!

poll can actually fail with ENOMEM, which is one of the reasons
I used epoll.

>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>> systemd readiness notification has two
>> strict advantages over the s6 version:
>>
>> 1. It allows reliable reloading.
>> 2. It allows providing a status message that the service manager
>>    can show in status output.
>>
>> s6 would actually benefit from both of these features.
>> ---
>> Changes since v1:
>>
>> - Hard-code file descriptors.
>> - Run wrapper as background process.
>> - Massively reduce code size.
>> - Use // instead of /* */ for comments.
>> - Check that the notification FD is a pipe and that the listening socket
>>   is a socket.
>> - Rely on s6-ipc-socketbinder to create the listening socket.
>> - Do not unlink the listening socket.
>> ---
>>  tools/default.nix                           |   1 +
>>  tools/meson.build                           |   1 +
>>  tools/sd-notify-adapter/meson.build         |   4 +
>>  tools/sd-notify-adapter/sd-notify-adapter.c | 206 ++++++++++++++++++++++++++++
>>  4 files changed, 212 insertions(+)
>>
>> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/meson.build
>> @@ -0,0 +1,4 @@
>> +# SPDX-License-Identifier: ISC
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
> 
> Why the non-standard license?

Mistake :)

>> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..661e3f41e57dae97a5cfaeb3a7088b0c67235563
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
>> @@ -0,0 +1,206 @@
>> +// SPDX-License-Identifier: MIT
>> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +// check_posix and check_posix_bool are based on playpen.c, which has
>> +// the license:
>> +//
>> +// Copyright  2014 Daniel Micay
>> +//
>> +// Permission is hereby granted, free of charge, to any person obtaining a
>> +// copy of this software and associated documentation files (the
>> +// "Software"), to deal in the Software without restriction, including
>> +// without limitation the rights to use, copy, modify, merge, publish,
>> +// distribute, sublicense, and/or sell copies of the Software, and to
>> +// permit persons to whom the Software is furnished to do so, subject to
>> +// the following conditions:
>> +//
>> +// The above copyright notice and this permission notice shall be included
>> +// in all copies or substantial portions of the Software.
>> +//
>> +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
>> +// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
>> +// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
>> +// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
>> +// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
>> +// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
>> +// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
>> +
>> +#define _GNU_SOURCE 1
>> +#include <assert.h>
>> +#include <errno.h>
>> +#include <limits.h>
>> +#include <signal.h>
>> +#include <stdarg.h>
>> +#include <stddef.h>
>> +#include <stdint.h>
>> +#include <stdio.h>
>> +#include <stdlib.h>
>> +#include <string.h>
>> +
>> +#include <err.h>
>> +#include <fcntl.h>
>> +#include <sys/epoll.h>
>> +#include <sys/socket.h>
>> +#include <sys/stat.h>
>> +#include <sys/un.h>
>> +#include <sysexits.h>
>> +#include <unistd.h>
>> +
>> +#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
>> +
>> +// TODO: does this need to have credit given to Daniel Micay?
>> +[[gnu::format(printf, 2, 3), gnu::warn_unused_result]]
>> +static intmax_t check_posix(intmax_t arg, const char *fmt, ...) {
>> +	if (arg >= 0)
>> +		return arg;
>> +	assert(arg == -1);
>> +	va_list a;
>> +	va_start(a, fmt);
>> +	verr(EX_OSERR, fmt, a);
>> +}
>> +
>> +#define check_posix(arg, message, ...) \
>> +	((__typeof__(arg))check_posix(arg, message, ## __VA_ARGS__))
>> +
>> +// And same here
>> +[[gnu::format(printf, 2, 3)]]
>> +static void check_posix_bool(intmax_t arg, const char *fmt, ...) {
>> +	if (arg != -1) {
>> +		assert(arg == 0);
>> +		return;
>> +	}
>> +	va_list a;
>> +	va_start(a, fmt);
>> +	verr(EX_OSERR, fmt, a);
>> +	va_end(a); // Not reached
>> +}
> 
> I would prefer that we do manual error checks in the style of other C
> code in Spectrum.  Then we don't have to worry about licensing of these
> helpers, and also don't have the problem of how to share them between
> multiple files later on.  It's likely that readers are also going to be
> more familiar with simple error checks.

Will change.

>> +
>> +static bool ready;
>> +
>> +enum {
>> +	socket_fd,
>> +	notification_fd,
>> +};
>> +
>> +static void
>> +process_notification(struct iovec *const msg, const char *const initial_buffer) {
>> +	ssize_t data = recv(socket_fd, msg->iov_base, msg->iov_len,
>> +	                    MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
>> +	if (data == -1) {
>> +		if (errno == EINTR) {
>> +			return; // signal caught
>> +		}
>> +		if (errno == EAGAIN || errno == EWOULDBLOCK) {
>> +			return; // spurious wakeup
>> +		}
>> +	}
>> +	size_t size = (size_t)check_posix(data, "recv");
>> +	if (size > (size_t)INT_MAX) {
>> +		// cannot happen on Linux, don't bother implementing
>> +		size = (size_t)INT_MAX;
>> +	}
> 
> If it can't happen, why do we branch on it?

G

>> +	if (size > msg->iov_len) {
>> +		char *b = (msg->iov_base == initial_buffer) ?
>> +			malloc(size) : realloc(msg->iov_base, size);
>> +		if (b != NULL) {
>> +			msg->iov_base = b;
>> +			msg->iov_len = size;
>> +		}
>> +	}
> 
> Wouldn't it be simpler to pass an empty iov, then allocate whatever size
> we need here, than to have to handle sometimes having a stack-allocated
> buffer and sometimes not?

It would

>> +	size = (size_t)check_posix(recv(socket_fd, msg->iov_base, msg->iov_len,
>> +	                                MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC),
>> +	                           "recv");
>> +	const char *cursor = msg->iov_base;
>> +	const char *const end = cursor + size;
>> +	for (char *next; cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
>> +		next = memchr(cursor, '\n', (size_t)(end - cursor));
>> +		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
>> +
>> +		// TODO: avoid repeating sizeof(string)
> 
> Yeah, let's maybe pull the message we're looking for out into a constant.

I agree.

>> +		if (message_size == sizeof("READY=1") - 1 &&
>> +		    memcmp(cursor, "READY=1", sizeof("READY=1") - 1) == 0) {
>> +			if (check_posix(write(notification_fd, "\n", 1), "write") != 1)
>> +				assert(0);
>> +			exit(0);
>> +		}
>> +	}
>> +}
>> +
>> +int main(int argc, char **argv [[gnu::unused]]) {
>> +	if (argc != 1) {
>> +		errx(EX_USAGE, "stdin is listening socket, stdout is notification pipe");
>> +	}
>> +	struct stat info;
>> +	check_posix_bool(fstat(notification_fd, &info), "fstat");
>> +	if (!S_ISFIFO(info.st_mode)) {
>> +		errx(EX_USAGE, "notification descriptor is not a pipe");
>> +	}
>> +	int value;
>> +	socklen_t len = sizeof(value);
>> +	int status = getsockopt(socket_fd, SOL_SOCKET, SO_DOMAIN, &value, &len);
>> +	if (status == -1 && errno == ENOTSOCK) {
>> +		errx(EX_USAGE, "socket fd is not a socket");
>> +	}
>> +	check_posix_bool(status, "getsockopt");
>> +	assert(len == sizeof(value));
>> +	if (value != AF_UNIX) {
>> +		errx(EX_USAGE, "socket fd must be AF_UNIX socket");
>> +	}
>> +	check_posix_bool(getsockopt(socket_fd, SOL_SOCKET, SO_TYPE, &value, &len),
>> +	                 "getsockopt");
>> +	assert(len == sizeof(value));
>> +	if (value != SOCK_DGRAM) {
>> +		errx(EX_USAGE, "socket must be datagram socket");
>> +	}
>> +
> 
> I think these checks are overly defensive.  It's going to be very
> difficult to use this program wrong given it's always going to be used
> in the same way in run scripts.  I'd rather have less code, which will
> make it easier to understand what the actual functionality of the
> program is.

Will fix.

>> +	// Ignore SIGPIPE.
>> +	struct sigaction act = { };
>> +	act.sa_handler = SIG_IGN;
>> +	check_posix_bool(sigaction(SIGPIPE, &act, NULL), "sigaction(SIGPIPE)");
> 
> Wouldn't SIGPIPE be useful here?  Isn't the default behavior of exiting
> on SIGPIPE exactly what we'd want to do?

Good point.  I should ignore SIGPIPE in the run script, though.
systemd does this by default.

>> +
>> +	// Open file descriptors.
>> +	int epoll_fd = check_posix(epoll_create1(EPOLL_CLOEXEC), "epoll_create1");
>> +	if (epoll_fd < 3) {
>> +		errx(EX_USAGE, "Invoked with file descriptor 0, 1, or 2 closed");
>> +	}
>> +	struct epoll_event event = { .events = EPOLLIN, .data.u64 = socket_fd };
>> +	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, socket_fd, &event),
>> +	                 "epoll_ctl");
>> +	event = (struct epoll_event) { .events = 0, .data.u64 = notification_fd };
>> +	check_posix_bool(epoll_ctl(epoll_fd, EPOLL_CTL_ADD, notification_fd, &event),
>> +	                 "epoll_ctl");
>> +
>> +	// Main event loop.
>> +	char buf[sizeof("READY=1\n") - 1];
>> +	struct iovec v = {
>> +		.iov_base = buf,
>> +		.iov_len = sizeof(buf),
>> +	};
>> +	for (;;) {
>> +		struct epoll_event out_event[2] = {};
>> +		int epoll_wait_result =
>> +			check_posix(epoll_wait(epoll_fd, out_event, ARRAY_SIZE(out_event), -1),
>> +			            "epoll_wait");
>> +		for (int i = 0; i < epoll_wait_result; ++i) {
>> +			switch (out_event[i].data.u64) {
>> +			case socket_fd:
>> +				if (out_event[i].events != EPOLLIN) {
>> +					errx(EX_PROTOCOL, "Unexpected event from epoll() on notification socket");
>> +				}
>> +				process_notification(&v, buf);
>> +				break;
>> +			case notification_fd:
>> +				if (out_event[i].events != EPOLLERR) {
>> +					errx(EX_SOFTWARE, "Unexpected event from epoll() on supervison pipe");
>> +				}
>> +				if (ready) {
>> +					// Normal exit
>> +					return 0;
>> +				}
>> +				errx(EX_PROTOCOL, "s6 closed its pipe before the child was ready");
>> +				break;
> 
> Why do we need to poll on notification_fd at all?  If it closes early,
> we get a write fail or a SIGPIPE, and we exit with a failure or are
> killed, which is fine, right?

If it closes early, but systemd-udevd never sends READY=1, the program
uselessly hangs around.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH v2 2/3] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

This replaces the mdevd uevent daemon with systemd-udevd, which supports
much more hardware and is therefore to be preferred for a full desktop
environment.  Various Wayland compositors integrate with systemd-udevd,
allowing them to discover devices as they appear rather than having to
only use devices plugged in when the compositor is started.
Additionally, systemd-udevd has quirks for various devices that are
needed to support the wide variety of hardware end-users have.

The dependency on /dev/dri/card0 being present is eliminated, and
whatever devices the user has are now picked up by the compositor.  New
dependencies are added to ensure that udev coldplug has finished before
any non-trivial services are started.  systemd-udev-trigger.service runs
'udevadm trigger' and has Before=sysinit.target, so anything that is not
an early boot service can assume 'udevadm trigger' has run.

systemd-udevd doesn't set PATH to anything useful, presumably because
under NixOS this is handled some other way.  Therefore, explicitly set
it to /usr/bin in the scripts systemd-udevd calls.

The /etc/mdev/listen and /etc/mdev/wait scripts are replaced by
'udevadm wait', so they are deleted.  The whole static-nodes target also
goes away, as Linux handles that itself and systemd-udevd deals with
autoloading.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
The changes to default.nix are so that I could use the binary cache,
which was necessary to test this in a reasonable amount of time.  I'm
also not sure what changes you (Alyssa) want in this file.  Feel free to
fix it up on commit.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 host/rootfs/Makefile                               |  29 +++---
 host/rootfs/default.nix                            | 112 +++++++--------------
 host/rootfs/image/etc/mdev.conf                    |   7 --
 host/rootfs/image/etc/mdev/listen                  |  11 --
 host/rootfs/image/etc/mdev/wait                    |  14 ---
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   5 +-
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 host/rootfs/image/etc/s6-rc/ok-all/contents        |   2 +-
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   3 +
 .../card0 => systemd-udevd/flag-essential}         |   0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  11 ++
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 host/rootfs/image/etc/s6-rc/vm-env/contents        |   1 +
 host/rootfs/image/etc/s6-rc/vm-env/type.license    |   2 -
 host/rootfs/image/etc/s6-rc/vmm-env/contents       |   5 +-
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 .../image/etc/udev/rules.d/99-spectrum.rules       |   9 ++
 host/rootfs/image/usr/bin/vm-start                 |   2 +-
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 30 files changed, 86 insertions(+), 147 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 322d75026dbcba4301f26abfbf74efa8cc68cdfd..db142f290a1efd3884d8c5a114b26fa0f42ef5f1 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -13,10 +13,6 @@ FILES = \
 	image/etc/group \
 	image/etc/init \
 	image/etc/login \
-	image/etc/mdev.conf \
-	image/etc/mdev/listen \
-	image/etc/mdev/net/add \
-	image/etc/mdev/wait \
 	image/etc/parse-devname \
 	image/etc/passwd \
 	image/etc/s6-linux-init/env/WAYLAND_DISPLAY \
@@ -52,9 +48,9 @@ FILES = \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/notification-fd \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/run \
 	image/etc/s6-linux-init/scripts/rc.init \
+	image/etc/udev/rules.d/99-spectrum.rules \
 	image/etc/xdg/weston/autolaunch \
 	image/etc/xdg/weston/weston.ini \
-	image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service \
 	image/usr/bin/assign-devices \
 	image/usr/bin/create-vm-dependencies \
 	image/usr/bin/run-appimage \
@@ -63,12 +59,15 @@ FILES = \
 	image/usr/bin/vm-import \
 	image/usr/bin/vm-start \
 	image/usr/bin/vm-stop \
-	image/usr/bin/xdg-open
+	image/usr/bin/xdg-open \
+	image/usr/libexec/net-add \
+	image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service
 
 DIRS = \
 	dev \
 	etc/s6-linux-init/env \
 	etc/s6-linux-init/run-image/configs \
+	etc/s6-linux-init/run-image/sd-notify-wrapper \
 	etc/s6-linux-init/run-image/service/dbus/instance \
 	etc/s6-linux-init/run-image/service/dbus/instances \
 	etc/s6-linux-init/run-image/service/dbus/template/data \
@@ -93,7 +92,6 @@ DIRS = \
 	etc/s6-linux-init/run-image/user \
 	etc/s6-linux-init/run-image/vm/by-id \
 	etc/s6-linux-init/run-image/vm/by-name \
-	etc/s6-linux-init/run-image/wait \
 	ext \
 	run \
 	proc \
@@ -129,19 +127,11 @@ build/empty:
 	mkdir -p $@
 
 S6_RC_FILES = \
-	image/etc/s6-rc/card0/type \
-	image/etc/s6-rc/card0/up \
 	image/etc/s6-rc/core/type \
 	image/etc/s6-rc/core/up \
 	image/etc/s6-rc/kvm/timeout-up \
 	image/etc/s6-rc/kvm/type \
 	image/etc/s6-rc/kvm/up \
-	image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \
-	image/etc/s6-rc/mdevd-coldplug/type \
-	image/etc/s6-rc/mdevd-coldplug/up \
-	image/etc/s6-rc/mdevd/notification-fd \
-	image/etc/s6-rc/mdevd/run \
-	image/etc/s6-rc/mdevd/type \
 	image/etc/s6-rc/ok-all/contents \
 	image/etc/s6-rc/ok-all/type \
 	image/etc/s6-rc/static-nodes/type \
@@ -149,11 +139,18 @@ S6_RC_FILES = \
 	image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env \
 	image/etc/s6-rc/sys-vmms/type \
 	image/etc/s6-rc/sys-vmms/up \
+	image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd \
+	image/etc/s6-rc/systemd-udevd-coldplug/type \
+	image/etc/s6-rc/systemd-udevd-coldplug/up \
+	image/etc/s6-rc/systemd-udevd/flag-essential \
+	image/etc/s6-rc/systemd-udevd/notification-fd \
+	image/etc/s6-rc/systemd-udevd/run \
+	image/etc/s6-rc/systemd-udevd/type \
 	image/etc/s6-rc/vm-env/contents \
 	image/etc/s6-rc/vm-env/type \
 	image/etc/s6-rc/vmm-env/contents \
 	image/etc/s6-rc/vmm-env/type \
-	image/etc/s6-rc/weston/dependencies.d/card0 \
+	image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/weston/notification-fd \
 	image/etc/s6-rc/weston/run \
 	image/etc/s6-rc/weston/type
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 116b55232b0b9f0ef2d04a4b15ba6f198cfb832c..12d1a72a7365cb4a2cda477fe231725103fbe2c4 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -6,88 +6,47 @@ import ../../lib/call-package.nix (
 { callSpectrumPackage, lseek, src, pkgsMusl, pkgsStatic, linux_latest }:
 pkgsStatic.callPackage (
 
-{ spectrum-host-tools
-, lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc
-, busybox, cloud-hypervisor, cryptsetup, dbus, execline, inkscape
-, iproute2, inotify-tools, jq, kmod, mdevd, s6, s6-linux-init, socat
-, util-linuxMinimal, virtiofsd, xorg, xdg-desktop-portal-spectrum-host
+{ busybox, cloud-hypervisor, cryptsetup, dbus, erofs-utils, execline
+, inkscape, inotify-tools, iproute2, jq, kmod, lib, mdevd, nixos
+, runCommand, s6, s6-linux-init, s6-rc, socat, spectrum-host-tools
+, stdenvNoCC, util-linuxMinimal, virtiofsd, writeClosure
+, xdg-desktop-portal-spectrum-host, xorg
 }:
-
 let
-  inherit (nixosAllHardware.config.hardware) firmware;
   inherit (lib)
     concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs
-    mapAttrsToList systems trivial;
-
+    mapAttrsToList systems trivial lists;
   pkgsGui = pkgsMusl.extend (
     final: super:
-    (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
-      flatpak = super.flatpak.override {
-        withMalcontent = false;
-      };
-
-      libgudev = super.libgudev.overrideAttrs ({ ... }: {
-        # Tests use umockdev, which is not compatible with libudev-zero.
-        doCheck = false;
-      });
-
-      qt6 = super.qt6.overrideScope (_: prev: {
-        qttranslations = prev.qttranslations.override {
-          qttools = prev.qttools.override {
-            qtbase = prev.qtbase.override {
-              qttranslations = null;
-              systemdSupport = false;
-            };
-            qtdeclarative = null;
-          };
-        };
-
-        qtbase = prev.qtbase.override {
-          systemdSupport = false;
-        };
-      });
-
-      systemd = super.systemd.overrideAttrs ({ meta ? { }, ... }: {
+    (lib.optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
+      malcontent = super.malcontent.overrideAttrs ({ meta ? { }, ... }: {
         meta = meta // {
           platforms = [ ];
         };
       });
+   }));
+in
+pkgsGui.callPackage (
+{ cosmic-files, crosvm, dejavu_fonts, foot, mesa
+, systemdMinimal, westonLite, xdg-desktop-portal
+, xdg-desktop-portal-gtk
+}:
 
-      upower = super.upower.override {
-        # Not ideal, but it's the best way to get rid of an installed
-        # test that needs umockdev.
-        withIntrospection = false;
-      };
-
-      udev = final.libudev-zero;
-
-      weston = super.weston.overrideAttrs ({ mesonFlags ? [], ... }: {
-        mesonFlags = mesonFlags ++ [
-          "-Dsystemd=false"
-        ];
-      });
-
-      xdg-desktop-portal = (super.xdg-desktop-portal.override {
-        enableSystemd = false;
-      }).overrideAttrs ({ ... }: {
-        # Tests use umockdev.
-        doCheck = false;
-      });
-    })
-  );
-
-  foot = pkgsGui.foot.override { allowPgo = false; };
+let
+  inherit (nixosAllHardware.config.hardware) firmware;
+  no_pgo_foot = foot.override { allowPgo = false; };
 
   packages = [
-    cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2
-    jq kmod mdevd s6 s6-linux-init s6-rc socat spectrum-host-tools
-    virtiofsd xdg-desktop-portal-spectrum-host
+    cloud-hypervisor crosvm cryptsetup dbus execline inotify-tools
+    iproute2 jq kmod mdevd s6 s6-linux-init s6-rc socat
+    spectrum-host-tools virtiofsd xdg-desktop-portal-spectrum-host
 
     (busybox.override {
       extraConfig = ''
         CONFIG_CHATTR n
         CONFIG_DEPMOD n
         CONFIG_FINDFS n
+        CONFIG_HALT n
         CONFIG_INIT n
         CONFIG_INSMOD n
         CONFIG_IP n
@@ -98,10 +57,13 @@ let
         CONFIG_MODINFO n
         CONFIG_MODPROBE n
         CONFIG_MOUNT n
+        CONFIG_POWEROFF n
+        CONFIG_REBOOT n
         CONFIG_RMMOD n
+        CONFIG_SHUTDOWN n
       '';
     })
-  ] ++ (with pkgsGui; [ cosmic-files crosvm foot ]);
+  ];
 
   nixosAllHardware = nixos ({ modulesPath, ... }: {
     imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
@@ -111,14 +73,14 @@ let
 
   kernel = linux_latest;
 
-  appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; };
-  netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; };
+  appvm = callSpectrumPackage ../../img/app { inherit (no_pgo_foot) terminfo; };
+  netvm = callSpectrumPackage ../../vm/sys/net { inherit (no_pgo_foot) terminfo; };
 
   # Packages that should be fully linked into /usr,
   # (not just their bin/* files).
   usrPackages = [
     appvm kernel.modules firmware netvm
-  ] ++ (with pkgsGui; [ mesa dejavu_fonts westonLite ]);
+    mesa dejavu_fonts westonLite ];
 
   appvms = {
     appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {};
@@ -136,16 +98,16 @@ let
     # Weston doesn't support SVG icons.
     inkscape -w 20 -h 20 \
         -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \
-        ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
+        ${cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
 
     ln -st $out/usr/bin \
         ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \
-        ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \
-        ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
+        ${xdg-desktop-portal}/libexec/xdg-document-portal \
+        ${xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
     ln -st $out/usr/share/dbus-1 \
         ${dbus}/share/dbus-1/session.conf
     ln -st $out/usr/share/dbus-1/services \
-        ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
+        ${xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
 
     for pkg in ${escapeShellArgs usrPackages}; do
         lndir -ignorelinks -silent "$pkg" "$out/usr"
@@ -159,6 +121,10 @@ let
     # programs we want.
     # https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
     ln -s ${util-linuxMinimal}/bin/{findfs,uuidgen,lsblk,mount} $out/usr/bin
+
+    # TODO: this is another hack and it should be possible
+    # to build systemd without this.
+    ln -s -- ${lib.escapeShellArg systemdMinimal}/bin/udevadm "$out/usr/bin"
   '';
 in
 
@@ -195,7 +161,7 @@ stdenvNoCC.mkDerivation {
   unsafeDiscardReferences = { out = true; };
 
   passthru = {
-    inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui;
+    inherit appvm firmware kernel nixosAllHardware packagesSysroot;
   };
 
   meta = with lib; {
@@ -203,4 +169,4 @@ stdenvNoCC.mkDerivation {
     platforms = platforms.linux;
   };
 }
-) {}) (_: {})
+) {}) {}) (_: {})
diff --git a/host/rootfs/image/etc/mdev.conf b/host/rootfs/image/etc/mdev.conf
deleted file mode 100644
index bddcfdc44ec2a8b1aa95e84cb88fdde625c766d8..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021-2022, 2024 Alyssa Ross <hi@alyssa.is>
-
-$PCI_CLASS=^2....$ 0:0 660 +/etc/mdev/net/add
--$MODALIAS=.* 0:0 660 +importas -Siu MODALIAS modprobe -q $MODALIAS
-kvm 0:0 660 +background { /etc/mdev/listen kvm }
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
diff --git a/host/rootfs/image/etc/mdev/listen b/host/rootfs/image/etc/mdev/listen
deleted file mode 100755
index ab50ee8c5ed1139d1129bac56afa7263af150745..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/listen
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-redirfd -w 1 /run/wait/${1}
-echo
diff --git a/host/rootfs/image/etc/mdev/wait b/host/rootfs/image/etc/mdev/wait
deleted file mode 100755
index 6bddb303d2671ce4e5b8581cd81235d7404916e7..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/wait
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-foreground {
-  redirfd -w 1 /dev/null
-  head -1 /run/wait/${1}
-}
-rm /run/wait/${1}
diff --git a/host/rootfs/image/etc/s6-rc/card0/type.license b/host/rootfs/image/etc/s6-rc/card0/type.license
deleted file mode 100644
index c49c11b66262c7edc57ac06a486c1166d867c31d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/card0/up b/host/rootfs/image/etc/s6-rc/card0/up
deleted file mode 100644
index 703562e5442aea45198350afe86a8f38c11ed072..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait card0
diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
index c02e3f90245e005b98b4de8245a1863fb49c1158..a8436de58580f2a2a6f42bb69418a319f967df47 100644
--- a/host/rootfs/image/etc/s6-rc/kvm/up
+++ b/host/rootfs/image/etc/s6-rc/kvm/up
@@ -1,4 +1,3 @@
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait kvm
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+udevadm wait /dev/kvm
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
deleted file mode 100644
index bdd22a1850ae6c03a414eeb8084998679a2cdf92..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
+++ /dev/null
@@ -1 +0,0 @@
-oneshot
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
deleted file mode 100644
index 8698f7d7988a017786fb91a584eafbfb23b3165d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-
-mdevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
deleted file mode 100644
index 2b3b032142b7286bd317cf0abaa44fba3a9b8941..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2020 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/run b/host/rootfs/image/etc/s6-rc/mdevd/run
deleted file mode 100644
index 55899bbe674426e4591e866a4d0617361ba34305..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/run
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/execlineb -P
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi@alyssa.is>
-
-mdevd -D3 -O4 -b134217728
diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents b/host/rootfs/image/etc/s6-rc/ok-all/contents
index 9f8b0ed66ceedd591ed2f1a7e164d9abcc54cc53..c76a5af336c7f1c3f4b81bf1f6244a53e0399fe8 100644
--- a/host/rootfs/image/etc/s6-rc/ok-all/contents
+++ b/host/rootfs/image/etc/s6-rc/ok-all/contents
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
 #
-mdevd-coldplug
+systemd-udevd-coldplug
 sys-vmms
 vm-env
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
diff --git a/host/rootfs/image/etc/s6-rc/card0/type b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/card0/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
new file mode 100644
index 0000000000000000000000000000000000000000..1732c98158046d0fb6ba6e8fb2201444fcf9128a
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: CC0-1.0
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+udevadm trigger
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0 b/host/rootfs/image/etc/s6-rc/systemd-udevd/flag-essential
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/flag-essential
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/notification-fd
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
new file mode 100644
index 0000000000000000000000000000000000000000..c4a0586a407fe14c3e0855749a7524ac3871dda4
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
new file mode 100644
index 0000000000000000000000000000000000000000..2501680b69eb0060b651146dffb6b3a99640c6fb
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
@@ -0,0 +1,11 @@
+#!/bin/execlineb -P
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+if { rm -f /run/sd-notify-wrapper/systemd-udevd }
+background {
+   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
+   fdmove 1 3
+   sd-notify-adapter
+}
+export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
+exec -a systemd-udevd udevadm
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type b/host/rootfs/image/etc/s6-rc/systemd-udevd/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
index 580795b1b02bb7a8dff7f872723c678141d4bb70..ed8b5c410adfc17f5bbc33932ac79d97bd7b3115 100644
--- a/host/rootfs/image/etc/s6-rc/vm-env/contents
+++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
@@ -2,4 +2,5 @@
 # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
 #
 static-nodes
+systemd-udevd-coldplug
 weston
diff --git a/host/rootfs/image/etc/s6-rc/vm-env/type.license b/host/rootfs/image/etc/s6-rc/vm-env/type.license
deleted file mode 100644
index 5a4063310c3d22dbf59b30792e8e6f55a57ec9c0..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/vm-env/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2022 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents
index ee1e3cfc39d1a6545bbefc3692782b9de6b3ade3..9a1aea63abd1b5c374e3ac9a9671e4c9341f8d16 100644
--- a/host/rootfs/image/etc/s6-rc/vmm-env/contents
+++ b/host/rootfs/image/etc/s6-rc/vmm-env/contents
@@ -3,4 +3,7 @@
 #
 core
 kvm
-static-nodes
+# systemd runs systemd-udev-trigger.service before sysinit.target.
+# Therefore, anything using libudev that isn't an early boot service
+# might expect udev coldplug to have finished.
+systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug b/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
new file mode 100644
index 0000000000000000000000000000000000000000..ca91367529f39eebe009cc8acef782cf6a4516c1
--- /dev/null
+++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# systemd-udevd has a built-in module loading feature,
+# but it seems to not work for some reason or another.
+# This works.
+ACTION!="remove", ENV{MODALIAS}!="", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
+# systemd-udevd unsets PATH, so fix that.
+ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start
index 67480e5215d8a8260ce3f03c67f71ba8f210c291..9725ef5ec549ff191606282a7b0ae56838f53f03 100755
--- a/host/rootfs/image/usr/bin/vm-start
+++ b/host/rootfs/image/usr/bin/vm-start
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi@alyssa.is>
 
-foreground { s6-rc -bu change vm-env }
+foreground { s6-rc -bu change weston }
 
 foreground {
   redirfd -w 2 /dev/null
diff --git a/host/rootfs/image/etc/mdev/net/add b/host/rootfs/image/usr/libexec/net-add
similarity index 100%
rename from host/rootfs/image/etc/mdev/net/add
rename to host/rootfs/image/usr/libexec/net-add

-- 
2.51.0

Re: [PATCH v2 2/3] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 4977 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This replaces the mdevd uevent daemon with systemd-udevd, which supports
> much more hardware and is therefore to be preferred for a full desktop
> environment.  Various Wayland compositors integrate with systemd-udevd,
> allowing them to discover devices as they appear rather than having to
> only use devices plugged in when the compositor is started.
> Additionally, systemd-udevd has quirks for various devices that are
> needed to support the wide variety of hardware end-users have.
>
> The dependency on /dev/dri/card0 being present is eliminated, and
> whatever devices the user has are now picked up by the compositor.  New
> dependencies are added to ensure that udev coldplug has finished before
> any non-trivial services are started.  systemd-udev-trigger.service runs
> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
> an early boot service can assume 'udevadm trigger' has run.
>
> systemd-udevd doesn't set PATH to anything useful, presumably because
> under NixOS this is handled some other way.  Therefore, explicitly set
> it to /usr/bin in the scripts systemd-udevd calls.
>
> The /etc/mdev/listen and /etc/mdev/wait scripts are replaced by
> 'udevadm wait', so they are deleted.  The whole static-nodes target also
> goes away, as Linux handles that itself and systemd-udevd deals with
> autoloading.

Not quite right.  Linux does not create static nodes.  Userspace has to.
That's why we had a service for it.  (It sucks.)

> diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
> index c02e3f90245e005b98b4de8245a1863fb49c1158..a8436de58580f2a2a6f42bb69418a319f967df47 100644
> --- a/host/rootfs/image/etc/s6-rc/kvm/up
> +++ b/host/rootfs/image/etc/s6-rc/kvm/up
> @@ -1,4 +1,3 @@
>  # SPDX-License-Identifier: EUPL-1.2+
> -# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
> -
> -/etc/mdev/wait kvm
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +udevadm wait /dev/kvm

Any reason now not to just inline this into the services that need to wait?

> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> new file mode 100644
> index 0000000000000000000000000000000000000000..2501680b69eb0060b651146dffb6b3a99640c6fb
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> @@ -0,0 +1,11 @@
> +#!/bin/execlineb -P
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +if { rm -f /run/sd-notify-wrapper/systemd-udevd }
> +background {
> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
> +   fdmove 1 3
> +   sd-notify-adapter
> +}
> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
> +exec -a systemd-udevd udevadm

How does systemd expect this to normally work?

> diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
> index 580795b1b02bb7a8dff7f872723c678141d4bb70..ed8b5c410adfc17f5bbc33932ac79d97bd7b3115 100644
> --- a/host/rootfs/image/etc/s6-rc/vm-env/contents
> +++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
> @@ -2,4 +2,5 @@
>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>  #
>  static-nodes
> +systemd-udevd-coldplug
>  weston

Shouldn't static-nodes be removed here as well, and the static-nodes
files deleted?

> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> new file mode 100644
> index 0000000000000000000000000000000000000000..ca91367529f39eebe009cc8acef782cf6a4516c1
> --- /dev/null
> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> @@ -0,0 +1,9 @@
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# systemd-udevd has a built-in module loading feature,
> +# but it seems to not work for some reason or another.
> +# This works.
> +ACTION!="remove", ENV{MODALIAS}!="", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
> +# systemd-udevd unsets PATH, so fix that.
> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"

This is such a weird behavior.  Do we know why it does that?

> diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start
> index 67480e5215d8a8260ce3f03c67f71ba8f210c291..9725ef5ec549ff191606282a7b0ae56838f53f03 100755
> --- a/host/rootfs/image/usr/bin/vm-start
> +++ b/host/rootfs/image/usr/bin/vm-start
> @@ -2,7 +2,7 @@
>  # SPDX-License-Identifier: EUPL-1.2+
>  # SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi@alyssa.is>
>  
> -foreground { s6-rc -bu change vm-env }
> +foreground { s6-rc -bu change weston }
>  
>  foreground {
>    redirfd -w 2 /dev/null

Why?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v2 2/3] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 5588 bytes --]

On 9/25/25 06:53, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This replaces the mdevd uevent daemon with systemd-udevd, which supports
>> much more hardware and is therefore to be preferred for a full desktop
>> environment.  Various Wayland compositors integrate with systemd-udevd,
>> allowing them to discover devices as they appear rather than having to
>> only use devices plugged in when the compositor is started.
>> Additionally, systemd-udevd has quirks for various devices that are
>> needed to support the wide variety of hardware end-users have.
>>
>> The dependency on /dev/dri/card0 being present is eliminated, and
>> whatever devices the user has are now picked up by the compositor.  New
>> dependencies are added to ensure that udev coldplug has finished before
>> any non-trivial services are started.  systemd-udev-trigger.service runs
>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>> an early boot service can assume 'udevadm trigger' has run.
>>
>> systemd-udevd doesn't set PATH to anything useful, presumably because
>> under NixOS this is handled some other way.  Therefore, explicitly set
>> it to /usr/bin in the scripts systemd-udevd calls.
>>
>> The /etc/mdev/listen and /etc/mdev/wait scripts are replaced by
>> 'udevadm wait', so they are deleted.  The whole static-nodes target also
>> goes away, as Linux handles that itself and systemd-udevd deals with
>> autoloading.
> 
> Not quite right.  Linux does not create static nodes.  Userspace has to.
> That's why we had a service for it.  (It sucks.)
> 
>> diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
>> index c02e3f90245e005b98b4de8245a1863fb49c1158..a8436de58580f2a2a6f42bb69418a319f967df47 100644
>> --- a/host/rootfs/image/etc/s6-rc/kvm/up
>> +++ b/host/rootfs/image/etc/s6-rc/kvm/up
>> @@ -1,4 +1,3 @@
>>  # SPDX-License-Identifier: EUPL-1.2+
>> -# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
>> -
>> -/etc/mdev/wait kvm
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +udevadm wait /dev/kvm
> 
> Any reason now not to just inline this into the services that need to wait?

Avoiding redundant calls I guess?  I'm not
sure how expensive 'udevadm wait' is.

>> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..2501680b69eb0060b651146dffb6b3a99640c6fb
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> @@ -0,0 +1,11 @@
>> +#!/bin/execlineb -P
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +if { rm -f /run/sd-notify-wrapper/systemd-udevd }
>> +background {
>> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
>> +   fdmove 1 3
>> +   sd-notify-adapter
>> +}
>> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
>> +exec -a systemd-udevd udevadm
> 
> How does systemd expect this to normally work?

/usr/lib/systemd/systemd-udevd is a symlink to ../../bin/udevadm

>> diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
>> index 580795b1b02bb7a8dff7f872723c678141d4bb70..ed8b5c410adfc17f5bbc33932ac79d97bd7b3115 100644
>> --- a/host/rootfs/image/etc/s6-rc/vm-env/contents
>> +++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
>> @@ -2,4 +2,5 @@
>>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>>  #
>>  static-nodes
>> +systemd-udevd-coldplug
>>  weston
> 
> Shouldn't static-nodes be removed here as well, and the static-nodes
> files deleted?

Nope.  systemd-udevd doesn't create them.  However,
one can use kmod and systemd-tmpfiles to do that.

systemd-tmpfiles actually has no dependency on PID 1
*at all*, so we can use it as much as we want.

>> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..ca91367529f39eebe009cc8acef782cf6a4516c1
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
>> @@ -0,0 +1,9 @@
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +# systemd-udevd has a built-in module loading feature,
>> +# but it seems to not work for some reason or another.
>> +# This works.
>> +ACTION!="remove", ENV{MODALIAS}!="", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
>> +# systemd-udevd unsets PATH, so fix that.
>> +ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
> 
> This is such a weird behavior.  Do we know why it does that?

I don't at least.

>> diff --git a/host/rootfs/image/usr/bin/vm-start b/host/rootfs/image/usr/bin/vm-start
>> index 67480e5215d8a8260ce3f03c67f71ba8f210c291..9725ef5ec549ff191606282a7b0ae56838f53f03 100755
>> --- a/host/rootfs/image/usr/bin/vm-start
>> +++ b/host/rootfs/image/usr/bin/vm-start
>> @@ -2,7 +2,7 @@
>>  # SPDX-License-Identifier: EUPL-1.2+
>>  # SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi@alyssa.is>
>>  
>> -foreground { s6-rc -bu change vm-env }
>> +foreground { s6-rc -bu change weston }
>>  
>>  foreground {
>>    redirfd -w 2 /dev/null
> 
> Why?

Will revert.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v2 2/3] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 2879 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 9/25/25 06:53, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
>>> index c02e3f90245e005b98b4de8245a1863fb49c1158..a8436de58580f2a2a6f42bb69418a319f967df47 100644
>>> --- a/host/rootfs/image/etc/s6-rc/kvm/up
>>> +++ b/host/rootfs/image/etc/s6-rc/kvm/up
>>> @@ -1,4 +1,3 @@
>>>  # SPDX-License-Identifier: EUPL-1.2+
>>> -# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
>>> -
>>> -/etc/mdev/wait kvm
>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +udevadm wait /dev/kvm
>> 
>> Any reason now not to just inline this into the services that need to wait?
>
> Avoiding redundant calls I guess?  I'm not
> sure how expensive 'udevadm wait' is.

Then let's drop the service and see if it becomes a problem.  I suspect
it won't.

>>> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>>> new file mode 100644
>>> index 0000000000000000000000000000000000000000..2501680b69eb0060b651146dffb6b3a99640c6fb
>>> --- /dev/null
>>> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>>> @@ -0,0 +1,11 @@
>>> +#!/bin/execlineb -P
>>> +# SPDX-License-Identifier: EUPL-1.2+
>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +if { rm -f /run/sd-notify-wrapper/systemd-udevd }
>>> +background {
>>> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
>>> +   fdmove 1 3
>>> +   sd-notify-adapter
>>> +}
>>> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
>>> +exec -a systemd-udevd udevadm
>> 
>> How does systemd expect this to normally work?
>
> /usr/lib/systemd/systemd-udevd is a symlink to ../../bin/udevadm

Ah, and you had the problem that currently it's hard to install things
other than kernel modules to /usr/lib.  We can probably fix that.

>>> diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
>>> index 580795b1b02bb7a8dff7f872723c678141d4bb70..ed8b5c410adfc17f5bbc33932ac79d97bd7b3115 100644
>>> --- a/host/rootfs/image/etc/s6-rc/vm-env/contents
>>> +++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
>>> @@ -2,4 +2,5 @@
>>>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>>>  #
>>>  static-nodes
>>> +systemd-udevd-coldplug
>>>  weston
>> 
>> Shouldn't static-nodes be removed here as well, and the static-nodes
>> files deleted?
>
> Nope.  systemd-udevd doesn't create them.  However,
> one can use kmod and systemd-tmpfiles to do that.
>
> systemd-tmpfiles actually has no dependency on PID 1
> *at all*, so we can use it as much as we want.

Oh, I see, okay.  That's a separate series then. :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

[PATCH v3 0/2] Switch from mdevd to systemd-udevd in root filesystem

[Demi Marie Obenour]

systemd-udevd provides support for significantly more hardware than
mdevd does.  Therefore, switch to it.

I was not able to get the networking tests to work, as I currently don't
have hardware that can run KVM.  The other integration tests do pass.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes in v3:
- Try to avoid net-add running twice.
- Use full systemd instead of systemdMinimal, as something else already
  pulls it into the image.
- Hopefully fix integration tests.
- Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-6089de521b3b@gmail.com

Changes in v2:
- Use more optional arguments instead of positional parameters in
  sd-notify-wrapper.
- Explain why explicit modprobe is needed.
- Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-eade4ab8f2b4@gmail.com

---
Demi Marie Obenour (2):
      tools: Add adapter tool for services using sd_notify
      host/rootfs: Switch to systemd-udevd

 host/rootfs/Makefile                               |  36 +++---
 host/rootfs/default.nix                            | 118 +++++++------------
 host/rootfs/image/etc/mdev.conf                    |   7 --
 host/rootfs/image/etc/mdev/listen                  |  11 --
 host/rootfs/image/etc/mdev/wait                    |  14 ---
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
 host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
 host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   3 +
 .../kvm => systemd-udevd/flag-essential}           |   0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  13 +++
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 host/rootfs/image/etc/s6-rc/vm-env/type.license    |   2 -
 .../vmm-env/contents.d/systemd-udevd-coldplug      |   0
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 .../image/etc/udev/rules.d/99-spectrum.rules       |  19 +++
 host/rootfs/image/usr/bin/run-vmm                  |   3 +
 host/rootfs/image/usr/bin/systemd-udevd            |   1 +
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 tools/default.nix                                  |   1 +
 tools/meson.build                                  |   1 +
 tools/sd-notify-adapter/meson.build                |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c        | 127 +++++++++++++++++++++
 39 files changed, 233 insertions(+), 157 deletions(-)
---
base-commit: 2551f9eb1a6c9245699ff5cf77f9957d1e2d14be
change-id: 20250911-udev-24cf4bf68fbe
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[PATCH v3 1/2] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

This adapts programs using sd_notify for use with s6 readiness
notification.  stdin and stdout are hard-coded for simplicity.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
systemd readiness notification has two
strict advantages over the s6 version:

1. It allows reliable reloading.
2. It allows providing a status message that the service manager
   can show in status output.

s6 would actually benefit from both of these features.
---
Changes since v1:

- Hard-code file descriptors.
- Run wrapper as background process.
- Massively reduce code size.
- Use // instead of /* */ for comments.
- Check that the notification FD is a pipe and that the listening socket
  is a socket.
- Rely on s6-ipc-socketbinder to create the listening socket.
- Do not unlink the listening socket.
---
 tools/default.nix                           |   1 +
 tools/meson.build                           |   1 +
 tools/sd-notify-adapter/meson.build         |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c | 127 ++++++++++++++++++++++++++++
 4 files changed, 133 insertions(+)

diff --git a/tools/default.nix b/tools/default.nix
index f1157f0072f58c2ad9e741ca60bab2ed6507b72d..3634ef8ee892697b1bc7fff259eaccd54fddcd2f 100644
--- a/tools/default.nix
+++ b/tools/default.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
       ./lsvm
       ./start-vmm
       ./subprojects
+      ./sd-notify-adapter
     ] ++ lib.optionals driverSupport [
       ./xdp-forwarder
     ]));
diff --git a/tools/meson.build b/tools/meson.build
index 17b4c16c07c9c6847306c47fbb7fe54f5a6e8cc5..d679afa64966d7b237f332096281a9bc9ef76e94 100644
--- a/tools/meson.build
+++ b/tools/meson.build
@@ -23,6 +23,7 @@ if get_option('host')
 
   subdir('lsvm')
   subdir('start-vmm')
+  subdir('sd-notify-adapter')
 endif
 
 if get_option('app')
diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
new file mode 100644
index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
--- /dev/null
+++ b/tools/sd-notify-adapter/meson.build
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: ISC
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
new file mode 100644
index 0000000000000000000000000000000000000000..2767dea30b8db69986d9c2a02d6be28d205b3b4b
--- /dev/null
+++ b/tools/sd-notify-adapter/sd-notify-adapter.c
@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+#define _GNU_SOURCE 1
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <err.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
+
+static bool ready;
+
+enum {
+	socket_fd,
+	notification_fd,
+};
+
+#define READY "READY=1"
+#define READY_SIZE (sizeof(READY) - 1)
+
+static void
+process_notification(struct iovec *const msg) {
+	ssize_t data = recv(socket_fd, msg->iov_base, msg->iov_len,
+	                    MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
+	if (data == -1) {
+		if (errno == EINTR) {
+			return; // signal caught
+		}
+		if (errno == EAGAIN || errno == EWOULDBLOCK) {
+			return; // spurious wakeup
+		}
+		err(EX_OSERR, "recv from notification socket");
+	}
+	assert(data >= 0 && data <= INT_MAX);
+	size_t size = (size_t)data;
+	if (size == 0)
+		return; // avoid arithmetic on NULL pointer
+	if (size > msg->iov_len) {
+		char *b = (size == 0 ? malloc(size) : realloc(msg->iov_base, size));
+		if (b == NULL) {
+			err(EX_OSERR, "allocation failure");
+		}
+		msg->iov_base = b;
+		msg->iov_len = size;
+	}
+	data = recv(socket_fd, msg->iov_base, msg->iov_len,
+	            MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC);
+	if (data < 0) {
+		if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
+			return;
+		err(EX_OSERR, "recv from notification socket");
+	}
+	for (char *next, *cursor = msg->iov_base, *end = cursor + size;
+	     cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
+		next = memchr(cursor, '\n', (size_t)(end - cursor));
+		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
+		if (message_size == READY_SIZE &&
+		    memcmp(cursor, READY, READY_SIZE) == 0) {
+			data = write(notification_fd, "\n", 1);
+			if (data != 1) {
+				err(EX_OSERR, "writing to notification descriptor");
+			}
+			exit(0);
+		}
+	}
+}
+
+int main(int argc, char **argv [[gnu::unused]]) {
+	if (argc != 1) {
+		errx(EX_USAGE, "stdin is listening socket, stdout is notification pipe");
+	}
+	// Main event loop.
+	struct iovec v = {
+		.iov_base = NULL,
+		.iov_len = 0,
+	};
+	for (;;) {
+		struct pollfd p[] = {
+			{
+				.fd = socket_fd,
+				.events = POLLIN,
+				.revents = 0,
+			},
+			{
+				.fd = notification_fd,
+				.events = 0,
+				.revents = 0,
+			},
+		};
+		int r = poll(p, 2, -1);
+		if (r < 0) {
+			if (errno == EINTR)
+				continue;
+			err(EX_OSERR, "poll");
+		}
+		if (p[0].revents) {
+			if (p[0].revents & POLLERR)
+				errx(EX_OSERR, "unexpected POLLERR");
+			if (p[0].revents & POLLIN)
+				process_notification(&v);
+			break;
+		}
+		if (p[1].revents) {
+			if (ready) {
+				// Normal exit
+				return 0;
+			}
+			errx(EX_PROTOCOL, "s6 closed its pipe before the child was ready");
+		}
+	}
+}

-- 
2.51.0

Re: [PATCH v3 1/2] tools: Add adapter tool for services using sd_notify

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 7404 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This adapts programs using sd_notify for use with s6 readiness
> notification.  stdin and stdout are hard-coded for simplicity.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> systemd readiness notification has two
> strict advantages over the s6 version:
>
> 1. It allows reliable reloading.
> 2. It allows providing a status message that the service manager
>    can show in status output.
>
> s6 would actually benefit from both of these features.
> ---
> Changes since v1:
>
> - Hard-code file descriptors.
> - Run wrapper as background process.
> - Massively reduce code size.
> - Use // instead of /* */ for comments.
> - Check that the notification FD is a pipe and that the listening socket
>   is a socket.
> - Rely on s6-ipc-socketbinder to create the listening socket.
> - Do not unlink the listening socket.
> ---
>  tools/default.nix                           |   1 +
>  tools/meson.build                           |   1 +
>  tools/sd-notify-adapter/meson.build         |   4 +
>  tools/sd-notify-adapter/sd-notify-adapter.c | 127 ++++++++++++++++++++++++++++
>  4 files changed, 133 insertions(+)
>
> diff --git a/tools/default.nix b/tools/default.nix
> index f1157f0072f58c2ad9e741ca60bab2ed6507b72d..3634ef8ee892697b1bc7fff259eaccd54fddcd2f 100644
> --- a/tools/default.nix
> +++ b/tools/default.nix
> @@ -74,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
>        ./lsvm
>        ./start-vmm
>        ./subprojects
> +      ./sd-notify-adapter

Sort.

>      ] ++ lib.optionals driverSupport [
>        ./xdp-forwarder
>      ]));
> diff --git a/tools/meson.build b/tools/meson.build
> index 17b4c16c07c9c6847306c47fbb7fe54f5a6e8cc5..d679afa64966d7b237f332096281a9bc9ef76e94 100644
> --- a/tools/meson.build
> +++ b/tools/meson.build
> @@ -23,6 +23,7 @@ if get_option('host')
>  
>    subdir('lsvm')
>    subdir('start-vmm')
> +  subdir('sd-notify-adapter')
>  endif
>  
>  if get_option('app')
> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
> new file mode 100644
> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
> --- /dev/null
> +++ b/tools/sd-notify-adapter/meson.build
> @@ -0,0 +1,4 @@
> +# SPDX-License-Identifier: ISC

Atypical license.

> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..2767dea30b8db69986d9c2a02d6be28d205b3b4b
> --- /dev/null
> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
> @@ -0,0 +1,127 @@
> +// SPDX-License-Identifier: MIT
> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +#define _GNU_SOURCE 1

This should be done in the build system, like how other programs in
Spectrum do it.  (That way we can't forget it needs to be set before any
headers are included.)

> +#include <assert.h>
> +#include <errno.h>
> +#include <limits.h>
> +#include <signal.h>
> +#include <stdarg.h>
> +#include <stddef.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +
> +#include <err.h>
> +#include <fcntl.h>
> +#include <poll.h>
> +#include <sys/socket.h>
> +#include <sys/stat.h>
> +#include <sys/un.h>
> +#include <sysexits.h>

I used to like sysexits.h too, but the BSD systems they originally came
from now consider them bad practice and discourage them in new code, so
that's why other code in Spectrum doesn't use them, and just uses
EXIT_FAILURE.

> +#include <unistd.h>
> +
> +#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
> +
> +static bool ready;
> +
> +enum {
> +	socket_fd,
> +	notification_fd,
> +};
> +
> +#define READY "READY=1"
> +#define READY_SIZE (sizeof(READY) - 1)
> +
> +static void
> +process_notification(struct iovec *const msg) {
> +	ssize_t data = recv(socket_fd, msg->iov_base, msg->iov_len,
> +	                    MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);

Why MSG_DONTWAIT?  We know there's data waiting for us.

I find "data" to be quite a confusing name for a size.

> +	if (data == -1) {
> +		if (errno == EINTR) {
> +			return; // signal caught
> +		}
> +		if (errno == EAGAIN || errno == EWOULDBLOCK) {
> +			return; // spurious wakeup
> +		}
> +		err(EX_OSERR, "recv from notification socket");
> +	}
> +	assert(data >= 0 && data <= INT_MAX);

Why do we care about the upper range?  We cast it to size_t after this,
not int.

> +	size_t size = (size_t)data;
> +	if (size == 0)
> +		return; // avoid arithmetic on NULL pointer
> +	if (size > msg->iov_len) {
> +		char *b = (size == 0 ? malloc(size) : realloc(msg->iov_base, size));

We already know size != 0 at this point.

> +		if (b == NULL) {
> +			err(EX_OSERR, "allocation failure");
> +		}
> +		msg->iov_base = b;

We could just msg->iov_base = realloc(…), without the b variable.

> +		msg->iov_len = size;
> +	}
> +	data = recv(socket_fd, msg->iov_base, msg->iov_len,
> +	            MSG_CMSG_CLOEXEC | MSG_DONTWAIT | MSG_TRUNC);
> +	if (data < 0) {
> +		if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
> +			return;
> +		err(EX_OSERR, "recv from notification socket");
> +	}

EAGAIN or EWOULDBLOCK would be quite unexpected.

> +	for (char *next, *cursor = msg->iov_base, *end = cursor + size;
> +	     cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
> +		next = memchr(cursor, '\n', (size_t)(end - cursor));
> +		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
> +		if (message_size == READY_SIZE &&
> +		    memcmp(cursor, READY, READY_SIZE) == 0) {
> +			data = write(notification_fd, "\n", 1);
> +			if (data != 1) {
> +				err(EX_OSERR, "writing to notification descriptor");
> +			}
> +			exit(0);
> +		}
> +	}
> +}
> +
> +int main(int argc, char **argv [[gnu::unused]]) {
> +	if (argc != 1) {
> +		errx(EX_USAGE, "stdin is listening socket, stdout is notification pipe");
> +	}

This is C23 — you can just write int main(int argc, char **).

> +	// Main event loop.
> +	struct iovec v = {
> +		.iov_base = NULL,
> +		.iov_len = 0,
> +	};
> +	for (;;) {
> +		struct pollfd p[] = {
> +			{
> +				.fd = socket_fd,
> +				.events = POLLIN,
> +				.revents = 0,
> +			},
> +			{
> +				.fd = notification_fd,
> +				.events = 0,
> +				.revents = 0,
> +			},
> +		};
> +		int r = poll(p, 2, -1);

Might as well use ARRAY_SIZE here, given we have it.

> +		if (r < 0) {
> +			if (errno == EINTR)
> +				continue;
> +			err(EX_OSERR, "poll");
> +		}
> +		if (p[0].revents) {
> +			if (p[0].revents & POLLERR)
> +				errx(EX_OSERR, "unexpected POLLERR");
> +			if (p[0].revents & POLLIN)
> +				process_notification(&v);
> +			break;

break?  So when we get a non-READY message, we just exit?

> +		}
> +		if (p[1].revents) {
> +			if (ready) {
> +				// Normal exit
> +				return 0;
> +			}

ready is never written, so this never happens.

> +			errx(EX_PROTOCOL, "s6 closed its pipe before the child was ready");
> +		}
> +	}
> +}
>
> -- 
> 2.51.0

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

[PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

This replaces the mdevd uevent daemon with systemd-udevd, which supports
much more hardware and is therefore to be preferred for a full desktop
environment.  Various Wayland compositors integrate with systemd-udevd,
allowing them to discover devices as they appear rather than having to
only use devices plugged in when the compositor is started.
Additionally, systemd-udevd has quirks for various devices that are
needed to support the wide variety of hardware end-users have.

The dependency on /dev/dri/card0 being present is eliminated, and
whatever devices the user has are now picked up by the compositor.  New
dependencies are added to ensure that udev coldplug has finished before
any non-trivial services are started.  systemd-udev-trigger.service runs
'udevadm trigger' and has Before=sysinit.target, so anything that is not
an early boot service can assume 'udevadm trigger' has run.

systemd-udevd unsets PATH.  Therefore, manually set it to /usr/bin
before invoking any scripts, like /usr/libexec/net-add.

systemd-udevd provides the 'udevadm wait' command to wait for a device
to appear and be processed.  This replaces all uses of /etc/mdev/wait,
so this script is removed.  /etc/mdev/listen and /run/wait only existed
to wake up /etc/mdev/wait, so they are also removed.

systemd-udevd does have a module loading feature via the 'kmod load'
builtin.  However, this does not work, so a manual call to modprobe is
used instead.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
I am not sure why the 'kmod load' builtin is broken in Spectrum.  I
suspect it is either a bug in Nixpkgs or a bug in systemd-udevd when not
spawned by systemd.  The simplest way to check which is the case would
be to see what Gentoo does, as Gentoo uses systemd-udevd with OpenRC by
default.  An early version of this patch didn't allow systemd-udevd to
load libkmod.so.2, but the problem persisted even after that was fixed.
---
 host/rootfs/Makefile                               |  36 +++----
 host/rootfs/default.nix                            | 118 ++++++++-------------
 host/rootfs/image/etc/mdev.conf                    |   7 --
 host/rootfs/image/etc/mdev/listen                  |  11 --
 host/rootfs/image/etc/mdev/wait                    |  14 ---
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
 host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
 host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   3 +
 .../kvm => systemd-udevd/flag-essential}           |   0
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  13 +++
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 host/rootfs/image/etc/s6-rc/vm-env/type.license    |   2 -
 .../vmm-env/contents.d/systemd-udevd-coldplug      |   0
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 .../image/etc/udev/rules.d/99-spectrum.rules       |  19 ++++
 host/rootfs/image/usr/bin/run-vmm                  |   3 +
 host/rootfs/image/usr/bin/systemd-udevd            |   1 +
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 35 files changed, 100 insertions(+), 157 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 4b163de68c38943117eb54a9a954eb77f682c150..4945bfed3cd9000eccc3daa43bf4044497a35498 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -13,10 +13,6 @@ FILES = \
 	image/etc/group \
 	image/etc/init \
 	image/etc/login \
-	image/etc/mdev.conf \
-	image/etc/mdev/listen \
-	image/etc/mdev/net/add \
-	image/etc/mdev/wait \
 	image/etc/parse-devname \
 	image/etc/passwd \
 	image/etc/s6-linux-init/env/WAYLAND_DISPLAY \
@@ -52,6 +48,7 @@ FILES = \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/notification-fd \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/run \
 	image/etc/s6-linux-init/scripts/rc.init \
+	image/etc/udev/rules.d/99-spectrum.rules \
 	image/etc/xdg/weston/autolaunch \
 	image/etc/xdg/weston/weston.ini \
 	image/usr/bin/assign-devices \
@@ -63,12 +60,14 @@ FILES = \
 	image/usr/bin/vm-start \
 	image/usr/bin/vm-stop \
 	image/usr/bin/xdg-open \
+	image/usr/libexec/net-add \
 	image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service
 
 DIRS = \
 	dev \
 	etc/s6-linux-init/env \
 	etc/s6-linux-init/run-image/configs \
+	etc/s6-linux-init/run-image/sd-notify-wrapper \
 	etc/s6-linux-init/run-image/service/dbus/instance \
 	etc/s6-linux-init/run-image/service/dbus/instances \
 	etc/s6-linux-init/run-image/service/dbus/template/data \
@@ -93,7 +92,6 @@ DIRS = \
 	etc/s6-linux-init/run-image/user \
 	etc/s6-linux-init/run-image/vm/by-id \
 	etc/s6-linux-init/run-image/vm/by-name \
-	etc/s6-linux-init/run-image/wait \
 	ext \
 	proc \
 	run \
@@ -108,7 +106,8 @@ LINKS = \
 	image/etc/s6-linux-init/run-image/opengl-driver \
 	image/etc/s6-linux-init/run-image/service/vmm/template/run \
 	image/lib \
-	image/sbin
+	image/sbin \
+	image/usr/bin/systemd-udevd
 
 BUILD_FILES = build/etc/s6-rc
 
@@ -129,21 +128,10 @@ build/empty:
 	mkdir -p $@
 
 S6_RC_FILES = \
-	image/etc/s6-rc/card0/type \
-	image/etc/s6-rc/card0/up \
 	image/etc/s6-rc/core/type \
 	image/etc/s6-rc/core/up \
-	image/etc/s6-rc/kvm/timeout-up \
-	image/etc/s6-rc/kvm/type \
-	image/etc/s6-rc/kvm/up \
-	image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \
-	image/etc/s6-rc/mdevd-coldplug/type \
-	image/etc/s6-rc/mdevd-coldplug/up \
-	image/etc/s6-rc/mdevd/notification-fd \
-	image/etc/s6-rc/mdevd/run \
-	image/etc/s6-rc/mdevd/type \
-	image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug \
 	image/etc/s6-rc/ok-all/contents.d/sys-vmms \
+	image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/ok-all/contents.d/vm-env \
 	image/etc/s6-rc/ok-all/type \
 	image/etc/s6-rc/static-nodes/type \
@@ -151,14 +139,22 @@ S6_RC_FILES = \
 	image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env \
 	image/etc/s6-rc/sys-vmms/type \
 	image/etc/s6-rc/sys-vmms/up \
+	image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd \
+	image/etc/s6-rc/systemd-udevd-coldplug/type \
+	image/etc/s6-rc/systemd-udevd-coldplug/up \
+	image/etc/s6-rc/systemd-udevd/flag-essential \
+	image/etc/s6-rc/systemd-udevd/notification-fd \
+	image/etc/s6-rc/systemd-udevd/run \
+	image/etc/s6-rc/systemd-udevd/type \
 	image/etc/s6-rc/vm-env/contents.d/static-nodes \
+	image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/vm-env/contents.d/weston \
 	image/etc/s6-rc/vm-env/type \
 	image/etc/s6-rc/vmm-env/contents.d/core \
-	image/etc/s6-rc/vmm-env/contents.d/kvm \
 	image/etc/s6-rc/vmm-env/contents.d/static-nodes \
+	image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/vmm-env/type \
-	image/etc/s6-rc/weston/dependencies.d/card0 \
+	image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/weston/notification-fd \
 	image/etc/s6-rc/weston/run \
 	image/etc/s6-rc/weston/type
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 116b55232b0b9f0ef2d04a4b15ba6f198cfb832c..276cc434fdf0e3a76655ecd3565cbff164b7f3ee 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -6,88 +6,48 @@ import ../../lib/call-package.nix (
 { callSpectrumPackage, lseek, src, pkgsMusl, pkgsStatic, linux_latest }:
 pkgsStatic.callPackage (
 
-{ spectrum-host-tools
-, lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc
-, busybox, cloud-hypervisor, cryptsetup, dbus, execline, inkscape
-, iproute2, inotify-tools, jq, kmod, mdevd, s6, s6-linux-init, socat
-, util-linuxMinimal, virtiofsd, xorg, xdg-desktop-portal-spectrum-host
+{ busybox, cloud-hypervisor, cryptsetup, dbus, erofs-utils, execline
+, inkscape, inotify-tools, iproute2, jq, lib, mdevd, nixos
+, runCommand, s6, s6-linux-init, s6-rc, socat, spectrum-host-tools
+, stdenvNoCC, util-linuxMinimal, virtiofsd, writeClosure
+, xdg-desktop-portal-spectrum-host, xorg
 }:
-
 let
-  inherit (nixosAllHardware.config.hardware) firmware;
   inherit (lib)
-    concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs
+    concatMapStringsSep concatStrings escapeShellArgs fileset
     mapAttrsToList systems trivial;
-
   pkgsGui = pkgsMusl.extend (
-    final: super:
-    (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
-      flatpak = super.flatpak.override {
-        withMalcontent = false;
-      };
-
-      libgudev = super.libgudev.overrideAttrs ({ ... }: {
-        # Tests use umockdev, which is not compatible with libudev-zero.
-        doCheck = false;
-      });
-
-      qt6 = super.qt6.overrideScope (_: prev: {
-        qttranslations = prev.qttranslations.override {
-          qttools = prev.qttools.override {
-            qtbase = prev.qtbase.override {
-              qttranslations = null;
-              systemdSupport = false;
-            };
-            qtdeclarative = null;
-          };
-        };
-
-        qtbase = prev.qtbase.override {
-          systemdSupport = false;
-        };
-      });
-
-      systemd = super.systemd.overrideAttrs ({ meta ? { }, ... }: {
+    _final: super:
+    (lib.optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
+      malcontent = super.malcontent.overrideAttrs ({ meta ? { }, ... }: {
         meta = meta // {
           platforms = [ ];
         };
       });
+   }));
+in
+# Something already pulls in the full
+# systemd, so might as well use it.
+pkgsGui.callPackage (
+{ cosmic-files, crosvm, dejavu_fonts, foot, kmod, mesa
+, systemd, westonLite, xdg-desktop-portal, xdg-desktop-portal-gtk
+}:
 
-      upower = super.upower.override {
-        # Not ideal, but it's the best way to get rid of an installed
-        # test that needs umockdev.
-        withIntrospection = false;
-      };
-
-      udev = final.libudev-zero;
-
-      weston = super.weston.overrideAttrs ({ mesonFlags ? [], ... }: {
-        mesonFlags = mesonFlags ++ [
-          "-Dsystemd=false"
-        ];
-      });
-
-      xdg-desktop-portal = (super.xdg-desktop-portal.override {
-        enableSystemd = false;
-      }).overrideAttrs ({ ... }: {
-        # Tests use umockdev.
-        doCheck = false;
-      });
-    })
-  );
-
-  foot = pkgsGui.foot.override { allowPgo = false; };
+let
+  inherit (nixosAllHardware.config.hardware) firmware;
+  no_pgo_foot = foot.override { allowPgo = false; };
 
   packages = [
-    cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2
-    jq kmod mdevd s6 s6-linux-init s6-rc socat spectrum-host-tools
-    virtiofsd xdg-desktop-portal-spectrum-host
+    cloud-hypervisor crosvm cryptsetup dbus execline inotify-tools
+    iproute2 jq mdevd s6 s6-linux-init s6-rc socat
+    spectrum-host-tools virtiofsd xdg-desktop-portal-spectrum-host
 
     (busybox.override {
       extraConfig = ''
         CONFIG_CHATTR n
         CONFIG_DEPMOD n
         CONFIG_FINDFS n
+        CONFIG_HALT n
         CONFIG_INIT n
         CONFIG_INSMOD n
         CONFIG_IP n
@@ -98,10 +58,13 @@ let
         CONFIG_MODINFO n
         CONFIG_MODPROBE n
         CONFIG_MOUNT n
+        CONFIG_POWEROFF n
+        CONFIG_REBOOT n
         CONFIG_RMMOD n
+        CONFIG_SHUTDOWN n
       '';
     })
-  ] ++ (with pkgsGui; [ cosmic-files crosvm foot ]);
+  ];
 
   nixosAllHardware = nixos ({ modulesPath, ... }: {
     imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
@@ -111,14 +74,15 @@ let
 
   kernel = linux_latest;
 
-  appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; };
-  netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; };
+  appvm = callSpectrumPackage ../../img/app { inherit (no_pgo_foot) terminfo; };
+  netvm = callSpectrumPackage ../../vm/sys/net { inherit (no_pgo_foot) terminfo; };
 
   # Packages that should be fully linked into /usr,
   # (not just their bin/* files).
   usrPackages = [
-    appvm kernel.modules firmware netvm
-  ] ++ (with pkgsGui; [ mesa dejavu_fonts westonLite ]);
+    appvm kernel.modules firmware kmod kmod.lib
+    netvm mesa dejavu_fonts westonLite
+  ];
 
   appvms = {
     appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {};
@@ -136,16 +100,16 @@ let
     # Weston doesn't support SVG icons.
     inkscape -w 20 -h 20 \
         -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \
-        ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
+        ${cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
 
     ln -st $out/usr/bin \
         ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \
-        ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \
-        ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
+        ${xdg-desktop-portal}/libexec/xdg-document-portal \
+        ${xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
     ln -st $out/usr/share/dbus-1 \
         ${dbus}/share/dbus-1/session.conf
     ln -st $out/usr/share/dbus-1/services \
-        ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
+        ${xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
 
     for pkg in ${escapeShellArgs usrPackages}; do
         lndir -ignorelinks -silent "$pkg" "$out/usr"
@@ -159,6 +123,10 @@ let
     # programs we want.
     # https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
     ln -s ${util-linuxMinimal}/bin/{findfs,uuidgen,lsblk,mount} $out/usr/bin
+
+    # TODO: this is another hack and it should be possible
+    # to build systemd without this.
+    ln -s -- ${lib.escapeShellArg systemd}/bin/udevadm "$out/usr/bin"
   '';
 in
 
@@ -195,7 +163,7 @@ stdenvNoCC.mkDerivation {
   unsafeDiscardReferences = { out = true; };
 
   passthru = {
-    inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui;
+    inherit appvm firmware kernel nixosAllHardware packagesSysroot;
   };
 
   meta = with lib; {
@@ -203,4 +171,4 @@ stdenvNoCC.mkDerivation {
     platforms = platforms.linux;
   };
 }
-) {}) (_: {})
+) {}) {}) (_: {})
diff --git a/host/rootfs/image/etc/mdev.conf b/host/rootfs/image/etc/mdev.conf
deleted file mode 100644
index bddcfdc44ec2a8b1aa95e84cb88fdde625c766d8..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021-2022, 2024 Alyssa Ross <hi@alyssa.is>
-
-$PCI_CLASS=^2....$ 0:0 660 +/etc/mdev/net/add
--$MODALIAS=.* 0:0 660 +importas -Siu MODALIAS modprobe -q $MODALIAS
-kvm 0:0 660 +background { /etc/mdev/listen kvm }
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
diff --git a/host/rootfs/image/etc/mdev/listen b/host/rootfs/image/etc/mdev/listen
deleted file mode 100755
index ab50ee8c5ed1139d1129bac56afa7263af150745..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/listen
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-redirfd -w 1 /run/wait/${1}
-echo
diff --git a/host/rootfs/image/etc/mdev/wait b/host/rootfs/image/etc/mdev/wait
deleted file mode 100755
index 6bddb303d2671ce4e5b8581cd81235d7404916e7..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/wait
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-foreground {
-  redirfd -w 1 /dev/null
-  head -1 /run/wait/${1}
-}
-rm /run/wait/${1}
diff --git a/host/rootfs/image/etc/s6-rc/card0/type.license b/host/rootfs/image/etc/s6-rc/card0/type.license
deleted file mode 100644
index c49c11b66262c7edc57ac06a486c1166d867c31d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/card0/up b/host/rootfs/image/etc/s6-rc/card0/up
deleted file mode 100644
index 703562e5442aea45198350afe86a8f38c11ed072..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait card0
diff --git a/host/rootfs/image/etc/s6-rc/kvm/timeout-up b/host/rootfs/image/etc/s6-rc/kvm/timeout-up
deleted file mode 100644
index c5da56ae490a8ab35074fdcb6644a0dbbd280e3b..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/timeout-up
+++ /dev/null
@@ -1 +0,0 @@
-40000
diff --git a/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license b/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license
deleted file mode 100644
index d705e974a864074490588104a24a9ea789141572..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/kvm/type b/host/rootfs/image/etc/s6-rc/kvm/type
deleted file mode 100644
index bdd22a1850ae6c03a414eeb8084998679a2cdf92..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/type
+++ /dev/null
@@ -1 +0,0 @@
-oneshot
diff --git a/host/rootfs/image/etc/s6-rc/kvm/type.license b/host/rootfs/image/etc/s6-rc/kvm/type.license
deleted file mode 100644
index a941ca495a4211cf6659eda03b30f83c02985fe6..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
deleted file mode 100644
index c02e3f90245e005b98b4de8245a1863fb49c1158..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait kvm
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
deleted file mode 100644
index bdd22a1850ae6c03a414eeb8084998679a2cdf92..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
+++ /dev/null
@@ -1 +0,0 @@
-oneshot
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
deleted file mode 100644
index 8698f7d7988a017786fb91a584eafbfb23b3165d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-
-mdevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
deleted file mode 100644
index 2b3b032142b7286bd317cf0abaa44fba3a9b8941..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2020 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/run b/host/rootfs/image/etc/s6-rc/mdevd/run
deleted file mode 100644
index 55899bbe674426e4591e866a4d0617361ba34305..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/run
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/execlineb -P
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi@alyssa.is>
-
-mdevd -D3 -O4 -b134217728
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd b/host/rootfs/image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd
rename to host/rootfs/image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
diff --git a/host/rootfs/image/etc/s6-rc/card0/type b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/card0/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
new file mode 100644
index 0000000000000000000000000000000000000000..1732c98158046d0fb6ba6e8fb2201444fcf9128a
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: CC0-1.0
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+udevadm trigger
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm b/host/rootfs/image/etc/s6-rc/systemd-udevd/flag-essential
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/flag-essential
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/notification-fd
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
new file mode 100644
index 0000000000000000000000000000000000000000..c4a0586a407fe14c3e0855749a7524ac3871dda4
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
new file mode 100644
index 0000000000000000000000000000000000000000..8d0fd046e2d38aef9c0010fa40aa7b9a57c76373
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
@@ -0,0 +1,13 @@
+#!/bin/execlineb -P
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+s6-setlock -d 4 /run/sd-notify-wrapper/systemd-udevd.lock
+if { rm -f /run/sd-notify-wrapper/systemd-udevd.sock }
+background {
+   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
+   fdmove 1 3
+   sd-notify-adapter
+}
+fdclose 3
+export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
+systemd-udevd
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type b/host/rootfs/image/etc/s6-rc/systemd-udevd/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0 b/host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0
rename to host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/vm-env/type.license b/host/rootfs/image/etc/s6-rc/vm-env/type.license
deleted file mode 100644
index 5a4063310c3d22dbf59b30792e8e6f55a57ec9c0..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/vm-env/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2022 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug b/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug b/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
new file mode 100644
index 0000000000000000000000000000000000000000..f9047d5dabe493f21b5f27d6ef7d44b31f9d741b
--- /dev/null
+++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# systemd-udevd has a built-in module loading feature,
+# but it seems to not work for some reason or another.
+# This works.
+ACTION!="remove", ENV{MODALIAS}!="", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
+# systemd-udevd unsets PATH, so fix that.
+ACTION=="remove", GOTO="spectrum-end"
+ENV{PCI_CLASS}!="2????", GOTO="spectrum-end"
+
+# net-add unbinds and rebinds the driver, so avoid calling
+# it more than once.
+IMPORT{db}="SPECTRUM_DRIVER_ASSIGNED"
+ENV{SPECTRUM_DRIVER_ASSIGNED}=="yes", GOTO="spectrum-end"
+# systemd-udevd unsets PATH, so fix that.
+RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
+ENV{SPECTRUM_DRIVER_ASSIGNED}="yes"
+LABEL="spectrum-end"
diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
index bcb6cdaf6646da6bb4970fe97f5ef03badbd66a6..00d8b0ee75311855f0b2c0686b66616c747b68c0 100755
--- a/host/rootfs/image/usr/bin/run-vmm
+++ b/host/rootfs/image/usr/bin/run-vmm
@@ -53,4 +53,7 @@ unexport !
 fdmove -c 3 0
 redirfd -r 0 /dev/null
 
+# Do this last so that udev has as much
+# time to set up KVM as possible.
+if { udevadm wait /dev/kvm }
 cloud-hypervisor --api-socket fd=3
diff --git a/host/rootfs/image/usr/bin/systemd-udevd b/host/rootfs/image/usr/bin/systemd-udevd
new file mode 120000
index 0000000000000000000000000000000000000000..b7887eaf6dd3279116ba61d613bd467598089597
--- /dev/null
+++ b/host/rootfs/image/usr/bin/systemd-udevd
@@ -0,0 +1 @@
+udevadm
\ No newline at end of file
diff --git a/host/rootfs/image/etc/mdev/net/add b/host/rootfs/image/usr/libexec/net-add
similarity index 100%
rename from host/rootfs/image/etc/mdev/net/add
rename to host/rootfs/image/usr/libexec/net-add

-- 
2.51.0

Re: [PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 771 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
> new file mode 100644
> index 0000000000000000000000000000000000000000..1732c98158046d0fb6ba6e8fb2201444fcf9128a
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
> @@ -0,0 +1,3 @@
> +# SPDX-License-Identifier: CC0-1.0
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +udevadm trigger

This is the reason you need to add your own modprobe rule.  The default
rule only runs on ACTION=="add", but if you don't specify otherwise,
udevadm trigger triggers a change action.  Shouldn't we match the
behavior of systemd-udev-trigger.service?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1576 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This replaces the mdevd uevent daemon with systemd-udevd, which supports
> much more hardware and is therefore to be preferred for a full desktop
> environment.  Various Wayland compositors integrate with systemd-udevd,
> allowing them to discover devices as they appear rather than having to
> only use devices plugged in when the compositor is started.
> Additionally, systemd-udevd has quirks for various devices that are
> needed to support the wide variety of hardware end-users have.

Just want to note that this implementation currently doesn't, because it
doesn't install the hardware database.  (I noticed this while debugging
the modprobe thing.)

I was able to get it to work with the following diff.  I don't think it
needs to be in this commit, so I'll just add this separately once we
have the basic udev implementation in, but I'm posting it here now so we
don't end up duplicating work. :)

diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 8abe108..b8e72f2 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -84,6 +84,15 @@ let
   usrPackages = [
     appvm kernel.modules firmware kmod kmod.lib
     netvm mesa dejavu_fonts westonLite
+
+    (runCommand "hwdb.bin" {
+      nativeBuildInputs = [ systemd ];
+    } ''
+      mkdir -p $out/lib/systemd/hwdb etc/udev
+      cp -R ${systemd}/lib/udev/hwdb.d etc/udev
+      systemd-hwdb update -sr .
+      mv etc/udev/hwdb.bin $out/lib/systemd/hwdb
+    '')
   ];
 
   appvms = {

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 1793 bytes --]

On 10/1/25 10:39, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This replaces the mdevd uevent daemon with systemd-udevd, which supports
>> much more hardware and is therefore to be preferred for a full desktop
>> environment.  Various Wayland compositors integrate with systemd-udevd,
>> allowing them to discover devices as they appear rather than having to
>> only use devices plugged in when the compositor is started.
>> Additionally, systemd-udevd has quirks for various devices that are
>> needed to support the wide variety of hardware end-users have.
> 
> Just want to note that this implementation currently doesn't, because it
> doesn't install the hardware database.  (I noticed this while debugging
> the modprobe thing.)

Nice catch.  Thank you!

> I was able to get it to work with the following diff.  I don't think it
> needs to be in this commit, so I'll just add this separately once we
> have the basic udev implementation in, but I'm posting it here now so we
> don't end up duplicating work. :)
> 
> diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
> index 8abe108..b8e72f2 100644
> --- a/host/rootfs/default.nix
> +++ b/host/rootfs/default.nix
> @@ -84,6 +84,15 @@ let
>    usrPackages = [
>      appvm kernel.modules firmware kmod kmod.lib
>      netvm mesa dejavu_fonts westonLite
> +
> +    (runCommand "hwdb.bin" {
> +      nativeBuildInputs = [ systemd ];
> +    } ''
> +      mkdir -p $out/lib/systemd/hwdb etc/udev
> +      cp -R ${systemd}/lib/udev/hwdb.d etc/udev
> +      systemd-hwdb update -sr .
> +      mv etc/udev/hwdb.bin $out/lib/systemd/hwdb
> +    '')
>    ];
>  
>    appvms = {

Could this just be a symlink?
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 2022 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 10/1/25 10:39, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> This replaces the mdevd uevent daemon with systemd-udevd, which supports
>>> much more hardware and is therefore to be preferred for a full desktop
>>> environment.  Various Wayland compositors integrate with systemd-udevd,
>>> allowing them to discover devices as they appear rather than having to
>>> only use devices plugged in when the compositor is started.
>>> Additionally, systemd-udevd has quirks for various devices that are
>>> needed to support the wide variety of hardware end-users have.
>> 
>> Just want to note that this implementation currently doesn't, because it
>> doesn't install the hardware database.  (I noticed this while debugging
>> the modprobe thing.)
>
> Nice catch.  Thank you!
>
>> I was able to get it to work with the following diff.  I don't think it
>> needs to be in this commit, so I'll just add this separately once we
>> have the basic udev implementation in, but I'm posting it here now so we
>> don't end up duplicating work. :)
>> 
>> diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
>> index 8abe108..b8e72f2 100644
>> --- a/host/rootfs/default.nix
>> +++ b/host/rootfs/default.nix
>> @@ -84,6 +84,15 @@ let
>>    usrPackages = [
>>      appvm kernel.modules firmware kmod kmod.lib
>>      netvm mesa dejavu_fonts westonLite
>> +
>> +    (runCommand "hwdb.bin" {
>> +      nativeBuildInputs = [ systemd ];
>> +    } ''
>> +      mkdir -p $out/lib/systemd/hwdb etc/udev
>> +      cp -R ${systemd}/lib/udev/hwdb.d etc/udev
>> +      systemd-hwdb update -sr .
>> +      mv etc/udev/hwdb.bin $out/lib/systemd/hwdb
>> +    '')
>>    ];
>>  
>>    appvms = {
>
> Could this just be a symlink?

Oh, probably.  Although I wonder if we want to move away from explicit
symlinks, because that's what created the problem where it's hard for
you to add stuff to /usr/lib…

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v3 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 7221 bytes --]

Every time it's time to review this I feel intimidated, and then I end
up once again being pleasantly surprised by how nice and small it is.

Demi Marie Obenour <demiobenour@gmail.com> writes:

> The dependency on /dev/dri/card0 being present is eliminated, and
> whatever devices the user has are now picked up by the compositor.  New
> dependencies are added to ensure that udev coldplug has finished before
> any non-trivial services are started.  systemd-udev-trigger.service runs
> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
> an early boot service can assume 'udevadm trigger' has run.

Sorry if we already discussed this — I thought I remembered bringing it
up but can't find it now, so maybe I didn't — but I've found in the past
that Weston does need /dev/dri/card0 to exist before it's started, even
with udev, in the release/checks/wayland NixOS test — see commit ab5a00b
("release/checks/wayland: add missing dependency").  Before that, the
test intermittently failed, so to make sure we're not introducing a
similar intermittent fault here, I'd like to understand why that's
different, if it is.  Do NixOS tests start running before coldplug, for
example?  If so, that suggests it might be okay for us to run things
before coldplug too.

> ---
>  host/rootfs/Makefile                               |  36 +++----
>  host/rootfs/default.nix                            | 118 ++++++++-------------
>  host/rootfs/image/etc/mdev.conf                    |   7 --
>  host/rootfs/image/etc/mdev/listen                  |  11 --
>  host/rootfs/image/etc/mdev/wait                    |  14 ---
>  host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
>  host/rootfs/image/etc/s6-rc/card0/up               |   4 -
>  host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
>  host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
>  host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
>  host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
>  host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
>  .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
>  host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
>  .../contents.d/systemd-udevd-coldplug}             |   0
>  .../dependencies.d/systemd-udevd}                  |   0
>  .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
>  .../type.license                                   |   0
>  .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   3 +
>  .../kvm => systemd-udevd/flag-essential}           |   0

You said you were going to drop this?

https://spectrum-os.org/lists/archives/spectrum-devel/3bc30fa7-3f40-4373-bb7a-1c9119d8b939@gmail.com

>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
>  .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
>  host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  13 +++
>  .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
>  .../contents.d/systemd-udevd-coldplug}             |   0
>  host/rootfs/image/etc/s6-rc/vm-env/type.license    |   2 -

Mistake?

>  .../vmm-env/contents.d/systemd-udevd-coldplug      |   0
>  .../weston/dependencies.d/systemd-udevd-coldplug   |   0
>  .../image/etc/udev/rules.d/99-spectrum.rules       |  19 ++++
>  host/rootfs/image/usr/bin/run-vmm                  |   3 +
>  host/rootfs/image/usr/bin/systemd-udevd            |   1 +
>  .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
>  35 files changed, 100 insertions(+), 157 deletions(-)
>
> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> new file mode 100644
> index 0000000000000000000000000000000000000000..8d0fd046e2d38aef9c0010fa40aa7b9a57c76373
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> @@ -0,0 +1,13 @@
> +#!/bin/execlineb -P
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +s6-setlock -d 4 /run/sd-notify-wrapper/systemd-udevd.lock

Why do we need to specify a descriptor here?

> +if { rm -f /run/sd-notify-wrapper/systemd-udevd.sock }

"Note that path will be deleted if it already exists at program start time."

https://skarnet.org/software/s6/s6-ipcserver-socketbinder.html

> +background {
> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
> +   fdmove 1 3
> +   sd-notify-adapter
> +}
> +fdclose 3
> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
> +systemd-udevd

> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> new file mode 100644
> index 0000000000000000000000000000000000000000..f9047d5dabe493f21b5f27d6ef7d44b31f9d741b
> --- /dev/null
> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> @@ -0,0 +1,19 @@
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# systemd-udevd has a built-in module loading feature,
> +# but it seems to not work for some reason or another.
> +# This works.
> +ACTION!="remove", ENV{MODALIAS}!="", RUN+="/usr/bin/modprobe -q $env{MODALIAS}"
> +# systemd-udevd unsets PATH, so fix that.
> +ACTION=="remove", GOTO="spectrum-end"
> +ENV{PCI_CLASS}!="2????", GOTO="spectrum-end"
> +
> +# net-add unbinds and rebinds the driver, so avoid calling
> +# it more than once.
> +IMPORT{db}="SPECTRUM_DRIVER_ASSIGNED"
> +ENV{SPECTRUM_DRIVER_ASSIGNED}=="yes", GOTO="spectrum-end"
> +# systemd-udevd unsets PATH, so fix that.
> +RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
> +ENV{SPECTRUM_DRIVER_ASSIGNED}="yes"
> +LABEL="spectrum-end"

I'd rather this was protected against in net-add, in the way I outlined
before, because that would also protect against it being run from
elsewhere.

> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
> index bcb6cdaf6646da6bb4970fe97f5ef03badbd66a6..00d8b0ee75311855f0b2c0686b66616c747b68c0 100755
> --- a/host/rootfs/image/usr/bin/run-vmm
> +++ b/host/rootfs/image/usr/bin/run-vmm
> @@ -53,4 +53,7 @@ unexport !
>  fdmove -c 3 0
>  redirfd -r 0 /dev/null
>  
> +# Do this last so that udev has as much
> +# time to set up KVM as possible.
> +if { udevadm wait /dev/kvm }

Doesn't need the comment IMO.  Lots of this stuff is deliberately
ordered already.

>  cloud-hypervisor --api-socket fd=3
> diff --git a/host/rootfs/image/usr/bin/systemd-udevd b/host/rootfs/image/usr/bin/systemd-udevd
> new file mode 120000
> index 0000000000000000000000000000000000000000..b7887eaf6dd3279116ba61d613bd467598089597
> --- /dev/null
> +++ b/host/rootfs/image/usr/bin/systemd-udevd
> @@ -0,0 +1 @@
> +udevadm
> \ No newline at end of file

Do we want to just put it in usrPackages, so we get both
/usr/bin/udevadm and /usr/lib/systemd/systemd-udevd without having to do
anything else?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v3 0/2] Switch from mdevd to systemd-udevd in root filesystem

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> systemd-udevd provides support for significantly more hardware than
> mdevd does.  Therefore, switch to it.
>
> I was not able to get the networking tests to work, as I currently don't
> have hardware that can run KVM.  The other integration tests do pass.

I can confirm the networking test works.  Do remember the other checks,
like uncrustify and reuse.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

[PATCH v4 0/2] Switch from mdevd to systemd-udevd in root filesystem

[Demi Marie Obenour]

systemd-udevd provides support for significantly more hardware than
mdevd does.  Therefore, switch to it.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Changes in v4:
- Use 'udevadm trigger --action=add' at coldplug time.
- Ensure that the wrapper does not exit after the first message.
- Include the hardware database.
- sd-notify-adapter should not exit if it receives a message without
  READY=1.
- Link to v3: https://spectrum-os.org/lists/archives/spectrum-devel/20250928-udev-v3-0-bb0e9612c415@gmail.com

Changes in v3:
- Try to avoid net-add running twice.
- Use full systemd instead of systemdMinimal, as something else already
  pulls it into the image.
- Hopefully fix integration tests.
- Link to v2: https://spectrum-os.org/lists/archives/spectrum-devel/20250924-udev-v2-2-6089de521b3b@gmail.com

Changes in v2:
- Use more optional arguments instead of positional parameters in
  sd-notify-wrapper.
- Explain why explicit modprobe is needed.
- Link to v1: https://spectrum-os.org/lists/archives/spectrum-devel/20250913-udev-v1-0-eade4ab8f2b4@gmail.com

---
Demi Marie Obenour (2):
      tools: Add adapter tool for services using sd_notify
      host/rootfs: Switch to systemd-udevd

 LICENSES/LGPL-2.1-or-later.txt                     | 502 +++++++++++++++++++++
 host/rootfs/Makefile                               |   2 +-
 host/rootfs/default.nix                            | 118 ++---
 host/rootfs/file-list.mk                           |  33 +-
 host/rootfs/image/etc/mdev.conf                    |   7 -
 host/rootfs/image/etc/mdev/listen                  |  11 -
 host/rootfs/image/etc/mdev/wait                    |  14 -
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
 host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
 host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   6 +
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  15 +
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 host/rootfs/image/etc/s6-rc/weston/run             |   7 +-
 .../image/etc/udev/rules.d/99-spectrum.rules       |  15 +
 host/rootfs/image/usr/bin/run-vmm                  |   1 +
 host/rootfs/image/usr/bin/systemd-udevd            |   1 +
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 tools/default.nix                                  |   1 +
 tools/meson.build                                  |   1 +
 tools/sd-notify-adapter/meson.build                |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c        | 114 +++++
 40 files changed, 724 insertions(+), 158 deletions(-)
---
base-commit: c5d5786d3dc938af0b279c542d1e43bce381b4b9
change-id: 20250911-udev-24cf4bf68fbe
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

This adapts programs using sd_notify for use with s6 readiness
notification.  stdin and stdout are hard-coded for simplicity.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
systemd readiness notification has two
strict advantages over the s6 version:

1. It allows reliable reloading.
2. It allows providing a status message that the service manager
   can show in status output.

s6 would actually benefit from both of these features.
---
Changes since v1:

- Hard-code file descriptors.
- Run wrapper as background process.
- Massively reduce code size.
- Use // instead of /* */ for comments.
- Check that the notification FD is a pipe and that the listening socket
  is a socket.
- Rely on s6-ipc-socketbinder to create the listening socket.
- Do not unlink the listening socket.
---
 tools/default.nix                           |   1 +
 tools/meson.build                           |   1 +
 tools/sd-notify-adapter/meson.build         |   4 +
 tools/sd-notify-adapter/sd-notify-adapter.c | 114 ++++++++++++++++++++++++++++
 4 files changed, 120 insertions(+)

diff --git a/tools/default.nix b/tools/default.nix
index 2c6846c80073e7b64fb7a19488103f6cf97a4420..4971e8bf6d84163b665ba0fb2af570cafa3171f5 100644
--- a/tools/default.nix
+++ b/tools/default.nix
@@ -77,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
       ./lsvm
       ./start-vmm
       ./subprojects
+      ./sd-notify-adapter
     ] ++ lib.optionals driverSupport [
       ./xdp-forwarder
     ]));
diff --git a/tools/meson.build b/tools/meson.build
index 186008dbc9dd2b63adbce7475c375fb0de5c2c6a..5d0ae81042fd3d77646594500f32cb1d48a6af0c 100644
--- a/tools/meson.build
+++ b/tools/meson.build
@@ -27,6 +27,7 @@ if get_option('host')
 
   subdir('lsvm')
   subdir('start-vmm')
+  subdir('sd-notify-adapter')
 endif
 
 if get_option('app')
diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
new file mode 100644
index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
--- /dev/null
+++ b/tools/sd-notify-adapter/meson.build
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: ISC
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
new file mode 100644
index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
--- /dev/null
+++ b/tools/sd-notify-adapter/sd-notify-adapter.c
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: MIT
+// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+#define _GNU_SOURCE 1
+#include <assert.h>
+#include <errno.h>
+#include <limits.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <err.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
+
+enum {
+	socket_fd,
+	notification_fd,
+};
+
+#define READY "READY=1"
+#define READY_SIZE (sizeof(READY) - 1)
+
+static void process_notification(struct iovec *const msg)
+{
+	ssize_t first_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
+	                               MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
+	if (first_recv_size == -1) {
+		if (errno == EINTR)
+			return; // signal caught
+		if (errno == EAGAIN || errno == EWOULDBLOCK)
+			return; // spurious wakeup
+		err(EXIT_FAILURE, "recv from notification socket");
+	}
+	assert(first_recv_size >= 0);
+	size_t size = (size_t)first_recv_size;
+	if (size == 0)
+		return; // avoid arithmetic on NULL pointer
+	if (size > msg->iov_len) {
+		msg->iov_base = realloc(msg->iov_base, size);
+		if (msg->iov_base == NULL)
+			err(EXIT_FAILURE, "allocation failure");
+		msg->iov_len = size;
+	}
+	ssize_t second_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
+	                                MSG_CMSG_CLOEXEC | MSG_TRUNC);
+	if (second_recv_size == -1) {
+		if (errno == EINTR)
+			return;
+		err(EXIT_FAILURE, "recv from notification socket");
+	}
+	assert(first_recv_size == second_recv_size);
+	for (char *next, *cursor = msg->iov_base, *end = cursor + size;
+	     cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
+		next = memchr(cursor, '\n', (size_t)(end - cursor));
+		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
+		if (message_size == READY_SIZE &&
+		    memcmp(cursor, READY, READY_SIZE) == 0) {
+			ssize_t write_size = write(notification_fd, "\n", 1);
+			if (write_size != 1)
+				err(EXIT_FAILURE, "writing to notification descriptor");
+			exit(0);
+		}
+	}
+}
+
+int main(int argc, char **)
+{
+	if (argc != 1)
+		errx(EXIT_FAILURE, "stdin is listening socket, stdout is notification pipe");
+	// Main event loop.
+	struct iovec v = {
+		.iov_base = NULL,
+		.iov_len = 0,
+	};
+	for (;;) {
+		struct pollfd p[] = {
+			{
+				.fd = socket_fd,
+				.events = POLLIN,
+				.revents = 0,
+			},
+			{
+				.fd = notification_fd,
+				.events = 0,
+				.revents = 0,
+			},
+		};
+		int r = poll(p, ARRAY_SIZE(p), -1);
+		if (r < 0) {
+			if (errno == EINTR)
+				continue;
+			err(EXIT_FAILURE, "poll");
+		}
+		if (p[0].revents) {
+			if (p[0].revents & POLLERR)
+				errx(EXIT_FAILURE, "unexpected POLLERR");
+			if (p[0].revents & POLLIN)
+				process_notification(&v);
+		}
+		if (p[1].revents)
+			errx(EXIT_FAILURE, "s6 closed its pipe before the child was ready");
+	}
+}

-- 
2.51.0

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 5661 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This adapts programs using sd_notify for use with s6 readiness
> notification.  stdin and stdout are hard-coded for simplicity.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> systemd readiness notification has two
> strict advantages over the s6 version:
>
> 1. It allows reliable reloading.
> 2. It allows providing a status message that the service manager
>    can show in status output.
>
> s6 would actually benefit from both of these features.
> ---
> Changes since v1:
>
> - Hard-code file descriptors.
> - Run wrapper as background process.
> - Massively reduce code size.
> - Use // instead of /* */ for comments.
> - Check that the notification FD is a pipe and that the listening socket
>   is a socket.
> - Rely on s6-ipc-socketbinder to create the listening socket.
> - Do not unlink the listening socket.
> ---
>  tools/default.nix                           |   1 +
>  tools/meson.build                           |   1 +
>  tools/sd-notify-adapter/meson.build         |   4 +
>  tools/sd-notify-adapter/sd-notify-adapter.c | 114 ++++++++++++++++++++++++++++
>  4 files changed, 120 insertions(+)

Looks correct, so just some convention/readability things.  If you're
happy with all my comments I can just change them all myself if you
prefer not to send a new version of the patch — up to you.

> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
> new file mode 100644
> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
> --- /dev/null
> +++ b/tools/sd-notify-adapter/meson.build
> @@ -0,0 +1,4 @@
> +# SPDX-License-Identifier: ISC
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
> --- /dev/null
> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
> @@ -0,0 +1,114 @@
> +// SPDX-License-Identifier: MIT
> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +#define _GNU_SOURCE 1

Like I said last time, this should be set by the build system.

> +#include <assert.h>
> +#include <errno.h>
> +#include <limits.h>
> +#include <signal.h>
> +#include <stdarg.h>
> +#include <stddef.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +
> +#include <err.h>
> +#include <fcntl.h>
> +#include <poll.h>
> +#include <sys/socket.h>
> +#include <sys/stat.h>
> +#include <sys/un.h>
> +#include <unistd.h>
> +
> +#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
> +
> +enum {
> +	socket_fd,
> +	notification_fd,
> +};
> +
> +#define READY "READY=1"
> +#define READY_SIZE (sizeof(READY) - 1)
> +
> +static void process_notification(struct iovec *const msg)
> +{
> +	ssize_t first_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
> +	                               MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);

I guess it just doesn't matter either way, but my question about why
MSG_DONTWAIT from last time wasn't answered either.

> +	if (first_recv_size == -1) {
> +		if (errno == EINTR)
> +			return; // signal caught
> +		if (errno == EAGAIN || errno == EWOULDBLOCK)
> +			return; // spurious wakeup

The check for these from the second recv was removed.  Should this check
also be removed?  Is returning EAGAIN or EWOULDBLOCK here a valid thing
for the kernel to do?

> +		err(EXIT_FAILURE, "recv from notification socket");
> +	}
> +	assert(first_recv_size >= 0);

Worth even checking?  Would be a serious contract violation that would
break all sorts of things.

> +	size_t size = (size_t)first_recv_size;
> +	if (size == 0)
> +		return; // avoid arithmetic on NULL pointer
> +	if (size > msg->iov_len) {
> +		msg->iov_base = realloc(msg->iov_base, size);
> +		if (msg->iov_base == NULL)
> +			err(EXIT_FAILURE, "allocation failure");
> +		msg->iov_len = size;
> +	}
> +	ssize_t second_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
> +	                                MSG_CMSG_CLOEXEC | MSG_TRUNC);
> +	if (second_recv_size == -1) {
> +		if (errno == EINTR)
> +			return;
> +		err(EXIT_FAILURE, "recv from notification socket");
> +	}
> +	assert(first_recv_size == second_recv_size);
> +	for (char *next, *cursor = msg->iov_base, *end = cursor + size;
> +	     cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
> +		next = memchr(cursor, '\n', (size_t)(end - cursor));
> +		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
> +		if (message_size == READY_SIZE &&
> +		    memcmp(cursor, READY, READY_SIZE) == 0) {
> +			ssize_t write_size = write(notification_fd, "\n", 1);
> +			if (write_size != 1)
> +				err(EXIT_FAILURE, "writing to notification descriptor");
> +			exit(0);
> +		}
> +	}
> +}
> +
> +int main(int argc, char **)
> +{
> +	if (argc != 1)
> +		errx(EXIT_FAILURE, "stdin is listening socket, stdout is notification pipe");
> +	// Main event loop.
> +	struct iovec v = {
> +		.iov_base = NULL,
> +		.iov_len = 0,
> +	};

It might be clearer for this to be a static, rather than a variable in
main that's only ever used by a function it calls.  It took me a while
to figure out that it's being reused between calls (for realloc).  And
then you don't need the initializer either. :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 7201 bytes --]

On 10/28/25 11:38, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This adapts programs using sd_notify for use with s6 readiness
>> notification.  stdin and stdout are hard-coded for simplicity.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>> systemd readiness notification has two
>> strict advantages over the s6 version:
>>
>> 1. It allows reliable reloading.
>> 2. It allows providing a status message that the service manager
>>    can show in status output.
>>
>> s6 would actually benefit from both of these features.
>> ---
>> Changes since v1:
>>
>> - Hard-code file descriptors.
>> - Run wrapper as background process.
>> - Massively reduce code size.
>> - Use // instead of /* */ for comments.
>> - Check that the notification FD is a pipe and that the listening socket
>>   is a socket.
>> - Rely on s6-ipc-socketbinder to create the listening socket.
>> - Do not unlink the listening socket.
>> ---
>>  tools/default.nix                           |   1 +
>>  tools/meson.build                           |   1 +
>>  tools/sd-notify-adapter/meson.build         |   4 +
>>  tools/sd-notify-adapter/sd-notify-adapter.c | 114 ++++++++++++++++++++++++++++
>>  4 files changed, 120 insertions(+)
> 
> Looks correct, so just some convention/readability things.  If you're
> happy with all my comments I can just change them all myself if you
> prefer not to send a new version of the patch — up to you.

See below.  I think the EAGAIN/EWOULDBLOCK checks and the MSG_DONTWAIT
are good practices in general.  You are correct that in this particular
case they aren't needed, at least unless poll() can produce spurious
wakeups.  That said, if you prefer to change them feel free to do so.

Making the changes on commit would be great.  Saving a round of review
is always a good thing.

>> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/meson.build
>> @@ -0,0 +1,4 @@
>> +# SPDX-License-Identifier: ISC
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
>> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
>> @@ -0,0 +1,114 @@
>> +// SPDX-License-Identifier: MIT
>> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +#define _GNU_SOURCE 1
> 
> Like I said last time, this should be set by the build system.

Good point.

>> +#include <assert.h>
>> +#include <errno.h>
>> +#include <limits.h>
>> +#include <signal.h>
>> +#include <stdarg.h>
>> +#include <stddef.h>
>> +#include <stdint.h>
>> +#include <stdio.h>
>> +#include <stdlib.h>
>> +#include <string.h>
>> +
>> +#include <err.h>
>> +#include <fcntl.h>
>> +#include <poll.h>
>> +#include <sys/socket.h>
>> +#include <sys/stat.h>
>> +#include <sys/un.h>
>> +#include <unistd.h>
>> +
>> +#define ARRAY_SIZE(s) (sizeof(s)/sizeof(s[0]))
>> +
>> +enum {
>> +	socket_fd,
>> +	notification_fd,
>> +};
>> +
>> +#define READY "READY=1"
>> +#define READY_SIZE (sizeof(READY) - 1)
>> +
>> +static void process_notification(struct iovec *const msg)
>> +{
>> +	ssize_t first_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
>> +	                               MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK);
> 
> I guess it just doesn't matter either way, but my question about why
> MSG_DONTWAIT from last time wasn't answered either.

It's good practice to use MSG_DONTWAIT whenever it makes sense
to do so.  That avoids relying on sockets being in blocking or
non-blocking mode.  Setting the blocking mode changes the open file
description, which means it can affect other processes too.

So no-op in this case, but good idea in general.

>> +	if (first_recv_size == -1) {
>> +		if (errno == EINTR)
>> +			return; // signal caught
>> +		if (errno == EAGAIN || errno == EWOULDBLOCK)
>> +			return; // spurious wakeup
> 
> The check for these from the second recv was removed.  Should this check
> also be removed?  Is returning EAGAIN or EWOULDBLOCK here a valid thing
> for the kernel to do?

In this particular case it probably isn't needed.  However, many
other cases *do* need the check:

1. Edge-triggered event sources.
2. Processing messages until no more are available.
3. Event sources that can produce spurious wakeups.

>> +		err(EXIT_FAILURE, "recv from notification socket");
>> +	}
>> +	assert(first_recv_size >= 0);
> 
> Worth even checking?  Would be a serious contract violation that would
> break all sorts of things.

Yeah, and this comes from the kernel, not from userspace.  So it
can't even happen as a result of a bug in this code.

>> +	size_t size = (size_t)first_recv_size;
>> +	if (size == 0)
>> +		return; // avoid arithmetic on NULL pointer
>> +	if (size > msg->iov_len) {
>> +		msg->iov_base = realloc(msg->iov_base, size);
>> +		if (msg->iov_base == NULL)
>> +			err(EXIT_FAILURE, "allocation failure");
>> +		msg->iov_len = size;
>> +	}
>> +	ssize_t second_recv_size = recv(socket_fd, msg->iov_base, msg->iov_len,
>> +	                                MSG_CMSG_CLOEXEC | MSG_TRUNC);
>> +	if (second_recv_size == -1) {
>> +		if (errno == EINTR)
>> +			return;
>> +		err(EXIT_FAILURE, "recv from notification socket");
>> +	}
>> +	assert(first_recv_size == second_recv_size);
>> +	for (char *next, *cursor = msg->iov_base, *end = cursor + size;
>> +	     cursor != NULL; cursor = (next == NULL ? NULL : next + 1)) {
>> +		next = memchr(cursor, '\n', (size_t)(end - cursor));
>> +		size_t message_size = (size_t)((next == NULL ? end : next) - cursor);
>> +		if (message_size == READY_SIZE &&
>> +		    memcmp(cursor, READY, READY_SIZE) == 0) {
>> +			ssize_t write_size = write(notification_fd, "\n", 1);
>> +			if (write_size != 1)
>> +				err(EXIT_FAILURE, "writing to notification descriptor");
>> +			exit(0);
>> +		}
>> +	}
>> +}
>> +
>> +int main(int argc, char **)
>> +{
>> +	if (argc != 1)
>> +		errx(EXIT_FAILURE, "stdin is listening socket, stdout is notification pipe");
>> +	// Main event loop.
>> +	struct iovec v = {
>> +		.iov_base = NULL,
>> +		.iov_len = 0,
>> +	};
> 
> It might be clearer for this to be a static, rather than a variable in
> main that's only ever used by a function it calls.  It took me a while
> to figure out that it's being reused between calls (for realloc).  And
> then you don't need the initializer either. :)

That is a good idea.  I normally dislike global variables, but
the disadvantages are much less severe here.  This program is
single-threaded, and this code will never be used in a library.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1089 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
> new file mode 100644
> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
> --- /dev/null
> +++ b/tools/sd-notify-adapter/meson.build
> @@ -0,0 +1,4 @@
> +# SPDX-License-Identifier: ISC
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
> --- /dev/null
> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
> @@ -0,0 +1,114 @@
> +// SPDX-License-Identifier: MIT
> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +

One more thing: why is the meson.build file ISC?  Why is the
implementation MIT?  Should I change these to the normal EUPL-1.2+ when
applying?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 1376 bytes --]

On 10/29/25 07:26, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/meson.build
>> @@ -0,0 +1,4 @@
>> +# SPDX-License-Identifier: ISC
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
>> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
>> --- /dev/null
>> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
>> @@ -0,0 +1,114 @@
>> +// SPDX-License-Identifier: MIT
>> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
> 
> One more thing: why is the meson.build file ISC?  Why is the
> implementation MIT?  Should I change these to the normal EUPL-1.2+ when
> applying?
I'd actually prefer ISC for the implementation, so that this can be
used in s6 if upstream ever decides to accept it.  MIT is just an oops.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1853 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 10/29/25 07:26, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
>>> new file mode 100644
>>> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
>>> --- /dev/null
>>> +++ b/tools/sd-notify-adapter/meson.build
>>> @@ -0,0 +1,4 @@
>>> +# SPDX-License-Identifier: ISC
>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +
>>> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
>>> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
>>> new file mode 100644
>>> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
>>> --- /dev/null
>>> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
>>> @@ -0,0 +1,114 @@
>>> +// SPDX-License-Identifier: MIT
>>> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>> +
>> 
>> One more thing: why is the meson.build file ISC?  Why is the
>> implementation MIT?  Should I change these to the normal EUPL-1.2+ when
>> applying?
> I'd actually prefer ISC for the implementation, so that this can be
> used in s6 if upstream ever decides to accept it.  MIT is just an oops.

I think there's no way s6 is going to adopt an external implementation
like this that doesn't use skalibs, rather than just rewriting it, but
okay, we can stick with ISC if you want.

There's definitely no way it's going to take the one line Meson
file, but it's unlikely to be copyrightable anyway, and I think we might
as well just inline it into tools/meson.build like lseek, so I'll just
do that when I apply unless you object.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v4 1/2] tools: Add adapter tool for services using sd_notify

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 2044 bytes --]

On 10/31/25 04:54, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 10/29/25 07:26, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> diff --git a/tools/sd-notify-adapter/meson.build b/tools/sd-notify-adapter/meson.build
>>>> new file mode 100644
>>>> index 0000000000000000000000000000000000000000..6032a3a7704d49cae0655b43d0189444d3b15e4d
>>>> --- /dev/null
>>>> +++ b/tools/sd-notify-adapter/meson.build
>>>> @@ -0,0 +1,4 @@
>>>> +# SPDX-License-Identifier: ISC
>>>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>>> +
>>>> +executable('sd-notify-adapter', 'sd-notify-adapter.c', install: true)
>>>> diff --git a/tools/sd-notify-adapter/sd-notify-adapter.c b/tools/sd-notify-adapter/sd-notify-adapter.c
>>>> new file mode 100644
>>>> index 0000000000000000000000000000000000000000..10f4e05eb602491540a792c7fb5620d66d5bb989
>>>> --- /dev/null
>>>> +++ b/tools/sd-notify-adapter/sd-notify-adapter.c
>>>> @@ -0,0 +1,114 @@
>>>> +// SPDX-License-Identifier: MIT
>>>> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>>>> +
>>>
>>> One more thing: why is the meson.build file ISC?  Why is the
>>> implementation MIT?  Should I change these to the normal EUPL-1.2+ when
>>> applying?
>> I'd actually prefer ISC for the implementation, so that this can be
>> used in s6 if upstream ever decides to accept it.  MIT is just an oops.
> 
> I think there's no way s6 is going to adopt an external implementation
> like this that doesn't use skalibs, rather than just rewriting it, but
> okay, we can stick with ISC if you want.

It could still be useful as a basis.

> There's definitely no way it's going to take the one line Meson
> file, but it's unlikely to be copyrightable anyway, and I think we might
> as well just inline it into tools/meson.build like lseek, so I'll just
> do that when I apply unless you object.

That's fine.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH v4 2/2] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

This replaces the mdevd uevent daemon with systemd-udevd, which supports
much more hardware and is therefore to be preferred for a full desktop
environment.  Various Wayland compositors integrate with systemd-udevd,
allowing them to discover devices as they appear rather than having to
only use devices plugged in when the compositor is started.
Additionally, systemd-udevd has quirks for various devices that are
needed to support the wide variety of hardware end-users have.

The dependency on /dev/dri/card0 being present is eliminated, and
whatever devices the user has are now picked up by the compositor.  New
dependencies are added to ensure that udev coldplug has finished before
any non-trivial services are started.  systemd-udev-trigger.service runs
'udevadm trigger' and has Before=sysinit.target, so anything that is not
an early boot service can assume 'udevadm trigger' has run.

systemd-udevd unsets PATH before it runs programs.  Therefore, manually
set it to /usr/bin before invoking any scripts.

systemd-udevd provides the 'udevadm wait' command to wait for a device
to appear and be processed.  This replaces all uses of /etc/mdev/wait,
so this script is removed.  /etc/mdev/listen and /run/wait only existed
to wake up /etc/mdev/wait, so they are also removed.

The command-line options to 'udevadm trigger' are taken from
systemd-udev-trigger.service on my Arch machine.  Using the wrong
arguments leads to problems that take a very long time to debug.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 LICENSES/LGPL-2.1-or-later.txt                     | 502 +++++++++++++++++++++
 host/rootfs/Makefile                               |   2 +-
 host/rootfs/default.nix                            | 118 ++---
 host/rootfs/file-list.mk                           |  33 +-
 host/rootfs/image/etc/mdev.conf                    |   7 -
 host/rootfs/image/etc/mdev/listen                  |  11 -
 host/rootfs/image/etc/mdev/wait                    |  14 -
 host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
 host/rootfs/image/etc/s6-rc/card0/up               |   4 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
 host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
 host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
 host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
 host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
 host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
 .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
 host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../dependencies.d/systemd-udevd}                  |   0
 .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
 .../type.license                                   |   0
 .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   6 +
 .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
 .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
 host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  15 +
 .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
 .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../contents.d/systemd-udevd-coldplug}             |   0
 .../weston/dependencies.d/systemd-udevd-coldplug   |   0
 host/rootfs/image/etc/s6-rc/weston/run             |   7 +-
 .../image/etc/udev/rules.d/99-spectrum.rules       |  15 +
 host/rootfs/image/usr/bin/run-vmm                  |   1 +
 host/rootfs/image/usr/bin/systemd-udevd            |   1 +
 .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
 36 files changed, 604 insertions(+), 158 deletions(-)

diff --git a/LICENSES/LGPL-2.1-or-later.txt b/LICENSES/LGPL-2.1-or-later.txt
new file mode 100644
index 0000000000000000000000000000000000000000..e5ab03e1238af66de157fae2e6270d7e8f967f93
--- /dev/null
+++ b/LICENSES/LGPL-2.1-or-later.txt
@@ -0,0 +1,502 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index aa45ca1d5c18d0dfb78d19267f263cc4222e8e84..00d125774bb7b98736d0928c69cb307740cee034 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -12,6 +12,7 @@ DIRS = \
 	dev \
 	etc/s6-linux-init/env \
 	etc/s6-linux-init/run-image/configs \
+	etc/s6-linux-init/run-image/sd-notify-wrapper \
 	etc/s6-linux-init/run-image/service/dbus/instance \
 	etc/s6-linux-init/run-image/service/dbus/instances \
 	etc/s6-linux-init/run-image/service/dbus/template/data \
@@ -36,7 +37,6 @@ DIRS = \
 	etc/s6-linux-init/run-image/user \
 	etc/s6-linux-init/run-image/vm/by-id \
 	etc/s6-linux-init/run-image/vm/by-name \
-	etc/s6-linux-init/run-image/wait \
 	ext \
 	proc \
 	run \
diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 484a43f372f934e6b3be0c383d12c9eabf2f7171..8abe108477cbf18c0ac0134b8b2c24f92430c840 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -8,88 +8,48 @@ import ../../lib/call-package.nix (
 }:
 pkgsStatic.callPackage (
 
-{ spectrum-host-tools
-, lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc
-, busybox, cloud-hypervisor, cryptsetup, dbus, execline, inkscape
-, iproute2, inotify-tools, jq, kmod, mdevd, s6, s6-linux-init, socat
-, util-linuxMinimal, virtiofsd, xorg, xdg-desktop-portal-spectrum-host
+{ busybox, cloud-hypervisor, cryptsetup, dbus, erofs-utils, execline
+, inkscape, inotify-tools, iproute2, jq, lib, mdevd, nixos
+, runCommand, s6, s6-linux-init, s6-rc, socat, spectrum-host-tools
+, stdenvNoCC, util-linuxMinimal, virtiofsd, writeClosure
+, xdg-desktop-portal-spectrum-host, xorg
 }:
-
 let
-  inherit (nixosAllHardware.config.hardware) firmware;
   inherit (lib)
-    concatMapStringsSep concatStrings escapeShellArgs fileset optionalAttrs
+    concatMapStringsSep concatStrings escapeShellArgs fileset
     mapAttrsToList systems trivial;
-
   pkgsGui = pkgsMusl.extend (
-    final: super:
-    (optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
-      flatpak = super.flatpak.override {
-        withMalcontent = false;
-      };
-
-      libgudev = super.libgudev.overrideAttrs ({ ... }: {
-        # Tests use umockdev, which is not compatible with libudev-zero.
-        doCheck = false;
-      });
-
-      qt6 = super.qt6.overrideScope (_: prev: {
-        qttranslations = prev.qttranslations.override {
-          qttools = prev.qttools.override {
-            qtbase = prev.qtbase.override {
-              qttranslations = null;
-              systemdSupport = false;
-            };
-            qtdeclarative = null;
-          };
-        };
-
-        qtbase = prev.qtbase.override {
-          systemdSupport = false;
-        };
-      });
-
-      systemd = super.systemd.overrideAttrs ({ meta ? { }, ... }: {
+    _final: super:
+    (lib.optionalAttrs (systems.equals pkgsMusl.stdenv.hostPlatform super.stdenv.hostPlatform) {
+      malcontent = super.malcontent.overrideAttrs ({ meta ? { }, ... }: {
         meta = meta // {
           platforms = [ ];
         };
       });
+   }));
+in
+# Something already pulls in the full
+# systemd, so might as well use it.
+pkgsGui.callPackage (
+{ cosmic-files, crosvm, dejavu_fonts, foot, kmod, mesa
+, systemd, westonLite, xdg-desktop-portal, xdg-desktop-portal-gtk
+}:
 
-      upower = super.upower.override {
-        # Not ideal, but it's the best way to get rid of an installed
-        # test that needs umockdev.
-        withIntrospection = false;
-      };
-
-      udev = final.libudev-zero;
-
-      weston = super.weston.overrideAttrs ({ mesonFlags ? [], ... }: {
-        mesonFlags = mesonFlags ++ [
-          "-Dsystemd=false"
-        ];
-      });
-
-      xdg-desktop-portal = (super.xdg-desktop-portal.override {
-        enableSystemd = false;
-      }).overrideAttrs ({ ... }: {
-        # Tests use umockdev.
-        doCheck = false;
-      });
-    })
-  );
-
-  foot = pkgsGui.foot.override { allowPgo = false; };
+let
+  inherit (nixosAllHardware.config.hardware) firmware;
+  no_pgo_foot = foot.override { allowPgo = false; };
 
   packages = [
-    cloud-hypervisor cryptsetup dbus execline inotify-tools iproute2
-    jq kmod mdevd s6 s6-linux-init s6-rc socat spectrum-host-tools
-    virtiofsd xdg-desktop-portal-spectrum-host
+    cloud-hypervisor crosvm cryptsetup dbus execline inotify-tools
+    iproute2 jq mdevd s6 s6-linux-init s6-rc socat
+    spectrum-host-tools virtiofsd xdg-desktop-portal-spectrum-host
 
     (busybox.override {
       extraConfig = ''
         CONFIG_CHATTR n
         CONFIG_DEPMOD n
         CONFIG_FINDFS n
+        CONFIG_HALT n
         CONFIG_INIT n
         CONFIG_INSMOD n
         CONFIG_IP n
@@ -100,10 +60,13 @@ let
         CONFIG_MODINFO n
         CONFIG_MODPROBE n
         CONFIG_MOUNT n
+        CONFIG_POWEROFF n
+        CONFIG_REBOOT n
         CONFIG_RMMOD n
+        CONFIG_SHUTDOWN n
       '';
     })
-  ] ++ (with pkgsGui; [ cosmic-files crosvm foot ]);
+  ];
 
   nixosAllHardware = nixos ({ modulesPath, ... }: {
     imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
@@ -113,14 +76,15 @@ let
 
   kernel = linux_latest;
 
-  appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; };
-  netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; };
+  appvm = callSpectrumPackage ../../img/app { inherit (no_pgo_foot) terminfo; };
+  netvm = callSpectrumPackage ../../vm/sys/net { inherit (no_pgo_foot) terminfo; };
 
   # Packages that should be fully linked into /usr,
   # (not just their bin/* files).
   usrPackages = [
-    appvm kernel.modules firmware netvm
-  ] ++ (with pkgsGui; [ mesa dejavu_fonts westonLite ]);
+    appvm kernel.modules firmware kmod kmod.lib
+    netvm mesa dejavu_fonts westonLite
+  ];
 
   appvms = {
     appvm-firefox = callSpectrumPackage ../../vm/app/firefox.nix {};
@@ -138,16 +102,16 @@ let
     # Weston doesn't support SVG icons.
     inkscape -w 20 -h 20 \
         -o $out/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png \
-        ${pkgsGui.cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
+        ${cosmic-files}/share/icons/hicolor/24x24/apps/com.system76.CosmicFiles.svg
 
     ln -st $out/usr/bin \
         ${concatMapStringsSep " " (p: "${p}/bin/*") packages} \
-        ${pkgsGui.xdg-desktop-portal}/libexec/xdg-document-portal \
-        ${pkgsGui.xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
+        ${xdg-desktop-portal}/libexec/xdg-document-portal \
+        ${xdg-desktop-portal-gtk}/libexec/xdg-desktop-portal-gtk
     ln -st $out/usr/share/dbus-1 \
         ${dbus}/share/dbus-1/session.conf
     ln -st $out/usr/share/dbus-1/services \
-        ${pkgsGui.xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
+        ${xdg-desktop-portal-gtk}/share/dbus-1/services/org.freedesktop.impl.portal.desktop.gtk.service
 
     for pkg in ${escapeShellArgs usrPackages}; do
         lndir -ignorelinks -silent "$pkg" "$out/usr"
@@ -161,6 +125,10 @@ let
     # programs we want.
     # https://lore.kernel.org/util-linux/87zgrl6ufb.fsf@alyssa.is/
     ln -s ${util-linuxMinimal}/bin/{findfs,uuidgen,lsblk,mount} $out/usr/bin
+
+    # TODO: this is another hack and it should be possible
+    # to build systemd without this.
+    ln -s -- ${lib.escapeShellArg systemd}/bin/udevadm "$out/usr/bin"
   '';
 in
 
@@ -197,7 +165,7 @@ stdenvNoCC.mkDerivation {
   unsafeDiscardReferences = { out = true; };
 
   passthru = {
-    inherit appvm firmware kernel nixosAllHardware packagesSysroot pkgsGui;
+    inherit appvm firmware kernel nixosAllHardware packagesSysroot;
   };
 
   meta = with lib; {
@@ -205,4 +173,4 @@ stdenvNoCC.mkDerivation {
     platforms = platforms.linux;
   };
 }
-) {}) (_: {})
+) {}) {}) (_: {})
diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk
index 3694dc472a013fff931847171145465329fb800f..9acaa1d90bed674814775becf89c1c847d0ce3e3 100644
--- a/host/rootfs/file-list.mk
+++ b/host/rootfs/file-list.mk
@@ -7,10 +7,6 @@ FILES = \
 	image/etc/group \
 	image/etc/init \
 	image/etc/login \
-	image/etc/mdev.conf \
-	image/etc/mdev/listen \
-	image/etc/mdev/net/add \
-	image/etc/mdev/wait \
 	image/etc/parse-devname \
 	image/etc/passwd \
 	image/etc/s6-linux-init/env/WAYLAND_DISPLAY \
@@ -46,6 +42,7 @@ FILES = \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/notification-fd \
 	image/etc/s6-linux-init/run-image/service/xdg-desktop-portal-spectrum-host/template/run \
 	image/etc/s6-linux-init/scripts/rc.init \
+	image/etc/udev/rules.d/99-spectrum.rules \
 	image/etc/xdg/weston/autolaunch \
 	image/etc/xdg/weston/weston.ini \
 	image/usr/bin/assign-devices \
@@ -57,6 +54,7 @@ FILES = \
 	image/usr/bin/vm-start \
 	image/usr/bin/vm-stop \
 	image/usr/bin/xdg-open \
+	image/usr/libexec/net-add \
 	image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service
 
 LINKS = \
@@ -64,24 +62,14 @@ LINKS = \
 	image/etc/s6-linux-init/run-image/opengl-driver \
 	image/etc/s6-linux-init/run-image/service/vmm/template/run \
 	image/lib \
-	image/sbin
+	image/sbin \
+	image/usr/bin/systemd-udevd
 
 S6_RC_FILES = \
-	image/etc/s6-rc/card0/type \
-	image/etc/s6-rc/card0/up \
 	image/etc/s6-rc/core/type \
 	image/etc/s6-rc/core/up \
-	image/etc/s6-rc/kvm/timeout-up \
-	image/etc/s6-rc/kvm/type \
-	image/etc/s6-rc/kvm/up \
-	image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \
-	image/etc/s6-rc/mdevd-coldplug/type \
-	image/etc/s6-rc/mdevd-coldplug/up \
-	image/etc/s6-rc/mdevd/notification-fd \
-	image/etc/s6-rc/mdevd/run \
-	image/etc/s6-rc/mdevd/type \
-	image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug \
 	image/etc/s6-rc/ok-all/contents.d/sys-vmms \
+	image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/ok-all/contents.d/vm-env \
 	image/etc/s6-rc/ok-all/type \
 	image/etc/s6-rc/static-nodes/type \
@@ -89,14 +77,21 @@ S6_RC_FILES = \
 	image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env \
 	image/etc/s6-rc/sys-vmms/type \
 	image/etc/s6-rc/sys-vmms/up \
+	image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd \
+	image/etc/s6-rc/systemd-udevd-coldplug/type \
+	image/etc/s6-rc/systemd-udevd-coldplug/up \
+	image/etc/s6-rc/systemd-udevd/notification-fd \
+	image/etc/s6-rc/systemd-udevd/run \
+	image/etc/s6-rc/systemd-udevd/type \
 	image/etc/s6-rc/vm-env/contents.d/static-nodes \
+	image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/vm-env/contents.d/weston \
 	image/etc/s6-rc/vm-env/type \
 	image/etc/s6-rc/vmm-env/contents.d/core \
-	image/etc/s6-rc/vmm-env/contents.d/kvm \
 	image/etc/s6-rc/vmm-env/contents.d/static-nodes \
+	image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/vmm-env/type \
-	image/etc/s6-rc/weston/dependencies.d/card0 \
+	image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug \
 	image/etc/s6-rc/weston/notification-fd \
 	image/etc/s6-rc/weston/run \
 	image/etc/s6-rc/weston/type
diff --git a/host/rootfs/image/etc/mdev.conf b/host/rootfs/image/etc/mdev.conf
deleted file mode 100644
index bddcfdc44ec2a8b1aa95e84cb88fdde625c766d8..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021-2022, 2024 Alyssa Ross <hi@alyssa.is>
-
-$PCI_CLASS=^2....$ 0:0 660 +/etc/mdev/net/add
--$MODALIAS=.* 0:0 660 +importas -Siu MODALIAS modprobe -q $MODALIAS
-kvm 0:0 660 +background { /etc/mdev/listen kvm }
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
diff --git a/host/rootfs/image/etc/mdev/listen b/host/rootfs/image/etc/mdev/listen
deleted file mode 100755
index ab50ee8c5ed1139d1129bac56afa7263af150745..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/listen
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-redirfd -w 1 /run/wait/${1}
-echo
diff --git a/host/rootfs/image/etc/mdev/wait b/host/rootfs/image/etc/mdev/wait
deleted file mode 100755
index 6bddb303d2671ce4e5b8581cd81235d7404916e7..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/mdev/wait
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/execlineb -S1
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-foreground {
-  redirfd -w 2 /dev/null
-  mkfifo /run/wait/${1}
-}
-
-foreground {
-  redirfd -w 1 /dev/null
-  head -1 /run/wait/${1}
-}
-rm /run/wait/${1}
diff --git a/host/rootfs/image/etc/s6-rc/card0/type.license b/host/rootfs/image/etc/s6-rc/card0/type.license
deleted file mode 100644
index c49c11b66262c7edc57ac06a486c1166d867c31d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/card0/up b/host/rootfs/image/etc/s6-rc/card0/up
deleted file mode 100644
index 703562e5442aea45198350afe86a8f38c11ed072..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/card0/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait card0
diff --git a/host/rootfs/image/etc/s6-rc/kvm/timeout-up b/host/rootfs/image/etc/s6-rc/kvm/timeout-up
deleted file mode 100644
index c5da56ae490a8ab35074fdcb6644a0dbbd280e3b..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/timeout-up
+++ /dev/null
@@ -1 +0,0 @@
-40000
diff --git a/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license b/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license
deleted file mode 100644
index d705e974a864074490588104a24a9ea789141572..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/timeout-up.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/kvm/type b/host/rootfs/image/etc/s6-rc/kvm/type
deleted file mode 100644
index bdd22a1850ae6c03a414eeb8084998679a2cdf92..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/type
+++ /dev/null
@@ -1 +0,0 @@
-oneshot
diff --git a/host/rootfs/image/etc/s6-rc/kvm/type.license b/host/rootfs/image/etc/s6-rc/kvm/type.license
deleted file mode 100644
index a941ca495a4211cf6659eda03b30f83c02985fe6..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/type.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/kvm/up b/host/rootfs/image/etc/s6-rc/kvm/up
deleted file mode 100644
index c02e3f90245e005b98b4de8245a1863fb49c1158..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/kvm/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
-
-/etc/mdev/wait kvm
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
deleted file mode 100644
index bdd22a1850ae6c03a414eeb8084998679a2cdf92..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type
+++ /dev/null
@@ -1 +0,0 @@
-oneshot
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up b/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
deleted file mode 100644
index 8698f7d7988a017786fb91a584eafbfb23b3165d..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/up
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-
-mdevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
deleted file mode 100644
index 2b3b032142b7286bd317cf0abaa44fba3a9b8941..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd.license
+++ /dev/null
@@ -1,2 +0,0 @@
-SPDX-License-Identifier: CC0-1.0
-SPDX-FileCopyrightText: 2020 Alyssa Ross <hi@alyssa.is>
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/run b/host/rootfs/image/etc/s6-rc/mdevd/run
deleted file mode 100644
index 55899bbe674426e4591e866a4d0617361ba34305..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/mdevd/run
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/execlineb -P
-# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2022 Alyssa Ross <hi@alyssa.is>
-
-mdevd -D3 -O4 -b134217728
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd b/host/rootfs/image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd
rename to host/rootfs/image/etc/s6-rc/ok-all/contents.d/systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/ok-all/contents.d/mdevd-coldplug
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd
diff --git a/host/rootfs/image/etc/s6-rc/card0/type b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/card0/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd-coldplug/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/type.license
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
new file mode 100644
index 0000000000000000000000000000000000000000..f4bfe58d1219218ba486050e4de0f949df8f2058
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# SPDX-FileCopyrightText: systemd is free software; you can redistribute it and/or modify it
+#                         under the terms of the GNU Lesser General Public License as published by
+#                         the Free Software Foundation; either version 2.1 of the License, or
+#                         (at your option) any later version.
+udevadm trigger --type=all --action=add --prioritized-subsystem=module,block,tpmrm,net,tty,input
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/notification-fd b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/notification-fd
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
new file mode 100644
index 0000000000000000000000000000000000000000..c4a0586a407fe14c3e0855749a7524ac3871dda4
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/notification-fd.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
new file mode 100644
index 0000000000000000000000000000000000000000..98d1aa83153c99f32afb4d27a97cf39fcadb2968
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
@@ -0,0 +1,15 @@
+#!/bin/execlineb -P
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock
+# Save stdin to restore it later.
+fdmove -c 4 0
+s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
+background {
+   fdmove 1 3
+   sd-notify-adapter
+}
+fdclose 3
+fdmove 0 4
+export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
+systemd-udevd
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type b/host/rootfs/image/etc/s6-rc/systemd-udevd/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type
diff --git a/host/rootfs/image/etc/s6-rc/mdevd/type.license b/host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/mdevd/type.license
rename to host/rootfs/image/etc/s6-rc/systemd-udevd/type.license
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm b/host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/vmm-env/contents.d/kvm
rename to host/rootfs/image/etc/s6-rc/vm-env/contents.d/systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0 b/host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/weston/dependencies.d/card0
rename to host/rootfs/image/etc/s6-rc/vmm-env/contents.d/systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug b/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
index 7dca0dab095569c9e7d49df9d245533a7265283e..8276e7eed45ab8155e21a3e11f86c57c03d66cc4 100644
--- a/host/rootfs/image/etc/s6-rc/weston/run
+++ b/host/rootfs/image/etc/s6-rc/weston/run
@@ -4,9 +4,9 @@
 
 unexport WAYLAND_DISPLAY
 
-foreground {
-  umask 077
-  mkdir /run/user/0
+if {
+  umask 0022
+  mkdir -p -m 0700 /run/user/0
 }
 unexport ?
 
@@ -20,4 +20,5 @@ redirfd -r 0 /dev/tty1
 
 importas -i home HOME
 cd $home
+if { udevadm wait /dev/dri/card0 }
 weston
diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
new file mode 100644
index 0000000000000000000000000000000000000000..c65829419de3516d6ec8e95e7928a69c308507aa
--- /dev/null
+++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# systemd-udevd unsets PATH, so fix that.
+ACTION=="remove", GOTO="spectrum-end"
+ENV{PCI_CLASS}!="2????", GOTO="spectrum-end"
+
+# net-add unbinds and rebinds the driver, so avoid calling
+# it more than once.
+IMPORT{db}="SPECTRUM_DRIVER_ASSIGNED"
+ENV{SPECTRUM_DRIVER_ASSIGNED}=="yes", GOTO="spectrum-end"
+# systemd-udevd unsets PATH, so fix that.
+RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
+ENV{SPECTRUM_DRIVER_ASSIGNED}="yes"
+LABEL="spectrum-end"
diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
index bcb6cdaf6646da6bb4970fe97f5ef03badbd66a6..5649674c51b29b08532fc2cd985a5b20a78c3764 100755
--- a/host/rootfs/image/usr/bin/run-vmm
+++ b/host/rootfs/image/usr/bin/run-vmm
@@ -53,4 +53,5 @@ unexport !
 fdmove -c 3 0
 redirfd -r 0 /dev/null
 
+if { udevadm wait /dev/kvm }
 cloud-hypervisor --api-socket fd=3
diff --git a/host/rootfs/image/usr/bin/systemd-udevd b/host/rootfs/image/usr/bin/systemd-udevd
new file mode 120000
index 0000000000000000000000000000000000000000..b7887eaf6dd3279116ba61d613bd467598089597
--- /dev/null
+++ b/host/rootfs/image/usr/bin/systemd-udevd
@@ -0,0 +1 @@
+udevadm
\ No newline at end of file
diff --git a/host/rootfs/image/etc/mdev/net/add b/host/rootfs/image/usr/libexec/net-add
similarity index 100%
rename from host/rootfs/image/etc/mdev/net/add
rename to host/rootfs/image/usr/libexec/net-add

-- 
2.51.0

Re: [PATCH v4 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 8174 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This replaces the mdevd uevent daemon with systemd-udevd, which supports
> much more hardware and is therefore to be preferred for a full desktop
> environment.  Various Wayland compositors integrate with systemd-udevd,
> allowing them to discover devices as they appear rather than having to
> only use devices plugged in when the compositor is started.
> Additionally, systemd-udevd has quirks for various devices that are
> needed to support the wide variety of hardware end-users have.
>
> The dependency on /dev/dri/card0 being present is eliminated, and
> whatever devices the user has are now picked up by the compositor.  New
> dependencies are added to ensure that udev coldplug has finished before
> any non-trivial services are started.  systemd-udev-trigger.service runs
> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
> an early boot service can assume 'udevadm trigger' has run.
>
> systemd-udevd unsets PATH before it runs programs.  Therefore, manually
> set it to /usr/bin before invoking any scripts.
>
> systemd-udevd provides the 'udevadm wait' command to wait for a device
> to appear and be processed.  This replaces all uses of /etc/mdev/wait,
> so this script is removed.  /etc/mdev/listen and /run/wait only existed
> to wake up /etc/mdev/wait, so they are also removed.
>
> The command-line options to 'udevadm trigger' are taken from
> systemd-udev-trigger.service on my Arch machine.  Using the wrong
> arguments leads to problems that take a very long time to debug.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
>  LICENSES/LGPL-2.1-or-later.txt                     | 502 +++++++++++++++++++++
>  host/rootfs/Makefile                               |   2 +-
>  host/rootfs/default.nix                            | 118 ++---
>  host/rootfs/file-list.mk                           |  33 +-
>  host/rootfs/image/etc/mdev.conf                    |   7 -
>  host/rootfs/image/etc/mdev/listen                  |  11 -
>  host/rootfs/image/etc/mdev/wait                    |  14 -
>  host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
>  host/rootfs/image/etc/s6-rc/card0/up               |   4 -
>  host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
>  host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
>  host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
>  host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
>  host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
>  .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
>  host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
>  .../contents.d/systemd-udevd-coldplug}             |   0
>  .../dependencies.d/systemd-udevd}                  |   0
>  .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
>  .../type.license                                   |   0
>  .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   6 +
>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
>  .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
>  host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  15 +
>  .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
>  .../contents.d/systemd-udevd-coldplug}             |   0
>  .../contents.d/systemd-udevd-coldplug}             |   0
>  .../weston/dependencies.d/systemd-udevd-coldplug   |   0
>  host/rootfs/image/etc/s6-rc/weston/run             |   7 +-
>  .../image/etc/udev/rules.d/99-spectrum.rules       |  15 +
>  host/rootfs/image/usr/bin/run-vmm                  |   1 +
>  host/rootfs/image/usr/bin/systemd-udevd            |   1 +
>  .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
>  36 files changed, 604 insertions(+), 158 deletions(-)

Also looking good, and again if you'd prefer I just make my suggested
changes myself when I apply it that's fine by me.

> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
> new file mode 100644
> index 0000000000000000000000000000000000000000..f4bfe58d1219218ba486050e4de0f949df8f2058
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
> @@ -0,0 +1,6 @@
> +# SPDX-License-Identifier: LGPL-2.1-or-later
> +# SPDX-FileCopyrightText: systemd is free software; you can redistribute it and/or modify it
> +#                         under the terms of the GNU Lesser General Public License as published by
> +#                         the Free Software Foundation; either version 2.1 of the License, or
> +#                         (at your option) any later version.

This is a statement of the license and is covered by the
SPDX-License-Identifier metadata.  SPDX-FileCopyrightText is for
identifying copyright owners.  For a project that doesn't provide a
copyright notice, we'd typically attribute copyright to e.g. "The
systemd Authors".

In this case though, I don't think there's anything copyrightable here,
so CC0-1.0 and your name should be fine.

> +udevadm trigger --type=all --action=add --prioritized-subsystem=module,block,tpmrm,net,tty,input

> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> new file mode 100644
> index 0000000000000000000000000000000000000000..98d1aa83153c99f32afb4d27a97cf39fcadb2968
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> @@ -0,0 +1,15 @@
> +#!/bin/execlineb -P
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock
> +# Save stdin to restore it later.
> +fdmove -c 4 0

stdin will always be /dev/null, so instead of this dance you can just
redirfd -r 0 /dev/null after the background.

> +s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
> +background {
> +   fdmove 1 3
> +   sd-notify-adapter
> +}
> +fdclose 3
> +fdmove 0 4
> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
> +systemd-udevd
> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
> index 7dca0dab095569c9e7d49df9d245533a7265283e..8276e7eed45ab8155e21a3e11f86c57c03d66cc4 100644
> --- a/host/rootfs/image/etc/s6-rc/weston/run
> +++ b/host/rootfs/image/etc/s6-rc/weston/run
> @@ -4,9 +4,9 @@
>  
>  unexport WAYLAND_DISPLAY
>  
> -foreground {
> -  umask 077
> -  mkdir /run/user/0
> +if {
> +  umask 0022
> +  mkdir -p -m 0700 /run/user/0

What's the point in continuing to umask when you explicitly provide the mode?

>  }
>  unexport ?
>  
> @@ -20,4 +20,5 @@ redirfd -r 0 /dev/tty1
>  
>  importas -i home HOME
>  cd $home
> +if { udevadm wait /dev/dri/card0 }
>  weston
> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> new file mode 100644
> index 0000000000000000000000000000000000000000..c65829419de3516d6ec8e95e7928a69c308507aa
> --- /dev/null
> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
> @@ -0,0 +1,15 @@
> +# SPDX-License-Identifier: EUPL-1.2+
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# systemd-udevd unsets PATH, so fix that.

Stray copy of comment.

> +ACTION=="remove", GOTO="spectrum-end"
> +ENV{PCI_CLASS}!="2????", GOTO="spectrum-end"
> +
> +# net-add unbinds and rebinds the driver, so avoid calling
> +# it more than once.
> +IMPORT{db}="SPECTRUM_DRIVER_ASSIGNED"
> +ENV{SPECTRUM_DRIVER_ASSIGNED}=="yes", GOTO="spectrum-end"
> +# systemd-udevd unsets PATH, so fix that.
> +RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
> +ENV{SPECTRUM_DRIVER_ASSIGNED}="yes"
> +LABEL="spectrum-end"

Again, I'd much rather this was taken care of in net-add.  I'll post a
patch to make it re-entrant, I guess.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v4 2/2] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 8780 bytes --]

On 10/28/25 12:02, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This replaces the mdevd uevent daemon with systemd-udevd, which supports
>> much more hardware and is therefore to be preferred for a full desktop
>> environment.  Various Wayland compositors integrate with systemd-udevd,
>> allowing them to discover devices as they appear rather than having to
>> only use devices plugged in when the compositor is started.
>> Additionally, systemd-udevd has quirks for various devices that are
>> needed to support the wide variety of hardware end-users have.
>>
>> The dependency on /dev/dri/card0 being present is eliminated, and
>> whatever devices the user has are now picked up by the compositor.  New
>> dependencies are added to ensure that udev coldplug has finished before
>> any non-trivial services are started.  systemd-udev-trigger.service runs
>> 'udevadm trigger' and has Before=sysinit.target, so anything that is not
>> an early boot service can assume 'udevadm trigger' has run.
>>
>> systemd-udevd unsets PATH before it runs programs.  Therefore, manually
>> set it to /usr/bin before invoking any scripts.
>>
>> systemd-udevd provides the 'udevadm wait' command to wait for a device
>> to appear and be processed.  This replaces all uses of /etc/mdev/wait,
>> so this script is removed.  /etc/mdev/listen and /run/wait only existed
>> to wake up /etc/mdev/wait, so they are also removed.
>>
>> The command-line options to 'udevadm trigger' are taken from
>> systemd-udev-trigger.service on my Arch machine.  Using the wrong
>> arguments leads to problems that take a very long time to debug.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>>  LICENSES/LGPL-2.1-or-later.txt                     | 502 +++++++++++++++++++++
>>  host/rootfs/Makefile                               |   2 +-
>>  host/rootfs/default.nix                            | 118 ++---
>>  host/rootfs/file-list.mk                           |  33 +-
>>  host/rootfs/image/etc/mdev.conf                    |   7 -
>>  host/rootfs/image/etc/mdev/listen                  |  11 -
>>  host/rootfs/image/etc/mdev/wait                    |  14 -
>>  host/rootfs/image/etc/s6-rc/card0/type.license     |   2 -
>>  host/rootfs/image/etc/s6-rc/card0/up               |   4 -
>>  host/rootfs/image/etc/s6-rc/kvm/timeout-up         |   1 -
>>  host/rootfs/image/etc/s6-rc/kvm/timeout-up.license |   2 -
>>  host/rootfs/image/etc/s6-rc/kvm/type               |   1 -
>>  host/rootfs/image/etc/s6-rc/kvm/type.license       |   2 -
>>  host/rootfs/image/etc/s6-rc/kvm/up                 |   4 -
>>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/type    |   1 -
>>  host/rootfs/image/etc/s6-rc/mdevd-coldplug/up      |   4 -
>>  .../image/etc/s6-rc/mdevd/notification-fd.license  |   2 -
>>  host/rootfs/image/etc/s6-rc/mdevd/run              |   5 -
>>  .../contents.d/systemd-udevd-coldplug}             |   0
>>  .../dependencies.d/systemd-udevd}                  |   0
>>  .../s6-rc/{card0 => systemd-udevd-coldplug}/type   |   0
>>  .../type.license                                   |   0
>>  .../image/etc/s6-rc/systemd-udevd-coldplug/up      |   6 +
>>  .../s6-rc/{mdevd => systemd-udevd}/notification-fd |   0
>>  .../s6-rc/systemd-udevd/notification-fd.license    |   2 +
>>  host/rootfs/image/etc/s6-rc/systemd-udevd/run      |  15 +
>>  .../image/etc/s6-rc/{mdevd => systemd-udevd}/type  |   0
>>  .../s6-rc/{mdevd => systemd-udevd}/type.license    |   0
>>  .../contents.d/systemd-udevd-coldplug}             |   0
>>  .../contents.d/systemd-udevd-coldplug}             |   0
>>  .../weston/dependencies.d/systemd-udevd-coldplug   |   0
>>  host/rootfs/image/etc/s6-rc/weston/run             |   7 +-
>>  .../image/etc/udev/rules.d/99-spectrum.rules       |  15 +
>>  host/rootfs/image/usr/bin/run-vmm                  |   1 +
>>  host/rootfs/image/usr/bin/systemd-udevd            |   1 +
>>  .../{etc/mdev/net/add => usr/libexec/net-add}      |   0
>>  36 files changed, 604 insertions(+), 158 deletions(-)
> 
> Also looking good, and again if you'd prefer I just make my suggested
> changes myself when I apply it that's fine by me.

That would be great, especially because a change to net-add is needed.

>> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..f4bfe58d1219218ba486050e4de0f949df8f2058
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd-coldplug/up
>> @@ -0,0 +1,6 @@
>> +# SPDX-License-Identifier: LGPL-2.1-or-later
>> +# SPDX-FileCopyrightText: systemd is free software; you can redistribute it and/or modify it
>> +#                         under the terms of the GNU Lesser General Public License as published by
>> +#                         the Free Software Foundation; either version 2.1 of the License, or
>> +#                         (at your option) any later version.
> 
> This is a statement of the license and is covered by the
> SPDX-License-Identifier metadata.  SPDX-FileCopyrightText is for
> identifying copyright owners.  For a project that doesn't provide a
> copyright notice, we'd typically attribute copyright to e.g. "The
> systemd Authors".
> 
> In this case though, I don't think there's anything copyrightable here,
> so CC0-1.0 and your name should be fine.

That makes sense.

>> +udevadm trigger --type=all --action=add --prioritized-subsystem=module,block,tpmrm,net,tty,input
> 
>> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..98d1aa83153c99f32afb4d27a97cf39fcadb2968
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> @@ -0,0 +1,15 @@
>> +#!/bin/execlineb -P
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +s6-setlock /run/sd-notify-wrapper/systemd-udevd.lock
>> +# Save stdin to restore it later.
>> +fdmove -c 4 0
> 
> stdin will always be /dev/null, so instead of this dance you can just
> redirfd -r 0 /dev/null after the background.

Good point.

>> +s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
>> +background {
>> +   fdmove 1 3
>> +   sd-notify-adapter
>> +}
>> +fdclose 3
>> +fdmove 0 4
>> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
>> +systemd-udevd
>> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
>> index 7dca0dab095569c9e7d49df9d245533a7265283e..8276e7eed45ab8155e21a3e11f86c57c03d66cc4 100644
>> --- a/host/rootfs/image/etc/s6-rc/weston/run
>> +++ b/host/rootfs/image/etc/s6-rc/weston/run
>> @@ -4,9 +4,9 @@
>>  
>>  unexport WAYLAND_DISPLAY
>>  
>> -foreground {
>> -  umask 077
>> -  mkdir /run/user/0
>> +if {
>> +  umask 0022
>> +  mkdir -p -m 0700 /run/user/0
> 
> What's the point in continuing to umask when you explicitly provide the mode?

The mode only applies to the last directory (/run/user/0).  The umask
ensures that /run/user will be created with the correct permissions
(0022) if it doesn't exist already.

>>  }
>>  unexport ?
>>  
>> @@ -20,4 +20,5 @@ redirfd -r 0 /dev/tty1
>>  
>>  importas -i home HOME
>>  cd $home
>> +if { udevadm wait /dev/dri/card0 }
>>  weston
>> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..c65829419de3516d6ec8e95e7928a69c308507aa
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
>> @@ -0,0 +1,15 @@
>> +# SPDX-License-Identifier: EUPL-1.2+
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +# systemd-udevd unsets PATH, so fix that.
> 
> Stray copy of comment.

Whoops!

>> +ACTION=="remove", GOTO="spectrum-end"
>> +ENV{PCI_CLASS}!="2????", GOTO="spectrum-end"
>> +
>> +# net-add unbinds and rebinds the driver, so avoid calling
>> +# it more than once.
>> +IMPORT{db}="SPECTRUM_DRIVER_ASSIGNED"
>> +ENV{SPECTRUM_DRIVER_ASSIGNED}=="yes", GOTO="spectrum-end"
>> +# systemd-udevd unsets PATH, so fix that.
>> +RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
>> +ENV{SPECTRUM_DRIVER_ASSIGNED}="yes"
>> +LABEL="spectrum-end"
> 
> Again, I'd much rather this was taken care of in net-add.  I'll post a
> patch to make it re-entrant, I guess.

That would be great.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v4 2/2] host/rootfs: Switch to systemd-udevd

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1022 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 10/28/25 12:02, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
>>> index 7dca0dab095569c9e7d49df9d245533a7265283e..8276e7eed45ab8155e21a3e11f86c57c03d66cc4 100644
>>> --- a/host/rootfs/image/etc/s6-rc/weston/run
>>> +++ b/host/rootfs/image/etc/s6-rc/weston/run
>>> @@ -4,9 +4,9 @@
>>>  
>>>  unexport WAYLAND_DISPLAY
>>>  
>>> -foreground {
>>> -  umask 077
>>> -  mkdir /run/user/0
>>> +if {
>>> +  umask 0022
>>> +  mkdir -p -m 0700 /run/user/0
>> 
>> What's the point in continuing to umask when you explicitly provide the mode?
>
> The mode only applies to the last directory (/run/user/0).  The umask
> ensures that /run/user will be created with the correct permissions
> (0022) if it doesn't exist already.

/run/user always exists, though.  It's in the run-image copied by
s6-linux-init in early boot.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v4 2/2] host/rootfs: Switch to systemd-udevd

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 1188 bytes --]

On 10/29/25 05:31, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 10/28/25 12:02, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
>>>> index 7dca0dab095569c9e7d49df9d245533a7265283e..8276e7eed45ab8155e21a3e11f86c57c03d66cc4 100644
>>>> --- a/host/rootfs/image/etc/s6-rc/weston/run
>>>> +++ b/host/rootfs/image/etc/s6-rc/weston/run
>>>> @@ -4,9 +4,9 @@
>>>>  
>>>>  unexport WAYLAND_DISPLAY
>>>>  
>>>> -foreground {
>>>> -  umask 077
>>>> -  mkdir /run/user/0
>>>> +if {
>>>> +  umask 0022
>>>> +  mkdir -p -m 0700 /run/user/0
>>>
>>> What's the point in continuing to umask when you explicitly provide the mode?
>>
>> The mode only applies to the last directory (/run/user/0).  The umask
>> ensures that /run/user will be created with the correct permissions
>> (0022) if it doesn't exist already.
> 
> /run/user always exists, though.  It's in the run-image copied by
> s6-linux-init in early boot.

Ah, feel free to drop the umask call then.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH v2 3/3] host/rootfs: Simplify s6-rc dependencies

[Demi Marie Obenour]

This moves almost all of the s6-rc dependencies into named, commented
bundles.  This makes the system much easier to understand.

Most of the explanation is in the bundle files themselves.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 host/rootfs/Makefile                                  |  8 ++++----
 host/rootfs/image/etc/s6-rc/basic/contents            | 18 ++++++++++++++++++
 host/rootfs/image/etc/s6-rc/{vmm-env => basic}/type   |  0
 .../image/etc/s6-rc/{vmm-env => basic}/type.license   |  0
 host/rootfs/image/etc/s6-rc/ok-all/contents           | 19 ++++++++++++++++---
 .../s6-rc/sys-vmms/dependencies.d/{vmm-env => vm-env} |  0
 host/rootfs/image/etc/s6-rc/systemd-udevd/run         |  9 ++++++---
 host/rootfs/image/etc/s6-rc/vm-env/contents           | 13 ++++++++++---
 host/rootfs/image/etc/s6-rc/vmm-env/contents          |  9 ---------
 .../dependencies.d/{systemd-udevd-coldplug => basic}  |  0
 10 files changed, 54 insertions(+), 22 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index db142f290a1efd3884d8c5a114b26fa0f42ef5f1..9a9e533ad2433bce137dd73e7e9d519c5afab303 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -127,6 +127,8 @@ build/empty:
 	mkdir -p $@
 
 S6_RC_FILES = \
+	image/etc/s6-rc/basic/contents \
+	image/etc/s6-rc/basic/type \
 	image/etc/s6-rc/core/type \
 	image/etc/s6-rc/core/up \
 	image/etc/s6-rc/kvm/timeout-up \
@@ -136,7 +138,7 @@ S6_RC_FILES = \
 	image/etc/s6-rc/ok-all/type \
 	image/etc/s6-rc/static-nodes/type \
 	image/etc/s6-rc/static-nodes/up \
-	image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env \
+	image/etc/s6-rc/sys-vmms/dependencies.d/vm-env \
 	image/etc/s6-rc/sys-vmms/type \
 	image/etc/s6-rc/sys-vmms/up \
 	image/etc/s6-rc/systemd-udevd-coldplug/dependencies.d/systemd-udevd \
@@ -148,9 +150,7 @@ S6_RC_FILES = \
 	image/etc/s6-rc/systemd-udevd/type \
 	image/etc/s6-rc/vm-env/contents \
 	image/etc/s6-rc/vm-env/type \
-	image/etc/s6-rc/vmm-env/contents \
-	image/etc/s6-rc/vmm-env/type \
-	image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug \
+	image/etc/s6-rc/weston/dependencies.d/basic \
 	image/etc/s6-rc/weston/notification-fd \
 	image/etc/s6-rc/weston/run \
 	image/etc/s6-rc/weston/type
diff --git a/host/rootfs/image/etc/s6-rc/basic/contents b/host/rootfs/image/etc/s6-rc/basic/contents
new file mode 100644
index 0000000000000000000000000000000000000000..54f58577ba9f125e7fc08dcdd69394e8a88ab622
--- /dev/null
+++ b/host/rootfs/image/etc/s6-rc/basic/contents
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: CC0-1.0
+# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# This file contains all atomics and bundles needed for basic system
+# initialization.  Everything that is not meant to run in early boot
+# should depend on this.
+
+# This ensures that core files are written to the right place.
+core
+
+# This ensures that static nodes are created.
+static-nodes
+
+# systemd runs systemd-udev-trigger.service before sysinit.target.
+# Therefore, anything using libudev that isn't an early boot service
+# might expect udev coldplug to have finished.
+systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/type b/host/rootfs/image/etc/s6-rc/basic/type
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/vmm-env/type
rename to host/rootfs/image/etc/s6-rc/basic/type
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/type.license b/host/rootfs/image/etc/s6-rc/basic/type.license
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/vmm-env/type.license
rename to host/rootfs/image/etc/s6-rc/basic/type.license
diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents b/host/rootfs/image/etc/s6-rc/ok-all/contents
index c76a5af336c7f1c3f4b81bf1f6244a53e0399fe8..edef03d2b6eae4fb0b92ac828436cd4572ca7acc 100644
--- a/host/rootfs/image/etc/s6-rc/ok-all/contents
+++ b/host/rootfs/image/etc/s6-rc/ok-all/contents
@@ -1,6 +1,19 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-#
-systemd-udevd-coldplug
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# This file contains the services that need to be started even
+# if nothing else depends on them.  It should not include services
+# that are only needed by other services.  For instance, it would
+# not be appropriate for this file to reference systemd-udevd.
+# However, services should be included in this file whenever they
+# are directly needed by the user, even if they depend on another
+# service in this files.  For instance, sys-vmms depends on weston,
+# but it is still included.
+
+# VMMs that should be started at boot.  In the future
+# it might make sense to start them only as needed.
 sys-vmms
-vm-env
+
+# The Wayland compositor.
+weston
diff --git a/host/rootfs/image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env b/host/rootfs/image/etc/s6-rc/sys-vmms/dependencies.d/vm-env
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/sys-vmms/dependencies.d/vmm-env
rename to host/rootfs/image/etc/s6-rc/sys-vmms/dependencies.d/vm-env
diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
index 2501680b69eb0060b651146dffb6b3a99640c6fb..f05804a6b3903a767f8e1400cf0153045dd3781f 100644
--- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run
+++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
@@ -1,11 +1,14 @@
 #!/bin/execlineb -P
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
-if { rm -f /run/sd-notify-wrapper/systemd-udevd }
+if { mkdir -p /run/sd-notify-wrapper }
+s6-setlock -d 4 /run/sd-notify-wrapper/systemd-udevd.lock
+if { rm -f /run/sd-notify-wrapper/systemd-udevd.sock }
 background {
-   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
+   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
    fdmove 1 3
    sd-notify-adapter
 }
-export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
+fdclose 3
+export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
 exec -a systemd-udevd udevadm
diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
index ed8b5c410adfc17f5bbc33932ac79d97bd7b3115..81bfd422d22bde582fe198e0778c1c93d0d0f329 100644
--- a/host/rootfs/image/etc/s6-rc/vm-env/contents
+++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
@@ -1,6 +1,13 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-#
-static-nodes
-systemd-udevd-coldplug
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
+
+# This file contains s6 atomics and bundles that
+# need to be started before starting any VMs.
+
+# Basic initialization
+basic
+# KVM being available
+kvm
+# Wayland compositor ready
 weston
diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents
deleted file mode 100644
index 9a1aea63abd1b5c374e3ac9a9671e4c9341f8d16..0000000000000000000000000000000000000000
--- a/host/rootfs/image/etc/s6-rc/vmm-env/contents
+++ /dev/null
@@ -1,9 +0,0 @@
-# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-#
-core
-kvm
-# systemd runs systemd-udev-trigger.service before sysinit.target.
-# Therefore, anything using libudev that isn't an early boot service
-# might expect udev coldplug to have finished.
-systemd-udevd-coldplug
diff --git a/host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug b/host/rootfs/image/etc/s6-rc/weston/dependencies.d/basic
similarity index 100%
rename from host/rootfs/image/etc/s6-rc/weston/dependencies.d/systemd-udevd-coldplug
rename to host/rootfs/image/etc/s6-rc/weston/dependencies.d/basic

-- 
2.51.0

Re: [PATCH v2 3/3] host/rootfs: Simplify s6-rc dependencies

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 7001 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> This moves almost all of the s6-rc dependencies into named, commented
> bundles.  This makes the system much easier to understand.
>
> Most of the explanation is in the bundle files themselves.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
>  host/rootfs/Makefile                                  |  8 ++++----
>  host/rootfs/image/etc/s6-rc/basic/contents            | 18 ++++++++++++++++++
>  host/rootfs/image/etc/s6-rc/{vmm-env => basic}/type   |  0
>  .../image/etc/s6-rc/{vmm-env => basic}/type.license   |  0
>  host/rootfs/image/etc/s6-rc/ok-all/contents           | 19 ++++++++++++++++---
>  .../s6-rc/sys-vmms/dependencies.d/{vmm-env => vm-env} |  0
>  host/rootfs/image/etc/s6-rc/systemd-udevd/run         |  9 ++++++---
>  host/rootfs/image/etc/s6-rc/vm-env/contents           | 13 ++++++++++---
>  host/rootfs/image/etc/s6-rc/vmm-env/contents          |  9 ---------
>  .../dependencies.d/{systemd-udevd-coldplug => basic}  |  0
>  10 files changed, 54 insertions(+), 22 deletions(-)

Hmm, we just moved away from using dependencies files to dependencies.d
directories, but now we're going the other way with contents?  That's
not to say we couldn't have a README file in each contents.d or
something serving much the same purpose, though.

> diff --git a/host/rootfs/image/etc/s6-rc/basic/contents b/host/rootfs/image/etc/s6-rc/basic/contents
> new file mode 100644
> index 0000000000000000000000000000000000000000..54f58577ba9f125e7fc08dcdd69394e8a88ab622
> --- /dev/null
> +++ b/host/rootfs/image/etc/s6-rc/basic/contents
> @@ -0,0 +1,18 @@
> +# SPDX-License-Identifier: CC0-1.0
> +# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# This file contains all atomics and bundles needed for basic system
> +# initialization.  Everything that is not meant to run in early boot
> +# should depend on this.
> +
> +# This ensures that core files are written to the right place.
> +core
> +
> +# This ensures that static nodes are created.
> +static-nodes
> +
> +# systemd runs systemd-udev-trigger.service before sysinit.target.
> +# Therefore, anything using libudev that isn't an early boot service
> +# might expect udev coldplug to have finished.
> +systemd-udevd-coldplug

I'm not convinced by the "basic" bundle.  I worry that it's likely to
end up accumulating stuff that isn't actually needed by everything that
depends on it, and that things will end up being slow because they're
waiting for things they don't actually need.  I'm not sure where core
should go, really, because anything /could/ crash at any time.
static-nodes is presumably going away anyway with udev, so this is
really just the coldplug bundle.

> diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents b/host/rootfs/image/etc/s6-rc/ok-all/contents
> index c76a5af336c7f1c3f4b81bf1f6244a53e0399fe8..edef03d2b6eae4fb0b92ac828436cd4572ca7acc 100644
> --- a/host/rootfs/image/etc/s6-rc/ok-all/contents
> +++ b/host/rootfs/image/etc/s6-rc/ok-all/contents
> @@ -1,6 +1,19 @@
>  # SPDX-License-Identifier: CC0-1.0
>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -#
> -systemd-udevd-coldplug
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# This file contains the services that need to be started even
> +# if nothing else depends on them.  It should not include services
> +# that are only needed by other services.  For instance, it would
> +# not be appropriate for this file to reference systemd-udevd.
> +# However, services should be included in this file whenever they
> +# are directly needed by the user, even if they depend on another
> +# service in this files.  For instance, sys-vmms depends on weston,
> +# but it is still included.
> +
> +# VMMs that should be started at boot.  In the future
> +# it might make sense to start them only as needed.
>  sys-vmms
> -vm-env

See below — I think the name of "vm-env" hasn't captured what it does
very well.

> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> index 2501680b69eb0060b651146dffb6b3a99640c6fb..f05804a6b3903a767f8e1400cf0153045dd3781f 100644
> --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
> @@ -1,11 +1,14 @@
>  #!/bin/execlineb -P
>  # SPDX-License-Identifier: EUPL-1.2+
>  # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> -if { rm -f /run/sd-notify-wrapper/systemd-udevd }
> +if { mkdir -p /run/sd-notify-wrapper }
> +s6-setlock -d 4 /run/sd-notify-wrapper/systemd-udevd.lock
> +if { rm -f /run/sd-notify-wrapper/systemd-udevd.sock }
>  background {
> -   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
>     fdmove 1 3
>     sd-notify-adapter
>  }
> -export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
> +fdclose 3
> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
>  exec -a systemd-udevd udevadm

Are these changes supposed to be here?

> diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
> index ed8b5c410adfc17f5bbc33932ac79d97bd7b3115..81bfd422d22bde582fe198e0778c1c93d0d0f329 100644
> --- a/host/rootfs/image/etc/s6-rc/vm-env/contents
> +++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
> @@ -1,6 +1,13 @@
>  # SPDX-License-Identifier: CC0-1.0
>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -#
> -static-nodes
> -systemd-udevd-coldplug
> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
> +
> +# This file contains s6 atomics and bundles that
> +# need to be started before starting any VMs.
> +
> +# Basic initialization
> +basic
> +# KVM being available
> +kvm
> +# Wayland compositor ready
>  weston
> diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents
> deleted file mode 100644
> index 9a1aea63abd1b5c374e3ac9a9671e4c9341f8d16..0000000000000000000000000000000000000000
> --- a/host/rootfs/image/etc/s6-rc/vmm-env/contents
> +++ /dev/null
> @@ -1,9 +0,0 @@
> -# SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -#
> -core
> -kvm
> -# systemd runs systemd-udev-trigger.service before sysinit.target.
> -# Therefore, anything using libudev that isn't an early boot service
> -# might expect udev coldplug to have finished.
> -systemd-udevd-coldplug

I think it probably makes sense to keep a distinction between "user can
now start VMs" (vm-env) and "it is now possible to start a VMM, possibly
automatically" (vmm-env).  We can of course try to find better names,
though.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [PATCH v2 3/3] host/rootfs: Simplify s6-rc dependencies

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 7479 bytes --]

On 9/25/25 07:07, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This moves almost all of the s6-rc dependencies into named, commented
>> bundles.  This makes the system much easier to understand.
>>
>> Most of the explanation is in the bundle files themselves.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>>  host/rootfs/Makefile                                  |  8 ++++----
>>  host/rootfs/image/etc/s6-rc/basic/contents            | 18 ++++++++++++++++++
>>  host/rootfs/image/etc/s6-rc/{vmm-env => basic}/type   |  0
>>  .../image/etc/s6-rc/{vmm-env => basic}/type.license   |  0
>>  host/rootfs/image/etc/s6-rc/ok-all/contents           | 19 ++++++++++++++++---
>>  .../s6-rc/sys-vmms/dependencies.d/{vmm-env => vm-env} |  0
>>  host/rootfs/image/etc/s6-rc/systemd-udevd/run         |  9 ++++++---
>>  host/rootfs/image/etc/s6-rc/vm-env/contents           | 13 ++++++++++---
>>  host/rootfs/image/etc/s6-rc/vmm-env/contents          |  9 ---------
>>  .../dependencies.d/{systemd-udevd-coldplug => basic}  |  0
>>  10 files changed, 54 insertions(+), 22 deletions(-)
> 
> Hmm, we just moved away from using dependencies files to dependencies.d
> directories, but now we're going the other way with contents?  That's
> not to say we couldn't have a README file in each contents.d or
> something serving much the same purpose, though.

I did not know that contents.d was supported.
Will fix once the systemd-udevd work has landed.

>> diff --git a/host/rootfs/image/etc/s6-rc/basic/contents b/host/rootfs/image/etc/s6-rc/basic/contents
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..54f58577ba9f125e7fc08dcdd69394e8a88ab622
>> --- /dev/null
>> +++ b/host/rootfs/image/etc/s6-rc/basic/contents
>> @@ -0,0 +1,18 @@
>> +# SPDX-License-Identifier: CC0-1.0
>> +# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +# This file contains all atomics and bundles needed for basic system
>> +# initialization.  Everything that is not meant to run in early boot
>> +# should depend on this.
>> +
>> +# This ensures that core files are written to the right place.
>> +core
>> +
>> +# This ensures that static nodes are created.
>> +static-nodes
>> +
>> +# systemd runs systemd-udev-trigger.service before sysinit.target.
>> +# Therefore, anything using libudev that isn't an early boot service
>> +# might expect udev coldplug to have finished.
>> +systemd-udevd-coldplug
> 
> I'm not convinced by the "basic" bundle.  I worry that it's likely to
> end up accumulating stuff that isn't actually needed by everything that
> depends on it, and that things will end up being slow because they're
> waiting for things they don't actually need.  I'm not sure where core
> should go, really, because anything /could/ crash at any time.
> static-nodes is presumably going away anyway with udev, so this is
> really just the coldplug bundle.

static-nodes isn't going away.

>> diff --git a/host/rootfs/image/etc/s6-rc/ok-all/contents b/host/rootfs/image/etc/s6-rc/ok-all/contents
>> index c76a5af336c7f1c3f4b81bf1f6244a53e0399fe8..edef03d2b6eae4fb0b92ac828436cd4572ca7acc 100644
>> --- a/host/rootfs/image/etc/s6-rc/ok-all/contents
>> +++ b/host/rootfs/image/etc/s6-rc/ok-all/contents
>> @@ -1,6 +1,19 @@
>>  # SPDX-License-Identifier: CC0-1.0
>>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>> -#
>> -systemd-udevd-coldplug
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +# This file contains the services that need to be started even
>> +# if nothing else depends on them.  It should not include services
>> +# that are only needed by other services.  For instance, it would
>> +# not be appropriate for this file to reference systemd-udevd.
>> +# However, services should be included in this file whenever they
>> +# are directly needed by the user, even if they depend on another
>> +# service in this files.  For instance, sys-vmms depends on weston,
>> +# but it is still included.
>> +
>> +# VMMs that should be started at boot.  In the future
>> +# it might make sense to start them only as needed.
>>  sys-vmms
>> -vm-env
> 
> See below — I think the name of "vm-env" hasn't captured what it does
> very well.
> 
>> diff --git a/host/rootfs/image/etc/s6-rc/systemd-udevd/run b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> index 2501680b69eb0060b651146dffb6b3a99640c6fb..f05804a6b3903a767f8e1400cf0153045dd3781f 100644
>> --- a/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> +++ b/host/rootfs/image/etc/s6-rc/systemd-udevd/run
>> @@ -1,11 +1,14 @@
>>  #!/bin/execlineb -P
>>  # SPDX-License-Identifier: EUPL-1.2+
>>  # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> -if { rm -f /run/sd-notify-wrapper/systemd-udevd }
>> +if { mkdir -p /run/sd-notify-wrapper }
>> +s6-setlock -d 4 /run/sd-notify-wrapper/systemd-udevd.lock
>> +if { rm -f /run/sd-notify-wrapper/systemd-udevd.sock }
>>  background {
>> -   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd
>> +   s6-ipcserver-socketbinder -b0 -m -a 0600 /run/sd-notify-wrapper/systemd-udevd.sock
>>     fdmove 1 3
>>     sd-notify-adapter
>>  }
>> -export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd
>> +fdclose 3
>> +export NOTIFY_SOCKET /run/sd-notify-wrapper/systemd-udevd.sock
>>  exec -a systemd-udevd udevadm
> 
> Are these changes supposed to be here?

No, they are not. 

>> diff --git a/host/rootfs/image/etc/s6-rc/vm-env/contents b/host/rootfs/image/etc/s6-rc/vm-env/contents
>> index ed8b5c410adfc17f5bbc33932ac79d97bd7b3115..81bfd422d22bde582fe198e0778c1c93d0d0f329 100644
>> --- a/host/rootfs/image/etc/s6-rc/vm-env/contents
>> +++ b/host/rootfs/image/etc/s6-rc/vm-env/contents
>> @@ -1,6 +1,13 @@
>>  # SPDX-License-Identifier: CC0-1.0
>>  # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>> -#
>> -static-nodes
>> -systemd-udevd-coldplug
>> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
>> +
>> +# This file contains s6 atomics and bundles that
>> +# need to be started before starting any VMs.
>> +
>> +# Basic initialization
>> +basic
>> +# KVM being available
>> +kvm
>> +# Wayland compositor ready
>>  weston
>> diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents
>> deleted file mode 100644
>> index 9a1aea63abd1b5c374e3ac9a9671e4c9341f8d16..0000000000000000000000000000000000000000
>> --- a/host/rootfs/image/etc/s6-rc/vmm-env/contents
>> +++ /dev/null
>> @@ -1,9 +0,0 @@
>> -# SPDX-License-Identifier: CC0-1.0
>> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>> -#
>> -core
>> -kvm
>> -# systemd runs systemd-udev-trigger.service before sysinit.target.
>> -# Therefore, anything using libudev that isn't an early boot service
>> -# might expect udev coldplug to have finished.
>> -systemd-udevd-coldplug
> 
> I think it probably makes sense to keep a distinction between "user can
> now start VMs" (vm-env) and "it is now possible to start a VMM, possibly
> automatically" (vmm-env).  We can of course try to find better names,
> though.

can-start-vms-automatically and can-start-vms-manually?
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v2 3/3] host/rootfs: Simplify s6-rc dependencies

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 1186 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 9/25/25 07:07, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/host/rootfs/image/etc/s6-rc/vmm-env/contents b/host/rootfs/image/etc/s6-rc/vmm-env/contents
>>> deleted file mode 100644
>>> index 9a1aea63abd1b5c374e3ac9a9671e4c9341f8d16..0000000000000000000000000000000000000000
>>> --- a/host/rootfs/image/etc/s6-rc/vmm-env/contents
>>> +++ /dev/null
>>> @@ -1,9 +0,0 @@
>>> -# SPDX-License-Identifier: CC0-1.0
>>> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>>> -#
>>> -core
>>> -kvm
>>> -# systemd runs systemd-udev-trigger.service before sysinit.target.
>>> -# Therefore, anything using libudev that isn't an early boot service
>>> -# might expect udev coldplug to have finished.
>>> -systemd-udevd-coldplug
>> 
>> I think it probably makes sense to keep a distinction between "user can
>> now start VMs" (vm-env) and "it is now possible to start a VMM, possibly
>> automatically" (vmm-env).  We can of course try to find better names,
>> though.
>
> can-start-vms-automatically and can-start-vms-manually?

"interactive" and "vmm-env"?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]