Work around an annoying issue with the Intel AX210. It has a hardware bug
where the PCIe link will go into L1 before initialisation is complete. The
driver works around this by spamming read calls to an MSI-X register to keep
the link alive until firmware is ready. But these register accesses are
trapped by crosvm, and that's not fast enough.
As a shitty workaround, add an option to hide device MSI-X capability from
the VM. It should fall back to MSI. I hope.
Nvidia GPU drivers require RWX memory pages, which crosvm's seccomp
sandbox blocks. This option switches to a crosvm-nvidia build with
a relaxed W+X memory policy, keeping the default secure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
crosvm changes for realtime audio, plus some minor log message improvements.
Also stop pinning nixpkgs as the upstream build failure has been resolved.
- Add VIRTIO_F_VERSION_1 feature flag required by Linux kernel for
modern virtio devices
- Wrap daemon in reconnection loop so crosvm can reconnect after
disconnecting (fixes "Connection refused" error)
- Add clear_state() to reset backend between connections
- Add INFO logging for client connect/disconnect and thread lifecycle
Also disable timestamps in crosvm output as journald already adds them.
Having two timestamps per log line is annoying.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Convert systemd.user.sockets/services to systemd.sockets/services
- VMs run as root; crosvm drops privileges before starting guest
- Sockets in /run/qubes-lite/ with SocketUser for user access
- Add polkit rule so configured user can manage VM services
- Update soundDefault to use PulseAudio with user-specific paths
- Update wayland socket to explicit /run/user/<uid>/wayland-0
- vm-start-debug now requires sudo (root privileges)
- User must have explicit UID set in users.users
Also update documentation.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add support for passing PCI devices (USB controllers, network cards)
directly to VMs using vfio-pci, enabling Qubes-style hardware isolation.
Features:
- isolatedPciDevices option to claim devices with vfio-pci at early boot
- Per-VM pciDevices option to pass devices to crosvm
- Activation script for runtime rebinding after nixos-rebuild switch
- Build-time assertions (devices must be isolated, no duplicates)
- Runtime IOMMU group validation before VM start
- BDF format normalization (accepts 01:00.0 or 0000:01:00.0)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Instead of prefixing app names with the VM name, organize apps into
"VM: <name>" submenus using XDG menu integration. This creates a
cleaner menu structure:
VM: banking → Firefox, Konsole
VM: disposable → Firefox, Okular
Adds .directory files for submenu definitions and a .menu file to
configure the XDG menu grouping via custom categories.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Rename `disks` to `additionalDisks` with structured format
(path, readOnly, enableDiscard, blockSize, devIdentifier, useDirect)
- Add custom boot options: rootDisk, kernel, initramfs, rootDiskReadonly
- Add kernelParams for extra kernel command line options
- Add gpu option (default: "context-types=cross-domain:virgl2")
- Add sharedDirectories for crosvm --shared-dir
- Add global crosvmLogLevel option (default: "info")
- Add --name argument to crosvm set to VM name
- Migrate deprecated --disk/--rwdisk to --block format
- Switch flake to nixos-unstable channel
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The double-decoration crash issue has been fixed. Verified that both konsole
(prefers server-side decorations) and firefox (prefers client-side) work and
show server-side decorations.
- Add treefmt-nix with nixfmt for code formatting (nix fmt)
- Extract cidrToNetworkBase and mkVmCase helper functions
- Use lib.nameValuePair for cleaner listToAttrs patterns
- Consolidate assertions with single let block
- Remove duplicate util-linux package
- Document formatting requirement in CLAUDE.md
- Apply nixfmt to all Nix files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Use my wayland-proxy-virtwl fork. Unconditionally requests server-side
decorations even if the client doesn't want them.
Tested with firefox, works there.
Changes needed:
- Some minor renaming for nixpkgs changes.
- Kernel modules now come from a separate output.
- dash over vsock seems to be broken; switched to bash.
(it seems to be trying to use the console instead of the vsock)
