Refactor; Alastor Apple Silicon Host

flake.lock

@@ -29,11 +29,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1710329340,
+        "lastModified": 1710715192,
-        "narHash": "sha256-EL1wI4vyZsT0bUT8t5ZOPS+UrVZ6NKsQtKwxOSmZm6Q=",
+        "narHash": "sha256-w6dpqrZ5eCObzvxL+3QqGoYC/iR4TCYwGBlpX3D+ITQ=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "2587d46d5904de710b56a9f359579a165c38ee55",
+        "rev": "114486c3f75cc20196bd59836b7efd41826c2c08",
         "type": "gitlab"
       },
       "original": {
@@ -192,11 +192,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1710329147,
+        "lastModified": 1710714957,
-        "narHash": "sha256-ExKfXL6PURo5VJ9bNPkOxCNBlRDoPILeCfUrMyJ20i0=",
+        "narHash": "sha256-eZCxuF58YWgaJMMRrn8oRkwRhxooe5kBS/s2wRVr9PA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1b74e3679e90fe7ad142bb5f66610a0d92ac0165",
+        "rev": "7b3fca5adcf6c709874a8f2e0c364fe9c58db989",
         "type": "github"
       },
       "original": {
@@ -214,11 +214,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1710062421,
+        "lastModified": 1710281778,
-        "narHash": "sha256-FiCNRfyUgJOLYIokLiFsfI7B+Zn9HDnOzFR3uVr5qsQ=",
+        "narHash": "sha256-bvWr9vvBrAxb44kHM3H3cY/uQg+4pYP1BM/Nu3e/7V8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "36f873dfc8e2b6b89936ff3e2b74803d50447e0a",
+        "rev": "49a266d2ca59df8a03249550e73a54626181b65d",
         "type": "github"
       },
       "original": {
@@ -235,11 +235,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1709771483,
+        "lastModified": 1710281379,
-        "narHash": "sha256-Hjzu9nCknHLQvhdaRFfCEprH0o15KcaNu1QDr3J88DI=",
+        "narHash": "sha256-uFo9hxt982L3nFJeweW4Gip2esiGrIQlbvEGrNTh4AY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "550340062c16d7ef8c2cc20a3d2b97bcd3c6b6f6",
+        "rev": "d9ea313bc4851670dc99c5cc979cb79750e7d670",
         "type": "github"
       },
       "original": {
@@ -250,11 +250,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1710123225,
+        "lastModified": 1710622004,
-        "narHash": "sha256-j3oWlxRZxB7cFsgEntpH3rosjFHRkAo/dhX9H3OfxtY=",
+        "narHash": "sha256-6zR642tXcZzzk3C8BHxlCrR0yh8z8zMXLiuXpWDIpX0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "ad2fd7b978d5e462048729a6c635c45d3d33c9ba",
+        "rev": "968952f950a59dee9ed1e8799dda38c6dfa1bad3",
         "type": "github"
       },
       "original": {
@@ -282,11 +282,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1710329155,
+        "lastModified": 1710743772,
-        "narHash": "sha256-HvOKJXyu0JJuTGHHHw3gdiXgvWnyDkOyX42Nmnc2fDk=",
+        "narHash": "sha256-u2DncftQZEZElNeJIHkRHkq+1e/+z4c1bKCGan0LVcg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a6af0d92679222ba704841a6515d9a7e022af6fd",
+        "rev": "b3fd69b2616bf555b1de1b5e4585c125951ee018",
         "type": "github"
       },
       "original": {
@@ -298,11 +298,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1710272261,
+        "lastModified": 1710631334,
-        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
+        "narHash": "sha256-rL5LSYd85kplL5othxK5lmAtjyMOBg390sGBTb3LRMM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2",
+        "rev": "c75037bbf9093a2acb617804ee46320d6d1fea5a",
         "type": "github"
       },
       "original": {
@@ -325,11 +325,11 @@
         "pre-commit-hooks": "pre-commit-hooks"
       },
       "locked": {
-        "lastModified": 1710283972,
+        "lastModified": 1710634405,
-        "narHash": "sha256-kkN0CJwykU4XoTDLHG68eEBXyp+GLTp7eJGDVrI7QIU=",
+        "narHash": "sha256-e+EHQGqqjpvkln6vYmiAcafFKbTaze3XF7DEjDZyXGY=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "c2cd3cb7a13c0677c49f46d55a8c65b50b7d9431",
+        "rev": "939530edca29b44e65d8bd606ef3485346510ebe",
         "type": "github"
       },
       "original": {

flake.nix

@@ -37,13 +37,43 @@
       overlays = util.nixFilesIn ./overlays;
     };
   in {
-    nixosConfigurations = pkgs.util.mapHostAttrs (host: host) (host:
+    nixosConfigurations = {
-      lib.nixosSystem {
+      #pkgs.util.mapHostAttrs (host: host) (host:
-        inherit system;
+      #      lib.nixosSystem {
-        modules = [./hosts/${host}];
+      #        system = "x86_64-linux";
+      #        modules = [./hosts/x86_64-linux/${host}];
+      #        specialArgs = {inherit inputs;};
+      #      });
+      "asmodeus" = lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [./hosts/x86_64-linux/asmodeus];
         specialArgs = {inherit inputs;};
-      });
+      };
-    formatter.x86_64-linux =
+      "seraphim" = lib.nixosSystem {
-      inputs.nixpkgs.legacyPackages.x86_64-linux.alejandra;
+        system = "x86_64-linux";
+        modules = [./hosts/x86_64-linux/seraphim];
+        specialArgs = {inherit inputs;};
+      };
+      "lilith" = lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [./hosts/x86_64-linux/lilith];
+        specialArgs = {inherit inputs;};
+      };
+      "lambda" = lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [./hosts/x86_64-linux/lambda];
+        specialArgs = {inherit inputs;};
+      };
+      "alastor" = lib.nixosSystem {
+        system = "aarch64-linux";
+        modules = [./hosts/aarch64-linux/alastor];
+        specialArgs = {inherit inputs;};
+      };
+    };
+
+    formatter = {
+      x86_64-linux = inputs.nixpkgs.legacyPackages.x86_64-linux.alejandra;
+      aarch64-linux = inputs.nixpkgs.legacyPackages.aarch64-linux.alejandra;
+    };
   };
 }

home/modules/home-pkgs.nix

@@ -3,69 +3,69 @@
   inputs,
   pkgs,
   ...
-}: {
+}: let
-  home.packages = with pkgs; [
+  x86pkgs =
-    neofetch
+    if pkgs.system == "x86_64-linux"
-    uwufetch
+    then [
-    btop
+      pkgs.steam
-    iftop
+      pkgs.protonup-qt
-    ranger
+      pkgs.via
+      pkgs.spotify
+    ]
+    else [];
+in {
+  home.packages =
+    [
+      pkgs.neofetch
+      pkgs.uwufetch
+      pkgs.btop
+      pkgs.iftop
+      pkgs.ranger
 
-    obsidian
+      pkgs.obsidian
 
-    moodle-dl
+      pkgs.moodle-dl
 
-    brightnessctl
+      pkgs.brightnessctl
-    pavucontrol
+      pkgs.pavucontrol
 
-    bitwarden
+      pkgs.bitwarden-cli
-    bitwarden-cli
 
-    sway-contrib.grimshot
+      pkgs.sway-contrib.grimshot
 
-    libnotify
+      pkgs.libnotify
 
-    strace
+      pkgs.strace
-    ltrace
+      pkgs.ltrace
 
-    nodejs
+      pkgs.nodejs
-    hoppscotch
 
-    nerdfonts
+      pkgs.nerdfonts
-    ipafont
+      pkgs.ipafont
 
-    vivaldi
+      pkgs.signal-desktop
-    vivaldi-ffmpeg-codecs
+      pkgs.vesktop
+      pkgs.telegram-desktop
+      pkgs.element-desktop
 
-    signal-desktop
+      pkgs.qbittorrent
-    vesktop
+      pkgs.nicotine-plus
-    discord
-    telegram-desktop
-    webex
-    element-desktop
 
-    qbittorrent
+      pkgs.qmk
-    nicotine-plus
+      pkgs.qmk-udev-rules
 
-    via
+      pkgs.neovide
-    qmk
-    qmk-udev-rules
 
-    neovide
+      pkgs.ripgrep
 
-    ripgrep
+      pkgs.yubioath-flutter
 
-    yubioath-flutter
+      pkgs.sayonara
+      pkgs.mpv
+      pkgs.feishin
 
-    steam
+      pkgs.nixos-icons
-    protonup-qt
+      pkgs.swww
-
+    ]
-    spotify
+    ++ x86pkgs;
-    sayonara
-    mpv
-    feishin
-
-    nixos-icons
-    swww
-  ];
 }

home/modules/nixvim.nix

@@ -23,10 +23,6 @@
 
     colorschemes.catppuccin.enable = true;
     plugins = {
-      obsidian = {
-        enable = true;
-        dir = "~/Documents/Obsidian Vault/";
-      };
       indent-blankline.enable = true;
       lualine.enable = true;
       lsp-format = {enable = true;};
@@ -69,8 +65,8 @@
 
         settings = {
           snippet = {
-	    expand = "function(args) require('luasnip').lsp_expand(args.body) end";
+            expand = "function(args) require('luasnip').lsp_expand(args.body) end";
-	  };
+          };
           sources = [
             {name = "nvim_lsp";}
             {name = "path";}
@@ -86,8 +82,8 @@
           #};
           mapping = {
             "<CR>" = ''
-		cmp.mapping.confirm({ select = true })
+              cmp.mapping.confirm({ select = true })
-	    '';
+            '';
             "<Tab>" = ''
               function(fallback)
                 local luasnip = require('luasnip')
@@ -198,9 +194,9 @@
             #val = [
             #  "TOHA HEAVY INDUSTRIES"
             #];
-	    val = [
+            val = [
-	      "git@git.sr.ht:xqtc"
+              "git@git.sr.ht:xqtc"
-	    ];
+            ];
             opts = {
               position = "center";
               hl = "Keyword";

hosts/aarch64-linux/alastor/apple-silicon-support/default.nix

@@ -0,0 +1,5 @@
+{...}: {
+  imports = [
+    ./modules/default.nix
+  ];
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/boot-m1n1/default.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  pkgs' = config.hardware.asahi.pkgs;
+
+  bootM1n1 = pkgs'.m1n1.override {
+    isRelease = true;
+    withTools = false;
+    customLogo = config.boot.m1n1CustomLogo;
+  };
+
+  bootUBoot = pkgs'.uboot-asahi.override {
+    m1n1 = bootM1n1;
+  };
+
+  bootFiles = {
+    "m1n1/boot.bin" = pkgs.runCommand "boot.bin" {} ''
+      cat ${bootM1n1}/build/m1n1.bin > $out
+      cat ${config.boot.kernelPackages.kernel}/dtbs/apple/*.dtb >> $out
+      cat ${bootUBoot}/u-boot-nodtb.bin.gz >> $out
+      if [ -n "${config.boot.m1n1ExtraOptions}" ]; then
+        echo '${config.boot.m1n1ExtraOptions}' >> $out
+      fi
+    '';
+  };
+in {
+  config = lib.mkIf config.hardware.asahi.enable {
+    # install m1n1 with the boot loader
+    boot.loader.grub.extraFiles = bootFiles;
+    boot.loader.systemd-boot.extraFiles = bootFiles;
+
+    # ensure the installer has m1n1 in the image
+    system.extraDependencies = lib.mkForce [bootM1n1 bootUBoot];
+    system.build.m1n1 = bootFiles."m1n1/boot.bin";
+  };
+
+  options.boot = {
+    m1n1ExtraOptions = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = ''
+        Append extra options to the m1n1 boot binary. Might be useful for fixing
+        display problems on Mac minis.
+        https://github.com/AsahiLinux/m1n1/issues/159
+      '';
+    };
+
+    m1n1CustomLogo = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Custom logo to build into m1n1. The path must point to a 256x256 PNG.
+      '';
+    };
+  };
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/default.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    ./kernel
+    ./mesa
+    ./peripheral-firmware
+    ./boot-m1n1
+    ./sound
+  ];
+
+  config = let
+    cfg = config.hardware.asahi;
+  in
+    lib.mkIf cfg.enable {
+      nixpkgs.overlays = lib.mkBefore [cfg.overlay];
+
+      hardware.asahi.pkgs =
+        if cfg.pkgsSystem != "aarch64-linux"
+        then
+          import (pkgs.path) {
+            crossSystem.system = "aarch64-linux";
+            localSystem.system = cfg.pkgsSystem;
+            overlays = [cfg.overlay];
+          }
+        else pkgs;
+    };
+
+  options.hardware.asahi = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Enable the basic Asahi Linux components, such as kernel and boot setup.
+      '';
+    };
+
+    pkgsSystem = lib.mkOption {
+      type = lib.types.str;
+      default = "aarch64-linux";
+      description = ''
+        System architecture that should be used to build the major Asahi
+        packages, if not the default aarch64-linux. This allows installing from
+        a cross-built ISO without rebuilding them during installation.
+      '';
+    };
+
+    pkgs = lib.mkOption {
+      type = lib.types.raw;
+      description = ''
+        Package set used to build the major Asahi packages. Defaults to the
+        ambient set if not cross-built, otherwise re-imports the ambient set
+        with the system defined by `hardware.asahi.pkgsSystem`.
+      '';
+    };
+
+    overlay = lib.mkOption {
+      type = lib.mkOptionType {
+        name = "nixpkgs-overlay";
+        description = "nixpkgs overlay";
+        check = lib.isFunction;
+        merge = lib.mergeOneOption;
+      };
+      default = import ../packages/overlay.nix;
+      defaultText = "overlay provided with the module";
+      description = ''
+        The nixpkgs overlay for asahi packages.
+      '';
+    };
+  };
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/kernel/default.nix

@@ -0,0 +1,110 @@
+# the Asahi Linux kernel and options that must go along with it
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  config = lib.mkIf config.hardware.asahi.enable {
+    boot.kernelPackages = let
+      pkgs' = config.hardware.asahi.pkgs;
+    in
+      pkgs'.linux-asahi.override {
+        _kernelPatches = config.boot.kernelPatches;
+        withRust = config.hardware.asahi.withRust;
+      };
+
+    # we definitely want to use CONFIG_ENERGY_MODEL, and
+    # schedutil is a prerequisite for using it
+    # source: https://www.kernel.org/doc/html/latest/scheduler/sched-energy.html
+    powerManagement.cpuFreqGovernor = lib.mkOverride 800 "schedutil";
+
+    boot.initrd.includeDefaultModules = false;
+    boot.initrd.availableKernelModules = [
+      # list of initrd modules stolen from
+      # https://github.com/AsahiLinux/asahi-scripts/blob/f461f080a1d2575ae4b82879b5624360db3cff8c/initcpio/install/asahi
+      "apple-mailbox"
+      "nvme_apple"
+      "pinctrl-apple-gpio"
+      "macsmc"
+      "macsmc-rtkit"
+      "i2c-apple"
+      "tps6598x"
+      "apple-dart"
+      "dwc3"
+      "dwc3-of-simple"
+      "xhci-pci"
+      "pcie-apple"
+      "gpio_macsmc"
+      "phy-apple-atc"
+      "nvmem_apple_efuses"
+      "spi-apple"
+      "spi-hid-apple"
+      "spi-hid-apple-of"
+      "rtc-macsmc"
+      "simple-mfd-spmi"
+      "spmi-apple-controller"
+      "nvmem_spmi_mfd"
+      "apple-dockchannel"
+      "dockchannel-hid"
+      "apple-rtkit-helper"
+
+      # additional stuff necessary to boot off USB for the installer
+      # and if the initrd (i.e. stage 1) goes wrong
+      "usb-storage"
+      "xhci-plat-hcd"
+      "usbhid"
+      "hid_generic"
+    ];
+
+    boot.kernelParams = [
+      "earlycon"
+      "console=ttySAC0,115200n8"
+      "console=tty0"
+      "boot.shell_on_fail"
+      # Apple's SSDs are slow (~dozens of ms) at processing flush requests which
+      # slows down programs that make a lot of fsync calls. This parameter sets
+      # a delay in ms before actually flushing so that such requests can be
+      # coalesced. Be warned that increasing this parameter above zero (default
+      # is 1000) has the potential, though admittedly unlikely, risk of
+      # UNBOUNDED data corruption in case of power loss!!!! Don't even think
+      # about it on desktops!!
+      "nvme_apple.flush_interval=0"
+    ];
+
+    # U-Boot does not support EFI variables
+    boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+    # U-Boot does not support switching console mode
+    boot.loader.systemd-boot.consoleMode = "0";
+
+    # GRUB has to be installed as removable if the user chooses to use it
+    boot.loader.grub = lib.mkDefault {
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+    };
+
+    # autosuspend was enabled as safe for the PCI SD card reader
+    # "Genesys Logic, Inc GL9755 SD Host Controller [17a0:9755] (rev 01)"
+    # by recent systemd versions, but this has a "negative interaction"
+    # with our kernel/SoC and causes random boot hangs. disable it!
+    services.udev.extraHwdb = ''
+      pci:v000017A0d00009755*
+        ID_AUTOSUSPEND=0
+    '';
+  };
+
+  imports = [
+    (lib.mkRemovedOptionModule ["hardware" "asahi" "addEdgeKernelConfig"]
+      "All edge kernel config options are now the default.")
+  ];
+
+  options.hardware.asahi.withRust = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Build the Asahi Linux kernel with Rust support.
+    '';
+  };
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/mesa/default.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  config = let
+    isMode = mode: (config.hardware.asahi.useExperimentalGPUDriver
+      && config.hardware.asahi.experimentalGPUInstallMode == mode);
+  in
+    lib.mkIf config.hardware.asahi.enable (lib.mkMerge [
+      {
+        # required for proper DRM setup even without GPU driver
+        services.xserver.config = ''
+          Section "OutputClass"
+              Identifier "appledrm"
+              MatchDriver "apple"
+              Driver "modesetting"
+              Option "PrimaryGPU" "true"
+          EndSection
+        '';
+      }
+      (lib.mkIf config.hardware.asahi.useExperimentalGPUDriver {
+        # install the drivers
+        hardware.opengl.package = config.hardware.asahi.pkgs.mesa-asahi-edge.drivers;
+
+        # required for in-kernel GPU driver
+        hardware.asahi.withRust = true;
+      })
+      (lib.mkIf (isMode "replace") {
+        # replace the Mesa linked into system packages with the Asahi version
+        # without rebuilding them to avoid rebuilding the world.
+        system.replaceRuntimeDependencies = [
+          {
+            original = pkgs.mesa;
+            replacement = config.hardware.asahi.pkgs.mesa-asahi-edge;
+          }
+        ];
+      })
+      (lib.mkIf (isMode "overlay") {
+        # replace the Mesa used in Nixpkgs with the Asahi version using an overlay,
+        # which requires rebuilding the world but ensures it is done faithfully
+        # (and in a way compatible with pure evaluation)
+        nixpkgs.overlays = [
+          (final: prev: {
+            mesa = final.mesa-asahi-edge;
+          })
+        ];
+      })
+    ]);
+
+  options.hardware.asahi.useExperimentalGPUDriver = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Use the experimental Asahi Mesa GPU driver.
+
+      Do not report issues using this driver under NixOS to the Asahi project.
+    '';
+  };
+
+  options.hardware.asahi.experimentalGPUInstallMode = lib.mkOption {
+    type = lib.types.enum ["driver" "replace" "overlay"];
+    default = "replace";
+    description = ''
+      Mode to use to install the experimental GPU driver into the system.
+
+      driver: install only as a driver, do not replace system Mesa.
+        Causes issues with certain programs like Plasma Wayland.
+
+      replace (default): use replaceRuntimeDependencies to replace system Mesa with Asahi Mesa.
+        Does not work in pure evaluation context (i.e. in flakes by default).
+
+      overlay: overlay system Mesa with Asahi Mesa
+        Requires rebuilding the world.
+    '';
+  };
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/peripheral-firmware/default.nix

@@ -0,0 +1,75 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  config = lib.mkIf config.hardware.asahi.enable {
+    assertions = lib.mkIf config.hardware.asahi.extractPeripheralFirmware [
+      {
+        assertion = config.hardware.asahi.peripheralFirmwareDirectory != null;
+        message = ''
+          Asahi peripheral firmware extraction is enabled but the firmware
+          location appears incorrect.
+        '';
+      }
+    ];
+
+    hardware.firmware = let
+      pkgs' = config.hardware.asahi.pkgs;
+    in
+      lib.mkIf ((config.hardware.asahi.peripheralFirmwareDirectory != null)
+        && config.hardware.asahi.extractPeripheralFirmware) [
+        (pkgs.stdenv.mkDerivation {
+          name = "asahi-peripheral-firmware";
+
+          nativeBuildInputs = [pkgs'.asahi-fwextract pkgs.cpio];
+
+          buildCommand = ''
+            mkdir extracted
+            asahi-fwextract ${config.hardware.asahi.peripheralFirmwareDirectory} extracted
+
+            mkdir -p $out/lib/firmware
+            cat extracted/firmware.cpio | cpio -id --quiet --no-absolute-filenames
+            mv vendorfw/* $out/lib/firmware
+          '';
+        })
+      ];
+  };
+
+  options.hardware.asahi = {
+    extractPeripheralFirmware = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Automatically extract the non-free non-redistributable peripheral
+        firmware necessary for features like Wi-Fi.
+      '';
+    };
+
+    peripheralFirmwareDirectory = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+
+      default =
+        lib.findFirst (path: builtins.pathExists (path + "/all_firmware.tar.gz")) null
+        [
+          # path when the system is operating normally
+          /boot/asahi
+          # path when the system is mounted in the installer
+          /mnt/boot/asahi
+        ];
+
+      description = ''
+        Path to the directory containing the non-free non-redistributable
+        peripheral firmware necessary for features like Wi-Fi. Ordinarily, this
+        will automatically point to the appropriate location on the ESP. Flake
+        users and those interested in maximum purity will want to copy those
+        files elsewhere and specify this manually.
+
+        Currently, this consists of the files `all-firmware.tar.gz` and
+        `kernelcache*`. The official Asahi Linux installer places these files
+        in the `asahi` directory of the EFI system partition when creating it.
+      '';
+    };
+  };
+}

hosts/aarch64-linux/alastor/apple-silicon-support/modules/sound/default.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  options,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    # disable pulseaudio as the Asahi sound infrastructure can't use it.
+    # if we disable it only if setupAsahiSound is enabled, then infinite
+    # recursion results as pulseaudio enables config.sound by default.
+    {config.hardware.pulseaudio.enable = !config.hardware.asahi.enable;}
+  ];
+
+  options.hardware.asahi = {
+    setupAsahiSound = lib.mkOption {
+      type = lib.types.bool;
+      default = config.sound.enable && config.hardware.asahi.enable;
+      description = ''
+        Set up the Asahi DSP components so that the speakers and headphone jack
+        work properly and safely.
+      '';
+    };
+  };
+
+  config = let
+    cfg = config.hardware.asahi;
+
+    asahi-audio = pkgs.asahi-audio; # the asahi-audio we use
+
+    lsp-plugins = pkgs.lsp-plugins; # the lsp-plugins we use
+
+    lsp-plugins-is-patched =
+      (lsp-plugins.overrideAttrs (old: {
+        passthru =
+          (old.passthru or {})
+          // {
+            lsp-plugins-is-patched =
+              builtins.elem "58c3f985f009c84347fa91236f164a9e47aafa93.patch"
+              (builtins.map (p: p.name) (old.patches or []));
+          };
+      }))
+      .lsp-plugins-is-patched;
+
+    lsp-plugins-is-safe = (pkgs.lib.versionAtLeast lsp-plugins.version "1.2.14") || lsp-plugins-is-patched;
+
+    # https://github.com/NixOS/nixpkgs/pull/282377
+    # options is the set of all module option declarations, rather than their
+    # values, to prevent infinite recursion
+    newHotness = builtins.hasAttr "configPackages" options.services.pipewire;
+
+    lv2Path = lib.makeSearchPath "lib/lv2" [lsp-plugins pkgs.bankstown-lv2];
+  in
+    lib.mkIf (cfg.setupAsahiSound && cfg.enable) (lib.mkMerge [
+      {
+        # enable pipewire to run real-time and avoid audible glitches
+        security.rtkit.enable = true;
+        # set up pipewire with the supported capabilities (instead of pulseaudio)
+        # and asahi-audio configs and plugins
+        services.pipewire = {
+          enable = true;
+
+          alsa.enable = true;
+          pulse.enable = true;
+          wireplumber.enable = true;
+        };
+
+        # set up enivronment so that UCM configs are used as well
+        environment.variables.ALSA_CONFIG_UCM2 = "${pkgs.alsa-ucm-conf-asahi}/share/alsa/ucm2";
+        systemd.user.services.pipewire.environment.ALSA_CONFIG_UCM2 = config.environment.variables.ALSA_CONFIG_UCM2;
+        systemd.user.services.wireplumber.environment.ALSA_CONFIG_UCM2 = config.environment.variables.ALSA_CONFIG_UCM2;
+
+        # enable speakersafetyd to protect speakers
+        systemd.packages =
+          lib.mkAssert lsp-plugins-is-safe
+          "lsp-plugins is unpatched/outdated and speakers cannot be safely enabled"
+          [pkgs.speakersafetyd];
+        services.udev.packages = [pkgs.speakersafetyd];
+      }
+      (lib.optionalAttrs newHotness {
+        # use configPackages and friends to install asahi-audio and plugins
+        services.pipewire = {
+          configPackages = [asahi-audio];
+          extraLv2Packages = [lsp-plugins pkgs.bankstown-lv2];
+          wireplumber = {
+            configPackages = [asahi-audio];
+            extraLv2Packages = [lsp-plugins pkgs.bankstown-lv2];
+          };
+        };
+      })
+      (lib.optionalAttrs (!newHotness) {
+        # use environment.etc and environment variables to install asahi-audio and plugins
+        environment.etc = builtins.listToAttrs (builtins.map
+          (f: {
+            name = f;
+            value = {source = "${asahi-audio}/share/${f}";};
+          })
+          asahi-audio.providedConfigFiles);
+
+        systemd.user.services.pipewire.environment.LV2_PATH = lv2Path;
+        systemd.user.services.wireplumber.environment.LV2_PATH = lv2Path;
+      })
+    ]);
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/alsa-ucm-conf-asahi/default.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  fetchFromGitHub,
+  alsa-ucm-conf,
+}: (alsa-ucm-conf.overrideAttrs (oldAttrs: rec {
+  version = "5";
+
+  src_asahi = fetchFromGitHub {
+    # tracking: https://src.fedoraproject.org/rpms/alsa-ucm-asahi
+    owner = "AsahiLinux";
+    repo = "alsa-ucm-conf-asahi";
+    rev = "v${version}";
+    hash = "sha256-daUNz5oUrPfSMO0Tqq/WbtiLHMOtPeQQlI+juGrhTxw=";
+  };
+
+  postInstall =
+    oldAttrs.postInstall
+    or ""
+    + ''
+      cp -r ${src_asahi}/ucm2 $out/share/alsa
+    '';
+}))

hosts/aarch64-linux/alastor/apple-silicon-support/packages/asahi-audio/default.nix

@@ -0,0 +1,51 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation rec {
+  pname = "asahi-audio";
+  # tracking: https://src.fedoraproject.org/rpms/asahi-audio
+  # note: ensure that the providedConfigFiles list below is current!
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "AsahiLinux";
+    repo = "asahi-audio";
+    rev = "v${version}";
+    hash = "sha256-NxTQD742U2FUZNmw7RHuOruMuTRLtAh1HDlMV9EzQkg=";
+  };
+
+  preBuild = ''
+    export PREFIX=$out
+
+    readarray -t configs < <(\
+          find . \
+                -name '*.conf' -or \
+                -name '*.json' -or \
+                -name '*.lua'
+    )
+
+    substituteInPlace "''${configs[@]}" --replace \
+          "/usr/share/asahi-audio" \
+          "$out/asahi-audio"
+  '';
+
+  postInstall = ''
+    # no need to link the asahi-audio dir globally
+    mv $out/share/asahi-audio $out
+  '';
+
+  # list of config files installed in $out/share/ and destined for
+  # /etc/, from the `install -pm0644 conf/` lines in the Makefile. note
+  # that the contents of asahi-audio/ stay in $out/ and the config files
+  # are modified to point to them.
+  passthru.providedConfigFiles = [
+    "wireplumber/wireplumber.conf.d/99-asahi.conf"
+    "wireplumber/policy.lua.d/85-asahi-policy.lua"
+    "wireplumber/main.lua.d/85-asahi.lua"
+    "wireplumber/scripts/policy-asahi.lua"
+    "pipewire/pipewire.conf.d/99-asahi.conf"
+    "pipewire/pipewire-pulse.conf.d/99-asahi.conf"
+  ];
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/asahi-fwextract/default.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  gzip,
+  gnutar,
+  lzfse,
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "asahi-fwextract";
+  version = "0.6.9";
+
+  # tracking version: https://github.com/AsahiLinux/PKGBUILDs/blob/main/asahi-fwextract/PKGBUILD
+  src = fetchFromGitHub {
+    owner = "AsahiLinux";
+    repo = "asahi-installer";
+    rev = "v${version}";
+    hash = "sha256-MkNi4EBgT4gfev/yWqYyw5HZxewj6XTfb8na+eI2iVo=";
+  };
+
+  postPatch = ''
+    substituteInPlace asahi_firmware/img4.py \
+      --replace 'liblzfse.so' '${lzfse}/lib/liblzfse.so'
+    substituteInPlace asahi_firmware/update.py \
+      --replace '"tar"' '"${gnutar}/bin/tar"' \
+      --replace '"xf"' '"-x", "-I", "${gzip}/bin/gzip", "-f"'
+  '';
+
+  nativeBuildInputs = [python3.pkgs.setuptools];
+
+  doCheck = false;
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/bankstown-lv2/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  lv2,
+  pkg-config,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "bankstown-lv2";
+  # tracking: https://src.fedoraproject.org/rpms/rust-bankstown-lv2
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "chadmed";
+    repo = "bankstown";
+    rev = version;
+    hash = "sha256-IThXEY+mvT2MCw0PSWU/182xbUafd6dtm6hNjieLlKg=";
+  };
+
+  cargoSha256 = "sha256-yRzM4tcYc6mweTpLnnlCeKgP00L2wRgHamtUzK9Kstc=";
+
+  installPhase = ''
+    export LIBDIR=$out/lib
+    mkdir -p $LIBDIR
+
+    make
+    make install
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    lv2
+  ];
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/linux-asahi/0001-fs-fcntl-accept-more-values-as-F_DUPFD_CLOEXEC-args.patch

@@ -0,0 +1,40 @@
+From 0fcdbacd8b06c24f5761a0cf9cb0c43cad05c19b Mon Sep 17 00:00:00 2001
+From: Thomas Watson <twatson52@icloud.com>
+Date: Mon, 26 Feb 2024 19:51:12 -0600
+Subject: [PATCH] fs/fcntl: accept more values as F_DUPFD_CLOEXEC args
+
+libwebrtc doesn't pass anything as the arg to this function so the
+minimum fd ends up as random garbage. If it's bigger than the maximum
+fd, which is likely, then the duplication fails, and libwebrtc breaks.
+
+The previous patch (081abc5fa701738699705a6c0a41c824df77cb37) rejects
+args >= 1024 (the default soft max fd) and instead subtitutes a minimum
+fd of 0 to allow such requests to succeed.
+
+However, gnulib's test suite can pass the following values and expects
+them to fail; this patch prevents those from succeeding:
+* -1 (hard-coded)
+* 1024 (`ulimit -n` value by default)
+* 1048576 (`ulimit -n` value in Nix build sandbox)
+
+Hopefully the garbage values libwebrtc passes do not match very often.
+---
+ fs/fcntl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index f18f87419445..65a6861476ec 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -326,7 +326,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
+ 		err = f_dupfd(argi, filp, 0);
+ 		break;
+ 	case F_DUPFD_CLOEXEC:
+-		if (arg >= 1024)
++		if ((arg > 1024) && (argi != 1048576) && (argi != -1))
+ 			argi = 0; /* Lol libwebrtc */
+ 		err = f_dupfd(argi, filp, O_CLOEXEC);
+ 		break;
+-- 
+2.43.0
+

hosts/aarch64-linux/alastor/apple-silicon-support/packages/linux-asahi/default.nix

@@ -0,0 +1,205 @@
+{
+  lib,
+  pkgs,
+  callPackage,
+  writeShellScriptBin,
+  writeText,
+  removeReferencesTo,
+  linuxPackagesFor,
+  withRust ? false,
+  _kernelPatches ? [],
+}: let
+  i = builtins.elemAt;
+
+  # parse <OPT> [ymn]|foo style configuration as found in a patch's extraConfig
+  # into a list of k, v tuples
+  parseExtraConfig = config: let
+    lines =
+      builtins.filter (s: s != "") (lib.strings.splitString "\n" config);
+    parseLine = line: let
+      t = lib.strings.splitString " " line;
+      join = l:
+        builtins.foldl' (a: b: "${a} ${b}")
+        (builtins.head l) (builtins.tail l);
+      v =
+        if (builtins.length t) > 2
+        then join (builtins.tail t)
+        else (i t 1);
+    in ["CONFIG_${i t 0}" v];
+  in
+    map parseLine lines;
+
+  # parse <OPT>=lib.kernel.(yes|module|no)|lib.kernel.freeform "foo"
+  # style configuration as found in a patch's extraStructuredConfig into
+  # a list of k, v tuples
+  parseExtraStructuredConfig = config:
+    lib.attrsets.mapAttrsToList
+    (k: v: ["CONFIG_${k}" (v.tristate or v.freeform)])
+    config;
+
+  parsePatchConfig = {
+    extraConfig ? "",
+    extraStructuredConfig ? {},
+    ...
+  }:
+    (parseExtraConfig extraConfig)
+    ++ (parseExtraStructuredConfig extraStructuredConfig);
+
+  # parse CONFIG_<OPT>=[ymn]|"foo" style configuration as found in a config file
+  # into a list of k, v tuples
+  parseConfig = config: let
+    parseLine = builtins.match ''(CONFIG_[[:upper:][:digit:]_]+)=(([ymn])|"([^"]*)")'';
+    # get either the [ymn] option or the "foo" option; whichever matched
+    t = l: let
+      v = i l 2;
+    in [
+      (i l 0)
+      (
+        if v != null
+        then v
+        else (i l 3)
+      )
+    ];
+    lines = lib.strings.splitString "\n" config;
+  in
+    map t (builtins.filter (l: l != null) (map parseLine lines));
+
+  origConfigfile = ./config;
+
+  linux-asahi-pkg = {
+    stdenv,
+    lib,
+    fetchFromGitHub,
+    fetchpatch,
+    linuxKernel,
+    rustPlatform,
+    rustc,
+    rustfmt,
+    rust-bindgen,
+    ...
+  } @ args: let
+    origConfigText = builtins.readFile origConfigfile;
+
+    # extraConfig from all patches in order
+    extraConfig =
+      lib.fold (patch: ex: ex ++ (parsePatchConfig patch)) [] _kernelPatches;
+    # config file text for above
+    extraConfigText = let
+      text = k: v:
+        if (v == "y") || (v == "m") || (v == "n")
+        then "${k}=${v}"
+        else ''${k}="${v}"'';
+    in (map (t: text (i t 0) (i t 1)) extraConfig);
+
+    # final config as a text file path
+    configfile =
+      if extraConfig == []
+      then origConfigfile
+      else
+        writeText "config" ''
+          ${origConfigText}
+
+          # Patches
+          ${lib.strings.concatStringsSep "\n" extraConfigText}
+        '';
+    # final config as an attrset
+    configAttrs = let
+      makePair = t: lib.nameValuePair (i t 0) (i t 1);
+      configList = (parseConfig origConfigText) ++ extraConfig;
+    in
+      builtins.listToAttrs (map makePair (lib.lists.reverseList configList));
+
+    # used to (ostensibly) keep compatibility for those running stable versions of nixos
+    rustOlder = version: withRust && (lib.versionOlder rustc.version version);
+    bindgenOlder = version: withRust && (lib.versionOlder rust-bindgen.unwrapped.version version);
+
+    # used to fix issues when nixpkgs gets ahead of the kernel
+    rustAtLeast = version: withRust && (lib.versionAtLeast rustc.version version);
+    bindgenAtLeast = version: withRust && (lib.versionAtLeast rust-bindgen.unwrapped.version version);
+  in
+    (linuxKernel.manualConfig rec {
+        inherit stdenv lib;
+
+        version = "6.6.0-asahi";
+        modDirVersion = version;
+        extraMeta.branch = "6.6";
+
+        src = fetchFromGitHub {
+          # tracking: https://github.com/AsahiLinux/linux/tree/asahi-wip (w/ fedora verification)
+          owner = "AsahiLinux";
+          repo = "linux";
+          rev = "asahi-6.6-15";
+          hash = "sha256-Jm7wTKWuwd/6ZN0g5F4CNNETiOyGQL31hfSyTDYH85k=";
+        };
+
+        kernelPatches =
+          [
+            {
+              name = "coreutils-fix";
+              patch = ./0001-fs-fcntl-accept-more-values-as-F_DUPFD_CLOEXEC-args.patch;
+            }
+            # speaker enablement; we assert on the relevant lsp-plugins patch
+            # before installing speakersafetyd to let the speakers work
+            {
+              name = "speakers-1";
+              patch = fetchpatch {
+                url = "https://github.com/AsahiLinux/linux/commit/385ea7b5023486aba7919cec8b6b3f6a843a1013.patch";
+                hash = "sha256-u7IzhJbUgBPfhJXAcpHw1I6OPzPHc1UKYjH91Ep3QHQ=";
+              };
+            }
+            {
+              name = "speakers-2";
+              patch = fetchpatch {
+                url = "https://github.com/AsahiLinux/linux/commit/6a24102c06c95951ab992e2d41336cc6d4bfdf23.patch";
+                hash = "sha256-wn5x2hN42/kCp/XHBvLWeNLfwlOBB+T6UeeMt2tSg3o=";
+              };
+            }
+          ]
+          ++ lib.optionals (rustAtLeast "1.75.0") [
+            {
+              name = "rustc-1.75.0";
+              patch = ./0001-check-in-new-alloc-for-1.75.0.patch;
+            }
+          ]
+          ++ lib.optionals (rustAtLeast "1.76.0") [
+            {
+              name = "rustc-1.76.0";
+              patch = ./rust_1_76_0.patch;
+            }
+          ]
+          ++ _kernelPatches;
+
+        inherit configfile;
+        # hide Rust support from the nixpkgs infra to avoid it re-adding the rust packages.
+        # we can't use it until it's in stable and until we've evaluated the cross-compilation impact.
+        config = configAttrs // {"CONFIG_RUST" = "n";};
+      }
+      // (args.argsOverride or {}))
+    .overrideAttrs (old:
+      if withRust
+      then {
+        nativeBuildInputs =
+          (old.nativeBuildInputs or [])
+          ++ [
+            rust-bindgen
+            rustfmt
+            rustc
+            removeReferencesTo
+          ];
+        # HACK: references shouldn't have been there in the first place
+        # TODO: remove once 23.05 is obsolete
+        postFixup =
+          (old.postFixup or "")
+          + ''
+            if [ -f $dev/lib/modules/${old.version}/build/vmlinux ]; then
+              remove-references-to -t $out $dev/lib/modules/${old.version}/build/vmlinux
+            fi
+            remove-references-to -t $dev $out/Image
+          '';
+        RUST_LIB_SRC = rustPlatform.rustLibSrc;
+      }
+      else {});
+
+  linux-asahi = callPackage linux-asahi-pkg {};
+in
+  lib.recurseIntoAttrs (linuxPackagesFor linux-asahi)

hosts/aarch64-linux/alastor/apple-silicon-support/packages/linux-asahi/rust_1_76_0.patch

@@ -0,0 +1,426 @@
+diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
+index 08eafb3de807..7cf4edb8b786 100644
+--- a/rust/alloc/alloc.rs
++++ b/rust/alloc/alloc.rs
+@@ -426,12 +426,14 @@ pub unsafe fn __rdl_oom(size: usize, _align: usize) -> ! {
+     }
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ /// Specialize clones into pre-allocated, uninitialized memory.
+ /// Used by `Box::clone` and `Rc`/`Arc::make_mut`.
+ pub(crate) trait WriteCloneIntoRaw: Sized {
+     unsafe fn write_clone_into_raw(&self, target: *mut Self);
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ impl<T: Clone> WriteCloneIntoRaw for T {
+     #[inline]
+     default unsafe fn write_clone_into_raw(&self, target: *mut Self) {
+@@ -441,6 +443,7 @@ impl<T: Clone> WriteCloneIntoRaw for T {
+     }
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ impl<T: Copy> WriteCloneIntoRaw for T {
+     #[inline]
+     unsafe fn write_clone_into_raw(&self, target: *mut Self) {
+diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
+index ed7e2f666178..359b8bcdb7a2 100644
+--- a/rust/alloc/boxed.rs
++++ b/rust/alloc/boxed.rs
+@@ -1030,10 +1030,18 @@ impl<T: ?Sized, A: Allocator> Box<T, A> {
+     /// use std::ptr;
+     ///
+     /// let x = Box::new(String::from("Hello"));
+-    /// let p = Box::into_raw(x);
++    /// let ptr = Box::into_raw(x);
++    /// unsafe {
++    ///     ptr::drop_in_place(ptr);
++    ///     dealloc(ptr as *mut u8, Layout::new::<String>());
++    /// }
++    /// ```
++    /// Note: This is equivalent to the following:
++    /// ```
++    /// let x = Box::new(String::from("Hello"));
++    /// let ptr = Box::into_raw(x);
+     /// unsafe {
+-    ///     ptr::drop_in_place(p);
+-    ///     dealloc(p as *mut u8, Layout::new::<String>());
++    ///     drop(Box::from_raw(ptr));
+     /// }
+     /// ```
+     ///
+diff --git a/rust/alloc/collections/mod.rs b/rust/alloc/collections/mod.rs
+index 2506065d158a..00ffb3b97365 100644
+--- a/rust/alloc/collections/mod.rs
++++ b/rust/alloc/collections/mod.rs
+@@ -150,6 +150,7 @@ fn fmt(
+ 
+ /// An intermediate trait for specialization of `Extend`.
+ #[doc(hidden)]
++#[cfg(not(no_global_oom_handling))]
+ trait SpecExtend<I: IntoIterator> {
+     /// Extends `self` with the contents of the given iterator.
+     fn spec_extend(&mut self, iter: I);
+diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
+index 65b7a02d0956..6cddaf298118 100644
+--- a/rust/alloc/lib.rs
++++ b/rust/alloc/lib.rs
+@@ -157,6 +157,7 @@
+ #![feature(std_internals)]
+ #![feature(str_internals)]
+ #![feature(strict_provenance)]
++#![feature(trusted_fused)]
+ #![feature(trusted_len)]
+ #![feature(trusted_random_access)]
+ #![feature(try_trait_v2)]
+@@ -276,7 +277,7 @@ pub(crate) mod test_helpers {
+     /// seed not being the same for every RNG invocation too.
+     pub(crate) fn test_rng() -> rand_xorshift::XorShiftRng {
+         use std::hash::{BuildHasher, Hash, Hasher};
+-        let mut hasher = std::collections::hash_map::RandomState::new().build_hasher();
++        let mut hasher = std::hash::RandomState::new().build_hasher();
+         std::panic::Location::caller().hash(&mut hasher);
+         let hc64 = hasher.finish();
+         let seed_vec =
+diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
+index 65d5ce15828e..3fb1ee104cff 100644
+--- a/rust/alloc/raw_vec.rs
++++ b/rust/alloc/raw_vec.rs
+@@ -27,6 +27,16 @@ enum AllocInit {
+     Zeroed,
+ }
+ 
++#[repr(transparent)]
++#[cfg_attr(target_pointer_width = "16", rustc_layout_scalar_valid_range_end(0x7fff))]
++#[cfg_attr(target_pointer_width = "32", rustc_layout_scalar_valid_range_end(0x7fff_ffff))]
++#[cfg_attr(target_pointer_width = "64", rustc_layout_scalar_valid_range_end(0x7fff_ffff_ffff_ffff))]
++struct Cap(usize);
++
++impl Cap {
++    const ZERO: Cap = unsafe { Cap(0) };
++}
++
+ /// A low-level utility for more ergonomically allocating, reallocating, and deallocating
+ /// a buffer of memory on the heap without having to worry about all the corner cases
+ /// involved. This type is excellent for building your own data structures like Vec and VecDeque.
+@@ -52,7 +62,12 @@ enum AllocInit {
+ #[allow(missing_debug_implementations)]
+ pub(crate) struct RawVec<T, A: Allocator = Global> {
+     ptr: Unique<T>,
+-    cap: usize,
++    /// Never used for ZSTs; it's `capacity()`'s responsibility to return usize::MAX in that case.
++    ///
++    /// # Safety
++    ///
++    /// `cap` must be in the `0..=isize::MAX` range.
++    cap: Cap,
+     alloc: A,
+ }
+ 
+@@ -121,7 +136,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     /// the returned `RawVec`.
+     pub const fn new_in(alloc: A) -> Self {
+         // `cap: 0` means "unallocated". zero-sized types are ignored.
+-        Self { ptr: Unique::dangling(), cap: 0, alloc }
++        Self { ptr: Unique::dangling(), cap: Cap::ZERO, alloc }
+     }
+ 
+     /// Like `with_capacity`, but parameterized over the choice of
+@@ -203,7 +218,7 @@ fn allocate_in(capacity: usize, init: AllocInit, alloc: A) -> Self {
+             // here should change to `ptr.len() / mem::size_of::<T>()`.
+             Self {
+                 ptr: unsafe { Unique::new_unchecked(ptr.cast().as_ptr()) },
+-                cap: capacity,
++                cap: unsafe { Cap(capacity) },
+                 alloc,
+             }
+         }
+@@ -228,7 +243,7 @@ fn try_allocate_in(capacity: usize, init: AllocInit, alloc: A) -> Result<Self, T
+         // here should change to `ptr.len() / mem::size_of::<T>()`.
+         Ok(Self {
+             ptr: unsafe { Unique::new_unchecked(ptr.cast().as_ptr()) },
+-            cap: capacity,
++            cap: unsafe { Cap(capacity) },
+             alloc,
+         })
+     }
+@@ -240,12 +255,13 @@ fn try_allocate_in(capacity: usize, init: AllocInit, alloc: A) -> Result<Self, T
+     /// The `ptr` must be allocated (via the given allocator `alloc`), and with the given
+     /// `capacity`.
+     /// The `capacity` cannot exceed `isize::MAX` for sized types. (only a concern on 32-bit
+-    /// systems). ZST vectors may have a capacity up to `usize::MAX`.
++    /// systems). For ZSTs capacity is ignored.
+     /// If the `ptr` and `capacity` come from a `RawVec` created via `alloc`, then this is
+     /// guaranteed.
+     #[inline]
+     pub unsafe fn from_raw_parts_in(ptr: *mut T, capacity: usize, alloc: A) -> Self {
+-        Self { ptr: unsafe { Unique::new_unchecked(ptr) }, cap: capacity, alloc }
++        let cap = if T::IS_ZST { Cap::ZERO } else { unsafe { Cap(capacity) } };
++        Self { ptr: unsafe { Unique::new_unchecked(ptr) }, cap, alloc }
+     }
+ 
+     /// Gets a raw pointer to the start of the allocation. Note that this is
+@@ -261,7 +277,7 @@ pub fn ptr(&self) -> *mut T {
+     /// This will always be `usize::MAX` if `T` is zero-sized.
+     #[inline(always)]
+     pub fn capacity(&self) -> usize {
+-        if T::IS_ZST { usize::MAX } else { self.cap }
++        if T::IS_ZST { usize::MAX } else { self.cap.0 }
+     }
+ 
+     /// Returns a shared reference to the allocator backing this `RawVec`.
+@@ -270,7 +286,7 @@ pub fn allocator(&self) -> &A {
+     }
+ 
+     fn current_memory(&self) -> Option<(NonNull<u8>, Layout)> {
+-        if T::IS_ZST || self.cap == 0 {
++        if T::IS_ZST || self.cap.0 == 0 {
+             None
+         } else {
+             // We could use Layout::array here which ensures the absence of isize and usize overflows
+@@ -280,7 +296,7 @@ fn current_memory(&self) -> Option<(NonNull<u8>, Layout)> {
+             let _: () = const { assert!(mem::size_of::<T>() % mem::align_of::<T>() == 0) };
+             unsafe {
+                 let align = mem::align_of::<T>();
+-                let size = mem::size_of::<T>().unchecked_mul(self.cap);
++                let size = mem::size_of::<T>().unchecked_mul(self.cap.0);
+                 let layout = Layout::from_size_align_unchecked(size, align);
+                 Some((self.ptr.cast().into(), layout))
+             }
+@@ -404,12 +420,15 @@ fn needs_to_grow(&self, len: usize, additional: usize) -> bool {
+         additional > self.capacity().wrapping_sub(len)
+     }
+ 
+-    fn set_ptr_and_cap(&mut self, ptr: NonNull<[u8]>, cap: usize) {
++    /// # Safety:
++    ///
++    /// `cap` must not exceed `isize::MAX`.
++    unsafe fn set_ptr_and_cap(&mut self, ptr: NonNull<[u8]>, cap: usize) {
+         // Allocators currently return a `NonNull<[u8]>` whose length matches
+         // the size requested. If that ever changes, the capacity here should
+         // change to `ptr.len() / mem::size_of::<T>()`.
+         self.ptr = unsafe { Unique::new_unchecked(ptr.cast().as_ptr()) };
+-        self.cap = cap;
++        self.cap = unsafe { Cap(cap) };
+     }
+ 
+     // This method is usually instantiated many times. So we want it to be as
+@@ -434,14 +453,15 @@ fn grow_amortized(&mut self, len: usize, additional: usize) -> Result<(), TryRes
+ 
+         // This guarantees exponential growth. The doubling cannot overflow
+         // because `cap <= isize::MAX` and the type of `cap` is `usize`.
+-        let cap = cmp::max(self.cap * 2, required_cap);
++        let cap = cmp::max(self.cap.0 * 2, required_cap);
+         let cap = cmp::max(Self::MIN_NON_ZERO_CAP, cap);
+ 
+         let new_layout = Layout::array::<T>(cap);
+ 
+         // `finish_grow` is non-generic over `T`.
+         let ptr = finish_grow(new_layout, self.current_memory(), &mut self.alloc)?;
+-        self.set_ptr_and_cap(ptr, cap);
++        // SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than isize::MAX items
++        unsafe { self.set_ptr_and_cap(ptr, cap) };
+         Ok(())
+     }
+ 
+@@ -460,7 +480,10 @@ fn grow_exact(&mut self, len: usize, additional: usize) -> Result<(), TryReserve
+ 
+         // `finish_grow` is non-generic over `T`.
+         let ptr = finish_grow(new_layout, self.current_memory(), &mut self.alloc)?;
+-        self.set_ptr_and_cap(ptr, cap);
++        // SAFETY: finish_grow would have resulted in a capacity overflow if we tried to allocate more than isize::MAX items
++        unsafe {
++            self.set_ptr_and_cap(ptr, cap);
++        }
+         Ok(())
+     }
+ 
+diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
+index aac0ec16aef1..136bfe94af6c 100644
+--- a/rust/alloc/vec/into_iter.rs
++++ b/rust/alloc/vec/into_iter.rs
+@@ -9,7 +9,8 @@
+ use core::array;
+ use core::fmt;
+ use core::iter::{
+-    FusedIterator, InPlaceIterable, SourceIter, TrustedLen, TrustedRandomAccessNoCoerce,
++    FusedIterator, InPlaceIterable, SourceIter, TrustedFused, TrustedLen,
++    TrustedRandomAccessNoCoerce,
+ };
+ use core::marker::PhantomData;
+ use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
+@@ -287,9 +288,7 @@ unsafe fn __iterator_get_unchecked(&mut self, i: usize) -> Self::Item
+         // Also note the implementation of `Self: TrustedRandomAccess` requires
+         // that `T: Copy` so reading elements from the buffer doesn't invalidate
+         // them for `Drop`.
+-        unsafe {
+-            if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) }
+-        }
++        unsafe { if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) } }
+     }
+ }
+ 
+@@ -341,6 +340,10 @@ fn is_empty(&self) -> bool {
+ #[stable(feature = "fused", since = "1.26.0")]
+ impl<T, A: Allocator> FusedIterator for IntoIter<T, A> {}
+ 
++#[doc(hidden)]
++#[unstable(issue = "none", feature = "trusted_fused")]
++unsafe impl<T, A: Allocator> TrustedFused for IntoIter<T, A> {}
++
+ #[unstable(feature = "trusted_len", issue = "37572")]
+ unsafe impl<T, A: Allocator> TrustedLen for IntoIter<T, A> {}
+ 
+@@ -425,7 +428,10 @@ fn drop(&mut self) {
+ // also refer to the vec::in_place_collect module documentation to get an overview
+ #[unstable(issue = "none", feature = "inplace_iteration")]
+ #[doc(hidden)]
+-unsafe impl<T, A: Allocator> InPlaceIterable for IntoIter<T, A> {}
++unsafe impl<T, A: Allocator> InPlaceIterable for IntoIter<T, A> {
++    const EXPAND_BY: Option<NonZeroUsize> = NonZeroUsize::new(1);
++    const MERGE_BY: Option<NonZeroUsize> = NonZeroUsize::new(1);
++}
+ 
+ #[unstable(issue = "none", feature = "inplace_iteration")]
+ #[doc(hidden)]
+diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
+index 05c70de0227e..2534ec65500e 100644
+--- a/rust/alloc/vec/mod.rs
++++ b/rust/alloc/vec/mod.rs
+@@ -105,6 +105,7 @@
+ #[cfg(not(no_global_oom_handling))]
+ use self::is_zero::IsZero;
+ 
++#[cfg(not(no_global_oom_handling))]
+ mod is_zero;
+ 
+ #[cfg(not(no_global_oom_handling))]
+@@ -123,7 +124,7 @@
+ mod set_len_on_drop;
+ 
+ #[cfg(not(no_global_oom_handling))]
+-use self::in_place_drop::{InPlaceDrop, InPlaceDstBufDrop};
++use self::in_place_drop::{InPlaceDrop, InPlaceDstDataSrcBufDrop};
+ 
+ #[cfg(not(no_global_oom_handling))]
+ mod in_place_drop;
+@@ -1837,7 +1838,32 @@ pub fn dedup_by<F>(&mut self, mut same_bucket: F)
+             return;
+         }
+ 
+-        /* INVARIANT: vec.len() > read >= write > write-1 >= 0 */
++        // Check if we ever want to remove anything.
++        // This allows to use copy_non_overlapping in next cycle.
++        // And avoids any memory writes if we don't need to remove anything.
++        let mut first_duplicate_idx: usize = 1;
++        let start = self.as_mut_ptr();
++        while first_duplicate_idx != len {
++            let found_duplicate = unsafe {
++                // SAFETY: first_duplicate always in range [1..len)
++                // Note that we start iteration from 1 so we never overflow.
++                let prev = start.add(first_duplicate_idx.wrapping_sub(1));
++                let current = start.add(first_duplicate_idx);
++                // We explicitly say in docs that references are reversed.
++                same_bucket(&mut *current, &mut *prev)
++            };
++            if found_duplicate {
++                break;
++            }
++            first_duplicate_idx += 1;
++        }
++        // Don't need to remove anything.
++        // We cannot get bigger than len.
++        if first_duplicate_idx == len {
++            return;
++        }
++
++        /* INVARIANT: vec.len() > read > write > write-1 >= 0 */
+         struct FillGapOnDrop<'a, T, A: core::alloc::Allocator> {
+             /* Offset of the element we want to check if it is duplicate */
+             read: usize,
+@@ -1883,31 +1909,39 @@ fn drop(&mut self) {
+             }
+         }
+ 
+-        let mut gap = FillGapOnDrop { read: 1, write: 1, vec: self };
+-        let ptr = gap.vec.as_mut_ptr();
+-
+         /* Drop items while going through Vec, it should be more efficient than
+          * doing slice partition_dedup + truncate */
+ 
++        // Construct gap first and then drop item to avoid memory corruption if `T::drop` panics.
++        let mut gap =
++            FillGapOnDrop { read: first_duplicate_idx + 1, write: first_duplicate_idx, vec: self };
++        unsafe {
++            // SAFETY: we checked that first_duplicate_idx in bounds before.
++            // If drop panics, `gap` would remove this item without drop.
++            ptr::drop_in_place(start.add(first_duplicate_idx));
++        }
++
+         /* SAFETY: Because of the invariant, read_ptr, prev_ptr and write_ptr
+          * are always in-bounds and read_ptr never aliases prev_ptr */
+         unsafe {
+             while gap.read < len {
+-                let read_ptr = ptr.add(gap.read);
+-                let prev_ptr = ptr.add(gap.write.wrapping_sub(1));
++                let read_ptr = start.add(gap.read);
++                let prev_ptr = start.add(gap.write.wrapping_sub(1));
+ 
+-                if same_bucket(&mut *read_ptr, &mut *prev_ptr) {
++                // We explicitly say in docs that references are reversed.
++                let found_duplicate = same_bucket(&mut *read_ptr, &mut *prev_ptr);
++                if found_duplicate {
+                     // Increase `gap.read` now since the drop may panic.
+                     gap.read += 1;
+                     /* We have found duplicate, drop it in-place */
+                     ptr::drop_in_place(read_ptr);
+                 } else {
+-                    let write_ptr = ptr.add(gap.write);
++                    let write_ptr = start.add(gap.write);
+ 
+-                    /* Because `read_ptr` can be equal to `write_ptr`, we either
+-                     * have to use `copy` or conditional `copy_nonoverlapping`.
+-                     * Looks like the first option is faster. */
+-                    ptr::copy(read_ptr, write_ptr, 1);
++                    /* read_ptr cannot be equal to write_ptr because at this point
++                     * we guaranteed to skip at least one element (before loop starts).
++                     */
++                    ptr::copy_nonoverlapping(read_ptr, write_ptr, 1);
+ 
+                     /* We have filled that place, so go further */
+                     gap.write += 1;
+@@ -2802,6 +2836,7 @@ pub fn from_elem_in<T: Clone, A: Allocator>(elem: T, n: usize, alloc: A) -> Vec<
+     <T as SpecFromElem>::from_elem(elem, n, alloc)
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ trait ExtendFromWithinSpec {
+     /// # Safety
+     ///
+@@ -2810,6 +2845,7 @@ trait ExtendFromWithinSpec {
+     unsafe fn spec_extend_from_within(&mut self, src: Range<usize>);
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ impl<T: Clone, A: Allocator> ExtendFromWithinSpec for Vec<T, A> {
+     default unsafe fn spec_extend_from_within(&mut self, src: Range<usize>) {
+         // SAFETY:
+@@ -2829,6 +2865,7 @@ impl<T: Clone, A: Allocator> ExtendFromWithinSpec for Vec<T, A> {
+     }
+ }
+ 
++#[cfg(not(no_global_oom_handling))]
+ impl<T: Copy, A: Allocator> ExtendFromWithinSpec for Vec<T, A> {
+     unsafe fn spec_extend_from_within(&mut self, src: Range<usize>) {
+         let count = src.len();
+@@ -2909,7 +2946,7 @@ fn clone_from(&mut self, other: &Self) {
+ /// ```
+ /// use std::hash::BuildHasher;
+ ///
+-/// let b = std::collections::hash_map::RandomState::new();
++/// let b = std::hash::RandomState::new();
+ /// let v: Vec<u8> = vec![0xa8, 0x3c, 0x09];
+ /// let s: &[u8] = &[0xa8, 0x3c, 0x09];
+ /// assert_eq!(b.hash_one(v), b.hash_one(s));

hosts/aarch64-linux/alastor/apple-silicon-support/packages/m1n1/default.nix

@@ -0,0 +1,108 @@
+{
+  stdenv,
+  buildPackages,
+  lib,
+  fetchFromGitHub,
+  python3,
+  dtc,
+  imagemagick,
+  isRelease ? false,
+  withTools ? true,
+  withChainloading ? false,
+  rust-bin ? null,
+  customLogo ? null,
+}:
+assert withChainloading -> rust-bin != null; let
+  pyenv = python3.withPackages (p:
+    with p; [
+      construct
+      pyserial
+    ]);
+
+  rustenv = rust-bin.selectLatestNightlyWith (toolchain:
+    toolchain.minimal.override {
+      targets = ["aarch64-unknown-none-softfloat"];
+    });
+in
+  stdenv.mkDerivation rec {
+    pname = "m1n1";
+    version = "1.4.11";
+
+    src = fetchFromGitHub {
+      # tracking: https://src.fedoraproject.org/rpms/m1n1
+      owner = "AsahiLinux";
+      repo = "m1n1";
+      rev = "v${version}";
+      hash = "sha256-1lWI9tcOxgrcfaPfdSF+xRE9qofhNR3SQiA4h86VVeE=";
+      fetchSubmodules = true;
+    };
+
+    makeFlags =
+      ["ARCH=${stdenv.cc.targetPrefix}"]
+      ++ lib.optional isRelease "RELEASE=1"
+      ++ lib.optional withChainloading "CHAINLOADING=1";
+
+    nativeBuildInputs =
+      [
+        dtc
+        buildPackages.gcc
+      ]
+      ++ lib.optional withChainloading rustenv
+      ++ lib.optional (customLogo != null) imagemagick;
+
+    postPatch = ''
+      substituteInPlace proxyclient/m1n1/asm.py \
+        --replace 'aarch64-linux-gnu-' 'aarch64-unknown-linux-gnu-' \
+        --replace 'TOOLCHAIN = ""' 'TOOLCHAIN = "'$out'/toolchain-bin/"'
+    '';
+
+    preConfigure = lib.optionalString (customLogo != null) ''
+      pushd data &>/dev/null
+      ln -fs ${customLogo} bootlogo_256.png
+      if [[ "$(magick identify bootlogo_256.png)" != 'bootlogo_256.png PNG 256x256'* ]]; then
+        echo "Custom logo is not a 256x256 PNG"
+        exit 1
+      fi
+
+      rm bootlogo_128.png
+      convert bootlogo_256.png -resize 128x128 bootlogo_128.png
+      patchShebangs --build ./makelogo.sh
+      ./makelogo.sh
+      popd &>/dev/null
+    '';
+
+    installPhase =
+      ''
+        runHook preInstall
+
+        mkdir -p $out/build
+        cp build/m1n1.bin $out/build
+      ''
+      + (lib.optionalString withTools ''
+            mkdir -p $out/{bin,script,toolchain-bin}
+            cp -r proxyclient $out/script
+            cp -r tools $out/script
+
+            for toolpath in $out/script/proxyclient/tools/*.py; do
+              tool=$(basename $toolpath .py)
+              script=$out/bin/m1n1-$tool
+              cat > $script <<EOF
+        #!/bin/sh
+        ${pyenv}/bin/python $toolpath "\$@"
+        EOF
+              chmod +x $script
+            done
+
+            GCC=${buildPackages.gcc}
+            BINUTILS=${buildPackages.binutils-unwrapped}
+
+            ln -s $GCC/bin/${stdenv.cc.targetPrefix}gcc $out/toolchain-bin/
+            ln -s $GCC/bin/${stdenv.cc.targetPrefix}ld $out/toolchain-bin/
+            ln -s $BINUTILS/bin/${stdenv.cc.targetPrefix}objcopy $out/toolchain-bin/
+            ln -s $BINUTILS/bin/${stdenv.cc.targetPrefix}objdump $out/toolchain-bin/
+            ln -s $GCC/bin/${stdenv.cc.targetPrefix}nm $out/toolchain-bin/
+      '')
+      + ''
+        runHook postInstall
+      '';
+  }

hosts/aarch64-linux/alastor/apple-silicon-support/packages/mesa-asahi-edge/default.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  fetchFromGitLab,
+  mesa,
+  meson,
+  llvmPackages,
+}:
+(mesa.override {
+  galliumDrivers = ["swrast" "asahi"];
+  vulkanDrivers = ["swrast"];
+  enableGalliumNine = false;
+  # libclc and other OpenCL components are needed for geometry shader support on Apple Silicon
+  enableOpenCL = true;
+})
+.overrideAttrs (oldAttrs: {
+  # version must be the same length (i.e. no unstable or date)
+  # so that system.replaceRuntimeDependencies can work
+  version = "24.1.0";
+  src = fetchFromGitLab {
+    # tracking: https://pagure.io/fedora-asahi/mesa/commits/asahi
+    domain = "gitlab.freedesktop.org";
+    owner = "asahi";
+    repo = "mesa";
+    rev = "asahi-20240228";
+    hash = "sha256-wOFJyYfoN6yxE9HaHXLP/0MhjyRvmlb+jPPUke0sbbE=";
+  };
+
+  mesonFlags =
+    # remove flag to configure xvmc functionality as having it
+    # breaks the build because that no longer exists in Mesa 23
+    (lib.filter (x: !(lib.hasPrefix "-Dxvmc-libs-path=" x)) oldAttrs.mesonFlags)
+    ++ [
+      # we do not build any graphics drivers these features can be enabled for
+      "-Dgallium-va=disabled"
+      "-Dgallium-vdpau=disabled"
+      "-Dgallium-xa=disabled"
+      # does not make any sense
+      "-Dandroid-libbacktrace=disabled"
+      # do not want to add the dependencies
+      "-Dlibunwind=disabled"
+      "-Dlmsensors=disabled"
+    ]
+    ++ ( # does not compile on nixpkgs stable, doesn't seem mandatory
+      lib.optional (lib.versionOlder meson.version "1.3.1")
+      "-Dgallium-rusticl=false"
+    );
+
+  # replace patches with ones tweaked slightly to apply to this version
+  patches = [
+    ./disk_cache-include-dri-driver-path-in-cache-key.patch
+    ./opencl.patch
+  ];
+})

hosts/aarch64-linux/alastor/apple-silicon-support/packages/mesa-asahi-edge/disk_cache-include-dri-driver-path-in-cache-key.patch

@@ -0,0 +1,67 @@
+Author: David McFarland <corngood@gmail.com>
+Date:   Mon Aug 6 15:52:11 2018 -0300
+
+    [PATCH] disk_cache: include dri driver path in cache key
+    
+    This fixes invalid cache hits on NixOS where all shared library
+    timestamps in /nix/store are zero.
+
+diff --git a/meson_options.txt b/meson_options.txt
+index 512e05d..93001da 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -513,6 +513,13 @@ option(
+   description : 'Enable direct rendering in GLX and EGL for DRI',
+ )
+ 
++option(
++  'disk-cache-key',
++  type : 'string',
++  value : '',
++  description : 'Mesa cache key.'
++)
++
+ option('egl-lib-suffix',
+   type : 'string',
+   value : '',
+diff --git a/src/util/disk_cache.c b/src/util/disk_cache.c
+index 8298f9d..e622133 100644
+--- a/src/util/disk_cache.c
++++ b/src/util/disk_cache.c
+@@ -226,8 +226,10 @@ disk_cache_type_create(const char *gpu_name,
+ 
+    /* Create driver id keys */
+    size_t id_size = strlen(driver_id) + 1;
++   size_t key_size = strlen(DISK_CACHE_KEY) + 1;
+    size_t gpu_name_size = strlen(gpu_name) + 1;
+    cache->driver_keys_blob_size += id_size;
++   cache->driver_keys_blob_size += key_size;
+    cache->driver_keys_blob_size += gpu_name_size;
+ 
+    /* We sometimes store entire structs that contains a pointers in the cache,
+@@ -248,6 +250,7 @@ disk_cache_type_create(const char *gpu_name,
+    uint8_t *drv_key_blob = cache->driver_keys_blob;
+    DRV_KEY_CPY(drv_key_blob, &cache_version, cv_size)
+    DRV_KEY_CPY(drv_key_blob, driver_id, id_size)
++   DRV_KEY_CPY(drv_key_blob, DISK_CACHE_KEY, key_size)
+    DRV_KEY_CPY(drv_key_blob, gpu_name, gpu_name_size)
+    DRV_KEY_CPY(drv_key_blob, &ptr_size, ptr_size_size)
+    DRV_KEY_CPY(drv_key_blob, &driver_flags, driver_flags_size)
+diff --git a/src/util/meson.build b/src/util/meson.build
+index c0c1b9d..442163c 100644
+--- a/src/util/meson.build
++++ b/src/util/meson.build
+@@ -268,7 +268,12 @@ _libmesa_util = static_library(
+   include_directories : [inc_util, include_directories('format')],
+   dependencies : deps_for_libmesa_util,
+   link_with: [libmesa_util_sse41],
+-  c_args : [c_msvc_compat_args],
++  c_args : [
++    c_msvc_compat_args,
++    '-DDISK_CACHE_KEY="@0@"'.format(
++      get_option('disk-cache-key')
++    ),
++  ],
+   gnu_symbol_visibility : 'hidden',
+   build_by_default : false
+ )

hosts/aarch64-linux/alastor/apple-silicon-support/packages/mesa-asahi-edge/opencl.patch

@@ -0,0 +1,84 @@
+From bbd0f154183e4d26a14bb005f6afc636629c201e Mon Sep 17 00:00:00 2001
+From: Thomas Watson <twatson52@icloud.com>
+Date: Sat, 16 Dec 2023 20:46:51 -0600
+Subject: [PATCH] opencl.patch from nixpkgs
+ f416128e90ac75bec060e8b9435fe9c38423c036
+
+---
+ meson.build                             | 2 +-
+ meson_options.txt                       | 6 ++++++
+ src/gallium/targets/opencl/meson.build  | 6 +++---
+ src/gallium/targets/rusticl/meson.build | 3 +--
+ 4 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 552ff196aa8..9e10156b875 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1829,7 +1829,7 @@ endif
+ 
+ dep_clang = null_dep
+ if with_clc
+-  llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
++  llvm_libdir = get_option('clang-libdir')
+ 
+   dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
+ 
+diff --git a/meson_options.txt b/meson_options.txt
+index c76fa6d3382..d2021f55634 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -1,6 +1,12 @@
+ # Copyright © 2017-2019 Intel Corporation
+ # SPDX-License-Identifier: MIT
+ 
++option(
++  'clang-libdir',
++  type : 'string',
++  value : '',
++  description : 'Locations to search for clang libraries.'
++)
+ option(
+   'platforms',
+   type : 'array',
+diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
+index 7c14135898e..cbcd67cc443 100644
+--- a/src/gallium/targets/opencl/meson.build
++++ b/src/gallium/targets/opencl/meson.build
+@@ -39,7 +39,8 @@ if dep_llvm.version().version_compare('>=10.0.0')
+   polly_isl_dep = cpp.find_library('PollyISL', dirs : llvm_libdir, required : false)
+ endif
+ 
+-dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
++clang_libdir = get_option('clang-libdir')
++dep_clang = cpp.find_library('clang-cpp', dirs : clang_libdir, required : false)
+ 
+ # meson will return clang-cpp from system dirs if it's not found in llvm_libdir
+ linker_rpath_arg = '-Wl,--rpath=@0@'.format(llvm_libdir)
+@@ -123,8 +124,7 @@ if with_opencl_icd
+     configuration : _config,
+     input : 'mesa.icd.in',
+     output : 'mesa.icd',
+-    install : true,
+-    install_tag : 'runtime',
++    install : false,
+     install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
+   )
+ 
+diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
+index b2963fe6dfa..2f784bdccd4 100644
+--- a/src/gallium/targets/rusticl/meson.build
++++ b/src/gallium/targets/rusticl/meson.build
+@@ -76,8 +76,7 @@ configure_file(
+   configuration : _config,
+   input : 'rusticl.icd.in',
+   output : 'rusticl.icd',
+-  install : true,
+-  install_tag : 'runtime',
++  install : false,
+   install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
+ )
+ 
+-- 
+2.40.1
+

hosts/aarch64-linux/alastor/apple-silicon-support/packages/overlay.nix

@@ -0,0 +1,11 @@
+final: prev: {
+  linux-asahi = final.callPackage ./linux-asahi {};
+  m1n1 = final.callPackage ./m1n1 {};
+  uboot-asahi = final.callPackage ./uboot-asahi {};
+  asahi-fwextract = final.callPackage ./asahi-fwextract {};
+  mesa-asahi-edge = final.callPackage ./mesa-asahi-edge {inherit (prev) mesa;};
+  alsa-ucm-conf-asahi = final.callPackage ./alsa-ucm-conf-asahi {inherit (prev) alsa-ucm-conf;};
+  speakersafetyd = final.callPackage ./speakersafetyd {};
+  bankstown-lv2 = final.callPackage ./bankstown-lv2 {};
+  asahi-audio = final.callPackage ./asahi-audio {};
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/speakersafetyd/default.nix

@@ -0,0 +1,36 @@
+{
+  rustPlatform,
+  stdenv,
+  rust,
+  fetchCrate,
+  pkg-config,
+  alsa-lib,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "speakersafetyd";
+  # tracking: https://src.fedoraproject.org/rpms/rust-speakersafetyd
+  version = "0.1.9";
+
+  nativeBuildInputs = [pkg-config];
+  buildInputs = [alsa-lib];
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-I1fL1U4vqKxPS1t6vujMTdi/JAAOCcPkvUqv6FqkId4=";
+  };
+  cargoHash = "sha256-Adwct+qFhUsOIao8XqNK2zcn13DBlQNA+X4aRFeIAXM=";
+
+  postPatch = ''
+    substituteInPlace speakersafetyd.service --replace "/usr" "$out"
+    substituteInPlace Makefile --replace "target/release" "target/${rust.lib.toRustTargetSpec stdenv.hostPlatform}/$cargoBuildType"
+  '';
+
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "BINDIR=/bin"
+    "SHAREDIR=/share"
+    "TMPFILESDIR=/lib/tmpfiles.d"
+  ];
+
+  dontCargoInstall = true;
+}

hosts/aarch64-linux/alastor/apple-silicon-support/packages/uboot-asahi/default.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildUBoot,
+  m1n1,
+}:
+(buildUBoot rec {
+  src = fetchFromGitHub {
+    # tracking: https://pagure.io/fedora-asahi/uboot-tools/commits/main
+    owner = "AsahiLinux";
+    repo = "u-boot";
+    rev = "asahi-v2023.07.02-4";
+    hash = "sha256-M4qkEyNgwV2AKSr5VzPGfhHo1kGy8Tw8TfyP36cgYjc=";
+  };
+  version = "2023.07.02.asahi4-1";
+
+  defconfig = "apple_m1_defconfig";
+  extraMeta.platforms = ["aarch64-linux"];
+  filesToInstall = [
+    "u-boot-nodtb.bin.gz"
+    "m1n1-u-boot.bin"
+  ];
+  extraConfig = ''
+    CONFIG_IDENT_STRING=" ${version}"
+    CONFIG_VIDEO_FONT_4X6=n
+    CONFIG_VIDEO_FONT_8X16=n
+    CONFIG_VIDEO_FONT_SUN12X22=n
+    CONFIG_VIDEO_FONT_16X32=y
+  '';
+})
+.overrideAttrs (o: {
+  # nixos's downstream patches are not applicable
+  patches = [
+  ];
+
+  # DTC= flag somehow breaks DTC compilation so we remove it
+  makeFlags = builtins.filter (s: (!(lib.strings.hasPrefix "DTC=" s))) o.makeFlags;
+
+  preInstall = ''
+    # compress so that m1n1 knows U-Boot's size and can find things after it
+    gzip -n u-boot-nodtb.bin
+    cat ${m1n1}/build/m1n1.bin arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.bin
+  '';
+})

hosts/aarch64-linux/alastor/default.nix

@@ -0,0 +1,150 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./apple-silicon-support
+    ../../../common
+    #../../antivirus.nix
+    ../../../modules/home-manager.nix
+    ../../gc.nix
+  ];
+  nixpkgs.config.allowUnfree = true;
+  hardware.asahi.peripheralFirmwareDirectory = ./firmware;
+  hardware.asahi.useExperimentalGPUDriver = true;
+  hardware.asahi.withRust = true;
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport = true;
+  hardware.opengl.driSupport32Bit = lib.mkForce false;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+
+  networking.hostName = "alastor"; # Define your hostname.
+  # Pick only one of the below networking options.
+  networking.wireless.iwd = {
+    enable = true;
+    settings.General.EnableNetworkConfiguration = true;
+  };
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.xqtc = {
+    isNormalUser = true;
+    extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
+    packages = with pkgs; [
+      tree
+    ];
+    shell = pkgs.nushell;
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    #git
+
+    firefox
+
+    neovim
+
+    gcc13
+
+    cargo
+    rustc
+
+    wl-clipboard
+    xclip
+
+    jellyfin
+    jellyfin-web
+    jellyfin-ffmpeg
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  programs.dconf.enable = true;
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [22];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.05"; # Did you read the comment?
+
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+}

hosts/aarch64-linux/alastor/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["usb_storage"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/0d3d62cd-ecc8-472c-9d5f-3daf3f1656f1";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/A2B1-1BF0";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/x86_64-linux/lilith/default.nix

@@ -8,11 +8,11 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
-    ../../common
+    ../../../common
-    #../antivirus.nix
+    #../../antivirus.nix
-    ../../modules/home-manager.nix
+    ../../../modules/home-manager.nix
     inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t480
-    ../gc.nix
+    ../../gc.nix
   ];
 
   nixpkgs.config.allowUnfree = true;

overlays/util.nix

@@ -1,7 +1,7 @@
 self: super: {
   util = rec {
     dirEntries = path: builtins.attrNames (builtins.readDir path);
-    mapHosts = f: builtins.map f (dirEntries ../hosts);
+    mapHosts = f: builtins.map f (dirEntries ../hosts/x86_64-linux);
     mapHostAttrs = key_f: val_f:
       builtins.listToAttrs (mapHosts (host: {
         name = key_f host;