Build igloo.ko with nix, against kernel derivations

[lacraig2]

Moves igloo_driver to nix. build.sh and the Docker workflows are untouched and still work — this is additive while both release paths exist.

Why

A module is loadable only by the exact kernel build it was compiled against. Its modversion CRCs come from that kernel's headers, and the kernel's .config itself holds options Kconfig resolves by probing the compiler (CONFIG_STACKPROTECTOR_PER_TASK, CONFIG_INIT_STACK_*, the CC_HAS_* family). The ABI moves when the toolchain moves, with byte-identical sources and byte-identical config files.

The Docker path downloads kernel-devel-all.tar.gz from a linux_builder release, unpacks it, and builds against whatever is in that directory. Two problems, only one obvious:

1. Nothing ties the unpacked tree to the kernel the module is inserted into. The pin was a release tag — a label, not an identity. Pairing v0.0.96 with linux_builder's nix kernels put 129 of 221 CRCs out of agreement; the only symptom was igloo: disagrees about version of symbol module_layout and a guest panic, and nothing in either release recorded what it was built against.

2. A nix-built kernel-devel tree is not consumable from a non-nix container at all. It ships prebuilt host tools linked against the Nix store — scripts/basic/fixdep requests an interpreter under /nix/store — so inside embedded-toolchains every target died within seconds of make starting (run 31767370803). That is not a bug in the tarball; it is what "prebuilt host tools" means.

Taking linux_builder as a flake input makes the kernel derivation the build input. ARCH, CROSS_COMPILE and the compiler all come out of the kernel's passthru via kernelsmith's buildModule, so a mismatched (kernel, module) pair is not representable — "built against a different kernel" is a different store path, not a runtime panic.

What lands

File
flake.nix	linux_builder as an input. The 19-cell matrix is derived from its kernel outputs, not restated — build.sh's hand-maintained TARGETS/VERSIONS lists can no longer drift into silent SKIPPED (No kernel config) lines. Also exposes lib.<system>.buildFor (below).
nix/module.nix	the buildModule call. entry = "wrapper" because src/Makefile runs python3 codegen before re-entering kbuild.
nix/artifacts.nix	ISF and stripped .ko as separate derivations off the unstripped module, so the extract-then-strip ordering _in_container_build.sh relies on cannot be reordered into a bug. dwarf2json is linux_builder's pinned fork, shared rather than re-derived — the kernel ISFs and the module ISFs in a release are now produced by one identical tool, which was previously true only by coincidence.
nix/release.nix	the tarball, reproducible, plus BUILT_AGAINST.txt — which names each kernel's store path, i.e. the ABI itself, not a tag two different ABIs can share.
nix/shape.nix	every module's ELF class / byte order / machine must match its target name. The Docker build has no such check and collapses every powerpc* target onto ARCH=powerpc; linux_builder shipped two bugs of exactly this shape before adding the equivalent.
nix/modversions.nix	every module's CRCs must agree with its kernel's Module.symvers (below).
.github/workflows/nix.yml	PR gate (one cell per version, through to the shipped artifacts), full matrix on demand and on a nixdev_* tag, which cuts a prerelease.
build.sh	refuses a nix-built kernel-devel tree up front, with a message pointing at the nix path. Plus a set -u fix — see below.

Verification

nix build .#igloo_driver produces all 19 cells (7.1 MB): kernels/<version>/igloo.ko.<target> + .json.xz, the same layout the Docker build produces, so penguin's mk-igloo-static.nix consumes it unchanged.

nix flake check — all 38 checks pass:

igloo-driver-shape-check> 6.13/powerpc      ok  ELF 32-bit MSB relocatable, PowerPC ...
igloo-driver-shape-check> 6.13/powerpc64le  ok  ELF 64-bit LSB relocatable, 64-bit PowerPC ...
igloo-driver-modversions-check> ok   4.10/armel:  209 symbols, all CRCs agree
igloo-driver-modversions-check> ok   6.13/armel:  222 symbols, all CRCs agree
igloo-driver-modversions-check> ok   6.13/x86_64: 225 symbols, all CRCs agree
    ... 19 cells, 198-225 symbols each, zero mismatches, zero absent
all checks passed!

That last check is the point of the exercise: 222 of 222 CRCs agree where the old pairing had 129 of 221 disagreeing.

Building against a kernel derivation makes the right inputs structural. It does not prove the output is right — kbuild happily emits a module with no __versions section at all if CONFIG_MODVERSIONS is off in a config, and nothing else here would notice. nix/modversions.nix closes that, and is the check that would have caught the incident that motivated this PR.

Two implementation notes worth a reviewer's eye:

• The section is read by parsing the ELF directly rather than via objcopy: nixpkgs' binutils is built for the host target and objcopy --dump-section fails outright on several machines in this matrix.
• MODULE_NAME_LEN is (64 - sizeof(Elf_Addr)), so a modversion entry is 64 bytes on every arch. Parsing it as crc + 56 misreads every 32-bit module (found the hard way).

Also in here

build.sh's rewrite_mount referenced $PENGUIN_HOST_MOUNT_FROM unguarded under set -u, so it aborted with unbound variable whenever that variable was unset — every local build, i.e. exactly the case its own comment says is a no-op. ./build.sh has been unusable locally as a result. Fixed with ${VAR:-}.

Where this is going

lib.<system>.buildFor { kernel, version, target } builds igloo.ko against an arbitrary kernelsmith-built kernel, not just one of linux_builder's cells:

igloo-driver.lib.x86_64-linux.buildFor {
  kernel = kernelsmith.buildKernel { /* ... */ };
  version = "6.6"; target = "armel";
}

That is the seam for the direction this is heading — fewer changes carried as kernel patches, more of the delta in the module, eventually igloo.ko loading into a stock upstream kernel. Anything that can hand over a buildKernel derivation can build a matching module today, without this repo enumerating that kernel anywhere.

Follow-ups (not in this PR)

• inputs.linux-builder is pinned to the nixdev_0.1.0 prerelease. Repin once Build kernels from upstream tarballs + an IGLOO patch series, via Nix/kernelsmith linux_builder#59 lands.
• Cut a nixdev_* tag here, then point nix: take kernels from linux_builder's flake, not a release tarball penguin#932's inputs.igloo-driver at the resulting release (or, better, at .#kernels from this flake — it is exactly the tree penguin's mk-igloo-static.nix wants, with no tar/untar round trip).
• Retire the Docker path once penguin consumes the nix one.