Add container-hotplug package

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   checks:
     name: Quality Check
-    runs-on: ubuntu-latest
+    runs-on: nixos-23.11
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -38,7 +38,7 @@ jobs:
     # Save some computation. If the checks fail, don't build.
     needs: checks
     name: Generate Build Plan
-    runs-on: ubuntu-latest
+    runs-on: nixos-23.11
     outputs:
       attrs: ${{ steps.plan.outputs.ATTRS }}
     steps:
@@ -69,10 +69,20 @@ jobs:
           echo '| Package | Outputs | Status |' >> $GITHUB_STEP_SUMMARY
           echo '|---------|---------|--------|' >> $GITHUB_STEP_SUMMARY
 
-          for LINE in $(nix-shell -p nix-eval-jobs --run 'nix-eval-jobs --accept-flake-config --check-cache-status --flake .#packages.x86_64-linux'); do
+          for LINE in $(nix-shell -p nix-eval-jobs --run 'nix-eval-jobs --accept-flake-config --flake .#packages.x86_64-linux'); do
             ATTR=$(echo "$LINE" | jq -r .attr)
             OUTPUTS=$(echo "$LINE" | jq -r '.outputs | keys | join(",")')
-            if echo "$LINE" | jq -e .isCached > /dev/null; then
+
+            # Check if all outputs are cached. We don't use nix-eval-jobs's cache check because it also includes local path
+            CACHED=y
+            for OUTPUT in ${OUTPUTS//,/ }; do
+              HASH=$(echo "$LINE" | jq -r ".outputs.$OUTPUT" | cut -d '/' -f4 | cut -d '-' -f1)
+              if ! curl -sSfL "https://nix-cache.lowrisc.org/public/$HASH.narinfo"; then
+                CACHED=n
+              fi
+            done
+
+            if [[ $CACHED == y ]]; then
               echo "| $ATTR | $OUTPUTS | ✅ Cached |" | tee -a $GITHUB_STEP_SUMMARY
             else
               if [[ "$OUTPUTS" = *,* ]]; then
@@ -92,7 +102,7 @@ jobs:
   build:
     needs: build-plan
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: nixos-23.11
     # Matrix can't be empty, so skip the job entirely if nothing needs to be rebuilt.
     if: fromJSON(needs.build-plan.outputs.attrs)[0] != null
     strategy:

pkgs/container-hotplug/default.nix

@@ -0,0 +1,44 @@
+# Copyright lowRISC contributors.
+#
+# SPDX-License-Identifier: MIT
+{
+  fetchurl,
+  stdenv,
+  lib,
+  udev,
+  docker,
+  makeWrapper,
+  autoPatchelfHook,
+}:
+# We currently fetch from container-hotplug directly due to complexity in building bpf-linker.
+stdenv.mkDerivation rec {
+  name = "container-hotplug";
+  version = "20240319-2";
+  src = fetchurl {
+    url = "https://github.com/lowRISC/container-hotplug/releases/download/${version}/container-hotplug";
+    sha256 = "sha256-1LWPYssU4HGw4C85mKq/lFtfQMhtexA2Qc87j4OIh0Y=";
+  };
+
+  buildInputs = [
+    udev
+    stdenv.cc.cc.lib
+  ];
+
+  nativeBuildInputs = [makeWrapper autoPatchelfHook];
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -R $src $out/bin/container-hotplug
+    chmod +x $out/bin/container-hotplug
+
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/container-hotplug --prefix PATH : "${lib.makeBinPath [docker]}"
+  '';
+}

pkgs/default.nix

@@ -9,14 +9,19 @@
 {
   ncurses5-fhs = pkgs.callPackage ./ncurses5-fhs.nix {};
 
+  # OpenTitan packages
   verilator_ot = import ./verilator {inherit pkgs;};
   python_ot = pkgs.callPackage ./python_ot {inherit inputs;};
   bazel_ot = pkgs.callPackage ./bazel_ot {};
+  verible_ot = pkgs.callPackage ./verible.nix {};
+
+  # CherIoT packages
   spike-ibex-cosim = pkgs.callPackage ./spike.nix {};
   llvm_cheriot = pkgs.callPackage ./llvm_cheriot.nix {};
   xmake = import ./xmake.nix {inherit pkgs;};
   cheriot-sim = pkgs.callPackage ./cheriot-sim.nix {};
-  verible_ot = pkgs.callPackage ./verible.nix {};
+
+  container-hotplug = pkgs.callPackage ./container-hotplug {};
 }
 // pkgs.lib.optionalAttrs (pkgs.system == "x86_64-linux") {
   lowrisc-toolchain-gcc-rv32imcb = pkgs.callPackage ./lowrisc-toolchain-gcc-rv32imcb.nix {};