linuxPackages.nvidia-x11: separate proprietary kernel modules

nixos/modules/hardware/video/bumblebee.nix

@@ -93,7 +93,10 @@ in
     ];
     boot.kernelModules = lib.optional useBbswitch "bbswitch";
     boot.extraModulePackages =
-      lib.optional useBbswitch kernel.bbswitch ++ lib.optional useNvidia kernel.nvidia_x11.bin;
+      lib.optional useBbswitch kernel.bbswitch
+      ++ lib.optional useNvidia (
+        if config.hardware.nvidia.open == true then kernel.nvidia_x11.open else kernel.nvidia_x11.mod
+      );
 
     environment.systemPackages = [
       bumblebee

nixos/modules/hardware/video/nvidia.nix

@@ -681,7 +681,7 @@ in
               "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
 
           boot = {
-            extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.bin ];
+            extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.mod ];
             # nvidia-uvm is required by CUDA applications.
             kernelModules = lib.optionals config.services.xserver.enable [
               "nvidia"
@@ -735,7 +735,7 @@ in
         })
         # Data Center
         (lib.mkIf (cfg.datacenter.enable) {
-          boot.extraModulePackages = [ nvidia_x11.bin ];
+          boot.extraModulePackages = if useOpenModules then [ nvidia_x11.open ] else [ nvidia_x11.mod ];
 
           systemd = {
             tmpfiles.rules =

pkgs/os-specific/linux/nvidia-x11/builder.sh

@@ -10,23 +10,6 @@ unpackFile() {
 }
 
 
-buildPhase() {
-    runHook preBuild
-
-    if [ -n "$bin" ]; then
-        # Create the module.
-        echo "Building linux driver against kernel: $kernel";
-        cd kernel
-        unset src # used by the nv makefile
-        make $makeFlags -j $NIX_BUILD_CORES module
-
-        cd ..
-    fi
-
-    runHook postBuild
-}
-
-
 installPhase() {
     runHook preInstall
 
@@ -152,13 +135,6 @@ installPhase() {
         mkdir -p $bin/lib/xorg/modules/extensions
         cp -p libglx*.so* $bin/lib/xorg/modules/extensions
 
-        # Install the kernel module.
-        mkdir -p $bin/lib/modules/$kernelVersion/misc
-        for i in $(find ./kernel -name '*.ko'); do
-            nuke-refs $i
-            cp $i $bin/lib/modules/$kernelVersion/misc/
-        done
-
         # Install application profiles.
         if [ "$useProfiles" = "1" ]; then
             mkdir -p $bin/share/nvidia
@@ -167,6 +143,11 @@ installPhase() {
         fi
     fi
 
+    # Install the proprietary kernel module build files.
+    if [ -n "$modsrc" ]; then
+        cp -r kernel $modsrc
+    fi
+
     if [ -n "$firmware" ]; then
         # Install the GSP firmware
         install -Dm644 -t $firmware/lib/firmware/nvidia/$version firmware/gsp*.bin

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -6,6 +6,7 @@
   fetchpatch,
   stdenv,
   pkgsi686Linux,
+  kernel,
 }:
 
 let
@@ -18,20 +19,9 @@ let
       lib32 =
         (pkgsi686Linux.callPackage imported {
           libsOnly = true;
-          kernel = null;
         }).out;
     };
 
-  kernel =
-    # a hacky way of extracting parameters from callPackage
-    callPackage (
-      {
-        kernel,
-        libsOnly ? false,
-      }:
-      if libsOnly then { } else kernel
-    ) { };
-
   selectHighestVersion = a: b: if lib.versionOlder a.version b.version then b else a;
 
   # https://forums.developer.nvidia.com/t/linux-6-7-3-545-29-06-550-40-07-error-modpost-gpl-incompatible-module-nvidia-ko-uses-gpl-only-symbol-rcu-read-lock/280908/19

pkgs/os-specific/linux/nvidia-x11/generic.nix

@@ -41,16 +41,12 @@
   pkgsi686Linux,
   fetchurl,
   fetchzip,
-  kernel ? null,
-  kernelModuleMakeFlags ? [ ],
-  perl,
-  nukeReferences,
   which,
   libarchive,
   jq,
-  # Whether to build the libraries only (i.e. not the kernel module or
-  # nvidia-settings).  Used to support 32-bit binaries on 64-bit
-  # Linux.
+  zstd,
+  # Whether to build only userspace libraries (without bin/modsrc/firmware
+  # outputs). Used to support 32-bit binaries on 64-bit Linux.
   libsOnly ? false,
   # don't include the bundled 32-bit libraries on 64-bit platforms,
   # even if it’s in downloaded binary
@@ -65,7 +61,6 @@
   acceptLicense ? config.nvidia.acceptLicense or false,
 }:
 
-assert !libsOnly -> kernel != null;
 assert lib.versionOlder version "391" -> sha256_32bit != null;
 assert useSettings -> settingsSha256 != null;
 assert usePersistenced -> persistencedSha256 != null;
@@ -96,7 +91,6 @@ let
           --clean "$patch" > "$out"
       '';
 
-  nameSuffix = lib.optionalString (!libsOnly) "-${kernel.version}";
   pkgSuffix = lib.optionalString (lib.versionOlder version "304") "-pkg0";
   i686bundled = lib.versionAtLeast version "391" && !disable32Bit;
 
@@ -143,7 +137,6 @@ let
 in
 
 stdenv.mkDerivation (finalAttrs: {
-  name = "${finalAttrs.pname}-${finalAttrs.version}${nameSuffix}";
   pname = "nvidia-${if useFabricmanager then "dc" else "x11"}";
 
   builder = ./builder.sh;
@@ -201,31 +194,13 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ]
   ++ lib.optional i686bundled "lib32"
-  ++ lib.optional (!libsOnly) "bin"
+  ++ lib.optionals (!libsOnly) [
+    "bin"
+    "modsrc"
+  ]
   ++ lib.optional (!libsOnly && firmware) "firmware";
   outputDev = if libsOnly then null else "bin";
 
-  kernel = if libsOnly then null else kernel.dev;
-  kernelVersion = if libsOnly then null else kernel.modDirVersion;
-
-  makeFlags = lib.optionals (!libsOnly) (
-    kernelModuleMakeFlags
-    ++ [
-      "IGNORE_PREEMPT_RT_PRESENCE=1"
-      "NV_BUILD_SUPPORTS_HMM=1"
-      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      "C_INCLUDE_PATH=${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
-    ]
-  );
-
-  hardeningDisable = [
-    "pic"
-    "format"
-  ];
-
   dontStrip = true;
   dontPatchELF = true;
 
@@ -233,15 +208,12 @@ stdenv.mkDerivation (finalAttrs: {
   libPath32 = lib.optionalString i686bundled (libPathFor pkgsi686Linux);
 
   nativeBuildInputs = [
-    perl
-    nukeReferences
-    which
     libarchive
     jq
   ]
-  ++ lib.optionals (!libsOnly) kernel.moduleBuildDependencies;
-
-  disallowedReferences = lib.optionals (!libsOnly) [ kernel.dev ];
+  # NVIDIA has changed the compression format of their driver to zstd since version 530.30.02
+  # https://forums.developer.nvidia.com/t/linux-solaris-and-freebsd-driver-530-30-02-beta/244406
+  ++ (if (lib.versionAtLeast version "530") then [ zstd ] else [ which ]);
 
   passthru =
     let
@@ -274,9 +246,17 @@ stdenv.mkDerivation (finalAttrs: {
         );
     in
     {
+      mod = callPackage ./kernel-modules.nix {
+        open = false;
+        nvidia_x11 = finalAttrs.finalPackage;
+        # build files already patched when building the main package, so no need to patch them again
+        patches = [ ];
+        inherit broken;
+      };
       open = lib.mapNullable (
         hash:
-        callPackage ./open.nix {
+        callPackage ./kernel-modules.nix {
+          open = true;
           inherit hash;
           nvidia_x11 = finalAttrs.finalPackage;
           patches =
@@ -339,11 +319,15 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals (sha256_32bit != null) [ "i686-linux" ]
     ++ lib.optionals (sha256_aarch64 != null) [ "aarch64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [
+      binaryNativeCode
+      binaryFirmware
+    ];
     maintainers = with lib.maintainers; [
       kiskae
       edwtjo
     ];
     priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
-    inherit broken;
+    broken = broken && brokenOpen;
   };
 })

pkgs/os-specific/linux/nvidia-x11/kernel-modules.nix

@@ -0,0 +1,81 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  nvidia_x11,
+  open,
+  patches,
+  broken,
+  hash ? null,
+}:
+
+assert open -> hash != null;
+
+stdenv.mkDerivation {
+  pname = "nvidia-${if open then "open" else "kernel-modules"}";
+  version = "${nvidia_x11.version}-${kernel.version}";
+
+  src =
+    if open then
+      fetchFromGitHub {
+        owner = "NVIDIA";
+        repo = "open-gpu-kernel-modules";
+        tag = nvidia_x11.version;
+        inherit hash;
+      }
+    else
+      nvidia_x11.modsrc;
+
+  inherit patches;
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags =
+    kernelModuleMakeFlags
+    ++ [
+      "IGNORE_PREEMPT_RT_PRESENCE=1"
+      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+      "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
+      "DATE="
+      "TARGET_ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
+    ]
+    ++ lib.optionals stdenv.cc.isClang [
+      "C_INCLUDE_PATH=${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
+    ];
+
+  buildTargets = [ "modules" ];
+  installTargets = [ "modules_install" ];
+  enableParallelBuilding = true;
+
+  allowedReferences = [ ];
+
+  meta = {
+    description = "NVIDIA Linux ${lib.optionalString open "Open "}GPU Kernel Modules";
+    homepage =
+      if open then "https://github.com/NVIDIA/open-gpu-kernel-modules" else nvidia_x11.meta.homepage;
+    license =
+      if open then
+        with lib.licenses;
+        [
+          gpl2Plus
+          mit
+        ]
+      else
+        nvidia_x11.meta.license;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance =
+      with lib.sourceTypes;
+      [
+        fromSource
+      ]
+      ++ lib.optional (!open) binaryNativeCode;
+    maintainers = with lib.maintainers; [ nickcao ];
+    inherit broken;
+  };
+}

pkgs/os-specific/linux/nvidia-x11/open.nix

@@ -1,59 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  kernel,
-  kernelModuleMakeFlags,
-  nvidia_x11,
-  hash,
-  patches ? [ ],
-  broken ? false,
-}:
-
-stdenv.mkDerivation {
-  pname = "nvidia-open";
-  version = "${kernel.version}-${nvidia_x11.version}";
-
-  src = fetchFromGitHub {
-    owner = "NVIDIA";
-    repo = "open-gpu-kernel-modules";
-    rev = nvidia_x11.version;
-    inherit hash;
-  };
-
-  inherit patches;
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  makeFlags =
-    kernelModuleMakeFlags
-    ++ [
-      "IGNORE_PREEMPT_RT_PRESENCE=1"
-      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
-      "DATE="
-      "TARGET_ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      "C_INCLUDE_PATH=${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
-    ];
-
-  installTargets = [ "modules_install" ];
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "NVIDIA Linux Open GPU Kernel Module";
-    homepage = "https://github.com/NVIDIA/open-gpu-kernel-modules";
-    license = with lib.licenses; [
-      gpl2Plus
-      mit
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-    maintainers = with lib.maintainers; [ nickcao ];
-    inherit broken;
-  };
-}