Merge branch 'master' into core-updates

6 files changed, 1401 insertions, 0 deletions

diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm
new file mode 100644
index 0000000000..362669cbf9
--- /dev/null
+++ b/gnu/build/activation.scm
@@ -0,0 +1,226 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build activation)
+  #:use-module (gnu build linux-boot)
+  #:use-module (guix build utils)
+  #:use-module (ice-9 ftw)
+  #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
+  #:export (activate-users+groups
+            activate-etc
+            activate-setuid-programs
+            activate-current-system))
+
+;;; Commentary:
+;;;
+;;; This module provides "activation" helpers.  Activation is the process that
+;;; consists in setting up system-wide files and directories so that an
+;;; 'operating-system' configuration becomes active.
+;;;
+;;; Code:
+
+(define* (add-group name #:key gid password system?
+                    (log-port (current-error-port)))
+  "Add NAME as a user group, with the given numeric GID if specified."
+  ;; Use 'groupadd' from the Shadow package.
+  (format log-port "adding group '~a'...~%" name)
+  (let ((args `(,@(if gid `("-g" ,(number->string gid)) '())
+                ,@(if password `("-p" ,password) '())
+                ,@(if system? `("--system") '())
+                ,name)))
+    (zero? (apply system* "groupadd" args))))
+
+(define* (add-user name group
+                   #:key uid comment home shell password system?
+                   (supplementary-groups '())
+                   (log-port (current-error-port)))
+  "Create an account for user NAME part of GROUP, with the specified
+properties.  Return #t on success."
+  (format log-port "adding user '~a'...~%" name)
+
+  (if (and uid (zero? uid))
+
+      ;; 'useradd' fails with "Cannot determine your user name" if the root
+      ;; account doesn't exist.  Thus, for bootstrapping purposes, create that
+      ;; one manually.
+      (begin
+        (call-with-output-file "/etc/shadow"
+          (cut format <> "~a::::::::~%" name))
+        (call-with-output-file "/etc/passwd"
+          (cut format <> "~a:x:~a:~a:~a:~a:~a~%"
+               name "0" "0" comment home shell))
+        (chmod "/etc/shadow" #o600)
+        #t)
+
+      ;; Use 'useradd' from the Shadow package.
+      (let ((args `(,@(if uid `("-u" ,(number->string uid)) '())
+                    "-g" ,(if (number? group) (number->string group) group)
+                    ,@(if (pair? supplementary-groups)
+                          `("-G" ,(string-join supplementary-groups ","))
+                          '())
+                    ,@(if comment `("-c" ,comment) '())
+                    ,@(if home
+                          (if (file-exists? home)
+                              `("-d" ,home)     ; avoid warning from 'useradd'
+                              `("-d" ,home "--create-home"))
+                          '())
+                    ,@(if shell `("-s" ,shell) '())
+                    ,@(if password `("-p" ,password) '())
+                    ,@(if system? '("--system") '())
+                    ,name)))
+        (zero? (apply system* "useradd" args)))))
+
+(define (activate-users+groups users groups)
+  "Make sure the accounts listed in USERS and the user groups listed in GROUPS
+are all available.
+
+Each item in USERS is a list of all the characteristics of a user account;
+each item in GROUPS is a tuple with the group name, group password or #f, and
+numeric gid or #f."
+  (define (touch file)
+    (close-port (open-file file "a0b")))
+
+  (define activate-user
+    (match-lambda
+     ((name uid group supplementary-groups comment home shell password system?)
+      (unless (false-if-exception (getpwnam name))
+        (let ((profile-dir (string-append "/var/guix/profiles/per-user/"
+                                          name)))
+          (add-user name group
+                    #:uid uid
+                    #:system? system?
+                    #:supplementary-groups supplementary-groups
+                    #:comment comment
+                    #:home home
+                    #:shell shell
+                    #:password password)
+
+          (unless system?
+            ;; Create the profile directory for the new account.
+            (let ((pw (getpwnam name)))
+              (mkdir-p profile-dir)
+              (chown profile-dir (passwd:uid pw) (passwd:gid pw)))))))))
+
+  ;; 'groupadd' aborts if the file doesn't already exist.
+  (touch "/etc/group")
+
+  ;; Create the root account so we can use 'useradd' and 'groupadd'.
+  (activate-user (find (match-lambda
+                        ((name (? zero?) _ ...) #t)
+                        (_ #f))
+                       users))
+
+  ;; Then create the groups.
+  (for-each (match-lambda
+             ((name password gid system?)
+              (unless (false-if-exception (getgrnam name))
+                (add-group name
+                           #:gid gid #:password password
+                           #:system? system?))))
+            groups)
+
+  ;; Finally create the other user accounts.
+  (for-each activate-user users))
+
+(define (activate-etc etc)
+  "Install ETC, a directory in the store, as the source of static files for
+/etc."
+
+  ;; /etc is a mixture of static and dynamic settings.  Here is where we
+  ;; initialize it from the static part.
+
+  (format #t "populating /etc from ~a...~%" etc)
+  (let ((rm-f (lambda (f)
+                (false-if-exception (delete-file f)))))
+    (rm-f "/etc/static")
+    (symlink etc "/etc/static")
+    (for-each (lambda (file)
+                ;; TODO: Handle 'shadow' specially so that changed
+                ;; password aren't lost.
+                (let ((target (string-append "/etc/" file))
+                      (source (string-append "/etc/static/" file)))
+                  (rm-f target)
+                  (symlink source target)))
+              (scandir etc
+                       (lambda (file)
+                         (not (member file '("." ".."))))
+
+                       ;; The default is 'string-locale<?', but we don't have
+                       ;; it when run from the initrd's statically-linked
+                       ;; Guile.
+                       string<?))
+
+    ;; Prevent ETC from being GC'd.
+    (rm-f "/var/guix/gcroots/etc-directory")
+    (symlink etc "/var/guix/gcroots/etc-directory")))
+
+(define %setuid-directory
+  ;; Place where setuid programs are stored.
+  "/run/setuid-programs")
+
+(define (activate-setuid-programs programs)
+  "Turn PROGRAMS, a list of file names, into setuid programs stored under
+%SETUID-DIRECTORY."
+  (define (make-setuid-program prog)
+    (let ((target (string-append %setuid-directory
+                                 "/" (basename prog))))
+      (catch 'system-error
+        (lambda ()
+          (link prog target))
+        (lambda args
+          ;; Perhaps PROG and TARGET live in a different file system, so copy
+          ;; PROG.
+          (copy-file prog target)))
+      (chown target 0 0)
+      (chmod target #o6555)))
+
+  (format #t "setting up setuid programs in '~a'...~%"
+          %setuid-directory)
+  (if (file-exists? %setuid-directory)
+      (for-each (compose delete-file
+                         (cut string-append %setuid-directory "/" <>))
+                (scandir %setuid-directory
+                         (lambda (file)
+                           (not (member file '("." ".."))))
+                         string<?))
+      (mkdir-p %setuid-directory))
+
+  (for-each make-setuid-program programs))
+
+(define %current-system
+  ;; The system that is current (a symlink.)  This is not necessarily the same
+  ;; as the system we booted (aka. /run/booted-system) because we can re-build
+  ;; a new system configuration and activate it, without rebooting.
+  "/run/current-system")
+
+(define (boot-time-system)
+  "Return the '--system' argument passed on the kernel command line."
+  (find-long-option "--system" (linux-command-line)))
+
+(define* (activate-current-system #:optional (system (boot-time-system)))
+  "Atomically make SYSTEM the current system."
+  (format #t "making '~a' the current system...~%" system)
+
+  ;; Atomically make SYSTEM current.
+  (let ((new (string-append %current-system ".new")))
+    (symlink system new)
+    (rename-file new %current-system)))
+
+;;; activation.scm ends here
diff --git a/gnu/build/file-systems.scm b/gnu/build/file-systems.scm
new file mode 100644
index 0000000000..5c04771e19
--- /dev/null
+++ b/gnu/build/file-systems.scm
@@ -0,0 +1,299 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build file-systems)
+  #:use-module (guix build utils)
+  #:use-module (rnrs io ports)
+  #:use-module (rnrs bytevectors)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 rdelim)
+  #:use-module (system foreign)
+  #:autoload   (system repl repl) (start-repl)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
+  #:export (disk-partitions
+            partition-label-predicate
+            find-partition-by-label
+            canonicalize-device-spec
+
+            MS_RDONLY
+            MS_NOSUID
+            MS_NODEV
+            MS_NOEXEC
+            MS_BIND
+            MS_MOVE
+            bind-mount
+
+            mount-flags->bit-mask
+            check-file-system
+            mount-file-system))
+
+;;; Commentary:
+;;;
+;;; This modules provides tools to deal with disk partitions, and to mount and
+;;; check file systems.
+;;;
+;;; Code:
+
+;; Linux mount flags, from libc's <sys/mount.h>.
+(define MS_RDONLY 1)
+(define MS_NOSUID 2)
+(define MS_NODEV  4)
+(define MS_NOEXEC 8)
+(define MS_BIND 4096)
+(define MS_MOVE 8192)
+
+(define (bind-mount source target)
+  "Bind-mount SOURCE at TARGET."
+  (mount source target "" MS_BIND))
+
+(define-syntax %ext2-endianness
+  ;; Endianness of ext2 file systems.
+  (identifier-syntax (endianness little)))
+
+;; Offset in bytes of interesting parts of an ext2 superblock.  See
+;; <http://www.nongnu.org/ext2-doc/ext2.html#DEF-SUPERBLOCK>.
+;; TODO: Use "packed structs" from Guile-OpenGL or similar.
+(define-syntax %ext2-sblock-magic       (identifier-syntax 56))
+(define-syntax %ext2-sblock-creator-os  (identifier-syntax 72))
+(define-syntax %ext2-sblock-uuid        (identifier-syntax 104))
+(define-syntax %ext2-sblock-volume-name (identifier-syntax 120))
+
+(define (read-ext2-superblock device)
+  "Return the raw contents of DEVICE's ext2 superblock as a bytevector, or #f
+if DEVICE does not contain an ext2 file system."
+  (define %ext2-magic
+    ;; The magic bytes that identify an ext2 file system.
+    #xef53)
+
+  (define superblock-size
+    ;; Size of the interesting part of an ext2 superblock.
+    264)
+
+  (define block
+    ;; The superblock contents.
+    (make-bytevector superblock-size))
+
+  (call-with-input-file device
+    (lambda (port)
+      (seek port 1024 SEEK_SET)
+
+      ;; Note: work around <http://bugs.gnu.org/17466>.
+      (and (eqv? superblock-size (get-bytevector-n! port block 0
+                                                    superblock-size))
+           (let ((magic (bytevector-u16-ref block %ext2-sblock-magic
+                                            %ext2-endianness)))
+             (and (= magic %ext2-magic)
+                  block))))))
+
+(define (ext2-superblock-uuid sblock)
+  "Return the UUID of ext2 superblock SBLOCK as a 16-byte bytevector."
+  (let ((uuid (make-bytevector 16)))
+    (bytevector-copy! sblock %ext2-sblock-uuid uuid 0 16)
+    uuid))
+
+(define (ext2-superblock-volume-name sblock)
+  "Return the volume name of SBLOCK as a string of at most 16 characters, or
+#f if SBLOCK has no volume name."
+  (let ((bv (make-bytevector 16)))
+    (bytevector-copy! sblock %ext2-sblock-volume-name bv 0 16)
+
+    ;; This is a Latin-1, nul-terminated string.
+    (let ((bytes (take-while (negate zero?) (bytevector->u8-list bv))))
+      (if (null? bytes)
+          #f
+          (list->string (map integer->char bytes))))))
+
+(define (disk-partitions)
+  "Return the list of device names corresponding to valid disk partitions."
+  (define (partition? major minor)
+    (let ((marker (format #f "/sys/dev/block/~a:~a/partition" major minor)))
+      (catch 'system-error
+        (lambda ()
+          (not (zero? (call-with-input-file marker read))))
+        (lambda args
+          (if (= ENOENT (system-error-errno args))
+              #f
+              (apply throw args))))))
+
+  (call-with-input-file "/proc/partitions"
+    (lambda (port)
+      ;; Skip the two header lines.
+      (read-line port)
+      (read-line port)
+
+      ;; Read each subsequent line, and extract the last space-separated
+      ;; field.
+      (let loop ((parts '()))
+        (let ((line  (read-line port)))
+          (if (eof-object? line)
+              (reverse parts)
+              (match (string-tokenize line)
+                (((= string->number major) (= string->number minor)
+                  blocks name)
+                 (if (partition? major minor)
+                     (loop (cons name parts))
+                     (loop parts))))))))))
+
+(define (partition-label-predicate label)
+  "Return a procedure that, when applied to a partition name such as \"sda1\",
+return #t if that partition's volume name is LABEL."
+  (lambda (part)
+    (let* ((device (string-append "/dev/" part))
+           (sblock (catch 'system-error
+                     (lambda ()
+                       (read-ext2-superblock device))
+                     (lambda args
+                       ;; When running on the hand-made /dev,
+                       ;; 'disk-partitions' could return partitions for which
+                       ;; we have no /dev node.  Handle that gracefully.
+                       (if (= ENOENT (system-error-errno args))
+                           (begin
+                             (format (current-error-port)
+                                     "warning: device '~a' not found~%"
+                                     device)
+                             #f)
+                           (apply throw args))))))
+      (and sblock
+           (let ((volume (ext2-superblock-volume-name sblock)))
+             (and volume
+                  (string=? volume label)))))))
+
+(define (find-partition-by-label label)
+  "Return the first partition found whose volume name is LABEL, or #f if none
+were found."
+  (and=> (find (partition-label-predicate label)
+               (disk-partitions))
+         (cut string-append "/dev/" <>)))
+
+(define* (canonicalize-device-spec spec #:optional (title 'any))
+  "Return the device name corresponding to SPEC.  TITLE is a symbol, one of
+the following:
+
+  • 'device', in which case SPEC is known to designate a device node--e.g.,
+     \"/dev/sda1\";
+  • 'label', in which case SPEC is known to designate a partition label--e.g.,
+     \"my-root-part\";
+  • 'any', in which case SPEC can be anything.
+"
+  (define max-trials
+    ;; Number of times we retry partition label resolution, 1 second per
+    ;; trial.  Note: somebody reported a delay of 16 seconds (!) before their
+    ;; USB key would be detected by the kernel, so we must wait for at least
+    ;; this long.
+    20)
+
+  (define canonical-title
+    ;; The realm of canonicalization.
+    (if (eq? title 'any)
+        (if (string-prefix? "/" spec)
+            'device
+            'label)
+        title))
+
+  (case canonical-title
+    ((device)
+     ;; Nothing to do.
+     spec)
+    ((label)
+     ;; Resolve the label.
+     (let loop ((count 0))
+       (let ((device (find-partition-by-label spec)))
+         (or device
+             ;; Some devices take a bit of time to appear, most notably USB
+             ;; storage devices.  Thus, wait for the device to appear.
+             (if (> count max-trials)
+                 (error "failed to resolve partition label" spec)
+                 (begin
+                   (format #t "waiting for partition '~a' to appear...~%"
+                           spec)
+                   (sleep 1)
+                   (loop (+ 1 count))))))))
+    ;; TODO: Add support for UUIDs.
+    (else
+     (error "unknown device title" title))))
+
+(define (check-file-system device type)
+  "Run a file system check of TYPE on DEVICE."
+  (define fsck
+    (string-append "fsck." type))
+
+  (let ((status (system* fsck "-v" "-p" device)))
+    (match (status:exit-val status)
+      (0
+       #t)
+      (1
+       (format (current-error-port) "'~a' corrected errors on ~a; continuing~%"
+               fsck device))
+      (2
+       (format (current-error-port) "'~a' corrected errors on ~a; rebooting~%"
+               fsck device)
+       (sleep 3)
+       (reboot))
+      (code
+       (format (current-error-port) "'~a' exited with code ~a on ~a; spawning REPL~%"
+               fsck code device)
+       (start-repl)))))
+
+(define (mount-flags->bit-mask flags)
+  "Return the number suitable for the 'flags' argument of 'mount' that
+corresponds to the symbols listed in FLAGS."
+  (let loop ((flags flags))
+    (match flags
+      (('read-only rest ...)
+       (logior MS_RDONLY (loop rest)))
+      (('bind-mount rest ...)
+       (logior MS_BIND (loop rest)))
+      (('no-suid rest ...)
+       (logior MS_NOSUID (loop rest)))
+      (('no-dev rest ...)
+       (logior MS_NODEV (loop rest)))
+      (('no-exec rest ...)
+       (logior MS_NOEXEC (loop rest)))
+      (()
+       0))))
+
+(define* (mount-file-system spec #:key (root "/root"))
+  "Mount the file system described by SPEC under ROOT.  SPEC must have the
+form:
+
+  (DEVICE TITLE MOUNT-POINT TYPE (FLAGS ...) OPTIONS CHECK?)
+
+DEVICE, MOUNT-POINT, and TYPE must be strings; OPTIONS can be a string or #f;
+FLAGS must be a list of symbols.  CHECK? is a Boolean indicating whether to
+run a file system check."
+  (match spec
+    ((source title mount-point type (flags ...) options check?)
+     (let ((source      (canonicalize-device-spec source title))
+           (mount-point (string-append root "/" mount-point)))
+       (when check?
+         (check-file-system source type))
+       (mkdir-p mount-point)
+       (mount source mount-point type (mount-flags->bit-mask flags)
+              (if options
+                  (string->pointer options)
+                  %null-pointer))
+
+       ;; Update /etc/mtab.
+       (mkdir-p (string-append root "/etc"))
+       (let ((port (open-file (string-append root "/etc/mtab") "a")))
+         (format port "~a ~a ~a ~a 0 0~%"
+                 source mount-point type (or options ""))
+         (close-port port))))))
+
+;;; file-systems.scm ends here
diff --git a/gnu/build/install.scm b/gnu/build/install.scm
new file mode 100644
index 0000000000..e16896f8b8
--- /dev/null
+++ b/gnu/build/install.scm
@@ -0,0 +1,135 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build install)
+  #:use-module (guix build utils)
+  #:use-module (srfi srfi-26)
+  #:use-module (ice-9 match)
+  #:export (install-grub
+            populate-root-file-system
+            reset-timestamps
+            register-closure))
+
+;;; Commentary:
+;;;
+;;; This module supports the installation of the GNU system on a hard disk.
+;;; It is meant to be used both in a build environment (in derivations that
+;;; build VM images), and on the bare metal (when really installing the
+;;; system.)
+;;;
+;;; Code:
+
+(define* (install-grub grub.cfg device mount-point)
+  "Install GRUB with GRUB.CFG on DEVICE, which is assumed to be mounted on
+MOUNT-POINT."
+  (let* ((target (string-append mount-point "/boot/grub/grub.cfg"))
+         (pivot  (string-append target ".new")))
+    (mkdir-p (dirname target))
+
+    ;; Copy GRUB.CFG instead of just symlinking it since it's not a GC root.
+    ;; Do that atomically.
+    (copy-file grub.cfg pivot)
+    (rename-file pivot target)
+
+    (unless (zero? (system* "grub-install" "--no-floppy"
+                            "--boot-directory"
+                            (string-append mount-point "/boot")
+                            device))
+      (error "failed to install GRUB"))))
+
+(define (evaluate-populate-directive directive target)
+  "Evaluate DIRECTIVE, an sexp describing a file or directory to create under
+directory TARGET."
+  (let loop ((directive directive))
+    (match directive
+      (('directory name)
+       (mkdir-p (string-append target name)))
+      (('directory name uid gid)
+       (let ((dir (string-append target name)))
+         (mkdir-p dir)
+         (chown dir uid gid)))
+      (('directory name uid gid mode)
+       (loop `(directory ,name ,uid ,gid))
+       (chmod (string-append target name) mode))
+      ((new '-> old)
+       (symlink old (string-append target new))))))
+
+(define (directives store)
+  "Return a list of directives to populate the root file system that will host
+STORE."
+  `(;; Note: the store's GID is fixed precisely so we can set it here rather
+    ;; than at activation time.
+    (directory ,store 0 30000 #o1775)
+
+    (directory "/etc")
+    (directory "/var/log")                          ; for dmd
+    (directory "/var/guix/gcroots")
+    (directory "/var/empty")                        ; for no-login accounts
+    (directory "/var/db")                           ; for dhclient, etc.
+    (directory "/var/run")
+    (directory "/run")
+    (directory "/mnt")
+    (directory "/var/guix/profiles/per-user/root" 0 0)
+
+    ;; Link to the initial system generation.
+    ("/var/guix/profiles/system" -> "system-1-link")
+
+    ("/var/guix/gcroots/booted-system" -> "/run/booted-system")
+    ("/var/guix/gcroots/current-system" -> "/run/current-system")
+
+    (directory "/bin")
+    ("/bin/sh" -> "/run/current-system/profile/bin/bash")
+    (directory "/tmp" 0 0 #o1777)                 ; sticky bit
+
+    (directory "/root" 0 0)                       ; an exception
+    (directory "/home" 0 0)))
+
+(define (populate-root-file-system system target)
+  "Make the essential non-store files and directories on TARGET.  This
+includes /etc, /var, /run, /bin/sh, etc., and all the symlinks to SYSTEM."
+  (for-each (cut evaluate-populate-directive <> target)
+            (directives (%store-directory)))
+
+  ;; Add system generation 1.
+  (symlink system
+           (string-append target "/var/guix/profiles/system-1-link")))
+
+(define (reset-timestamps directory)
+  "Reset the timestamps of all the files under DIRECTORY, so that they appear
+as created and modified at the Epoch."
+  (display "clearing file timestamps...\n")
+  (for-each (lambda (file)
+              (let ((s (lstat file)))
+                ;; XXX: Guile uses libc's 'utime' function (not 'futime'), so
+                ;; the timestamp of symlinks cannot be changed, and there are
+                ;; symlinks here pointing to /gnu/store, which is the host,
+                ;; read-only store.
+                (unless (eq? (stat:type s) 'symlink)
+                  (utime file 0 0 0 0))))
+            (find-files directory "")))
+
+(define (register-closure store closure)
+  "Register CLOSURE in STORE, where STORE is the directory name of the target
+store and CLOSURE is the name of a file containing a reference graph as used
+by 'guix-register'.  As a side effect, this resets timestamps on store files."
+  (let ((status (system* "guix-register" "--prefix" store
+                         closure)))
+    (unless (zero? status)
+      (error "failed to register store items" closure))))
+
+;;; install.scm ends here
diff --git a/gnu/build/linux-boot.scm b/gnu/build/linux-boot.scm
new file mode 100644
index 0000000000..21ee58ad50
--- /dev/null
+++ b/gnu/build/linux-boot.scm
@@ -0,0 +1,445 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build linux-boot)
+  #:use-module (rnrs io ports)
+  #:use-module (system repl error-handling)
+  #:autoload   (system repl repl) (start-repl)
+  #:autoload   (system base compile) (compile-file)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 ftw)
+  #:use-module (guix build utils)
+  #:use-module (gnu build file-systems)
+  #:export (mount-essential-file-systems
+            linux-command-line
+            find-long-option
+            make-essential-device-nodes
+            configure-qemu-networking
+
+            bind-mount
+            load-linux-module*
+            device-number
+            boot-system))
+
+;;; Commentary:
+;;;
+;;; Utility procedures useful in a Linux initial RAM disk (initrd).  Note that
+;;; many of these use procedures not yet available in vanilla Guile (`mount',
+;;; `load-linux-module', etc.); these are provided by a Guile patch used in
+;;; the GNU distribution.
+;;;
+;;; Code:
+
+(define* (mount-essential-file-systems #:key (root "/"))
+  "Mount /proc and /sys under ROOT."
+  (define (scope dir)
+    (string-append root
+                   (if (string-suffix? "/" root)
+                       ""
+                       "/")
+                   dir))
+
+  (unless (file-exists? (scope "proc"))
+    (mkdir (scope "proc")))
+  (mount "none" (scope "proc") "proc")
+
+  (unless (file-exists? (scope "sys"))
+    (mkdir (scope "sys")))
+  (mount "none" (scope "sys") "sysfs"))
+
+(define (move-essential-file-systems root)
+  "Move currently mounted essential file systems to ROOT."
+  (for-each (lambda (dir)
+              (let ((target (string-append root dir)))
+                (unless (file-exists? target)
+                  (mkdir target))
+                (mount dir target "" MS_MOVE)))
+            '("/proc" "/sys")))
+
+(define (linux-command-line)
+  "Return the Linux kernel command line as a list of strings."
+  (string-tokenize
+   (call-with-input-file "/proc/cmdline"
+     get-string-all)))
+
+(define (find-long-option option arguments)
+  "Find OPTION among ARGUMENTS, where OPTION is something like \"--load\".
+Return the value associated with OPTION, or #f on failure."
+  (let ((opt (string-append option "=")))
+    (and=> (find (cut string-prefix? opt <>)
+                 arguments)
+           (lambda (arg)
+             (substring arg (+ 1 (string-index arg #\=)))))))
+
+(define* (make-disk-device-nodes base major #:optional (minor 0))
+  "Make the block device nodes around BASE (something like \"/root/dev/sda\")
+with the given MAJOR number, starting with MINOR."
+  (mknod base 'block-special #o644 (device-number major minor))
+  (let loop ((i 1))
+    (when (< i 6)
+      (mknod (string-append base (number->string i))
+             'block-special #o644 (device-number major (+ minor i)))
+      (loop (+ i 1)))))
+
+(define* (make-essential-device-nodes #:key (root "/"))
+  "Make essential device nodes under ROOT/dev."
+  ;; The hand-made udev!
+
+  (define (scope dir)
+    (string-append root
+                   (if (string-suffix? "/" root)
+                       ""
+                       "/")
+                   dir))
+
+  (unless (file-exists? (scope "dev"))
+    (mkdir (scope "dev")))
+
+  ;; Make the device nodes for SCSI disks.
+  (make-disk-device-nodes (scope "dev/sda") 8)
+  (make-disk-device-nodes (scope "dev/sdb") 8 16)
+  (make-disk-device-nodes (scope "dev/sdc") 8 32)
+  (make-disk-device-nodes (scope "dev/sdd") 8 48)
+
+  ;; SCSI CD-ROM devices (aka. "/dev/sr0" etc.).
+  (mknod (scope "dev/scd0") 'block-special #o644 (device-number 11 0))
+  (mknod (scope "dev/scd1") 'block-special #o644 (device-number 11 1))
+
+  ;; The virtio (para-virtualized) block devices, as supported by QEMU/KVM.
+  (make-disk-device-nodes (scope "dev/vda") 252)
+
+  ;; Memory (used by Xorg's VESA driver.)
+  (mknod (scope "dev/mem") 'char-special #o640 (device-number 1 1))
+  (mknod (scope "dev/kmem") 'char-special #o640 (device-number 1 2))
+
+  ;; Inputs (used by Xorg.)
+  (unless (file-exists? (scope "dev/input"))
+    (mkdir (scope "dev/input")))
+  (mknod (scope "dev/input/mice") 'char-special #o640 (device-number 13 63))
+  (mknod (scope "dev/input/mouse0") 'char-special #o640 (device-number 13 32))
+  (mknod (scope "dev/input/event0") 'char-special #o640 (device-number 13 64))
+
+  ;; System console.  This node is magically created by the kernel on the
+  ;; initrd's root, so don't try to create it in that case.
+  (unless (string=? root "/")
+    (mknod (scope "dev/console") 'char-special #o600
+           (device-number 5 1)))
+
+  ;; TTYs.
+  (mknod (scope "dev/tty") 'char-special #o600
+         (device-number 5 0))
+  (chmod (scope "dev/tty") #o666)
+  (let loop ((n 0))
+    (and (< n 50)
+         (let ((name (format #f "dev/tty~a" n)))
+           (mknod (scope name) 'char-special #o600
+                  (device-number 4 n))
+           (loop (+ 1 n)))))
+
+  ;; Serial line.
+  (mknod (scope "dev/ttyS0") 'char-special #o660
+         (device-number 4 64))
+
+  ;; Pseudo ttys.
+  (mknod (scope "dev/ptmx") 'char-special #o666
+         (device-number 5 2))
+  (chmod (scope "dev/ptmx") #o666)
+
+  ;; Create /dev/pts; it will be mounted later, at boot time.
+  (unless (file-exists? (scope "dev/pts"))
+    (mkdir (scope "dev/pts")))
+
+  ;; Rendez-vous point for syslogd.
+  (mknod (scope "dev/log") 'socket #o666 0)
+  (mknod (scope "dev/kmsg") 'char-special #o600 (device-number 1 11))
+
+  ;; Other useful nodes, notably relied on by guix-daemon.
+  (for-each (match-lambda
+             ((file major minor)
+              (mknod (scope file) 'char-special #o666
+                     (device-number major minor))
+              (chmod (scope file) #o666)))
+            '(("dev/null" 1 3)
+              ("dev/zero" 1 5)
+              ("dev/full" 1 7)
+              ("dev/random" 1 8)
+              ("dev/urandom" 1 9)))
+
+  (symlink "/proc/self/fd" (scope "dev/fd"))
+  (symlink "/proc/self/fd/0" (scope "dev/stdin"))
+  (symlink "/proc/self/fd/1" (scope "dev/stdout"))
+  (symlink "/proc/self/fd/2" (scope "dev/stderr"))
+
+  ;; Loopback devices.
+  (let loop ((i 0))
+    (when (< i 8)
+      (mknod (scope (string-append "dev/loop" (number->string i)))
+             'block-special #o660
+             (device-number 7 i))
+      (loop (+ 1 i))))
+
+  ;; File systems in user space (FUSE).
+  (mknod (scope "dev/fuse") 'char-special #o666 (device-number 10 229)))
+
+(define %host-qemu-ipv4-address
+  (inet-pton AF_INET "10.0.2.10"))
+
+(define* (configure-qemu-networking #:optional (interface "eth0"))
+  "Setup the INTERFACE network interface and /etc/resolv.conf according to
+QEMU's default networking settings (see net/slirp.c in QEMU for default
+networking values.)  Return #t if INTERFACE is up, #f otherwise."
+  (display "configuring QEMU networking...\n")
+  (let* ((sock    (socket AF_INET SOCK_STREAM 0))
+         (address (make-socket-address AF_INET %host-qemu-ipv4-address 0))
+         (flags   (network-interface-flags sock interface)))
+    (set-network-interface-address sock interface address)
+    (set-network-interface-flags sock interface (logior flags IFF_UP))
+
+    ;; Hello!  We used to create /etc/resolv.conf here, with "nameserver
+    ;; 10.0.2.3\n".  However, with Linux-libre 3.16, we're getting ENOSPC.
+    ;; And since it's actually unnecessary, it's gone.
+
+    (logand (network-interface-flags sock interface) IFF_UP)))
+
+(define (load-linux-module* file)
+  "Load Linux module from FILE, the name of a `.ko' file."
+  (define (slurp module)
+    (call-with-input-file file get-bytevector-all))
+
+  (load-linux-module (slurp file)))
+
+(define (device-number major minor)
+  "Return the device number for the device with MAJOR and MINOR, for use as
+the last argument of `mknod'."
+  (+ (* major 256) minor))
+
+(define (pidof program)
+  "Return the PID of the first presumed instance of PROGRAM."
+  (let ((program (basename program)))
+    (find (lambda (pid)
+            (let ((exe (format #f "/proc/~a/exe" pid)))
+              (and=> (false-if-exception (readlink exe))
+                     (compose (cut string=? program <>) basename))))
+          (filter-map string->number (scandir "/proc")))))
+
+(define* (mount-root-file-system root type
+                                 #:key volatile-root? (unionfs "unionfs"))
+  "Mount the root file system of type TYPE at device ROOT.  If VOLATILE-ROOT?
+is true, mount ROOT read-only and make it a union with a writable tmpfs using
+UNIONFS."
+  (define (mark-as-not-killable pid)
+    ;; Tell the 'user-processes' dmd service that PID must be kept alive when
+    ;; shutting down.
+    (mkdir-p "/root/etc/dmd")
+    (let ((port (open-file "/root/etc/dmd/do-not-kill" "a")))
+      (chmod port #o600)
+      (write pid port)
+      (newline port)
+      (close-port port)))
+
+  (catch #t
+    (lambda ()
+      (if volatile-root?
+          (begin
+            (mkdir-p "/real-root")
+            (mount root "/real-root" type MS_RDONLY)
+            (mkdir-p "/rw-root")
+            (mount "none" "/rw-root" "tmpfs")
+
+            ;; We want read-write /dev nodes.
+            (make-essential-device-nodes #:root "/rw-root")
+
+            ;; Make /root a union of the tmpfs and the actual root.  Use
+            ;; 'max_files' to set a high RLIMIT_NOFILE for the unionfs process
+            ;; itself.  Failing to do that, we quickly run out of file
+            ;; descriptors; see <http://bugs.gnu.org/17827>.
+            (unless (zero? (system* unionfs "-o"
+                                    "cow,allow_other,use_ino,suid,dev,max_files=65536"
+                                    "/rw-root=RW:/real-root=RO"
+                                    "/root"))
+              (error "unionfs failed"))
+
+            ;; Make sure unionfs remains alive till the end.  Because
+            ;; 'fuse_daemonize' doesn't tell the PID of the forked daemon, we
+            ;; have to resort to 'pidof' here.
+            (mark-as-not-killable (pidof unionfs)))
+          (begin
+            (check-file-system root type)
+            (mount root "/root" type))))
+    (lambda args
+      (format (current-error-port) "exception while mounting '~a': ~s~%"
+              root args)
+      (start-repl)))
+
+  (copy-file "/proc/mounts" "/root/etc/mtab"))
+
+(define (switch-root root)
+  "Switch to ROOT as the root file system, in a way similar to what
+util-linux' switch_root(8) does."
+  (move-essential-file-systems root)
+  (chdir root)
+
+  ;; Since we're about to 'rm -rf /', try to make sure we're on an initrd.
+  ;; TODO: Use 'statfs' to check the fs type, like klibc does.
+  (when (or (not (file-exists? "/init")) (directory-exists? "/home"))
+    (format (current-error-port)
+            "The root file system is probably not an initrd; \
+bailing out.~%root contents: ~s~%" (scandir "/"))
+    (force-output (current-error-port))
+    (exit 1))
+
+  ;; Delete files from the old root, without crossing mount points (assuming
+  ;; there are no mount points in sub-directories.)  That means we're leaving
+  ;; the empty ROOT directory behind us, but that's OK.
+  (let ((root-device (stat:dev (stat "/"))))
+    (for-each (lambda (file)
+                (unless (member file '("." ".."))
+                  (let* ((file   (string-append "/" file))
+                         (device (stat:dev (lstat file))))
+                    (when (= device root-device)
+                      (delete-file-recursively file)))))
+              (scandir "/")))
+
+  ;; Make ROOT the new root.
+  (mount root "/" "" MS_MOVE)
+  (chroot ".")
+  (chdir "/")
+
+  (when (file-exists? "/dev/console")
+    ;; Close the standard file descriptors since they refer to the old
+    ;; /dev/console, and reopen them.
+    (let ((console (open-file "/dev/console" "r+b0")))
+      (for-each close-fdes '(0 1 2))
+
+      (dup2 (fileno console) 0)
+      (dup2 (fileno console) 1)
+      (dup2 (fileno console) 2)
+
+      (close-port console))))
+
+
+(define* (boot-system #:key
+                      (linux-modules '())
+                      qemu-guest-networking?
+                      guile-modules-in-chroot?
+                      volatile-root?
+                      (mounts '()))
+  "This procedure is meant to be called from an initrd.  Boot a system by
+first loading LINUX-MODULES, then setting up QEMU guest networking if
+QEMU-GUEST-NETWORKING? is true, mounting the file systems specified in MOUNTS,
+and finally booting into the new root if any.  The initrd supports kernel
+command-line options '--load', '--root', and '--repl'.
+
+Mount the root file system, specified by the '--root' command-line argument,
+if any.
+
+MOUNTS must be a list suitable for 'mount-file-system'.
+
+When GUILE-MODULES-IN-CHROOT? is true, make core Guile modules available in
+the new root.
+
+When VOLATILE-ROOT? is true, the root file system is writable but any changes
+to it are lost."
+  (define root-mount-point?
+    (match-lambda
+     ((device _ "/" _ ...) #t)
+     (_ #f)))
+
+  (define root-fs-type
+    (or (any (match-lambda
+              ((device _ "/" type _ ...) type)
+              (_ #f))
+             mounts)
+        "ext4"))
+
+  (display "Welcome, this is GNU's early boot Guile.\n")
+  (display "Use '--repl' for an initrd REPL.\n\n")
+
+  (call-with-error-handling
+   (lambda ()
+     (mount-essential-file-systems)
+     (let* ((args    (linux-command-line))
+            (to-load (find-long-option "--load" args))
+            (root    (find-long-option "--root" args)))
+
+       (when (member "--repl" args)
+         (start-repl))
+
+       (display "loading kernel modules...\n")
+       (for-each (compose load-linux-module*
+                          (cut string-append "/modules/" <>))
+                 linux-modules)
+
+       (when qemu-guest-networking?
+         (unless (configure-qemu-networking)
+           (display "network interface is DOWN\n")))
+
+       ;; Make /dev nodes.
+       (make-essential-device-nodes)
+
+       ;; Prepare the real root file system under /root.
+       (unless (file-exists? "/root")
+         (mkdir "/root"))
+       (if root
+           (mount-root-file-system (canonicalize-device-spec root)
+                                   root-fs-type
+                                   #:volatile-root? volatile-root?)
+           (mount "none" "/root" "tmpfs"))
+
+       (unless (file-exists? "/root/dev")
+         (mkdir "/root/dev")
+         (make-essential-device-nodes #:root "/root"))
+
+       ;; Mount the specified file systems.
+       (for-each mount-file-system
+                 (remove root-mount-point? mounts))
+
+       (when guile-modules-in-chroot?
+         ;; Copy the directories that contain .scm and .go files so that the
+         ;; child process in the chroot can load modules (we would bind-mount
+         ;; them but for some reason that fails with EINVAL -- XXX).
+         (mkdir-p "/root/share")
+         (mkdir-p "/root/lib")
+         (mount "none" "/root/share" "tmpfs")
+         (mount "none" "/root/lib" "tmpfs")
+         (copy-recursively "/share" "/root/share"
+                           #:log (%make-void-port "w"))
+         (copy-recursively "/lib" "/root/lib"
+                           #:log (%make-void-port "w")))
+
+       (if to-load
+           (begin
+             (switch-root "/root")
+             (format #t "loading '~a'...\n" to-load)
+
+             ;; TODO: Remove /lib, /share, and /loader.go.
+             (primitive-load to-load)
+
+             (format (current-error-port)
+                     "boot program '~a' terminated, rebooting~%"
+                     to-load)
+             (sleep 2)
+             (reboot))
+           (begin
+             (display "no boot file passed via '--load'\n")
+             (display "entering a warm and cozy REPL\n")
+             (start-repl)))))))
+
+;;; linux-initrd.scm ends here
diff --git a/gnu/build/linux-initrd.scm b/gnu/build/linux-initrd.scm
new file mode 100644
index 0000000000..bf60137e8f
--- /dev/null
+++ b/gnu/build/linux-initrd.scm
@@ -0,0 +1,72 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build linux-initrd)
+  #:use-module (ice-9 popen)
+  #:use-module (ice-9 ftw)
+  #:export (write-cpio-archive))
+
+;;; Commentary:
+;;;
+;;; Tools to create Linux initial RAM disks ("initrds").  Initrds are
+;;; essentially gzipped cpio archives, with a '/init' executable that the
+;;; kernel runs at boot time.
+;;;
+;;; Code:
+
+(define* (write-cpio-archive output directory
+                             #:key
+                             (compress? #t)
+                             (cpio "cpio") (gzip "gzip"))
+  "Write a cpio archive containing DIRECTORY to file OUTPUT, using CPIO.  When
+COMPRESS? is true, compress it using GZIP.  On success, return OUTPUT."
+
+  ;; Note: don't use '--no-absolute-filenames' since that strips leading
+  ;; slashes from symlink targets.
+  (let ((pipe (open-pipe* OPEN_WRITE cpio "-o" "-O" output
+                          "-H" "newc" "--null")))
+    (define (print0 file)
+      (format pipe "~a\0" file))
+
+    ;; Note: as per `ramfs-rootfs-initramfs.txt', always add directory entries
+    ;; before the files that are inside of it: "The Linux kernel cpio
+    ;; extractor won't create files in a directory that doesn't exist, so the
+    ;; directory entries must go before the files that go in those
+    ;; directories."
+
+    ;; XXX: Use a deterministic order.
+    (file-system-fold (const #t)
+                      (lambda (file stat result)   ; leaf
+                        (print0 file))
+                      (lambda (dir stat result)    ; down
+                        (unless (string=? dir directory)
+                          (print0 dir)))
+                      (const #f)                   ; up
+                      (const #f)                   ; skip
+                      (const #f)
+                      #f
+                      directory)
+
+    (and (zero? (close-pipe pipe))
+         (or (not compress?)
+             (and (zero? (system* gzip "--best" output))
+                  (rename-file (string-append output ".gz")
+                               output))
+             output))))
+
+;;; linux-initrd.scm ends here
diff --git a/gnu/build/vm.scm b/gnu/build/vm.scm
new file mode 100644
index 0000000000..27ccd047b7
--- /dev/null
+++ b/gnu/build/vm.scm
@@ -0,0 +1,224 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build vm)
+  #:use-module (guix build utils)
+  #:use-module (guix build store-copy)
+  #:use-module (gnu build linux-boot)
+  #:use-module (gnu build install)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 regex)
+  #:use-module (srfi srfi-26)
+  #:export (qemu-command
+            load-in-linux-vm
+            format-partition
+            initialize-root-partition
+            initialize-partition-table
+            initialize-hard-disk))
+
+;;; Commentary:
+;;;
+;;; This module provides supporting code to run virtual machines and build
+;;; virtual machine images using QEMU.
+;;;
+;;; Code:
+
+(define* (qemu-command #:optional (system %host-type))
+  "Return the default name of the QEMU command for SYSTEM."
+  (let ((cpu (substring %host-type 0
+                        (string-index %host-type #\-))))
+    (string-append "qemu-system-"
+                   (if (string-match "^i[3456]86$" cpu)
+                       "i386"
+                       cpu))))
+
+(define* (load-in-linux-vm builder
+                           #:key
+                           output
+                           (qemu (qemu-command)) (memory-size 512)
+                           linux initrd
+                           make-disk-image? (disk-image-size 100)
+                           (disk-image-format "qcow2")
+                           (references-graphs '()))
+  "Run BUILDER, a Scheme file, into a VM running LINUX with INITRD, and copy
+the result to OUTPUT.
+
+When MAKE-DISK-IMAGE? is true, OUTPUT will contain a VM image of
+DISK-IMAGE-SIZE MiB resulting from the execution of BUILDER, which may access
+it via /dev/hda.
+
+REFERENCES-GRAPHS can specify a list of reference-graph files as produced by
+the #:references-graphs parameter of 'derivation'."
+  (define image-file
+    (string-append "image." disk-image-format))
+
+  (when make-disk-image?
+    (unless (zero? (system* "qemu-img" "create" "-f" disk-image-format
+                            image-file
+                            (number->string disk-image-size)))
+      (error "qemu-img failed")))
+
+  (mkdir "xchg")
+
+  (match references-graphs
+    ((graph-files ...)
+     ;; Copy the reference-graph files under xchg/ so EXP can access it.
+     (map (lambda (file)
+            (copy-file file (string-append "xchg/" file)))
+          graph-files))
+    (_ #f))
+
+  (unless (zero?
+           (apply system* qemu "-enable-kvm" "-nographic" "-no-reboot"
+                  "-m" (number->string memory-size)
+                  "-net" "nic,model=virtio"
+                  "-virtfs"
+                  (string-append "local,id=store_dev,path="
+                                 (%store-directory)
+                                 ",security_model=none,mount_tag=store")
+                  "-virtfs"
+                  (string-append "local,id=xchg_dev,path=xchg"
+                                 ",security_model=none,mount_tag=xchg")
+                  "-kernel" linux
+                  "-initrd" initrd
+                  "-append" (string-append "console=ttyS0 --load="
+                                           builder)
+                  (if make-disk-image?
+                      `("-drive" ,(string-append "file=" image-file
+                                                 ",if=virtio"))
+                      '())))
+    (error "qemu failed" qemu))
+
+  (if make-disk-image?
+      (copy-file image-file output)
+      (begin
+        (mkdir output)
+        (copy-recursively "xchg" output))))
+
+(define* (initialize-partition-table device partition-size
+                                     #:key
+                                     (label-type "msdos")
+                                     (offset (expt 2 20)))
+  "Create on DEVICE a partition table of type LABEL-TYPE, with a single
+partition of PARTITION-SIZE bytes starting at OFFSET bytes.  Return #t on
+success."
+  (format #t "creating partition table with a ~a B partition...\n"
+          partition-size)
+  (unless (zero? (system* "parted" device "mklabel" label-type
+                          "mkpart" "primary" "ext2"
+                          (format #f "~aB" offset)
+                          (format #f "~aB" partition-size)))
+    (error "failed to create partition table")))
+
+(define MS_BIND 4096)                             ; <sys/mounts.h> again!
+
+(define* (format-partition partition type
+                           #:key label)
+  "Create a file system TYPE on PARTITION.  If LABEL is true, use that as the
+volume name."
+  (format #t "creating ~a partition...\n" type)
+  (unless (zero? (apply system* (string-append "mkfs." type)
+                        "-F" partition
+                        (if label
+                            `("-L" ,label)
+                            '())))
+    (error "failed to create partition")))
+
+(define* (initialize-root-partition target-directory
+                                    #:key copy-closures? register-closures?
+                                    closures system-directory)
+  "Initialize the root partition mounted at TARGET-DIRECTORY."
+  (define target-store
+    (string-append target-directory (%store-directory)))
+
+  (when copy-closures?
+    ;; Populate the store.
+    (populate-store (map (cut string-append "/xchg/" <>) closures)
+                    target-directory))
+
+  ;; Populate /dev.
+  (make-essential-device-nodes #:root target-directory)
+
+  ;; Optionally, register the inputs in the image's store.
+  (when register-closures?
+    (unless copy-closures?
+      ;; XXX: 'guix-register' wants to palpate the things it registers, so
+      ;; bind-mount the store on the target.
+      (mkdir-p target-store)
+      (mount (%store-directory) target-store "" MS_BIND))
+
+    (display "registering closures...\n")
+    (for-each (lambda (closure)
+                (register-closure target-directory
+                                  (string-append "/xchg/" closure)))
+              closures)
+    (unless copy-closures?
+      (system* "umount" target-store)))
+
+  ;; Add the non-store directories and files.
+  (display "populating...\n")
+  (populate-root-file-system system-directory target-directory))
+
+(define* (initialize-hard-disk device
+                               #:key
+                               system-directory
+                               grub.cfg
+                               disk-image-size
+                               (file-system-type "ext4")
+                               file-system-label
+                               (closures '())
+                               copy-closures?
+                               (register-closures? #t))
+  "Initialize DEVICE, a disk of DISK-IMAGE-SIZE bytes, with a FILE-SYSTEM-TYPE
+partition with (optionally) FILE-SYSTEM-LABEL as its volume name, and with
+GRUB installed.  If REGISTER-CLOSURES? is true, register all of CLOSURES is
+the partition's store.  If COPY-CLOSURES? is true, copy all of CLOSURES to the
+partition.  SYSTEM-DIRECTORY is the name of the directory of the 'system'
+derivation."
+  (define target-directory
+    "/fs")
+
+  (define partition
+    (string-append device "1"))
+
+  (initialize-partition-table device
+                              (- disk-image-size (* 5 (expt 2 20))))
+
+  (format-partition partition file-system-type
+                    #:label file-system-label)
+
+  (display "mounting partition...\n")
+  (mkdir target-directory)
+  (mount partition target-directory file-system-type)
+
+  (initialize-root-partition target-directory
+                             #:system-directory system-directory
+                             #:copy-closures? copy-closures?
+                             #:register-closures? register-closures?
+                             #:closures closures)
+
+  (install-grub grub.cfg device target-directory)
+
+  ;; 'guix-register' resets timestamps and everything, so no need to do it
+  ;; once more in that case.
+  (unless register-closures?
+    (reset-timestamps target-directory))
+
+  (zero? (system* "umount" target-directory)))
+
+;;; vm.scm ends here