Infecting the Steam Link with NixOS

In a recent endeavor, a writer sought to install the NixOS operating system onto a Steam Link device, a low-power Arm device equipped with Ethernet, Wi-Fi, Bluetooth, and multiple USB ports. The writer discovered that a fellow user, fijam, had already figured out the main hurdles involved in running a custom Linux distro on the Steam Link.

The most significant barrier was the Steam Link's bootloader only allowing kernels signed by Valve. To overcome this, the writer devised a method to boot into a Valve-approved kernel and then execute a freshly compiled kernel using the kexec syscall. However, the Steam Link's kernel did not include the CONFIG_KEXEC flag, necessitating a solution to add the kexec syscall to the running system.

The writer compiled a minimal kernel module containing the kexec syscall, which could be utilized to extend the Steam Link's capabilities. The compilation process involved creating a NixOS userspace and kernel/initrd, selecting the appropriate target architecture, and overcoming challenges related to the kernel module build process.

Once the kexec_mod kernel module and associated files were successfully compiled, the writer proceeded to create a disk image using the sd-image NixOS module, which contained all the necessary components for the Steam Link.

Testing the kexec handoff proved difficult, as the HDMI output was incompatible with the chosen kernel, and the UART was inaccessible. To debug the issue, the writer opted to use a minimal Busybox-based initramfs that rebooted after a variable duration to indicate success. Subsequent debugging was conducted using a Netcat-based reverse shell connected to the writer's laptop.

Upon successful booting, the writer faced the challenge of reducing the disk image size, which had ballooned to 2.3GB. After extensive experimentation and careful trimming, the writer achieved a 1.2GB disk image. The most significant optimizations included removing unnecessary binary blobs and building the kernel module from source. The writer's Nix flake and the source code for the kexec_mod kernel module are available for download, along with the complete flake.nix configuration for reference.