treewide: update sandboxroot to fedora 40, nix to 24.05

We didn't bump our sandboxroot in a long time, this updates it to fedora
 40
 and updates the nix shell to nixpkgs-24.05. It also bumps rules_oci to
 the current version.

Change-Id: I9ffb6f4dcd1a95be48b52015df987824dbb169f6
Reviewed-on: https://review.monogon.dev/c/monogon/+/3205
Tested-by: Jenkins CI
Reviewed-by: Leopold Schabel <leo@monogon.tech>
diff --git a/third_party/qemu/external.bzl b/third_party/qemu/external.bzl
index 456aa23..cae80da 100644
--- a/third_party/qemu/external.bzl
+++ b/third_party/qemu/external.bzl
@@ -29,6 +29,8 @@
             "//third_party/qemu/patches:bazel_support.patch",
             "//third_party/qemu/patches:pregenerated_config_files.patch",
             "//third_party/qemu/patches:headers_fix.patch",
+            "//third_party/qemu/patches:linux-headers-update.patch",
+            "//third_party/qemu/patches:standard-headers-removal.patch",
         ],
         sha256 = sums[version],
         strip_prefix = "qemu-" + version,
diff --git a/third_party/qemu/patches/bazel_support.patch b/third_party/qemu/patches/bazel_support.patch
index a2c65a0..6a1daff 100644
--- a/third_party/qemu/patches/bazel_support.patch
+++ b/third_party/qemu/patches/bazel_support.patch
@@ -3,7 +3,7 @@
 index 0000000000..436f8c5cf3
 --- /dev/null
 +++ b/BUILD
-@@ -0,0 +1,1358 @@
+@@ -0,0 +1,1356 @@
 +load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 +load("@rules_python//python:defs.bzl", "py_binary")
 +load("@dev_source_monogon//build/utils:template_file.bzl", "template_file")
@@ -126,8 +126,6 @@
 +        "io/**/*.inc",
 +        "libdecnumber/**/*.h",
 +        "libdecnumber/**/*.inc",
-+        "linux-headers/**/*.h",
-+        "linux-headers/**/*.inc",
 +        "linux-user/**/*.h",
 +        "linux-user/**/*.inc",
 +        "migration/**/*.h",
@@ -1116,7 +1114,7 @@
 +        "@zlib//:zlib",
 +    ],
 +    visibility = ["//visibility:public"],
-+    includes = ["linux-headers", "include"],
++    includes = ["include"],
 +)
 +
 +cc_binary(
@@ -1262,7 +1260,7 @@
 +        "@zlib//:zlib",
 +    ],
 +    visibility = ["//visibility:public"],
-+    includes = ["target/i386", "tcg/i386", "accel/tcg", "linux-headers"],
++    includes = ["target/i386", "tcg/i386", "accel/tcg"],
 +)
 +
 +genrule(
diff --git a/third_party/qemu/patches/linux-headers-update.patch b/third_party/qemu/patches/linux-headers-update.patch
new file mode 100644
index 0000000..f7d2580
--- /dev/null
+++ b/third_party/qemu/patches/linux-headers-update.patch
@@ -0,0 +1,132 @@
+From 9aee9f1af189d9026c06609386f5f034d08b73e1 Mon Sep 17 00:00:00 2001
+From: Tim Windelschmidt <tim@monogon.tech>
+Date: Thu, 4 Jul 2024 22:47:00 +0200
+Subject: [PATCH] update VFIO enum names
+
+---
+ hw/vfio/common.c    |  8 ++++----
+ hw/vfio/migration.c | 27 +++++++++++++++------------
+ 2 files changed, 19 insertions(+), 16 deletions(-)
+
+diff --git a/hw/vfio/common.c b/hw/vfio/common.c
+index 6ff1daa763..2ad5a3346b 100644
+--- a/hw/vfio/common.c
++++ b/hw/vfio/common.c
+@@ -329,9 +329,9 @@ static bool vfio_devices_all_saving(VFIOContainer *container)
+                 return false;
+             }
+
+-            if (migration->device_state & VFIO_DEVICE_STATE_SAVING) {
++            if (migration->device_state & VFIO_DEVICE_STATE_V1_SAVING) {
+                 if ((vbasedev->pre_copy_dirty_page_tracking == ON_OFF_AUTO_OFF)
+-                    && (migration->device_state & VFIO_DEVICE_STATE_RUNNING)) {
++                    && (migration->device_state & VFIO_DEVICE_STATE_V1_RUNNING)) {
+                         return false;
+                 }
+                 continue;
+@@ -361,8 +361,8 @@ static bool vfio_devices_all_running_and_saving(VFIOContainer *container)
+                 return false;
+             }
+
+-            if ((migration->device_state & VFIO_DEVICE_STATE_SAVING) &&
+-                (migration->device_state & VFIO_DEVICE_STATE_RUNNING)) {
++            if ((migration->device_state & VFIO_DEVICE_STATE_V1_SAVING) &&
++                (migration->device_state & VFIO_DEVICE_STATE_V1_RUNNING)) {
+                 continue;
+             } else {
+                 return false;
+diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
+index 00daa50ed8..a56b7d6a7a 100644
+--- a/hw/vfio/migration.c
++++ b/hw/vfio/migration.c
+@@ -405,7 +405,7 @@ static int vfio_set_dirty_page_tracking(VFIODevice *vbasedev, bool start)
+     };
+
+     if (start) {
+-        if (migration->device_state & VFIO_DEVICE_STATE_SAVING) {
++        if (migration->device_state & VFIO_DEVICE_STATE_V1_SAVING) {
+             dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_START;
+         } else {
+             return -EINVAL;
+@@ -463,7 +463,7 @@ static int vfio_save_setup(QEMUFile *f, void *opaque)
+     }
+
+     ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_MASK,
+-                                   VFIO_DEVICE_STATE_SAVING);
++                                   VFIO_DEVICE_STATE_V1_SAVING);
+     if (ret) {
+         error_report("%s: Failed to set state SAVING", vbasedev->name);
+         return ret;
+@@ -567,8 +567,8 @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
+     uint64_t data_size;
+     int ret;
+
+-    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_RUNNING,
+-                                   VFIO_DEVICE_STATE_SAVING);
++    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_V1_RUNNING,
++                                   VFIO_DEVICE_STATE_V1_SAVING);
+     if (ret) {
+         error_report("%s: Failed to set state STOP and SAVING",
+                      vbasedev->name);
+@@ -610,7 +610,7 @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
+         return ret;
+     }
+
+-    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_SAVING, 0);
++    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_V1_SAVING, 0);
+     if (ret) {
+         error_report("%s: Failed to set state STOPPED", vbasedev->name);
+         return ret;
+@@ -637,7 +637,7 @@ static int vfio_load_setup(QEMUFile *f, void *opaque)
+     }
+
+     ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_MASK,
+-                                   VFIO_DEVICE_STATE_RESUMING);
++                                   VFIO_DEVICE_STATE_V1_RESUMING);
+     if (ret) {
+         error_report("%s: Failed to set state RESUMING", vbasedev->name);
+         if (migration->region.mmaps) {
+@@ -748,13 +748,13 @@ static void vfio_vmstate_change(void *opaque, int running, RunState state)
+          * In both the above cases, set _RUNNING bit.
+          */
+         mask = ~VFIO_DEVICE_STATE_MASK;
+-        value = VFIO_DEVICE_STATE_RUNNING;
++        value = VFIO_DEVICE_STATE_V1_RUNNING;
+     } else {
+         /*
+          * Here device state could be either _RUNNING or _SAVING|_RUNNING. Reset
+          * _RUNNING bit
+          */
+-        mask = ~VFIO_DEVICE_STATE_RUNNING;
++        mask = ~VFIO_DEVICE_STATE_V1_RUNNING;
+         value = 0;
+     }
+
+@@ -790,8 +790,9 @@ static void vfio_migration_state_notifier(Notifier *notifier, void *data)
+     case MIGRATION_STATUS_FAILED:
+         bytes_transferred = 0;
+         ret = vfio_migration_set_state(vbasedev,
+-                      ~(VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING),
+-                      VFIO_DEVICE_STATE_RUNNING);
++                                       ~(VFIO_DEVICE_STATE_V1_SAVING |
++                                         VFIO_DEVICE_STATE_V1_RESUMING),
++                                       VFIO_DEVICE_STATE_V1_RUNNING);
+         if (ret) {
+             error_report("%s: Failed to set state RUNNING", vbasedev->name);
+         }
+@@ -886,8 +887,10 @@ int vfio_migration_probe(VFIODevice *vbasedev, Error **errp)
+         goto add_blocker;
+     }
+
+-    ret = vfio_get_dev_region_info(vbasedev, VFIO_REGION_TYPE_MIGRATION,
+-                                   VFIO_REGION_SUBTYPE_MIGRATION, &info);
++    ret = vfio_get_dev_region_info(vbasedev,
++                                   VFIO_REGION_TYPE_MIGRATION_DEPRECATED,
++                                   VFIO_REGION_SUBTYPE_MIGRATION_DEPRECATED,
++                                   &info);
+     if (ret) {
+         goto add_blocker;
+     }
+--
+2.44.1
+
diff --git a/third_party/qemu/patches/standard-headers-removal.patch b/third_party/qemu/patches/standard-headers-removal.patch
new file mode 100644
index 0000000..092a643
--- /dev/null
+++ b/third_party/qemu/patches/standard-headers-removal.patch
@@ -0,0 +1,26 @@
+From f0e030f8b33df2009d233ffda00def50b30c8ca6 Mon Sep 17 00:00:00 2001
+From: Tim Windelschmidt <tim@monogon.tech>
+Date: Thu, 11 Jul 2024 16:21:48 +0200
+Subject: [PATCH] remove includes of "standard-headers"
+
+We ship these ourselves and qemu uses old ones
+---
+ hw/virtio/vhost-backend.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c
+index 222bbcc62d..8f495ad374 100644
+--- a/hw/virtio/vhost-backend.c
++++ b/hw/virtio/vhost-backend.c
+@@ -13,7 +13,7 @@
+ #include "hw/virtio/vhost-backend.h"
+ #include "qemu/error-report.h"
+ #include "qemu/main-loop.h"
+-#include "standard-headers/linux/vhost_types.h"
++#include <linux/vhost_types.h>
+
+ #include "hw/virtio/vhost-vdpa.h"
+ #ifdef CONFIG_VHOST_KERNEL
+--
+2.44.1
+