anchor.diff:            -smp ${toString config.virtualisation.cores} \
             -device virtio-rng-pci \
             ${concatStringsSep " " config.virtualisation.qemu.networkingOptions} \
  -          -virtfs local,path=/nix/store,security_model=none,mount_tag=store \
  -          -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
  -          -virtfs local,path=''${SHARED_DIR:-$TMPDIR/xchg},security_model=none,mount_tag=shared \
  +          ${concatStringsSep " \\\n    "
  +            (mapAttrsToList
  +              (tag: share: "-virtfs local,path=${share.source},security_model=none,mount_tag=${tag}")
  +              config.virtualisation.sharedDirectories)} \
             ${drivesCmdLine config.virtualisation.qemu.drives} \
             ${concatStringsSep " \\\n    " config.virtualisation.qemu.options} \
             $QEMU_OPTS \
  
positive.code:           '';
        };
  
      virtualisation.pathsInNixDB =
        mkOption {
          type = types.listOf types.path;
  
negative.code:             # Sync with systemd's tmp.mount;
              options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmpOnTmpfsSize}" ];
            };
  
          "/nix/.rw-store" = mkIf (cfg.writableStore && cfg.writableStoreUseTmpfs)
            { fsType = "tmpfs";
              options = [ "mode=0755" ];
              neededForBoot = true;
            };
  
          "/boot" = mkIf cfg.useBootLoader
            # see note [Disk layout with `useBootLoader`]
            { device = "${lookupDriveDeviceName "boot" cfg.qemu.drives}2"; # 2 for e.g. `vdb2`, as created in `bootDisk`
              fsType = "vfat";
              noCheck = true; # fsck fails on a r/o filesystem
            };
        } // lib.mapAttrs' mkSharedDir cfg.sharedDirectories);
  
      swapDevices = mkVMOverride [ ];
      boot.initrd.luks.devices = mkVMOverride {};
  