diff --git a/.github/labeler.yml b/.github/labeler.yml
index eca2a2527037a..485bcce6a8a4d 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -385,9 +385,11 @@
- changed-files:
- any-glob-to-any-file:
- nixos/modules/virtualisation/xen*
- - pkgs/applications/virtualization/xen/**
+ - pkgs/by-name/xe/xen/*
+ - pkgs/by-name/qe/qemu_xen/*
- pkgs/by-name/xe/xen-guest-agent/*
- pkgs/by-name/xt/xtf/*
+ - pkgs/build-support/xen/*
- pkgs/development/ocaml-modules/xen*/*
- pkgs/development/ocaml-modules/vchan/*
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 569c03ec3497a..c0d8701095275 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -54,12 +54,11 @@
was added through the `boot.initrd.systemd.dmVerity` option.
- The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
- - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems.
+ - This release includes Xen [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes) and support for booting the hypervisor on EFI systems.
::: {.warning}
Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
:::
- - There are two flavours of Xen available by default: `xen`, which includes all built-in components, and `xen-slim`, which replaces the built-in components with their Nixpkgs equivalents.
- - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer available in any of the Xen Project Hypervisor packages.
+ - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer included in the Xen build.
- The OCaml-based Xen Store can now be configured using [`virtualisation.xen.store.settings`](#opt-virtualisation.xen.store.settings).
- The `virtualisation.xen.bridge` options have been deprecated in this release cycle. Users who need network bridges are encouraged to set up their own networking configurations.
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index 9b6ec543dae59..2911c0c1d97c4 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -8,6 +8,35 @@
}:
let
+ inherit (builtins) readFile;
+ inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule mkIf;
+ inherit (lib.options)
+ mkOption
+ mkEnableOption
+ literalExpression
+ mkPackageOption
+ ;
+ inherit (lib.types)
+ listOf
+ str
+ ints
+ lines
+ enum
+ path
+ submodule
+ addCheck
+ float
+ bool
+ int
+ nullOr
+ ;
+ inherit (lib.lists) optional optionals;
+ inherit (lib.strings) hasSuffix optionalString;
+ inherit (lib.meta) getExe;
+ inherit (lib.attrsets) optionalAttrs;
+ inherit (lib.trivial) boolToString;
+ inherit (lib.teams.xen) members;
+
cfg = config.virtualisation.xen;
xenBootBuilder = pkgs.writeShellApplication {
@@ -22,7 +51,7 @@ let
gnused
jq
])
- ++ lib.lists.optionals (cfg.efi.bootBuilderVerbosity == "info") (
+ ++ optionals (cfg.efi.bootBuilderVerbosity == "info") (
with pkgs;
[
bat
@@ -36,12 +65,12 @@ let
# We disable SC2016 because we don't want to expand the regexes in the sed commands.
excludeShellChecks = [ "SC2016" ];
- text = builtins.readFile ./xen-boot-builder.sh;
+ text = readFile ./xen-boot-builder.sh;
};
in
{
- imports = with lib.modules; [
+ imports = [
(mkRemovedOptionModule
[
"virtualisation"
@@ -123,59 +152,33 @@ in
options.virtualisation.xen = {
- enable = lib.options.mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect";
+ enable = mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect";
- debug = lib.options.mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production";
+ debug = mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production";
- trace = lib.options.mkOption {
- type = lib.types.bool;
+ trace = mkOption {
+ type = bool;
default = cfg.debug;
- defaultText = lib.options.literalExpression "false";
+ defaultText = literalExpression "false";
example = true;
description = "Whether to enable Xen debug tracing and logging for Domain 0.";
};
- package = lib.options.mkOption {
- type = lib.types.package;
- default = pkgs.xen;
- defaultText = lib.options.literalExpression "pkgs.xen";
- example = lib.options.literalExpression "pkgs.xen-slim";
- description = ''
- The package used for Xen Project Hypervisor.
- '';
- relatedPackages = [
- "xen"
- "xen-slim"
- ];
- };
+ package = mkPackageOption pkgs "Xen Hypervisor" { default = [ "xen" ]; };
qemu = {
- package = lib.options.mkOption {
- type = lib.types.package;
- default = pkgs.xen;
- defaultText = lib.options.literalExpression "pkgs.xen";
- example = lib.options.literalExpression "pkgs.qemu_xen";
- description = ''
- The package with QEMU binaries that runs in Domain 0
- and virtualises the unprivileged domains.
- '';
- relatedPackages = [
- "xen"
- {
- name = "qemu_xen";
- comment = "For use with `pkgs.xen-slim`.";
- }
- ];
+ package = mkPackageOption pkgs "QEMU (with Xen Hypervisor support)" {
+ default = [ "qemu_xen" ];
};
- pidFile = lib.options.mkOption {
- type = lib.types.path;
+ pidFile = mkOption {
+ type = path;
default = "/run/xen/qemu-dom0.pid";
example = "/var/run/xen/qemu-dom0.pid";
description = "Path to the QEMU PID file.";
};
};
- bootParams = lib.options.mkOption {
+ bootParams = mkOption {
default = [ ];
example = ''
[
@@ -184,7 +187,7 @@ in
"vga=ask"
]
'';
- type = lib.types.listOf lib.types.str;
+ type = listOf str;
description = ''
Xen Command Line parameters passed to Domain 0 at boot time.
Note: these are different from `boot.kernelParams`. See
@@ -193,8 +196,8 @@ in
};
efi = {
- bootBuilderVerbosity = lib.options.mkOption {
- type = lib.types.enum [
+ bootBuilderVerbosity = mkOption {
+ type = enum [
"default"
"info"
"debug"
@@ -218,11 +221,11 @@ in
'';
};
- path = lib.options.mkOption {
- type = lib.types.path;
+ path = mkOption {
+ type = path;
default = "${cfg.package.boot}/${cfg.package.efi}";
- defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
- example = lib.options.literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
+ defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
+ example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
description = ''
Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file
on `$boot/boot/xen.efi`, but an unpatched Xen build may install it
@@ -234,10 +237,10 @@ in
};
dom0Resources = {
- maxVCPUs = lib.options.mkOption {
+ maxVCPUs = mkOption {
default = 0;
example = 4;
- type = lib.types.ints.unsigned;
+ type = ints.unsigned;
description = ''
Amount of virtual CPU cores allocated to Domain 0 on boot.
If set to 0, all cores are assigned to Domain 0, and
@@ -245,10 +248,10 @@ in
'';
};
- memory = lib.options.mkOption {
+ memory = mkOption {
default = 0;
example = 512;
- type = lib.types.ints.unsigned;
+ type = ints.unsigned;
description = ''
Amount of memory (in MiB) allocated to Domain 0 on boot.
If set to 0, all memory is assigned to Domain 0, and
@@ -256,11 +259,11 @@ in
'';
};
- maxMemory = lib.options.mkOption {
+ maxMemory = mkOption {
default = cfg.dom0Resources.memory;
- defaultText = lib.options.literalExpression "config.virtualisation.xen.dom0Resources.memory";
+ defaultText = literalExpression "config.virtualisation.xen.dom0Resources.memory";
example = 1024;
- type = lib.types.ints.unsigned;
+ type = ints.unsigned;
description = ''
Maximum amount of memory (in MiB) that Domain 0 can
dynamically allocate to itself. Does nothing if set
@@ -271,8 +274,8 @@ in
};
domains = {
- extraConfig = lib.options.mkOption {
- type = lib.types.lines;
+ extraConfig = mkOption {
+ type = lines;
default = "";
example = ''
XENDOMAINS_SAVE=/persist/xen/save
@@ -288,28 +291,28 @@ in
};
store = {
- path = lib.options.mkOption {
- type = lib.types.path;
+ path = mkOption {
+ type = path;
default = "${cfg.package}/bin/oxenstored";
- defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored";
- example = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/xenstored";
+ defaultText = literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored";
+ example = literalExpression "\${config.virtualisation.xen.package}/bin/xenstored";
description = ''
Path to the Xen Store Daemon. This option is useful to
switch between the legacy C-based Xen Store Daemon, and
the newer OCaml-based Xen Store Daemon, `oxenstored`.
'';
};
- type = lib.options.mkOption {
- type = lib.types.enum [
+ type = mkOption {
+ type = enum [
"c"
"ocaml"
];
- default = if (lib.strings.hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c";
+ default = if (hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c";
internal = true;
readOnly = true;
description = "Helper internal option that determines the type of the Xen Store Daemon based on cfg.store.path.";
};
- settings = lib.options.mkOption {
+ settings = mkOption {
default = { };
example = {
enableMerge = false;
@@ -324,34 +327,34 @@ in
The OCaml-based Xen Store Daemon configuration. This
option does nothing with the C-based `xenstored`.
'';
- type = lib.types.submodule {
+ type = submodule {
options = {
- pidFile = lib.options.mkOption {
+ pidFile = mkOption {
default = "/run/xen/xenstored.pid";
example = "/var/run/xen/xenstored.pid";
- type = lib.types.path;
+ type = path;
description = "Path to the Xen Store Daemon PID file.";
};
- testEAGAIN = lib.options.mkOption {
+ testEAGAIN = mkOption {
default = cfg.debug;
- defaultText = lib.options.literalExpression "config.virtualisation.xen.debug";
+ defaultText = literalExpression "config.virtualisation.xen.debug";
example = true;
- type = lib.types.bool;
+ type = bool;
visible = false;
description = "Randomly fail a transaction with EAGAIN. This option is used for debugging purposes only.";
};
- enableMerge = lib.options.mkOption {
+ enableMerge = mkOption {
default = true;
example = false;
- type = lib.types.bool;
+ type = bool;
description = "Whether to enable transaction merge support.";
};
conflict = {
- burstLimit = lib.options.mkOption {
+ burstLimit = mkOption {
default = 5.0;
example = 15.0;
- type = lib.types.addCheck (
- lib.types.float
+ type = addCheck (
+ float
// {
name = "nonnegativeFloat";
description = "nonnegative floating point number, meaning >=0";
@@ -369,12 +372,12 @@ in
domain's requests are ignored.
'';
};
- maxHistorySeconds = lib.options.mkOption {
+ maxHistorySeconds = mkOption {
default = 5.0e-2;
example = 1.0;
- type = lib.types.addCheck (
- lib.types.float // { description = "nonnegative floating point number, meaning >=0"; }
- ) (n: n >= 0);
+ type = addCheck (float // { description = "nonnegative floating point number, meaning >=0"; }) (
+ n: n >= 0
+ );
description = ''
Limits applied to domains whose writes cause other domains' transaction
commits to fail. Must include decimal point.
@@ -384,10 +387,10 @@ in
is the minimum pause-time during which a domain will be ignored.
'';
};
- rateLimitIsAggregate = lib.options.mkOption {
+ rateLimitIsAggregate = mkOption {
default = true;
example = false;
- type = lib.types.bool;
+ type = bool;
description = ''
If the conflict.rateLimitIsAggregate option is `true`, then after each
tick one point of conflict-credit is given to just one domain: the
@@ -408,16 +411,16 @@ in
};
};
perms = {
- enable = lib.options.mkOption {
+ enable = mkOption {
default = true;
example = false;
- type = lib.types.bool;
+ type = bool;
description = "Whether to enable the node permission system.";
};
- enableWatch = lib.options.mkOption {
+ enableWatch = mkOption {
default = true;
example = false;
- type = lib.types.bool;
+ type = bool;
description = ''
Whether to enable the watch permission system.
@@ -432,144 +435,142 @@ in
};
};
quota = {
- enable = lib.options.mkOption {
+ enable = mkOption {
default = true;
example = false;
- type = lib.types.bool;
+ type = bool;
description = "Whether to enable the quota system.";
};
- maxEntity = lib.options.mkOption {
+ maxEntity = mkOption {
default = 1000;
example = 1024;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Entity limit for transactions.";
};
- maxSize = lib.options.mkOption {
+ maxSize = mkOption {
default = 2048;
example = 4096;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Size limit for transactions.";
};
- maxWatch = lib.options.mkOption {
+ maxWatch = mkOption {
default = 100;
example = 256;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Maximum number of watches by the Xenstore Watchdog.";
};
- transaction = lib.options.mkOption {
+ transaction = mkOption {
default = 10;
example = 50;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Maximum number of transactions.";
};
- maxRequests = lib.options.mkOption {
+ maxRequests = mkOption {
default = 1024;
example = 1024;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Maximum number of requests per transaction.";
};
- maxPath = lib.options.mkOption {
+ maxPath = mkOption {
default = 1024;
example = 1024;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Path limit for the quota system.";
};
- maxOutstanding = lib.options.mkOption {
+ maxOutstanding = mkOption {
default = 1024;
example = 1024;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Maximum outstanding requests, i.e. in-flight requests / domain.";
};
- maxWatchEvents = lib.options.mkOption {
+ maxWatchEvents = mkOption {
default = 1024;
example = 2048;
- type = lib.types.ints.positive;
+ type = ints.positive;
description = "Maximum number of outstanding watch events per watch.";
};
};
- persistent = lib.options.mkOption {
+ persistent = mkOption {
default = false;
example = true;
- type = lib.types.bool;
+ type = bool;
description = "Whether to activate the filed base backend.";
};
xenstored = {
log = {
- file = lib.options.mkOption {
+ file = mkOption {
default = "/var/log/xen/xenstored.log";
example = "/dev/null";
- type = lib.types.path;
+ type = path;
description = "Path to the Xen Store log file.";
};
- level = lib.options.mkOption {
+ level = mkOption {
default = if cfg.trace then "debug" else null;
- defaultText = lib.options.literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null";
+ defaultText = literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null";
example = "error";
- type = lib.types.nullOr (
- lib.types.enum [
- "debug"
- "info"
- "warn"
- "error"
- ]
- );
+ type = nullOr (enum [
+ "debug"
+ "info"
+ "warn"
+ "error"
+ ]);
description = "Logging level for the Xen Store.";
};
# The hidden options below have no upstream documentation whatsoever.
# The nb* options appear to alter the log rotation behaviour, and
# the specialOps option appears to affect the Xenbus logging logic.
- nbFiles = lib.options.mkOption {
+ nbFiles = mkOption {
default = 10;
example = 16;
- type = lib.types.int;
+ type = int;
visible = false;
description = "Set `xenstored-log-nb-files`.";
};
};
accessLog = {
- file = lib.options.mkOption {
+ file = mkOption {
default = "/var/log/xen/xenstored-access.log";
example = "/var/log/security/xenstored-access.log";
- type = lib.types.path;
+ type = path;
description = "Path to the Xen Store access log file.";
};
- nbLines = lib.options.mkOption {
+ nbLines = mkOption {
default = 13215;
example = 16384;
- type = lib.types.int;
+ type = int;
visible = false;
description = "Set `access-log-nb-lines`.";
};
- nbChars = lib.options.mkOption {
+ nbChars = mkOption {
default = 180;
example = 256;
- type = lib.types.int;
+ type = int;
visible = false;
description = "Set `acesss-log-nb-chars`.";
};
- specialOps = lib.options.mkOption {
+ specialOps = mkOption {
default = false;
example = true;
- type = lib.types.bool;
+ type = bool;
visible = false;
description = "Set `access-log-special-ops`.";
};
};
xenfs = {
- kva = lib.options.mkOption {
+ kva = mkOption {
default = "/proc/xen/xsd_kva";
example = cfg.store.settings.xenstored.xenfs.kva;
- type = lib.types.path;
+ type = path;
visible = false;
description = ''
Path to the Xen Store Daemon KVA location inside the XenFS pseudo-filesystem.
While it is possible to alter this value, some drivers may be hardcoded to follow the default paths.
'';
};
- port = lib.options.mkOption {
+ port = mkOption {
default = "/proc/xen/xsd_port";
example = cfg.store.settings.xenstored.xenfs.port;
- type = lib.types.path;
+ type = path;
visible = false;
description = ''
Path to the Xen Store Daemon userspace port inside the XenFS pseudo-filesystem.
@@ -578,11 +579,11 @@ in
};
};
};
- ringScanInterval = lib.options.mkOption {
+ ringScanInterval = mkOption {
default = 20;
example = 30;
- type = lib.types.addCheck (
- lib.types.int
+ type = addCheck (
+ int
// {
name = "nonzeroInt";
description = "nonzero signed integer, meaning !=0";
@@ -602,7 +603,7 @@ in
## Implementation ##
- config = lib.modules.mkIf cfg.enable {
+ config = mkIf cfg.enable {
assertions = [
{
assertion = pkgs.stdenv.hostPlatform.isx86_64;
@@ -639,18 +640,18 @@ in
];
virtualisation.xen.bootParams =
- lib.lists.optionals cfg.trace [
+ optionals cfg.trace [
"loglvl=all"
"guest_loglvl=all"
]
++
- lib.lists.optional (cfg.dom0Resources.memory != 0)
+ optional (cfg.dom0Resources.memory != 0)
"dom0_mem=${toString cfg.dom0Resources.memory}M${
- lib.strings.optionalString (
+ optionalString (
cfg.dom0Resources.memory != cfg.dom0Resources.maxMemory
) ",max:${toString cfg.dom0Resources.maxMemory}M"
}"
- ++ lib.lists.optional (
+ ++ optional (
cfg.dom0Resources.maxVCPUs != 0
) "dom0_max_vcpus=${toString cfg.dom0Resources.maxVCPUs}";
@@ -701,7 +702,7 @@ in
# See the `xenBootBuilder` script in the main `let...in` statement of this file.
loader.systemd-boot.extraInstallCommands = ''
- ${lib.meta.getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity}
+ ${getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity}
'';
};
@@ -744,7 +745,7 @@ in
XENSTORED="${cfg.store.path}"
QEMU_XEN="${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386}"
- ${lib.strings.optionalString cfg.trace ''
+ ${optionalString cfg.trace ''
XENSTORED_TRACE=yes
XENCONSOLED_TRACE=all
''}
@@ -756,10 +757,10 @@ in
'';
}
# The OCaml-based Xen Store Daemon requires /etc/xen/oxenstored.conf to start.
- // lib.attrsets.optionalAttrs (cfg.store.type == "ocaml") {
+ // optionalAttrs (cfg.store.type == "ocaml") {
"xen/oxenstored.conf".text = ''
pid-file = ${cfg.store.settings.pidFile}
- test-eagain = ${lib.trivial.boolToString cfg.store.settings.testEAGAIN}
+ test-eagain = ${boolToString cfg.store.settings.testEAGAIN}
merge-activate = ${toString cfg.store.settings.enableMerge}
conflict-burst-limit = ${toString cfg.store.settings.conflict.burstLimit}
conflict-max-history-seconds = ${toString cfg.store.settings.conflict.maxHistorySeconds}
@@ -775,7 +776,7 @@ in
quota-path-max = ${toString cfg.store.settings.quota.maxPath}
quota-maxoutstanding = ${toString cfg.store.settings.quota.maxOutstanding}
quota-maxwatchevents = ${toString cfg.store.settings.quota.maxWatchEvents}
- persistent = ${lib.trivial.boolToString cfg.store.settings.persistent}
+ persistent = ${boolToString cfg.store.settings.persistent}
xenstored-log-file = ${cfg.store.settings.xenstored.log.file}
xenstored-log-level = ${
if isNull cfg.store.settings.xenstored.log.level then
@@ -787,7 +788,7 @@ in
access-log-file = ${cfg.store.settings.xenstored.accessLog.file}
access-log-nb-lines = ${toString cfg.store.settings.xenstored.accessLog.nbLines}
acesss-log-nb-chars = ${toString cfg.store.settings.xenstored.accessLog.nbChars}
- access-log-special-ops = ${lib.trivial.boolToString cfg.store.settings.xenstored.accessLog.specialOps}
+ access-log-special-ops = ${boolToString cfg.store.settings.xenstored.accessLog.specialOps}
ring-scan-interval = ${toString cfg.store.settings.ringScanInterval}
xenstored-kva = ${cfg.store.settings.xenstored.xenfs.kva}
xenstored-port = ${cfg.store.settings.xenstored.xenfs.port}
@@ -870,5 +871,5 @@ in
};
};
};
- meta.maintainers = lib.teams.xen.members;
+ meta.maintainers = members;
}
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 3b797c957e83f..619cc9daeba6d 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -38,6 +38,8 @@
, hostCpuOnly ? false
, hostCpuTargets ? (if toolsOnly
then [ ]
+ else if xenSupport
+ then [ "i386-softmmu" ]
else if hostCpuOnly
then (lib.optional stdenv.hostPlatform.isx86_64 "i386-softmmu"
++ ["${stdenv.hostPlatform.qemuArch}-softmmu"])
@@ -50,6 +52,8 @@
, qemu-utils # for tests attribute
}:
+assert lib.assertMsg (xenSupport -> hostCpuTargets == [ "i386-softmmu" ]) "Xen should not use any other QEMU architecture other than i386.";
+
let
hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;
diff --git a/pkgs/applications/virtualization/xen/4.17/default.nix b/pkgs/applications/virtualization/xen/4.17/default.nix
deleted file mode 100644
index d270c37f2ce83..0000000000000
--- a/pkgs/applications/virtualization/xen/4.17/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
- lib,
- fetchpatch,
- callPackage,
- ocaml-ng,
- ...
-}@genericDefinition:
-
-let
- upstreamPatches = import ../generic/patches.nix {
- inherit lib;
- inherit fetchpatch;
- };
-
- upstreamPatchList = lib.lists.flatten (
- with upstreamPatches;
- [
- QUBES_REPRODUCIBLE_BUILDS
- XSA_462
- ]
- );
-in
-
-callPackage (import ../generic/default.nix {
- pname = "xen";
- branch = "4.17";
- version = "4.17.5";
- latest = false;
- pkg = {
- xen = {
- rev = "430ce6cd936546ad883ecd1c85ddea32d790604b";
- hash = "sha256-UoMdXRW0yWSaQPPV0rgoTZVO2ghdnqWruBHn7+ZjKzI=";
- patches = [ ] ++ upstreamPatchList;
- };
- qemu = {
- rev = "ffb451126550b22b43b62fb8731a0d78e3376c03";
- hash = "sha256-G0hMPid9d3fd1jAY7CiZ33xUZf1hdy96T1VUKFGeHSk=";
- patches = [ ];
- };
- seaBIOS = {
- rev = "d239552ce7220e448ae81f41515138f7b9e3c4db";
- hash = "sha256-UKMceJhIprN4/4Xe4EG2EvKlanxVcEi5Qcrrk3Ogiik=";
- patches = [ ];
- };
- ovmf = {
- rev = "7b4a99be8a39c12d3a7fc4b8db9f0eab4ac688d5";
- hash = "sha256-Qq2RgktCkJZBsq6Ch+6tyRHhme4lfcN7d2oQfxwhQt8=";
- patches = [ ];
- };
- ipxe = {
- rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
- hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
- patches = [ ];
- };
- };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/4.18/default.nix b/pkgs/applications/virtualization/xen/4.18/default.nix
deleted file mode 100644
index 21d6de13f1b03..0000000000000
--- a/pkgs/applications/virtualization/xen/4.18/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
- lib,
- fetchpatch,
- callPackage,
- ocaml-ng,
- ...
-}@genericDefinition:
-
-let
- upstreamPatches = import ../generic/patches.nix {
- inherit lib;
- inherit fetchpatch;
- };
-
- upstreamPatchList = lib.lists.flatten (
- with upstreamPatches;
- [
- QUBES_REPRODUCIBLE_BUILDS
- XSA_462
- ]
- );
-in
-
-callPackage (import ../generic/default.nix {
- pname = "xen";
- branch = "4.18";
- version = "4.18.3";
- latest = false;
- pkg = {
- xen = {
- rev = "bd51e573a730efc569646379cd59ccba967cde97";
- hash = "sha256-OFiFdpPCXR+sWjzFHCORtY4DkWyggvxkcsGdgEyO1ts=";
- patches = [ ] ++ upstreamPatchList;
- };
- qemu = {
- rev = "0df9387c8983e1b1e72d8c574356f572342c03e6";
- hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ=";
- patches = [ ];
- };
- seaBIOS = {
- rev = "ea1b7a0733906b8425d948ae94fba63c32b1d425";
- hash = "sha256-J2FuT+FXn9YoFLSfxDOxyKZvKrys59a6bP1eYvEXVNU=";
- patches = [ ];
- };
- ovmf = {
- rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16";
- hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s=";
- patches = [ ];
- };
- ipxe = {
- rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
- hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
- patches = [ ];
- };
- };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/4.19/default.nix b/pkgs/applications/virtualization/xen/4.19/default.nix
deleted file mode 100644
index a1b1337042855..0000000000000
--- a/pkgs/applications/virtualization/xen/4.19/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
- lib,
- fetchpatch,
- callPackage,
- ocaml-ng,
- ...
-}@genericDefinition:
-
-let
- upstreamPatches = import ../generic/patches.nix {
- inherit lib;
- inherit fetchpatch;
- };
-
- upstreamPatchList = lib.lists.flatten (
- with upstreamPatches;
- [
- QUBES_REPRODUCIBLE_BUILDS
- XSA_460
- XSA_461
- XSA_462
- ]
- );
-in
-
-callPackage (import ../generic/default.nix {
- pname = "xen";
- branch = "4.19";
- version = "4.19.0";
- latest = true;
- pkg = {
- xen = {
- rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239";
- hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q=";
- patches = [ ] ++ upstreamPatchList;
- };
- qemu = {
- rev = "0df9387c8983e1b1e72d8c574356f572342c03e6";
- hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ=";
- patches = [ ];
- };
- seaBIOS = {
- rev = "a6ed6b701f0a57db0569ab98b0661c12a6ec3ff8";
- hash = "sha256-hWemj83cxdY8p+Jhkh5GcPvI0Sy5aKYZJCsKDjHTUUk=";
- patches = [ ];
- };
- ovmf = {
- rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16";
- hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s=";
- patches = [ ];
- };
- ipxe = {
- rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca";
- hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU=";
- patches = [ ];
- };
- };
-}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition)
diff --git a/pkgs/applications/virtualization/xen/README.md b/pkgs/applications/virtualization/xen/README.md
deleted file mode 100644
index 07087e2fee230..0000000000000
--- a/pkgs/applications/virtualization/xen/README.md
+++ /dev/null
@@ -1,209 +0,0 @@
-
-
-
-
-
-
-
-
-
-# Xen Project Hypervisor ` flags, which enables and disables
-building those built-in components. The two most popular Xen configurations will
-be the default build, with all built-in components, and a `slim` build, with none
-of those components. To simplify this process, the `./packages.nix` file includes
-the `xen-slim` package overrides that have all `withInternal` flags
-disabled. See the `meta.longDescription` attribute for the `xen-slim` packages
-for more information.
-
-## Security
-
-We aim to support all **security-supported** versions of Xen at any given time.
-See the [Xen Support Matrix](https://xenbits.xen.org/docs/unstable/support-matrix.html)
-for a list of versions. As soon as a version is no longer **security-supported**,
-it should be removed from Nixpkgs.
-
-> [!CAUTION]
-> Pull requests that introduce XSA patches
-should have the `1.severity: security` label.
-
-### Maintainers
-
-Xen is a particularly complex piece of software, so we are always looking for new
-maintainers. Help out by [making and triaging issues](https://github.com/NixOS/nixpkgs/issues/new/choose),
-[sending build fixes and improvements through PRs](https://github.com/NixOS/nixpkgs/compare),
-updating the branches, and [patching security flaws](https://xenbits.xenproject.org/xsa/).
-
-We are also looking for testers, particularly those who can test Xen on AArch64
-machines. Open issues for any build failures or runtime errors you find!
-
-## Tests
-
-So far, we only have had one simple automated test that checks for
-the correct `pkg-config` output files.
-
-Due to Xen's nature as a type-1 hypervisor, it is not a trivial matter to design
-new tests, as even basic functionality requires a machine booted in a dom0
-kernel. For this reason, most testing done with this package must be done
-manually in a NixOS machine with `virtualisation.xen.enable` set to `true`.
-
-Another unfortunate thing is that none of the Xen commands have a `--version`
-flag. This means that `testers.testVersion` cannot ascertain the Xen version.
-The only way to verify that you have indeed built the correct version is to
-boot into the freshly built Xen kernel and run `xl info`.
-
-
-
-
-
-
-[^1]: We also produce fake `git`, `wget` and `hostname` binaries that do nothing,
- to prevent the build from failing because Xen cannot fetch the sources that
- were already fetched by Nix.
-[^2]: From the [Xen Documentation](https://xenbits.xenproject.org/docs/unstable/misc/efi.html):
- > For x86, building `xen.efi` requires `gcc` 4.5.x or above (4.6.x or newer
- recommended, as 4.5.x was probably never really tested for this purpose)
- and `binutils` 2.22 or newer. Additionally, the `binutils` build must be
- configured to include support for the x86_64-pep emulation (i.e.
- `--enable-targets=x86_64-pep` or an option of equivalent effect should be
- passed to the configure script).
diff --git a/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch b/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch
deleted file mode 100644
index d96023d1946ae..0000000000000
--- a/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Hack to make etherboot use pre-fetched iPXE.
-
-diff --git a/tools/firmware/etherboot/Makefile b/tools/firmware/etherboot/Makefile
-index ed9e11305f..979a3acea8 100644
---- a/tools/firmware/etherboot/Makefile
-+++ b/tools/firmware/etherboot/Makefile
-@@ -16,6 +16,7 @@ IPXE_TARBALL_URL ?= $(XEN_EXTFILES_URL)/ipxe-git-$(IPXE_GIT_TAG).tar.gz
-
- D=ipxe
- T=ipxe.tar.gz
-+G=ipxe.git
-
- ROMS = $(addprefix $D/src/bin/, $(addsuffix .rom, $(ETHERBOOT_NICS)))
- ROM = $D/src/bin/ipxe.bin
-@@ -41,9 +42,9 @@ $T:
- fi
- mv _$T $T
-
--$D/src/arch/i386/Makefile: $T Config
-- rm -rf $D
-- gzip -dc $T | tar xf -
-+$D/src/arch/i386/Makefile: $G Config
-+ mkdir $D
-+ cp -a $G/* $D
- for i in $$(cat patches/series) ; do \
- patch -d $D -p1 --quiet ${prefetchedSources.${source}.path}"
- mkdir --parents ${prefetchedSources.${source}.path}
- cp --recursive --no-target-directory ${prefetchedSources.${source}.src} ${
- prefetchedSources.${source}.path
- }
- chmod --recursive +w ${prefetchedSources.${source}.path}
- ''
- ) prefetchedSourcesList
- );
-
- # Produces strings with `patch` commands to be ran on postPatch.
- # These deploy the .patch files for each pre-fetched source.
- deployPrefetchedSourcesPatches =
- # Finish the deployment by concatnating the list of commands together.
- lib.strings.concatLines (
- # The double map functions create a list of lists. Flatten it so we can concatnate it.
- lib.lists.flatten (
- # Iterate on each pre-fetched source.
- builtins.map (
- source:
- # Iterate on each available patch.
- (builtins.map (
- patch:
- # Only produce a patch command if patches exist.
- lib.strings.optionalString
- (lib.attrsets.hasAttrByPath [
- "${source}"
- "patches"
- ] prefetchedSources)
- # The actual patch command. It changes directories to the correct source each time.
- ''
- echo "Applying patch ${patch} to ${source}."
- patch --directory ${prefetchedSources.${source}.path} --strip 1 < ${patch}
- ''
- ) prefetchedSources.${source}.patches)
- ) prefetchedSourcesList
- )
- );
-
- ## XSA Patches Description Builder ##
-
- # Sometimes patches are sourced through a path, like ./0000-xen.patch.
- # This would break the patch attribute parser functions, so we normalise
- # all patches sourced through paths by setting them to a { type = "path"; }
- # attribute set.
- # Patches from fetchpatch are already attribute sets.
- normalisedPatchList = builtins.map (
- patch:
- if !builtins.isAttrs patch then
- if builtins.isPath patch then
- { type = "path"; }
- else
- throw "xen/generic/default.nix: normalisedPatchList attempted to normalise something that is not a Path or an Attribute Set."
- else
- patch
- ) pkg.xen.patches;
-
- # Simple counter for the number of attrsets (patches) in the patches list after normalisation.
- numberOfPatches = lib.lists.count (patch: builtins.isAttrs patch) normalisedPatchList;
-
- # builtins.elemAt's index begins at 0, so we subtract 1 from the number of patches in order to
- # produce the range that will be used in the following builtin.map calls.
- availablePatchesToTry = lib.lists.range 0 (numberOfPatches - 1);
-
- # Takes in an attrByPath input, and outputs the attribute value for each patch in a list.
- # If a patch does not have a given attribute, returns `null`. Use lib.lists.remove null
- # to remove these junk values, if necessary.
- retrievePatchAttributes =
- attributeName:
- builtins.map (
- x: lib.attrsets.attrByPath attributeName null (builtins.elemAt normalisedPatchList x)
- ) availablePatchesToTry;
-
- # Produces a list of newline-separated strings that lists the vulnerabilities this
- # Xen is NOT affected by, due to the applied Xen Security Advisory patches. This is
- # then used in meta.longDescription, to let users know their Xen is patched against
- # known vulnerabilities, as the package version isn't always the best indicator.
- #
- # Produces something like this: (one string for each XSA)
- # * [Xen Security Advisory #1](https://xenbits.xenproject.org/xsa/advisory-1.html): **Title for XSA.**
- # >Description of issue in XSA
- #Extra lines
- #are not indented,
- #but markdown should be
- #fine with it.
- # Fixes:
- # * [CVE-1999-00001](https://www.cve.org/CVERecord?id=CVE-1999-00001)
- # * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002)
- # * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003)
- writeAdvisoryDescription =
- if (lib.lists.remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then
- lib.lists.zipListsWith (a: b: a + b)
- (lib.lists.zipListsWith (a: b: a + "**" + b + ".**\n >")
- (lib.lists.zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ")
- (lib.lists.remove null (retrievePatchAttributes [ "xsa" ]))
- (
- lib.lists.remove null (retrievePatchAttributes [
- "meta"
- "homepage"
- ])
- )
- )
- (
- lib.lists.remove null (retrievePatchAttributes [
- "meta"
- "description"
- ])
- )
- )
- (
- lib.lists.remove null (retrievePatchAttributes [
- "meta"
- "longDescription"
- ])
- )
- else
- [ ];
-
- ## Binutils Override ##
-
- # Originally, there were two versions of binutils being used: the standard one and
- # this patched one. Unfortunately, that required patches to the Xen Makefiles, and
- # quickly became too complex to maintain. The new solution is to simply build this
- # efi-binutils derivation and use it for the whole build process, except if
- # enableEFI is disabled; it'll then use `binutils`.
- efiBinutils = binutils-unwrapped.overrideAttrs (oldAttrs: {
- name = "efi-binutils";
- configureFlags = oldAttrs.configureFlags ++ [ "--enable-targets=x86_64-pep" ];
- doInstallCheck = false; # We get a spurious failure otherwise, due to a host/target mismatch.
- meta.mainProgram = "ld"; # We only really care for `ld`.
- });
-in
-
-stdenv.mkDerivation (finalAttrs: {
- inherit pname version;
-
- outputs = [
- "out" # TODO: Split $out in $bin for binaries and $lib for libraries.
- "man" # Manual pages for Xen userspace utilities.
- "doc" # The full Xen documentation in HTML format.
- "dev" # Development headers.
- "boot" # xen.gz kernel, policy file if Flask is enabled, xen.efi if EFI is enabled.
- # TODO: Python package to be in separate output/package.
- ];
-
- # Main Xen source.
- src = fetchgit {
- url = "https://xenbits.xenproject.org/git-http/xen.git";
- inherit (pkg.xen) rev hash;
- };
-
- patches =
- # Generic Xen patches that apply to all Xen versions.
- [ ./0000-xen-ipxe-src-generic.patch ]
- # Gets the patches from the pkg.xen.patches attribute from the versioned files.
- ++ lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.xen) pkg.xen.patches;
-
- nativeBuildInputs =
- [
- autoPatchelfHook
- bison
- cmake
- flex
- pandoc
- pkg-config
- python3Packages.setuptools
- ]
- ++ lib.lists.optionals withInternalQEMU [
- ninja
- python3Packages.sphinx
- ];
- buildInputs =
- [
- # Xen
- acpica-tools
- bzip2
- dev86
- e2fsprogs.dev
- libnl
- libuuid
- lzo
- ncurses
- perl
- python3Packages.python
- xz
- yajl
- zlib
- zstd
-
- # oxenstored
- ocamlPackages.findlib
- ocamlPackages.ocaml
-
- # Python Fixes
- python3Packages.wrapPython
- ]
- ++ lib.lists.optionals withInternalQEMU [
- glib
- pixman
- ]
- ++ lib.lists.optional withInternalOVMF nasm
- ++ lib.lists.optional withFlask checkpolicy
- ++ lib.lists.optional (lib.strings.versionOlder version "4.19") systemdMinimal;
-
- configureFlags =
- [
- "--enable-systemd"
- "--disable-qemu-traditional"
- ]
- ++ lib.lists.optional (!withInternalQEMU) "--with-system-qemu"
-
- ++ lib.lists.optional withSeaBIOS "--with-system-seabios=${seabios}/share/seabios"
- ++ lib.lists.optional (!withInternalSeaBIOS && !withSeaBIOS) "--disable-seabios"
-
- ++ lib.lists.optional withOVMF "--with-system-ovmf=${OVMF.firmware}"
- ++ lib.lists.optional withInternalOVMF "--enable-ovmf"
-
- ++ lib.lists.optional withIPXE "--with-system-ipxe=${ipxe}"
- ++ lib.lists.optional withInternalIPXE "--enable-ipxe"
-
- ++ lib.lists.optional withFlask "--enable-xsmpolicy";
-
- makeFlags =
- [
- "PREFIX=$(out)"
- "CONFIG_DIR=/etc"
- "XEN_SCRIPT_DIR=$(CONFIG_DIR)/xen/scripts"
- "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
- ]
- ++ lib.lists.optionals withEFI [
- "EFI_VENDOR=${efiVendor}"
- "INSTALL_EFI_STRIP=1"
- "LD=${lib.meta.getExe efiBinutils}" # See the comment in the efiBinutils definition above.
- ]
- # These flags set the CONFIG_* options in /boot/xen.config
- # and define if the default policy file is built. However,
- # the Flask binaries always get compiled by default.
- ++ lib.lists.optionals withFlask [
- "XSM_ENABLE=y"
- "FLASK_ENABLE=y"
- ]
- ++ (pkg.xen.makeFlags or [ ]);
-
- buildFlags = [
- "xen" # Build the Xen Hypervisor.
- "tools" # Build the userspace tools, such as `xl`.
- "docs" # Build the Xen Documentation
- ];
-
- enableParallelBuilding = true;
-
- env.NIX_CFLAGS_COMPILE = builtins.toString (
- [
- "-Wno-error=maybe-uninitialized"
- "-Wno-error=array-bounds"
- ]
- ++ lib.lists.optionals withInternalOVMF [
- "-Wno-error=format-security"
- "-Wno-error=use-after-free"
- "-Wno-error=vla-parameter"
- "-Wno-error=dangling-pointer"
- "-Wno-error=stringop-overflow"
- ]
- );
-
- dontUseCmakeConfigure = true;
- dontUseNinjaBuild = withInternalQEMU;
-
- prePatch =
- # Xen's stubdoms, tools and firmwares need various sources that
- # are usually fetched at build time using wget and git. We can't
- # have that, so we pre-fetch them in the versioned Nix expressions,
- # and produce fake wget and git executables for debugging purposes.
- #
- # We also produce a fake hostname executable to prevent spurious
- # command-not-found errors during compilation.
- #
- # The snippet below produces executables that simply print in stdout
- # what they were supposed to fetch, and exit gracefully.
- ''
- mkdir fake-bin
-
- cat > fake-bin/wget << EOF
- #!${stdenv.shell} -e
- echo ===== FAKE WGET: Not fetching \$*
- [ -e \$3 ]
- EOF
-
- cat > fake-bin/git << EOF
- #!${stdenv.shell}
- echo ===== FAKE GIT: Not cloning \$*
- [ -e \$3 ]
- EOF
-
- cat > fake-bin/hostname << EOF
- #!${stdenv.shell}
- echo ${efiVendor}
- [ -e \$3 ]
- EOF
-
- chmod +x fake-bin/*
- export PATH=$PATH:$PWD/fake-bin
- ''
-
- # Remove in-tree QEMU sources, as we either pre-fetch them through
- # the versioned Nix expressions if withInternalQEMU is true, or we
- # don't build QEMU at all if withInternalQEMU is false.
- + ''
- rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional
- ''
-
- # Call copyPrefetchedSources, which copies all aviable sources to their correct positions.
- + ''
- ${copyPrefetchedSources}
- '';
-
- postPatch =
- # The following patch forces Xen to install xen.efi on $out/boot
- # instead of $out/boot/efi/efi/nixos, as the latter directory
- # would otherwise need to be created manually. This also creates
- # a more consistent output for downstreams who override the
- # efiVendor attribute above.
- ''
- substituteInPlace xen/Makefile \
- --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
- "\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
- ''
-
- # The following patch fixes the call to /bin/mkdir on the
- # launch_xenstore.sh helper script.
- + ''
- substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
- --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
- ''
-
- # The following expression fixes the paths called by Xen's systemd
- # units, so we can use them in the NixOS module.
- + ''
- substituteInPlace \
- tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
- --replace-fail /bin/grep ${gnugrep}/bin/grep
- substituteInPlace \
- tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
- --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
- ''
-
- # # Call deployPrefetchedSourcesPatches, which patches all pre-fetched sources with their specified patchlists.
- + ''
- ${deployPrefetchedSourcesPatches}
- ''
- # Patch shebangs for QEMU and OVMF build scripts.
- + lib.strings.optionalString withInternalQEMU ''
- patchShebangs --build tools/qemu-xen/scripts/tracetool.py
- ''
- + lib.strings.optionalString withInternalOVMF ''
- patchShebangs --build tools/firmware/ovmf-dir-remote/OvmfPkg/build.sh tools/firmware/ovmf-dir-remote/BaseTools/BinWrappers/PosixLike/{AmlToC,BrotliCompress,build,GenFfs,GenFv,GenFw,GenSec,LzmaCompress,TianoCompress,Trim,VfrCompile}
- '';
-
- installPhase =
- let
- cpFlags = builtins.toString [
- "--preserve=mode,ownership,timestamps,link"
- "--recursive"
- "--verbose"
- "--no-dereference"
- ];
- in
- # Run the preInstall tasks.
- ''
- runHook preInstall
- ''
-
- # Create $out directories and copy build output.
- + ''
- mkdir --parents $out $out/share $boot
- cp ${cpFlags} dist/install/nix/store/*/* $out/
- cp ${cpFlags} dist/install/etc $out
- cp ${cpFlags} dist/install/boot $boot
- ''
-
- # Run the postInstall tasks.
- + ''
- runHook postInstall
- '';
-
- postInstall =
- # Wrap xencov_split, xenmon and xentrace_format.
- ''
- wrapPythonPrograms
- ''
-
- # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
- + ''
- wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
- ''
-
- # Fix shebangs in Xen's various scripts.
- #TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
- + ''
- shopt -s extglob
- for i in $out/etc/xen/scripts/!(*.sh); do
- sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
- done
- '';
-
- postFixup =
- # Fix binaries in $out/libexec/xen/bin.
- ''
- addAutoPatchelfSearchPath $out/lib
- autoPatchelf $out/libexec/xen/bin
- ''
- # Flask is particularly hard to disable. Even after
- # setting the make flags to `n`, it still gets compiled.
- # If withFlask is disabled, delete the extra binaries.
- + lib.strings.optionalString (!withFlask) ''
- rm -f $out/bin/flask-*
- '';
-
- passthru = {
- efi =
- if withEFI then "boot/xen-${version}.efi" else throw "This Xen was compiled without an EFI binary.";
- flaskPolicy =
- if withFlask then
- "boot/xenpolicy-${version}"
- else
- throw "This Xen was compiled without FLASK support.";
- qemu-system-i386 =
- if withInternalQEMU then
- "libexec/xen/bin/qemu-system-i386"
- else
- throw "This Xen was compiled without a built-in QEMU.";
- # This test suite is very simple, as Xen's userspace
- # utilities require the hypervisor to be booted.
- tests = {
- pkg-config = testers.hasPkgConfigModules {
- package = finalAttrs.finalPackage;
- moduleNames = [
- "xencall"
- "xencontrol"
- "xendevicemodel"
- "xenevtchn"
- "xenforeignmemory"
- "xengnttab"
- "xenguest"
- "xenhypfs"
- "xenlight"
- "xenstat"
- "xenstore"
- "xentoolcore"
- "xentoollog"
- "xenvchan"
- "xlutil"
- ];
- };
- };
- };
-
- meta =
- if
- !(lib.attrsets.hasAttrByPath [
- "meta"
- ] versionDefinition)
- then
- {
- inherit branch;
-
- # Short description for Xen.
- description =
- "Xen Project Hypervisor"
- # The "and related components" addition is automatically hidden if said components aren't being built.
- + lib.strings.optionalString (prefetchedSources != { }) " and related components"
- # To alter the description inside the paranthesis, edit ./packages.nix.
- + lib.strings.optionalString (lib.attrsets.hasAttrByPath [
- "meta"
- "description"
- ] packageDefinition) " (${packageDefinition.meta.description})";
-
- # Long description for Xen.
- longDescription =
- # Starts with the longDescription from ./packages.nix.
- (packageDefinition.meta.longDescription or "")
- + lib.strings.optionalString (!withInternalQEMU) (
- "\nUse with `qemu_xen_${lib.strings.stringAsChars (x: if x == "." then "_" else x) branch}`"
- + lib.strings.optionalString latest " or `qemu_xen`"
- + ".\n"
- )
- # Then, if any of the optional with* components are being built, add the "Includes:" string.
- +
- lib.strings.optionalString
- (
- withInternalQEMU
- || withInternalSeaBIOS
- || withInternalOVMF
- || withInternalIPXE
- || withEFI
- || withFlask
- )
- (
- "\nIncludes:"
- # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't
- # that many optional components, we just use lib.strings.optionalString, because it's simpler.
- # Optional components that aren't being built are automatically hidden.
- + lib.strings.optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
- + lib.strings.optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package."
- + lib.strings.optionalString withInternalQEMU "\n* `qemu-xen`: The Xen Project's mirror of [QEMU](https://www.qemu.org/)."
- + lib.strings.optionalString withInternalSeaBIOS "\n* `seabios-xen`: The Xen Project's mirror of [SeaBIOS](https://www.seabios.org/SeaBIOS)."
- + lib.strings.optionalString withInternalOVMF "\n* `ovmf-xen`: The Xen Project's mirror of [OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF)."
- + lib.strings.optionalString withInternalIPXE "\n* `ipxe-xen`: The Xen Project's pinned version of [iPXE](https://ipxe.org/)."
- )
- # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to.
- # This will hopefully give users the peace of mind that their Xen is secure, without needing
- # to search the source code for the XSA patches.
- + lib.strings.optionalString (writeAdvisoryDescription != [ ]) (
- "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n"
- + lib.strings.removeSuffix "\n" (lib.strings.concatLines writeAdvisoryDescription)
- );
-
- homepage = "https://xenproject.org/";
- downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
- changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
-
- license = with lib.licenses; [
- # Documentation.
- cc-by-40
- # Most of Xen is licensed under the GPL v2.0.
- gpl2Only
- # Xen Libraries and the `xl` command-line utility.
- lgpl21Only
- # Development headers in $dev/include.
- mit
- ];
-
- # This automatically removes maintainers from EOL versions of Xen, so we aren't bothered about versions we don't explictly support.
- maintainers = lib.lists.optionals (lib.strings.versionAtLeast version minSupportedVersion) lib.teams.xen.members;
- knownVulnerabilities = lib.lists.optional (lib.strings.versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
-
- mainProgram = "xl";
-
- # Evaluates to x86_64-linux.
- platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64;
-
- }
- else
- versionDefinition.meta;
-})
diff --git a/pkgs/applications/virtualization/xen/packages.nix b/pkgs/applications/virtualization/xen/packages.nix
deleted file mode 100644
index fe759709770ff..0000000000000
--- a/pkgs/applications/virtualization/xen/packages.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{
- python3Packages,
- python311Packages,
- callPackage,
-}:
-let
- standard = {
- # Broken with python 3.12+ when using internal QEMU due to https://github.com/NixOS/nixpkgs/issues/253751
- python3Packages = python311Packages;
- meta = {
- description = "Standard";
- longDescription = ''
- Standard version of the Xen Project Hypervisor. Uses forks of QEMU, SeaBIOS,
- OVMF and iPXE provided by the Xen Project. This provides the vanilla Xen
- experience, but wastes space and build time. A typical NixOS setup that runs
- lots of VMs will usually need to build two different versions of QEMU when using
- this Xen derivation (one fork and upstream).
- '';
- };
- };
- slim = {
- inherit python3Packages;
- meta = {
- description = "Without Internal Components";
- longDescription = ''
- Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages
- as much as possible. Instead of using the Xen Project forks for various internal
- components, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These
- components may ocasionally get out of sync with the hypervisor itself, but this
- builds faster and uses less space than the default derivation.
- '';
- };
- };
-in
-# TODO: generalise this to automatically generate both Xen variants for each .//default.nix.
-rec {
- xen_4_19 = callPackage ./4.19/default.nix {
- inherit (standard) meta python3Packages;
- };
- xen_4_19-slim = xen_4_19.override {
- withInternalQEMU = false;
- withInternalSeaBIOS = false;
- withInternalOVMF = false;
- withInternalIPXE = false;
- inherit (slim) meta python3Packages;
- };
-
- xen_4_18 = callPackage ./4.18/default.nix {
- inherit (standard) meta python3Packages;
- };
- xen_4_18-slim = xen_4_18.override {
- withInternalQEMU = false;
- withInternalSeaBIOS = false;
- withInternalOVMF = false;
- withInternalIPXE = false;
- inherit (slim) meta python3Packages;
- };
-
- xen_4_17 = callPackage ./4.17/default.nix {
- inherit (standard) meta python3Packages;
- };
- xen_4_17-slim = xen_4_17.override {
- withInternalQEMU = false;
- withInternalSeaBIOS = false;
- withInternalOVMF = false;
- withInternalIPXE = false;
- inherit (slim) meta;
- # Broken with python 3.12+ due to distutils missing.
- python3Packages = python311Packages;
- };
-}
diff --git a/pkgs/applications/virtualization/xen/update.sh b/pkgs/applications/virtualization/xen/update.sh
deleted file mode 100755
index e5012768b4e85..0000000000000
--- a/pkgs/applications/virtualization/xen/update.sh
+++ /dev/null
@@ -1,202 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gitMinimal curl gnupg nix-prefetch-git nixfmt-rfc-style
-# shellcheck disable=SC2206,SC2207 shell=bash
-set -o errexit
-set -o pipefail
-set -o nounset
-
-#TODO: Use `jq` instead of `sed`.
-#TODO: Accept the small security drawback and make this script runnable by r-ryantm.
-
-# This script expects to be called in an interactive terminal somewhere inside Nixpkgs.
-echo "Preparing..."
-nixpkgs=$(git rev-parse --show-toplevel)
-xenPath="$nixpkgs/pkgs/applications/virtualization/xen"
-rm -rf /tmp/xenUpdateScript
-mkdir /tmp/xenUpdateScript
-
-# Import and verify PGP key.
-curl --silent --output /tmp/xenUpdateScript/xen.asc https://keys.openpgp.org/vks/v1/by-fingerprint/23E3222C145F4475FA8060A783FE14C957E82BD9
-gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import /tmp/xenUpdateScript/xen.asc
-fingerprint="$(gpg --homedir /tmp/xenUpdateScript/.gnupg --with-colons --fingerprint "pgp@xen.org" 2>/dev/null | awk -F: '/^pub:.*/ { getline; print $10}')"
-echo -e "Please ascertain through multiple external sources that the \e[1;32mXen Project PGP Key Fingerprint\e[0m is indeed \e[1;33m$fingerprint\e[0m. If that is not the case, \e[1;31mexit immediately\e[0m."
-read -r -p $'Press \e[1;34menter\e[0m to continue with a pre-filled expected fingerprint, or input an arbitrary PGP fingerprint to match with the key\'s fingerprint: ' userInputFingerprint
-userInputFingerprint=${userInputFingerprint:-"23E3222C145F4475FA8060A783FE14C957E82BD9"}
-
-# Clone xen.git.
-echo -e "Cloning \e[1;34mxen.git\e[0m..."
-git clone --quiet https://xenbits.xenproject.org/git-http/xen.git /tmp/xenUpdateScript/xen
-cd /tmp/xenUpdateScript/xen
-
-# Get list of versions and branches.
-versionList="$(git tag --list "RELEASE-*" | sed s/RELEASE-//g | sed s/4.1.6.1//g | sort --numeric-sort)"
-latestVersion=$(echo "$versionList" | tr ' ' '\n' | tail --lines=1)
-branchList=($(echo "$versionList" | tr ' ' '\n' | sed s/\.[0-9]*$//g | awk '!seen[$0]++'))
-
-# Figure out which versions we're actually going to install.
-minSupportedBranch="$(grep " minSupportedVersion = " "$xenPath"/generic/default.nix | sed s/' minSupportedVersion = "'//g | sed s/'";'//g)"
-supportedBranches=($(for version in "${branchList[@]}"; do if [ "$(printf '%s\n' "$minSupportedBranch" "$version" | sort -V | head -n1)" = "$minSupportedBranch" ]; then echo "$version"; fi; done))
-supportedVersions=($(for version in "${supportedBranches[@]}"; do echo "$versionList" | tr ' ' '\n' | grep "$version" | tail --lines=1; done))
-
-echo -e "\e[1mNOTE\e[0m: As we're also pre-fetching the submodules, QEMU and OVMF may take a very long time to fetch."
-
-# Main loop that installs every supportedVersion.
-for version in "${supportedVersions[@]}"; do
- echo -e "\n------------------------------------------------"
- branch=${version/%.[0-9]/}
- if [[ "$version" == "$latestVersion" ]]; then
- latest=true
- echo -e "\nFound \e[1;34mlatest\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."
- else
- latest=false
- echo -e "\nFound \e[1;33msecurity-supported\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."
- fi
-
- # Verify PGP key automatically. If the fingerprint matches what the user specified, or the default fingerprint, then we consider it trusted.
- cd /tmp/xenUpdateScript/xen
- if [[ "$fingerprint" = "$userInputFingerprint" ]]; then
- echo "$fingerprint:6:" | gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import-ownertrust
- (git verify-tag RELEASE-"$version" 2>/dev/null && echo -e "\n\e[1;32mSuccessfully authenticated Xen $version.\e[0m") || (echo -e "\e[1;31merror:\e[0m Unable to verify tag \e[1;32mRELEASE-$version\e[0m.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or a \e[1;31msupply chain attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1)
- else
- echo -e "\e[1;31merror:\e[0m Unable to verify \e[1;34mpgp@xen.org\e[0m's fingerprint.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or an \e[1;31mimpersonation attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1
- fi
-
- git switch --quiet --detach RELEASE-"$version"
-
- # Originally we told people to go check the Makefile themselves.
- echo -e -n "\nDetermining source versions from Xen Makefiles..."
- qemuVersion="$(grep "QEMU_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"QEMU_UPSTREAM_REVISION ?= "//g)"
- seaBIOSVersion="$(grep "SEABIOS_UPSTREAM_REVISION ?= rel-" /tmp/xenUpdateScript/xen/Config.mk | sed s/"SEABIOS_UPSTREAM_REVISION ?= "//g)"
- ovmfVersion="$(grep "OVMF_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"OVMF_UPSTREAM_REVISION ?= "//g)"
- miniOSVersion="$(grep "MINIOS_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"MINIOS_UPSTREAM_REVISION ?= "//g)"
- ipxeVersion="$(grep "IPXE_GIT_TAG :=" /tmp/xenUpdateScript/xen/tools/firmware/etherboot/Makefile | sed s/"IPXE_GIT_TAG := "//g)"
- echo "done!"
-
- # Use `nix-prefetch-git` to fetch `rev`s and `hash`es.
- echo "Pre-fetching sources and determining hashes..."
- echo -e -n " \e[1;32mXen\e[0m..."
- fetchXen=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/xen.git --rev RELEASE-"$version" --quiet)
- finalVersion="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)"
- hash="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)"
- echo "done!"
- echo -e -n " \e[1;36mQEMU\e[0m..."
- fetchQEMU=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/qemu-xen.git --rev "$qemuVersion" --quiet --fetch-submodules)
- finalQEMUVersion="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)"
- qemuHash="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)"
- echo "done!"
- echo -e -n " \e[1;36mSeaBIOS\e[0m..."
- fetchSeaBIOS=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/seabios.git --rev "$seaBIOSVersion" --quiet)
- finalSeaBIOSVersion="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)"
- seaBIOSHash="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)"
- echo "done!"
- echo -e -n " \e[1;36mOVMF\e[0m..."
- ovmfHash="$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/ovmf.git --rev "$ovmfVersion" --quiet --fetch-submodules | grep -ie hash | sed s/' "hash": "'//g | sed s/'",'//g)"
- echo "done!"
- echo -e -n " \e[1;36miPXE\e[0m..."
- ipxeHash="$(nix-prefetch-git --url https://github.com/ipxe/ipxe.git --rev "$ipxeVersion" --quiet | grep -ie hash | sed s/' "hash": "'//g | sed s/'",'//g)"
- echo "done!"
-
- cd "$xenPath"
-
- echo -e "\nFound the following revisions:\n \e[1;32mXen\e[0m: \e[1;33m$finalVersion\e[0m (\e[1;33m$hash\e[0m)\n \e[1;36mQEMU\e[0m: \e[1;33m$finalQEMUVersion\e[0m (\e[1;33m$qemuHash\e[0m)\n \e[1;36mSeaBIOS\e[0m: \e[1;33m$finalSeaBIOSVersion\e[0m (\e[1;33m$seaBIOSHash\e[0m)\n \e[1;36mOVMF\e[0m: \e[1;33m$ovmfVersion\e[0m (\e[1;33m$ovmfHash\e[0m)\n \e[1;36miPXE\e[0m: \e[1;33m$ipxeVersion\e[0m (\e[1;33m$ipxeHash\e[0m)"
-
- # Set OCaml Version
- read -r -p $'\nEnter the corresponding \e[1;33mOCaml\e[0m version for \e[1;32mXen '"$version"$'\e[0m, or press \e[1;34menter\e[0m for the default value of \e[1;32m4_14\e[0m: ' ocamlVersion
- ocamlVersion=${ocamlVersion:-"4_14"}
-
- mkdir -p "$branch"/
- rm -f "$branch"/default.nix
-
- # Prepare any .patch files that are called by Nix through a path value.
- echo -e "\nPlease add any required patches to version \e[1;32m$branch\e[0m in \e[1;34m$branch/\e[0m, and press \e[1;34menter\e[0m when done."
- read -r -p $'Remember to follow the naming specification as defined in \e[1;34m./README.md\e[0m.'
-
- echo -e "\nDiscovering patches..."
- discoveredXenPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-xen-*-$branch.patch" -printf "./%f ")"
- discoveredQEMUPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-qemu-*-$branch.patch" -printf "./%f ")"
- discoveredSeaBIOSPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-seabios-*-$branch.patch" -printf "./%f ")"
- discoveredOVMFPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ovmf-*-$branch.patch" -printf "./%f ")"
- discoveredIPXEPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ipxe-*-$branch.patch" -printf "./%f ")"
-
- discoveredXenPatchesEcho=${discoveredXenPatches:-"\e[1;31mNone found!\e[0m"}
- discoveredQEMUPatchesEcho=${discoveredQEMUPatches:-"\e[1;31mNone found!\e[0m"}
- discoveredSeaBIOSPatchesEcho=${discoveredSeaBIOSPatches:-"\e[1;31mNone found!\e[0m"}
- discoveredOVMFPatchesEcho=${discoveredOVMFPatches:-"\e[1;31mNone found!\e[0m"}
- discoveredIPXEPatchesEcho=${discoveredIPXEPatches:-"\e[1;31mNone found!\e[0m"}
-
- echo -e "Found the following patches:\n \e[1;32mXen\e[0m: \e[1;33m$discoveredXenPatchesEcho\e[0m\n \e[1;36mQEMU\e[0m: \e[1;33m$discoveredQEMUPatchesEcho\e[0m\n \e[1;36mSeaBIOS\e[0m: \e[1;33m$discoveredSeaBIOSPatchesEcho\e[0m\n \e[1;36mOVMF\e[0m: \e[1;33m$discoveredOVMFPatchesEcho\e[0m\n \e[1;36miPXE\e[0m: \e[1;33m$discoveredIPXEPatchesEcho\e[0m"
-
- # Prepare patches that are called in ./patches.nix.
- defaultPatchListInit=("QUBES_REPRODUCIBLE_BUILDS" "XSA_460" "XSA_461" )
- read -r -a defaultPatchList -p $'\nWould you like to override the \e[1;34mupstreamPatches\e[0m list for \e[1;32mXen '"$version"$'\e[0m? If no, press \e[1;34menter\e[0m to use the default patch list: [ \e[1;34m'"${defaultPatchListInit[*]}"$' \e[0m]: '
- defaultPatchList=(${defaultPatchList[@]:-${defaultPatchListInit[@]}})
- upstreamPatches=${defaultPatchList[*]}
-
- # Write and format default.nix file.
- echo -e -n "\nWriting updated \e[1;34mversionDefinition\e[0m..."
- cat >"$branch"/default.nix <Description of issue in XSA
+ #Extra lines
+ #are not indented,
+ #but markdown should be
+ #fine with it.
+ # Fixes:
+ # * [CVE-1999-00001](https://www.cve.org/CVERecord?id=CVE-1999-00001)
+ # * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002)
+ # * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003)
+ writeAdvisoryDescription =
+ if (remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then
+ zipListsWith (a: b: a + b)
+ (zipListsWith (a: b: a + "**" + b + ".**\n >")
+ (zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ")
+ (remove null (retrievePatchAttributes [ "xsa" ]))
+ (
+ remove null (retrievePatchAttributes [
+ "meta"
+ "homepage"
+ ])
+ )
+ )
+ (
+ remove null (retrievePatchAttributes [
+ "meta"
+ "description"
+ ])
+ )
+ )
+ (
+ remove null (retrievePatchAttributes [
+ "meta"
+ "longDescription"
+ ])
+ )
+ else
+ [ ];
+
+ ## Binutils Override ##
+
+ # Originally, there were two versions of binutils being used: the standard one and
+ # this patched one. Unfortunately, that required patches to the Xen Makefiles, and
+ # quickly became too complex to maintain. The new solution is to simply build this
+ # efi-binutils derivation and use it for the whole build process, except if
+ # enableEFI is disabled; it'll then use `binutils`.
+ efiBinutils = binutils-unwrapped.overrideAttrs (oldAttrs: {
+ name = "efi-binutils";
+ configureFlags = oldAttrs.configureFlags ++ [ "--enable-targets=x86_64-pep" ];
+ doInstallCheck = false; # We get a spurious failure otherwise, due to a host/target mismatch.
+ meta.mainProgram = "ld"; # We only really care for `ld`.
+ });
+
+ #TODO: fix paths instead.
+ scriptEnvPath = makeSearchPathOutput "out" "bin" [
+ bridge-utils
+ coreutils
+ diffutils
+ gawk
+ gnugrep
+ gnused
+ inetutils
+ iproute2
+ iptables
+ multipath-tools
+ nbd
+ openvswitch
+ perl
+ util-linux.bin
+ which
+ ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+ inherit pname version;
+
+ # TODO: Split $out in $bin for binaries and $lib for libraries.
+ # TODO: Python package to be in separate output/package.
+ outputs = [
+ "out"
+ "man"
+ "doc"
+ "dev"
+ "boot"
+ ];
+
+ # Main Xen source.
+ src = fetchgit {
+ url = "https://xenbits.xenproject.org/git-http/xen.git";
+ inherit rev hash;
+ };
+
+ patches = optionals useDefaultPatchList upstreamPatchList ++ patches;
+
+ nativeBuildInputs = [
+ autoPatchelfHook
+ bison
+ cmake
+ flex
+ pandoc
+ pkg-config
+ python3Packages.setuptools
+ ];
+ buildInputs = [
+ # Xen
+ acpica-tools
+ bzip2
+ dev86
+ e2fsprogs.dev
+ libnl
+ libuuid
+ lzo
+ ncurses
+ perl
+ python3Packages.python
+ xz
+ yajl
+ zlib
+ zstd
+
+ # oxenstored
+ ocamlPackages.findlib
+ ocamlPackages.ocaml
+
+ # Python Fixes
+ python3Packages.wrapPython
+ ] ++ optional withFlask checkpolicy ++ optional (versionOlder version "4.19") systemdMinimal;
+
+ configureFlags = [
+ "--enable-systemd"
+ "--disable-qemu-traditional"
+ "--with-system-qemu"
+ (if withSeaBIOS then "--with-system-seabios=${seabios}/share/seabios" else "--disable-seabios")
+ (if withOVMF then "--with-system-ovmf=${OVMF.firmware}" else "--disable-ovmf")
+ (if withIPXE then "--with-system-ipxe=${ipxe}" else "--disable-ipxe")
+ (enableFeature withFlask "xsmpolicy")
+ ];
+
+ makeFlags =
+ [
+ "SUBSYSTEMS=${toString finalAttrs.buildFlags}"
+
+ "PREFIX=$(out)"
+ "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
+
+ "XEN_WHOAMI=${pname}"
+ "XEN_DOMAIN=${vendor}"
+
+ "GIT=${coreutils}/bin/false"
+ "WGET=${coreutils}/bin/false"
+ ]
+ ++ optionals withEFI [
+ "EFI_VENDOR=${vendor}"
+ "INSTALL_EFI_STRIP=1"
+ "LD=${getExe efiBinutils}" # See the comment in the efiBinutils definition above.
+ ]
+ # These flags set the CONFIG_* options in /boot/xen.config
+ # and define if the default policy file is built. However,
+ # the Flask binaries always get compiled by default.
+ ++ optionals withFlask [
+ "XSM_ENABLE=y"
+ "FLASK_ENABLE=y"
+ ];
+
+ buildFlags = [
+ "xen"
+ "tools"
+ "docs"
+ ];
+
+ enableParallelBuilding = true;
+
+ env.NIX_CFLAGS_COMPILE = toString [
+ "-Wno-error=maybe-uninitialized"
+ "-Wno-error=array-bounds"
+ ];
+
+ dontUseCmakeConfigure = true;
+
+ # Remove in-tree QEMU sources, we don't need them in any circumstance.
+ prePatch = "rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional";
+
+ postPatch =
+ # The following patch forces Xen to install xen.efi on $out/boot
+ # instead of $out/boot/efi/efi/nixos, as the latter directory
+ # would otherwise need to be created manually. This also creates
+ # a more consistent output for downstreams who override the
+ # vendor attribute above.
+ ''
+ substituteInPlace xen/Makefile \
+ --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
+ "\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
+ ''
+
+ # The following patch fixes the call to /bin/mkdir on the
+ # launch_xenstore.sh helper script.
+ + ''
+ substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
+ --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
+ ''
+
+ # The following expression fixes the paths called by Xen's systemd
+ # units, so we can use them in the NixOS module.
+ + ''
+ substituteInPlace \
+ tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
+ --replace-fail /bin/grep ${gnugrep}/bin/grep
+ substituteInPlace \
+ tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
+ --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
+ '';
+
+ installPhase = ''
+ runHook preInstall
+
+ mkdir --parents $out $out/share $boot
+ cp -prvd dist/install/nix/store/*/* $out/
+ cp -prvd dist/install/etc $out
+ cp -prvd dist/install/boot $boot
+
+ runHook postInstall
+ '';
+
+ postInstall =
+ # Wrap xencov_split, xenmon and xentrace_format.
+ ''
+ wrapPythonPrograms
+ ''
+
+ # We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
+ + ''
+ wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
+ ''
+
+ # Fix shebangs in Xen's various scripts.
+ #TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
+ + ''
+ shopt -s extglob
+ for i in $out/etc/xen/scripts/!(*.sh); do
+ sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
+ done
+ '';
+
+ postFixup =
+ ''
+ addAutoPatchelfSearchPath $out/lib
+ autoPatchelf $out/libexec/xen/bin
+ ''
+ # Flask is particularly hard to disable. Even after
+ # setting the make flags to `n`, it still gets compiled.
+ # If withFlask is disabled, delete the extra binaries.
+ + optionalString (!withFlask) ''
+ rm -f $out/bin/flask-*
+ '';
+
+ passthru = {
+ efi =
+ if withEFI then "boot/xen-${version}.efi" else throw "This Xen was compiled without an EFI binary.";
+ flaskPolicy =
+ if withFlask then
+ "boot/xenpolicy-${version}"
+ else
+ throw "This Xen was compiled without FLASK support.";
+ # This test suite is very simple, as Xen's userspace
+ # utilities require the hypervisor to be booted.
+ tests = {
+ pkg-config = testers.hasPkgConfigModules {
+ package = finalAttrs.finalPackage;
+ moduleNames = [
+ "xencall"
+ "xencontrol"
+ "xendevicemodel"
+ "xenevtchn"
+ "xenforeignmemory"
+ "xengnttab"
+ "xenguest"
+ "xenhypfs"
+ "xenlight"
+ "xenstat"
+ "xenstore"
+ "xentoolcore"
+ "xentoollog"
+ "xenvchan"
+ "xlutil"
+ ];
+ };
+ };
+ };
+
+ meta = {
+ inherit branch;
+
+ description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
+ longDescription =
+ ''
+ The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
+ hypervisor*, which allows multiple virtual machines, known as domains, to run
+ concurrently with the host on the physical machine. On a typical *type-2
+ hypervisor*, the virtual machines run as applications on top of the
+ host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
+ virtualise **Unprivileged Domains**.
+
+ Use with the `qemu_xen` package.
+ ''
+ # Then, if any of the optional with* components are being built, add the "Includes:" string.
+ + optionalString (withEFI || withFlask) (
+ "\nIncludes:"
+ # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't
+ # that many optional components, we just use lib.strings.optionalString, because it's simpler.
+ # Optional components that aren't being built are automatically hidden.
+ + optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
+ + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package."
+ + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
+ + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
+ + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains."
+ )
+ # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to.
+ # This will hopefully give users the peace of mind that their Xen is secure, without needing
+ # to search the source code for the XSA patches.
+ + optionalString (writeAdvisoryDescription != [ ]) (
+ "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n"
+ + removeSuffix "\n" (concatLines writeAdvisoryDescription)
+ );
+
+ homepage = "https://xenproject.org/";
+ downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
+ changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
+
+ license = [
+ # Documentation.
+ cc-by-40
+ # Most of Xen is licensed under the GPL v2.0.
+ gpl2Only
+ # Xen Libraries and the `xl` command-line utility.
+ lgpl21Only
+ # Development headers in $dev/include.
+ mit
+ ];
+
+ maintainers = teams.xen.members;
+ knownVulnerabilities = optional (versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
+
+ mainProgram = "xl";
+
+ #TODO: Migrate meta.platforms to the new lib.systems.inspect.patterns.* format.
+ platforms = linux;
+ badPlatforms = aarch64;
+ } // meta;
+})
diff --git a/pkgs/applications/virtualization/xen/generic/patches.nix b/pkgs/build-support/xen/patches.nix
similarity index 94%
rename from pkgs/applications/virtualization/xen/generic/patches.nix
rename to pkgs/build-support/xen/patches.nix
index 4bb58d5a42160..66ca02e52dd9d 100644
--- a/pkgs/applications/virtualization/xen/generic/patches.nix
+++ b/pkgs/build-support/xen/patches.nix
@@ -6,6 +6,9 @@
{ lib, fetchpatch }:
let
+ inherit (builtins) concatStringsSep;
+ inherit (lib.strings) optionalString concatMapStrings;
+
xsaPatch =
{
id,
@@ -16,8 +19,7 @@ let
cve ? null,
}:
(fetchpatch {
- name =
- "XSA-" + id + lib.strings.optionalString (cve != null) ("-" + builtins.concatStringsSep "+" cve);
+ name = "XSA-" + id + optionalString (cve != null) ("-" + concatStringsSep "+" cve);
url = "https://xenbits.xen.org/xsa/xsa${id}.patch";
inherit hash;
passthru = {
@@ -37,9 +39,7 @@ let
" _No CVE was assigned to this XSA._"
else
" Fixes:${
- lib.strings.concatMapStrings (
- x: "\n * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")"
- ) cve
+ concatMapStrings (x: "\n * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")") cve
}"
);
homepage = "https://xenbits.xenproject.org/xsa/advisory-${id}.html";
diff --git a/pkgs/by-name/li/libvmi/package.nix b/pkgs/by-name/li/libvmi/package.nix
index 4eb6f54ba3369..a1f314497b7b1 100644
--- a/pkgs/by-name/li/libvmi/package.nix
+++ b/pkgs/by-name/li/libvmi/package.nix
@@ -19,7 +19,7 @@
libkvmi,
xenSupport ? true,
- xen-slim,
+ xen,
}:
let
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
json_c
libvirt
]
- ++ lib.optionals xenSupport [ xen-slim ]
+ ++ lib.optionals xenSupport [ xen ]
++ lib.optionals (!legacyKVM) [ libkvmi ]
++ lib.optionals withVMIFS [ fuse ];
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
postFixup = lib.optionalString xenSupport ''
libvmi="$lib/lib/libvmi.so.${libVersion}"
oldrpath=$(patchelf --print-rpath "$libvmi")
- patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen-slim ]}" "$libvmi"
+ patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen ]}" "$libvmi"
'';
passthru = {
diff --git a/pkgs/by-name/qe/qemu_xen/package.nix b/pkgs/by-name/qe/qemu_xen/package.nix
new file mode 100644
index 0000000000000..0ea5571923e7c
--- /dev/null
+++ b/pkgs/by-name/qe/qemu_xen/package.nix
@@ -0,0 +1 @@
+{ qemu }: qemu.override { xenSupport = true; }
diff --git a/pkgs/by-name/xe/xen-guest-agent/package.nix b/pkgs/by-name/xe/xen-guest-agent/package.nix
index b0223a6311ed2..09c42e5709110 100644
--- a/pkgs/by-name/xe/xen-guest-agent/package.nix
+++ b/pkgs/by-name/xe/xen-guest-agent/package.nix
@@ -4,7 +4,7 @@
rustPlatform,
llvmPackages,
pkg-config,
- xen-slim,
+ xen,
}:
rustPlatform.buildRustPackage rec {
pname = "xen-guest-agent";
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
pkg-config
];
- buildInputs = [ xen-slim ];
+ buildInputs = [ xen ];
postInstall =
# Install the sample systemd service.
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
postFixup =
# Add the Xen libraries in the runpath so the guest agent can find libxenstore.
- "patchelf $out/bin/xen-guest-agent --add-rpath ${xen-slim.out}/lib";
+ "patchelf $out/bin/xen-guest-agent --add-rpath ${xen}/lib";
meta = {
description = "Xen agent running in Linux/BSDs (POSIX) VMs";
diff --git a/pkgs/by-name/xe/xen/README.md b/pkgs/by-name/xe/xen/README.md
new file mode 100644
index 0000000000000..df3b71b3c9565
--- /dev/null
+++ b/pkgs/by-name/xe/xen/README.md
@@ -0,0 +1,133 @@
+
+
+
+
+
+
+
+
+
+# Xen Project Hypervisor
+
+
+
+
+[^1]: We also produce fake `git`, `wget` and `hostname` binaries that do nothing,
+ to prevent the build from failing because Xen cannot fetch the sources that
+ were already fetched by Nix.
+[^2]: From the [Xen Documentation](https://xenbits.xenproject.org/docs/unstable/misc/efi.html):
+ > For x86, building `xen.efi` requires `gcc` 4.5.x or above (4.6.x or newer
+ recommended, as 4.5.x was probably never really tested for this purpose)
+ and `binutils` 2.22 or newer. Additionally, the `binutils` build must be
+ configured to include support for the x86_64-pep emulation (i.e.
+ `--enable-targets=x86_64-pep` or an option of equivalent effect should be
+ passed to the configure script).
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
new file mode 100644
index 0000000000000..6f527cda1e7b8
--- /dev/null
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -0,0 +1,11 @@
+{
+ buildXenPackage,
+ python3Packages,
+}:
+
+buildXenPackage.override { inherit python3Packages; } {
+ pname = "xen";
+ version = "4.19.0";
+ rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239";
+ hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q=";
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9884796a343ef..d645bdbcf8b92 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1701,6 +1701,12 @@ mapAliases {
xcodebuild6 = throw "'xcodebuild6' has been renamed to/replaced by 'xcodebuild'"; # Added 2023-12-10
xdg_utils = xdg-utils; # Added 2021-02-01
xen-light = throw "'xen-light' has been renamed to/replaced by 'xen-slim'"; # Added 2024-06-30
+ xen-slim = throw "'xen-slim' has been renamed to 'xen'. The old Xen package with built-in components no longer exists"; # Added 2024-10-05
+ xen_4_16 = throw "While Xen 4.16 was still security-supported when it was removed from Nixpkgs, it would have reached its End of Life a couple of days after NixOS 24.11 released. To avoid shipping an insecure version of Xen, the Xen Project Hypervisor Maintenance Team decided to delete the derivation entirely"; # Added 2024-10-05
+ xen_4_17 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.17 would have been the 'n-2' version, it was removed"; # Added 2024-10-05
+ xen_4_18 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.18 would have been the 'n-1' version, it was removed"; # Added 2024-10-05
+ xen_4_19 = throw "Use 'xen' instead"; # Added 2024-10-05
+ xenPackages = throw "The attributes in the xenPackages set have been promoted to the top-level. (xenPackages.xen_4_19 -> xen)";
xineLib = xine-lib; # Added 2021-04-27
xineUI = xine-ui; # Added 2021-04-27
xmlada = gnatPackages.xmlada; # Added 2024-02-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f8cd809caae64..19874f1842c23 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26413,13 +26413,6 @@ with pkgs;
glusterfsSupport = lib.meta.availableOn stdenv.hostPlatform glusterfs && lib.meta.availableOn stdenv.hostPlatform libuuid;
});
- # See `xenPackages` source for explanations.
- # Building with `xen` instead of `xen-slim` is possible, but makes no sense.
- qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_19-slim; });
- qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_18-slim; });
- qemu_xen_4_17 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_17-slim; });
- qemu_xen = qemu_xen_4_19;
-
qemu_test = lowPrio (qemu.override { hostCpuOnly = true; nixosTestRunner = true; });
quick-lint-js = callPackage ../development/tools/quick-lint-js { };
@@ -33849,10 +33842,7 @@ with pkgs;
xdotool = callPackage ../tools/X11/xdotool { };
- xenPackages = recurseIntoAttrs (callPackage ../applications/virtualization/xen/packages.nix {});
-
- xen = xenPackages.xen_4_19;
- xen-slim = xenPackages.xen_4_19-slim;
+ buildXenPackage = callPackage ../build-support/xen { };
xkbset = callPackage ../tools/X11/xkbset { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7b7ed5e1154f3..f7d6020211ec6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17590,7 +17590,7 @@ self: super: with self; {
inherit (pkgs) graphviz;
};
- xen = toPythonModule (pkgs.xen-slim.override {
+ xen = toPythonModule (pkgs.xen.override {
python3Packages = self;
});
- 
-
-This directory includes the build recipes for the [Xen Project Hypervisor](https://xenproject.org/).
-
-Some other notable packages that compose the Xen Project Ecosystem include:
-
-- `ocamlPackages.xenstore`: Mirage's `oxenstore` implementation.
-- `ocamlPackages.vchan`: Mirage's `xen-vchan` implementation.
-- `ocamlPackages.xenstore-tool`: XAPI's `oxenstore` utilities.
-- `xen-guest-agent`: Guest drivers for UNIX domUs.
-- `win-pvdrivers`: Guest drivers for Windows domUs.
-- `xtf`: The Xen Test Framework.
-
-## Updating
-
-### Automatically
-
-An automated update script is available in this directory. To produce up-to-date
-files for all supported Xen branches, simply run `./update.sh`, and follow the
-instructions given to you by the script. Notably, it will request that you verify
-the Xen Project code signing PGP key. This README understands that the fingerprint
-of that key is [`23E3 222C 145F 4475 FA80 60A7 83FE 14C9 57E8 2BD9`](https://keys.openpgp.org/search?q=pgp%40xen.org),
-but you should verify this information by seeking the fingerprint from other trusted
-sources, as this document may be compromised. Once the PGP key is verified, it will
-use `git verify-tag` to ascertain the validity of the cloned Xen sources.
-
-After the script is done, follow the steps in
-[**For Both Update Methods**](#for-both-update-methods) below.
-
-#### Downstream Patch Names
-
-The script expects local patch names to follow a certain specification.
-Please name any required patches using the template below:
-
-```console
-0000-project-description-branch.patch
-```
-
-Where:
-
-1. The first four numbers define the patch order.
- **0001** will be applied after **0000**, and so on.
-1. `project` means the name of the source the patch should be applied to.
- - If you are applying patches to the main Xen sources, use `xen`.
- - For the pre-fetched QEMU, use `qemu`.
- - For SeaBIOS, use `seabios`.
- - For OVMF, use `ovmf`.
- - For iPXE, use `ipxe`.
-1. `description` is a string with uppercase and lowercase letters, numbers and
- dashes. It describes the patch name and what it does to the upstream code.
-1. `branch` is the branch for which this patch is supposed to patch.
- It should match the name of the directory it is in.
-
-For example, a patch fixing `xentop`'s output in the 4.15 branch should have
-the following name: `0000-xen-xentop-output-4.15.patch`, and it should be added
-to the `4.15/` directory.
-
-### Manually
-
-The script is not infallible, and it may break in the future. If that happens,
-open a PR fixing the script, and update Xen manually:
-
-1. Check the support matrix to see which branches are security-supported.
-1. Create one directory per branch.
-1. [Update](https://xenbits.xenproject.org/gitweb/) the `default.nix` files for
- the branches that already exist and copy a new one to any branches that do
- not yet exist in Nixpkgs.
- - Do not forget to set the `branch`, `version`, and `latest` attributes for
- each of the `default.nix` files.
- - The revisions are preferably commit hashes, but tag names are acceptable
- as well.
-
-### For Both Update Methods
-
-1. Update `packages.nix` and `../../../top-level/all-packages.nix` with the new
- versions. Don't forget the `slim` packages!
-1. Make sure all branches build. (Both the `standard` and `slim` versions)
-1. Use the NixOS module to test if dom0 boots successfully on all new versions.
-1. Make sure the `meta` attributes evaluate to something that makes sense. The
- following one-line command is useful for testing this:
-
- ```console
- xenToEvaluate=xen; echo -e "\033[1m$(nix eval .#"$xenToEvaluate".meta.description --raw 2> /dev/null)\033[0m\n\n$(nix eval .#"$xenToEvaluate".meta.longDescription --raw 2> /dev/null)"
- ```
-
- Change the value of `xenToEvaluate` to evaluate all relevant Xen packages.
-1. Run `xtf --all --host` as root when booted into the Xen update, and make
- sure no tests fail.
-1. Clean up your changes and commit them, making sure to follow the
- [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md).
-1. Open a PR and await a review from the current maintainers.
-
-## Features
-
-### Pre-fetched Sources
-
-On a typical Xen build, the Xen Makefiles will fetch more required sources with
-`git` and `wget`. Due to the Nix Sandbox, build-time fetching will fail, so we
-pre-fetch the required sources before building.[^1] To accomplish this, we have
-a `prefetchedSources` attribute that contains the required derivations, if they
-are requested by the main Xen build.
-
-### EFI
-
-Building `xen.efi` requires an `ld` with PE support.[^2]
-
-We use a `makeFlag` to override the `$LD` environment variable to point to our
-patched `efiBinutils`. For more information, see the comment in `./generic/default.nix`.
-
-> [!TIP]
-> If you are certain you will not be running Xen in an x86 EFI environment, disable
-the `withEFI` flag with an [override](https://nixos.org/manual/nixpkgs/stable/#chap-overrides)
-to save you the need to compile `efiBinutils`.
-
-### Default Overrides
-
-By default, Xen also builds
-[QEMU](https://www.qemu.org/),
-[SeaBIOS](https://www.seabios.org/SeaBIOS),
-[OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF) and
-[iPXE](https://ipxe.org/).
-
-- QEMU is used for stubdomains and handling devices.
-- SeaBIOS is the default legacy BIOS ROM for HVM domains.
-- OVMF is the default UEFI ROM for HVM domains.
-- iPXE provides a PXE boot environment for HVMs.
-
-However, those packages are already available on Nixpkgs, and Xen does not
-necessarily need to build them into the main hypervisor build. For this reason,
-we also have the `withInternal
-
-