From 0eaec9f2f3b87ebbae89ec0ee71679c81bf50637 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 01:07:17 +0000 Subject: [PATCH 01/13] xen: drop 4.17 Signed-off-by: Fernando Rodrigues --- .../manual/release-notes/rl-2411.section.md | 2 +- .../virtualization/xen/4.17/default.nix | 56 ------------------- pkgs/top-level/all-packages.nix | 1 - 3 files changed, 1 insertion(+), 58 deletions(-) delete mode 100644 pkgs/applications/virtualization/xen/4.17/default.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 569c03ec3497a..c122d3425d99f 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -54,7 +54,7 @@ was added through the `boot.initrd.systemd.dmVerity` option. - The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable). - - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems. + - This release includes Xen [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems. ::: {.warning} Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported. ::: diff --git a/pkgs/applications/virtualization/xen/4.17/default.nix b/pkgs/applications/virtualization/xen/4.17/default.nix deleted file mode 100644 index d270c37f2ce83..0000000000000 --- a/pkgs/applications/virtualization/xen/4.17/default.nix +++ /dev/null @@ -1,56 +0,0 @@ -{ - lib, - fetchpatch, - callPackage, - ocaml-ng, - ... -}@genericDefinition: - -let - upstreamPatches = import ../generic/patches.nix { - inherit lib; - inherit fetchpatch; - }; - - upstreamPatchList = lib.lists.flatten ( - with upstreamPatches; - [ - QUBES_REPRODUCIBLE_BUILDS - XSA_462 - ] - ); -in - -callPackage (import ../generic/default.nix { - pname = "xen"; - branch = "4.17"; - version = "4.17.5"; - latest = false; - pkg = { - xen = { - rev = "430ce6cd936546ad883ecd1c85ddea32d790604b"; - hash = "sha256-UoMdXRW0yWSaQPPV0rgoTZVO2ghdnqWruBHn7+ZjKzI="; - patches = [ ] ++ upstreamPatchList; - }; - qemu = { - rev = "ffb451126550b22b43b62fb8731a0d78e3376c03"; - hash = "sha256-G0hMPid9d3fd1jAY7CiZ33xUZf1hdy96T1VUKFGeHSk="; - patches = [ ]; - }; - seaBIOS = { - rev = "d239552ce7220e448ae81f41515138f7b9e3c4db"; - hash = "sha256-UKMceJhIprN4/4Xe4EG2EvKlanxVcEi5Qcrrk3Ogiik="; - patches = [ ]; - }; - ovmf = { - rev = "7b4a99be8a39c12d3a7fc4b8db9f0eab4ac688d5"; - hash = "sha256-Qq2RgktCkJZBsq6Ch+6tyRHhme4lfcN7d2oQfxwhQt8="; - patches = [ ]; - }; - ipxe = { - rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca"; - hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU="; - patches = [ ]; - }; - }; -}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index f8cd809caae64..0c8aa1ae74b63 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -26417,7 +26417,6 @@ with pkgs; # Building with `xen` instead of `xen-slim` is possible, but makes no sense. qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_19-slim; }); qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_18-slim; }); - qemu_xen_4_17 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_17-slim; }); qemu_xen = qemu_xen_4_19; qemu_test = lowPrio (qemu.override { hostCpuOnly = true; nixosTestRunner = true; }); From 1dad6fe5cb962b7ca6ca2c154b0550dcd42294d0 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 01:11:12 +0000 Subject: [PATCH 02/13] xen: turn the generic builder into the buildXenPackage function Signed-off-by: Fernando Rodrigues Co-authored-by: Yaroslav Bolyukin --- .../xen}/0000-xen-ipxe-src-generic.patch | 0 .../generic => build-support/xen}/default.nix | 56 ++++++++++++++----- .../generic => build-support/xen}/patches.nix | 0 pkgs/top-level/all-packages.nix | 1 + 4 files changed, 43 insertions(+), 14 deletions(-) rename pkgs/{applications/virtualization/xen/generic => build-support/xen}/0000-xen-ipxe-src-generic.patch (100%) rename pkgs/{applications/virtualization/xen/generic => build-support/xen}/default.nix (93%) rename pkgs/{applications/virtualization/xen/generic => build-support/xen}/patches.nix (100%) diff --git a/pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch b/pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch similarity index 100% rename from pkgs/applications/virtualization/xen/generic/0000-xen-ipxe-src-generic.patch rename to pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch diff --git a/pkgs/applications/virtualization/xen/generic/default.nix b/pkgs/build-support/xen/default.nix similarity index 93% rename from pkgs/applications/virtualization/xen/generic/default.nix rename to pkgs/build-support/xen/default.nix index d4d0d235eef21..4f5c8fc7508d5 100644 --- a/pkgs/applications/virtualization/xen/generic/default.nix +++ b/pkgs/build-support/xen/default.nix @@ -1,4 +1,3 @@ -versionDefinition: { lib, stdenv, @@ -10,6 +9,7 @@ versionDefinition: which, fetchgit, + fetchpatch, fetchFromGitHub, # Xen @@ -32,21 +32,23 @@ versionDefinition: zlib, zstd, + slim ? false, + # Xen Optional - withInternalQEMU ? true, + withInternalQEMU ? !slim, pixman, glib, - withInternalSeaBIOS ? true, + withInternalSeaBIOS ? !slim, withSeaBIOS ? !withInternalSeaBIOS, seabios, - withInternalOVMF ? true, + withInternalOVMF ? !slim, withOVMF ? !withInternalOVMF, OVMF, nasm, - withInternalIPXE ? true, + withInternalIPXE ? !slim, withIPXE ? !withInternalIPXE, ipxe, @@ -75,7 +77,9 @@ versionDefinition: openvswitch, util-linux, ... -}@packageDefinition: +}: + +versionDefinition: let #TODO: fix paths instead. @@ -103,12 +107,23 @@ let branch version latest + genericPatchList pkg ; # Mark versions older than minSupportedVersion as EOL. minSupportedVersion = "4.17"; + ## Generic Patch Handling ## + + mappedGenericPatches = builtins.map (patch: upstreamPatches.${patch}) genericPatchList; + + upstreamPatches = import ./patches.nix { + inherit lib fetchpatch; + }; + + upstreamPatchList = lib.lists.flatten mappedGenericPatches; + ## Pre-fetched Source Handling ## # Main attribute set for sources needed to build tools and firmwares. @@ -336,7 +351,8 @@ stdenv.mkDerivation (finalAttrs: { # Generic Xen patches that apply to all Xen versions. [ ./0000-xen-ipxe-src-generic.patch ] # Gets the patches from the pkg.xen.patches attribute from the versioned files. - ++ lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.xen) pkg.xen.patches; + ++ lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.xen) pkg.xen.patches + ++ upstreamPatchList; nativeBuildInputs = [ @@ -652,16 +668,28 @@ stdenv.mkDerivation (finalAttrs: { "Xen Project Hypervisor" # The "and related components" addition is automatically hidden if said components aren't being built. + lib.strings.optionalString (prefetchedSources != { }) " and related components" - # To alter the description inside the paranthesis, edit ./packages.nix. - + lib.strings.optionalString (lib.attrsets.hasAttrByPath [ - "meta" - "description" - ] packageDefinition) " (${packageDefinition.meta.description})"; + + " (${if slim then "Without Internal Components" else "Standard"})"; # Long description for Xen. longDescription = - # Starts with the longDescription from ./packages.nix. - (packageDefinition.meta.longDescription or "") + ( + if slim then + '' + Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages + as much as possible. Instead of using the Xen Project forks for various internal + components, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These + components may ocasionally get out of sync with the hypervisor itself, but this + builds faster and uses less space than the default derivation. + '' + else + '' + Standard version of the Xen Project Hypervisor. Uses forks of QEMU, SeaBIOS, + OVMF and iPXE provided by the Xen Project. This provides the vanilla Xen + experience, but wastes space and build time. A typical NixOS setup that runs + lots of VMs will usually need to build two different versions of QEMU when using + this Xen derivation (one fork and upstream). + '' + ) + lib.strings.optionalString (!withInternalQEMU) ( "\nUse with `qemu_xen_${lib.strings.stringAsChars (x: if x == "." then "_" else x) branch}`" + lib.strings.optionalString latest " or `qemu_xen`" diff --git a/pkgs/applications/virtualization/xen/generic/patches.nix b/pkgs/build-support/xen/patches.nix similarity index 100% rename from pkgs/applications/virtualization/xen/generic/patches.nix rename to pkgs/build-support/xen/patches.nix diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 0c8aa1ae74b63..ba6276ad8dd44 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -33852,6 +33852,7 @@ with pkgs; xen = xenPackages.xen_4_19; xen-slim = xenPackages.xen_4_19-slim; + buildXenPackage = callPackage ../build-support/xen { }; xkbset = callPackage ../tools/X11/xkbset { }; From d2bb9a9ca542aec19fd2ba644ec41e8cd3dd406c Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 01:16:44 +0000 Subject: [PATCH 03/13] xen: revert minSupportedVersion to the upstream value. As the builder is generic, more people may be using it, so we should try to keep this value as close to the upstream source of truth as possible. Signed-off-by: Fernando Rodrigues --- pkgs/build-support/xen/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/xen/default.nix b/pkgs/build-support/xen/default.nix index 4f5c8fc7508d5..044375de0b03d 100644 --- a/pkgs/build-support/xen/default.nix +++ b/pkgs/build-support/xen/default.nix @@ -112,7 +112,7 @@ let ; # Mark versions older than minSupportedVersion as EOL. - minSupportedVersion = "4.17"; + minSupportedVersion = "4.16"; ## Generic Patch Handling ## From 9279ecc1c483a6b34b61ca445871dc8f18a8485b Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 6 Oct 2024 02:59:17 +0000 Subject: [PATCH 04/13] xen: nuke half of the builder - Removes the non-slim build instructions, massively simplifying everything in the package. - Removes unecessary patches. - Inherits functions from lib instead of repeating lib.* everywhere. Signed-off-by: Fernando Rodrigues --- .../xen/0000-xen-ipxe-src-generic.patch | 27 - pkgs/build-support/xen/default.nix | 709 ++++++------------ pkgs/build-support/xen/patches.nix | 10 +- 3 files changed, 229 insertions(+), 517 deletions(-) delete mode 100644 pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch diff --git a/pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch b/pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch deleted file mode 100644 index d96023d1946ae..0000000000000 --- a/pkgs/build-support/xen/0000-xen-ipxe-src-generic.patch +++ /dev/null @@ -1,27 +0,0 @@ -Hack to make etherboot use pre-fetched iPXE. - -diff --git a/tools/firmware/etherboot/Makefile b/tools/firmware/etherboot/Makefile -index ed9e11305f..979a3acea8 100644 ---- a/tools/firmware/etherboot/Makefile -+++ b/tools/firmware/etherboot/Makefile -@@ -16,6 +16,7 @@ IPXE_TARBALL_URL ?= $(XEN_EXTFILES_URL)/ipxe-git-$(IPXE_GIT_TAG).tar.gz - - D=ipxe - T=ipxe.tar.gz -+G=ipxe.git - - ROMS = $(addprefix $D/src/bin/, $(addsuffix .rom, $(ETHERBOOT_NICS))) - ROM = $D/src/bin/ipxe.bin -@@ -41,9 +42,9 @@ $T: - fi - mv _$T $T - --$D/src/arch/i386/Makefile: $T Config -- rm -rf $D -- gzip -dc $T | tar xf - -+$D/src/arch/i386/Makefile: $G Config -+ mkdir $D -+ cp -a $G/* $D - for i in $$(cat patches/series) ; do \ - patch -d $D -p1 --quiet ${prefetchedSources.${source}.path}" - mkdir --parents ${prefetchedSources.${source}.path} - cp --recursive --no-target-directory ${prefetchedSources.${source}.src} ${ - prefetchedSources.${source}.path - } - chmod --recursive +w ${prefetchedSources.${source}.path} - '' - ) prefetchedSourcesList - ); - - # Produces strings with `patch` commands to be ran on postPatch. - # These deploy the .patch files for each pre-fetched source. - deployPrefetchedSourcesPatches = - # Finish the deployment by concatnating the list of commands together. - lib.strings.concatLines ( - # The double map functions create a list of lists. Flatten it so we can concatnate it. - lib.lists.flatten ( - # Iterate on each pre-fetched source. - builtins.map ( - source: - # Iterate on each available patch. - (builtins.map ( - patch: - # Only produce a patch command if patches exist. - lib.strings.optionalString - (lib.attrsets.hasAttrByPath [ - "${source}" - "patches" - ] prefetchedSources) - # The actual patch command. It changes directories to the correct source each time. - '' - echo "Applying patch ${patch} to ${source}." - patch --directory ${prefetchedSources.${source}.path} --strip 1 < ${patch} - '' - ) prefetchedSources.${source}.patches) - ) prefetchedSourcesList - ) - ); + upstreamPatchList = flatten ( + with upstreamPatches; + [ + QUBES_REPRODUCIBLE_BUILDS + XSA_460 + XSA_461 + XSA_462 + ] + ); ## XSA Patches Description Builder ## - # Sometimes patches are sourced through a path, like ./0000-xen.patch. - # This would break the patch attribute parser functions, so we normalise - # all patches sourced through paths by setting them to a { type = "path"; } - # attribute set. - # Patches from fetchpatch are already attribute sets. - normalisedPatchList = builtins.map ( - patch: - if !builtins.isAttrs patch then - if builtins.isPath patch then - { type = "path"; } - else - throw "xen/generic/default.nix: normalisedPatchList attempted to normalise something that is not a Path or an Attribute Set." - else - patch - ) pkg.xen.patches; - # Simple counter for the number of attrsets (patches) in the patches list after normalisation. - numberOfPatches = lib.lists.count (patch: builtins.isAttrs patch) normalisedPatchList; + numberOfPatches = count (patch: isAttrs patch) upstreamPatchList; # builtins.elemAt's index begins at 0, so we subtract 1 from the number of patches in order to # produce the range that will be used in the following builtin.map calls. - availablePatchesToTry = lib.lists.range 0 (numberOfPatches - 1); + availablePatchesToTry = range 0 (numberOfPatches - 1); # Takes in an attrByPath input, and outputs the attribute value for each patch in a list. # If a patch does not have a given attribute, returns `null`. Use lib.lists.remove null # to remove these junk values, if necessary. retrievePatchAttributes = attributeName: - builtins.map ( - x: lib.attrsets.attrByPath attributeName null (builtins.elemAt normalisedPatchList x) - ) availablePatchesToTry; + map (x: attrByPath attributeName null (elemAt upstreamPatchList x)) availablePatchesToTry; # Produces a list of newline-separated strings that lists the vulnerabilities this # Xen is NOT affected by, due to the applied Xen Security Advisory patches. This is @@ -286,27 +155,27 @@ let # * [CVE-1999-00002](https://www.cve.org/CVERecord?id=CVE-1999-00002) # * [CVE-1999-00003](https://www.cve.org/CVERecord?id=CVE-1999-00003) writeAdvisoryDescription = - if (lib.lists.remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then - lib.lists.zipListsWith (a: b: a + b) - (lib.lists.zipListsWith (a: b: a + "**" + b + ".**\n >") - (lib.lists.zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ") - (lib.lists.remove null (retrievePatchAttributes [ "xsa" ])) + if (remove null (retrievePatchAttributes [ "xsa" ]) != [ ]) then + zipListsWith (a: b: a + b) + (zipListsWith (a: b: a + "**" + b + ".**\n >") + (zipListsWith (a: b: "* [Xen Security Advisory #" + a + "](" + b + "): ") + (remove null (retrievePatchAttributes [ "xsa" ])) ( - lib.lists.remove null (retrievePatchAttributes [ + remove null (retrievePatchAttributes [ "meta" "homepage" ]) ) ) ( - lib.lists.remove null (retrievePatchAttributes [ + remove null (retrievePatchAttributes [ "meta" "description" ]) ) ) ( - lib.lists.remove null (retrievePatchAttributes [ + remove null (retrievePatchAttributes [ "meta" "longDescription" ]) @@ -327,198 +196,142 @@ let doInstallCheck = false; # We get a spurious failure otherwise, due to a host/target mismatch. meta.mainProgram = "ld"; # We only really care for `ld`. }); + + #TODO: fix paths instead. + scriptEnvPath = makeSearchPathOutput "out" "bin" [ + bridge-utils + coreutils + diffutils + gawk + gnugrep + gnused + inetutils + iproute2 + iptables + multipath-tools + nbd + openvswitch + perl + util-linux.bin + which + ]; in stdenv.mkDerivation (finalAttrs: { inherit pname version; + # TODO: Split $out in $bin for binaries and $lib for libraries. + # TODO: Python package to be in separate output/package. outputs = [ - "out" # TODO: Split $out in $bin for binaries and $lib for libraries. - "man" # Manual pages for Xen userspace utilities. - "doc" # The full Xen documentation in HTML format. - "dev" # Development headers. - "boot" # xen.gz kernel, policy file if Flask is enabled, xen.efi if EFI is enabled. - # TODO: Python package to be in separate output/package. + "out" + "man" + "doc" + "dev" + "boot" ]; # Main Xen source. src = fetchgit { url = "https://xenbits.xenproject.org/git-http/xen.git"; - inherit (pkg.xen) rev hash; + inherit rev hash; }; - patches = - # Generic Xen patches that apply to all Xen versions. - [ ./0000-xen-ipxe-src-generic.patch ] - # Gets the patches from the pkg.xen.patches attribute from the versioned files. - ++ lib.lists.optionals (lib.attrsets.hasAttrByPath [ "patches" ] pkg.xen) pkg.xen.patches - ++ upstreamPatchList; - - nativeBuildInputs = - [ - autoPatchelfHook - bison - cmake - flex - pandoc - pkg-config - python3Packages.setuptools - ] - ++ lib.lists.optionals withInternalQEMU [ - ninja - python3Packages.sphinx - ]; - buildInputs = - [ - # Xen - acpica-tools - bzip2 - dev86 - e2fsprogs.dev - libnl - libuuid - lzo - ncurses - perl - python3Packages.python - xz - yajl - zlib - zstd - - # oxenstored - ocamlPackages.findlib - ocamlPackages.ocaml - - # Python Fixes - python3Packages.wrapPython - ] - ++ lib.lists.optionals withInternalQEMU [ - glib - pixman - ] - ++ lib.lists.optional withInternalOVMF nasm - ++ lib.lists.optional withFlask checkpolicy - ++ lib.lists.optional (lib.strings.versionOlder version "4.19") systemdMinimal; - - configureFlags = - [ - "--enable-systemd" - "--disable-qemu-traditional" - ] - ++ lib.lists.optional (!withInternalQEMU) "--with-system-qemu" - - ++ lib.lists.optional withSeaBIOS "--with-system-seabios=${seabios}/share/seabios" - ++ lib.lists.optional (!withInternalSeaBIOS && !withSeaBIOS) "--disable-seabios" - - ++ lib.lists.optional withOVMF "--with-system-ovmf=${OVMF.firmware}" - ++ lib.lists.optional withInternalOVMF "--enable-ovmf" - - ++ lib.lists.optional withIPXE "--with-system-ipxe=${ipxe}" - ++ lib.lists.optional withInternalIPXE "--enable-ipxe" + patches = optionals useDefaultPatchList upstreamPatchList ++ patches; - ++ lib.lists.optional withFlask "--enable-xsmpolicy"; + nativeBuildInputs = [ + autoPatchelfHook + bison + cmake + flex + pandoc + pkg-config + python3Packages.setuptools + ]; + buildInputs = [ + # Xen + acpica-tools + bzip2 + dev86 + e2fsprogs.dev + libnl + libuuid + lzo + ncurses + perl + python3Packages.python + xz + yajl + zlib + zstd + + # oxenstored + ocamlPackages.findlib + ocamlPackages.ocaml + + # Python Fixes + python3Packages.wrapPython + ] ++ optional withFlask checkpolicy ++ optional (versionOlder version "4.19") systemdMinimal; + + configureFlags = [ + "--enable-systemd" + "--disable-qemu-traditional" + "--with-system-qemu" + (if withSeaBIOS then "--with-system-seabios=${seabios}/share/seabios" else "--disable-seabios") + (if withOVMF then "--with-system-ovmf=${OVMF.firmware}" else "--disable-ovmf") + (if withIPXE then "--with-system-ipxe=${ipxe}" else "--disable-ipxe") + (enableFeature withFlask "xsmpolicy") + ]; makeFlags = [ + "SUBSYSTEMS=${toString finalAttrs.buildFlags}" + "PREFIX=$(out)" - "CONFIG_DIR=/etc" - "XEN_SCRIPT_DIR=$(CONFIG_DIR)/xen/scripts" "BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions" + + "XEN_WHOAMI=${pname}" + "XEN_DOMAIN=${vendor}" + + "GIT=${coreutils}/bin/false" + "WGET=${coreutils}/bin/false" ] - ++ lib.lists.optionals withEFI [ - "EFI_VENDOR=${efiVendor}" + ++ optionals withEFI [ + "EFI_VENDOR=${vendor}" "INSTALL_EFI_STRIP=1" - "LD=${lib.meta.getExe efiBinutils}" # See the comment in the efiBinutils definition above. + "LD=${getExe efiBinutils}" # See the comment in the efiBinutils definition above. ] # These flags set the CONFIG_* options in /boot/xen.config # and define if the default policy file is built. However, # the Flask binaries always get compiled by default. - ++ lib.lists.optionals withFlask [ + ++ optionals withFlask [ "XSM_ENABLE=y" "FLASK_ENABLE=y" - ] - ++ (pkg.xen.makeFlags or [ ]); + ]; buildFlags = [ - "xen" # Build the Xen Hypervisor. - "tools" # Build the userspace tools, such as `xl`. - "docs" # Build the Xen Documentation + "xen" + "tools" + "docs" ]; enableParallelBuilding = true; - env.NIX_CFLAGS_COMPILE = builtins.toString ( - [ - "-Wno-error=maybe-uninitialized" - "-Wno-error=array-bounds" - ] - ++ lib.lists.optionals withInternalOVMF [ - "-Wno-error=format-security" - "-Wno-error=use-after-free" - "-Wno-error=vla-parameter" - "-Wno-error=dangling-pointer" - "-Wno-error=stringop-overflow" - ] - ); + env.NIX_CFLAGS_COMPILE = toString [ + "-Wno-error=maybe-uninitialized" + "-Wno-error=array-bounds" + ]; dontUseCmakeConfigure = true; - dontUseNinjaBuild = withInternalQEMU; - - prePatch = - # Xen's stubdoms, tools and firmwares need various sources that - # are usually fetched at build time using wget and git. We can't - # have that, so we pre-fetch them in the versioned Nix expressions, - # and produce fake wget and git executables for debugging purposes. - # - # We also produce a fake hostname executable to prevent spurious - # command-not-found errors during compilation. - # - # The snippet below produces executables that simply print in stdout - # what they were supposed to fetch, and exit gracefully. - '' - mkdir fake-bin - - cat > fake-bin/wget << EOF - #!${stdenv.shell} -e - echo ===== FAKE WGET: Not fetching \$* - [ -e \$3 ] - EOF - - cat > fake-bin/git << EOF - #!${stdenv.shell} - echo ===== FAKE GIT: Not cloning \$* - [ -e \$3 ] - EOF - - cat > fake-bin/hostname << EOF - #!${stdenv.shell} - echo ${efiVendor} - [ -e \$3 ] - EOF - - chmod +x fake-bin/* - export PATH=$PATH:$PWD/fake-bin - '' - # Remove in-tree QEMU sources, as we either pre-fetch them through - # the versioned Nix expressions if withInternalQEMU is true, or we - # don't build QEMU at all if withInternalQEMU is false. - + '' - rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional - '' - - # Call copyPrefetchedSources, which copies all aviable sources to their correct positions. - + '' - ${copyPrefetchedSources} - ''; + # Remove in-tree QEMU sources, we don't need them in any circumstance. + prePatch = "rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional"; postPatch = # The following patch forces Xen to install xen.efi on $out/boot # instead of $out/boot/efi/efi/nixos, as the latter directory # would otherwise need to be created manually. This also creates # a more consistent output for downstreams who override the - # efiVendor attribute above. + # vendor attribute above. '' substituteInPlace xen/Makefile \ --replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \ @@ -541,46 +354,18 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace \ tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \ --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir" - '' - - # # Call deployPrefetchedSourcesPatches, which patches all pre-fetched sources with their specified patchlists. - + '' - ${deployPrefetchedSourcesPatches} - '' - # Patch shebangs for QEMU and OVMF build scripts. - + lib.strings.optionalString withInternalQEMU '' - patchShebangs --build tools/qemu-xen/scripts/tracetool.py - '' - + lib.strings.optionalString withInternalOVMF '' - patchShebangs --build tools/firmware/ovmf-dir-remote/OvmfPkg/build.sh tools/firmware/ovmf-dir-remote/BaseTools/BinWrappers/PosixLike/{AmlToC,BrotliCompress,build,GenFfs,GenFv,GenFw,GenSec,LzmaCompress,TianoCompress,Trim,VfrCompile} ''; - installPhase = - let - cpFlags = builtins.toString [ - "--preserve=mode,ownership,timestamps,link" - "--recursive" - "--verbose" - "--no-dereference" - ]; - in - # Run the preInstall tasks. - '' - runHook preInstall - '' + installPhase = '' + runHook preInstall - # Create $out directories and copy build output. - + '' - mkdir --parents $out $out/share $boot - cp ${cpFlags} dist/install/nix/store/*/* $out/ - cp ${cpFlags} dist/install/etc $out - cp ${cpFlags} dist/install/boot $boot - '' + mkdir --parents $out $out/share $boot + cp -prvd dist/install/nix/store/*/* $out/ + cp -prvd dist/install/etc $out + cp -prvd dist/install/boot $boot - # Run the postInstall tasks. - + '' - runHook postInstall - ''; + runHook postInstall + ''; postInstall = # Wrap xencov_split, xenmon and xentrace_format. @@ -603,7 +388,6 @@ stdenv.mkDerivation (finalAttrs: { ''; postFixup = - # Fix binaries in $out/libexec/xen/bin. '' addAutoPatchelfSearchPath $out/lib autoPatchelf $out/libexec/xen/bin @@ -611,7 +395,7 @@ stdenv.mkDerivation (finalAttrs: { # Flask is particularly hard to disable. Even after # setting the make flags to `n`, it still gets compiled. # If withFlask is disabled, delete the extra binaries. - + lib.strings.optionalString (!withFlask) '' + + optionalString (!withFlask) '' rm -f $out/bin/flask-* ''; @@ -623,11 +407,6 @@ stdenv.mkDerivation (finalAttrs: { "boot/xenpolicy-${version}" else throw "This Xen was compiled without FLASK support."; - qemu-system-i386 = - if withInternalQEMU then - "libexec/xen/bin/qemu-system-i386" - else - throw "This Xen was compiled without a built-in QEMU."; # This test suite is very simple, as Xen's userspace # utilities require the hypervisor to be booted. tests = { @@ -654,103 +433,63 @@ stdenv.mkDerivation (finalAttrs: { }; }; - meta = - if - !(lib.attrsets.hasAttrByPath [ - "meta" - ] versionDefinition) - then - { - inherit branch; - - # Short description for Xen. - description = - "Xen Project Hypervisor" - # The "and related components" addition is automatically hidden if said components aren't being built. - + lib.strings.optionalString (prefetchedSources != { }) " and related components" - + " (${if slim then "Without Internal Components" else "Standard"})"; - - # Long description for Xen. - longDescription = - ( - if slim then - '' - Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages - as much as possible. Instead of using the Xen Project forks for various internal - components, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These - components may ocasionally get out of sync with the hypervisor itself, but this - builds faster and uses less space than the default derivation. - '' - else - '' - Standard version of the Xen Project Hypervisor. Uses forks of QEMU, SeaBIOS, - OVMF and iPXE provided by the Xen Project. This provides the vanilla Xen - experience, but wastes space and build time. A typical NixOS setup that runs - lots of VMs will usually need to build two different versions of QEMU when using - this Xen derivation (one fork and upstream). - '' - ) - + lib.strings.optionalString (!withInternalQEMU) ( - "\nUse with `qemu_xen_${lib.strings.stringAsChars (x: if x == "." then "_" else x) branch}`" - + lib.strings.optionalString latest " or `qemu_xen`" - + ".\n" - ) - # Then, if any of the optional with* components are being built, add the "Includes:" string. - + - lib.strings.optionalString - ( - withInternalQEMU - || withInternalSeaBIOS - || withInternalOVMF - || withInternalIPXE - || withEFI - || withFlask - ) - ( - "\nIncludes:" - # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't - # that many optional components, we just use lib.strings.optionalString, because it's simpler. - # Optional components that aren't being built are automatically hidden. - + lib.strings.optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package." - + lib.strings.optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package." - + lib.strings.optionalString withInternalQEMU "\n* `qemu-xen`: The Xen Project's mirror of [QEMU](https://www.qemu.org/)." - + lib.strings.optionalString withInternalSeaBIOS "\n* `seabios-xen`: The Xen Project's mirror of [SeaBIOS](https://www.seabios.org/SeaBIOS)." - + lib.strings.optionalString withInternalOVMF "\n* `ovmf-xen`: The Xen Project's mirror of [OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF)." - + lib.strings.optionalString withInternalIPXE "\n* `ipxe-xen`: The Xen Project's pinned version of [iPXE](https://ipxe.org/)." - ) - # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to. - # This will hopefully give users the peace of mind that their Xen is secure, without needing - # to search the source code for the XSA patches. - + lib.strings.optionalString (writeAdvisoryDescription != [ ]) ( - "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n" - + lib.strings.removeSuffix "\n" (lib.strings.concatLines writeAdvisoryDescription) - ); - - homepage = "https://xenproject.org/"; - downloadPage = "https://downloads.xenproject.org/release/xen/${version}/"; - changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes"; - - license = with lib.licenses; [ - # Documentation. - cc-by-40 - # Most of Xen is licensed under the GPL v2.0. - gpl2Only - # Xen Libraries and the `xl` command-line utility. - lgpl21Only - # Development headers in $dev/include. - mit - ]; - - # This automatically removes maintainers from EOL versions of Xen, so we aren't bothered about versions we don't explictly support. - maintainers = lib.lists.optionals (lib.strings.versionAtLeast version minSupportedVersion) lib.teams.xen.members; - knownVulnerabilities = lib.lists.optional (lib.strings.versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html"; + meta = { + inherit branch; + + description = "Type-1 hypervisor intended for embedded and hyperscale use cases"; + longDescription = + '' + The Xen Project Hypervisor is a virtualisation technology defined as a *type-1 + hypervisor*, which allows multiple virtual machines, known as domains, to run + concurrently with the host on the physical machine. On a typical *type-2 + hypervisor*, the virtual machines run as applications on top of the + host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully + virtualise **Unprivileged Domains**. + + Use with the `qemu_xen` package. + '' + # Then, if any of the optional with* components are being built, add the "Includes:" string. + + optionalString (withEFI || withFlask) ( + "\nIncludes:" + # Originally, this was a call for the complicated withPrefetchedSources. Since there aren't + # that many optional components, we just use lib.strings.optionalString, because it's simpler. + # Optional components that aren't being built are automatically hidden. + + optionalString withEFI "\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package." + + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${version}` file is available on the `boot` output of this package." + + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains." + + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains." + + optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains." + ) + # Finally, we write a notice explaining which vulnerabilities this Xen is NOT vulnerable to. + # This will hopefully give users the peace of mind that their Xen is secure, without needing + # to search the source code for the XSA patches. + + optionalString (writeAdvisoryDescription != [ ]) ( + "\n\nThis Xen Project Hypervisor (${version}) has been patched against the following known security vulnerabilities:\n" + + removeSuffix "\n" (concatLines writeAdvisoryDescription) + ); + + homepage = "https://xenproject.org/"; + downloadPage = "https://downloads.xenproject.org/release/xen/${version}/"; + changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes"; + + license = [ + # Documentation. + cc-by-40 + # Most of Xen is licensed under the GPL v2.0. + gpl2Only + # Xen Libraries and the `xl` command-line utility. + lgpl21Only + # Development headers in $dev/include. + mit + ]; - mainProgram = "xl"; + maintainers = teams.xen.members; + knownVulnerabilities = optional (versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html"; - # Evaluates to x86_64-linux. - platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64; + mainProgram = "xl"; - } - else - versionDefinition.meta; + #TODO: Migrate meta.platforms to the new lib.systems.inspect.patterns.* format. + platforms = linux; + badPlatforms = aarch64; + } // meta; }) diff --git a/pkgs/build-support/xen/patches.nix b/pkgs/build-support/xen/patches.nix index 4bb58d5a42160..66ca02e52dd9d 100644 --- a/pkgs/build-support/xen/patches.nix +++ b/pkgs/build-support/xen/patches.nix @@ -6,6 +6,9 @@ { lib, fetchpatch }: let + inherit (builtins) concatStringsSep; + inherit (lib.strings) optionalString concatMapStrings; + xsaPatch = { id, @@ -16,8 +19,7 @@ let cve ? null, }: (fetchpatch { - name = - "XSA-" + id + lib.strings.optionalString (cve != null) ("-" + builtins.concatStringsSep "+" cve); + name = "XSA-" + id + optionalString (cve != null) ("-" + concatStringsSep "+" cve); url = "https://xenbits.xen.org/xsa/xsa${id}.patch"; inherit hash; passthru = { @@ -37,9 +39,7 @@ let " _No CVE was assigned to this XSA._" else " Fixes:${ - lib.strings.concatMapStrings ( - x: "\n * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")" - ) cve + concatMapStrings (x: "\n * [" + x + "](https://www.cve.org/CVERecord?id=" + x + ")") cve }" ); homepage = "https://xenbits.xenproject.org/xsa/advisory-${id}.html"; From 7030f11620d2fe75deec9fcfba2ac18d32a7f63d Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 01:20:11 +0000 Subject: [PATCH 05/13] xen: drop update script It was incredibly slow and will be replaced by something r-ryantm can run soon. Signed-off-by: Fernando Rodrigues --- .../applications/virtualization/xen/README.md | 51 ----- .../applications/virtualization/xen/update.sh | 202 ------------------ 2 files changed, 253 deletions(-) delete mode 100755 pkgs/applications/virtualization/xen/update.sh diff --git a/pkgs/applications/virtualization/xen/README.md b/pkgs/applications/virtualization/xen/README.md index 07087e2fee230..20c45f867dccd 100644 --- a/pkgs/applications/virtualization/xen/README.md +++ b/pkgs/applications/virtualization/xen/README.md @@ -30,54 +30,8 @@ Some other notable packages that compose the Xen Project Ecosystem include: ## Updating -### Automatically - -An automated update script is available in this directory. To produce up-to-date -files for all supported Xen branches, simply run `./update.sh`, and follow the -instructions given to you by the script. Notably, it will request that you verify -the Xen Project code signing PGP key. This README understands that the fingerprint -of that key is [`23E3 222C 145F 4475 FA80 60A7 83FE 14C9 57E8 2BD9`](https://keys.openpgp.org/search?q=pgp%40xen.org), -but you should verify this information by seeking the fingerprint from other trusted -sources, as this document may be compromised. Once the PGP key is verified, it will -use `git verify-tag` to ascertain the validity of the cloned Xen sources. - -After the script is done, follow the steps in -[**For Both Update Methods**](#for-both-update-methods) below. - -#### Downstream Patch Names - -The script expects local patch names to follow a certain specification. -Please name any required patches using the template below: - -```console -0000-project-description-branch.patch -``` - -Where: - -1. The first four numbers define the patch order. - **0001** will be applied after **0000**, and so on. -1. `project` means the name of the source the patch should be applied to. - - If you are applying patches to the main Xen sources, use `xen`. - - For the pre-fetched QEMU, use `qemu`. - - For SeaBIOS, use `seabios`. - - For OVMF, use `ovmf`. - - For iPXE, use `ipxe`. -1. `description` is a string with uppercase and lowercase letters, numbers and - dashes. It describes the patch name and what it does to the upstream code. -1. `branch` is the branch for which this patch is supposed to patch. - It should match the name of the directory it is in. - -For example, a patch fixing `xentop`'s output in the 4.15 branch should have -the following name: `0000-xen-xentop-output-4.15.patch`, and it should be added -to the `4.15/` directory. - ### Manually -The script is not infallible, and it may break in the future. If that happens, -open a PR fixing the script, and update Xen manually: - -1. Check the support matrix to see which branches are security-supported. 1. Create one directory per branch. 1. [Update](https://xenbits.xenproject.org/gitweb/) the `default.nix` files for the branches that already exist and copy a new one to any branches that do @@ -86,11 +40,6 @@ open a PR fixing the script, and update Xen manually: each of the `default.nix` files. - The revisions are preferably commit hashes, but tag names are acceptable as well. - -### For Both Update Methods - -1. Update `packages.nix` and `../../../top-level/all-packages.nix` with the new - versions. Don't forget the `slim` packages! 1. Make sure all branches build. (Both the `standard` and `slim` versions) 1. Use the NixOS module to test if dom0 boots successfully on all new versions. 1. Make sure the `meta` attributes evaluate to something that makes sense. The diff --git a/pkgs/applications/virtualization/xen/update.sh b/pkgs/applications/virtualization/xen/update.sh deleted file mode 100755 index e5012768b4e85..0000000000000 --- a/pkgs/applications/virtualization/xen/update.sh +++ /dev/null @@ -1,202 +0,0 @@ -#!/usr/bin/env nix-shell -#!nix-shell -i bash -p gitMinimal curl gnupg nix-prefetch-git nixfmt-rfc-style -# shellcheck disable=SC2206,SC2207 shell=bash -set -o errexit -set -o pipefail -set -o nounset - -#TODO: Use `jq` instead of `sed`. -#TODO: Accept the small security drawback and make this script runnable by r-ryantm. - -# This script expects to be called in an interactive terminal somewhere inside Nixpkgs. -echo "Preparing..." -nixpkgs=$(git rev-parse --show-toplevel) -xenPath="$nixpkgs/pkgs/applications/virtualization/xen" -rm -rf /tmp/xenUpdateScript -mkdir /tmp/xenUpdateScript - -# Import and verify PGP key. -curl --silent --output /tmp/xenUpdateScript/xen.asc https://keys.openpgp.org/vks/v1/by-fingerprint/23E3222C145F4475FA8060A783FE14C957E82BD9 -gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import /tmp/xenUpdateScript/xen.asc -fingerprint="$(gpg --homedir /tmp/xenUpdateScript/.gnupg --with-colons --fingerprint "pgp@xen.org" 2>/dev/null | awk -F: '/^pub:.*/ { getline; print $10}')" -echo -e "Please ascertain through multiple external sources that the \e[1;32mXen Project PGP Key Fingerprint\e[0m is indeed \e[1;33m$fingerprint\e[0m. If that is not the case, \e[1;31mexit immediately\e[0m." -read -r -p $'Press \e[1;34menter\e[0m to continue with a pre-filled expected fingerprint, or input an arbitrary PGP fingerprint to match with the key\'s fingerprint: ' userInputFingerprint -userInputFingerprint=${userInputFingerprint:-"23E3222C145F4475FA8060A783FE14C957E82BD9"} - -# Clone xen.git. -echo -e "Cloning \e[1;34mxen.git\e[0m..." -git clone --quiet https://xenbits.xenproject.org/git-http/xen.git /tmp/xenUpdateScript/xen -cd /tmp/xenUpdateScript/xen - -# Get list of versions and branches. -versionList="$(git tag --list "RELEASE-*" | sed s/RELEASE-//g | sed s/4.1.6.1//g | sort --numeric-sort)" -latestVersion=$(echo "$versionList" | tr ' ' '\n' | tail --lines=1) -branchList=($(echo "$versionList" | tr ' ' '\n' | sed s/\.[0-9]*$//g | awk '!seen[$0]++')) - -# Figure out which versions we're actually going to install. -minSupportedBranch="$(grep " minSupportedVersion = " "$xenPath"/generic/default.nix | sed s/' minSupportedVersion = "'//g | sed s/'";'//g)" -supportedBranches=($(for version in "${branchList[@]}"; do if [ "$(printf '%s\n' "$minSupportedBranch" "$version" | sort -V | head -n1)" = "$minSupportedBranch" ]; then echo "$version"; fi; done)) -supportedVersions=($(for version in "${supportedBranches[@]}"; do echo "$versionList" | tr ' ' '\n' | grep "$version" | tail --lines=1; done)) - -echo -e "\e[1mNOTE\e[0m: As we're also pre-fetching the submodules, QEMU and OVMF may take a very long time to fetch." - -# Main loop that installs every supportedVersion. -for version in "${supportedVersions[@]}"; do - echo -e "\n------------------------------------------------" - branch=${version/%.[0-9]/} - if [[ "$version" == "$latestVersion" ]]; then - latest=true - echo -e "\nFound \e[1;34mlatest\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m." - else - latest=false - echo -e "\nFound \e[1;33msecurity-supported\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m." - fi - - # Verify PGP key automatically. If the fingerprint matches what the user specified, or the default fingerprint, then we consider it trusted. - cd /tmp/xenUpdateScript/xen - if [[ "$fingerprint" = "$userInputFingerprint" ]]; then - echo "$fingerprint:6:" | gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import-ownertrust - (git verify-tag RELEASE-"$version" 2>/dev/null && echo -e "\n\e[1;32mSuccessfully authenticated Xen $version.\e[0m") || (echo -e "\e[1;31merror:\e[0m Unable to verify tag \e[1;32mRELEASE-$version\e[0m.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or a \e[1;31msupply chain attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1) - else - echo -e "\e[1;31merror:\e[0m Unable to verify \e[1;34mpgp@xen.org\e[0m's fingerprint.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or an \e[1;31mimpersonation attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1 - fi - - git switch --quiet --detach RELEASE-"$version" - - # Originally we told people to go check the Makefile themselves. - echo -e -n "\nDetermining source versions from Xen Makefiles..." - qemuVersion="$(grep "QEMU_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"QEMU_UPSTREAM_REVISION ?= "//g)" - seaBIOSVersion="$(grep "SEABIOS_UPSTREAM_REVISION ?= rel-" /tmp/xenUpdateScript/xen/Config.mk | sed s/"SEABIOS_UPSTREAM_REVISION ?= "//g)" - ovmfVersion="$(grep "OVMF_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"OVMF_UPSTREAM_REVISION ?= "//g)" - miniOSVersion="$(grep "MINIOS_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"MINIOS_UPSTREAM_REVISION ?= "//g)" - ipxeVersion="$(grep "IPXE_GIT_TAG :=" /tmp/xenUpdateScript/xen/tools/firmware/etherboot/Makefile | sed s/"IPXE_GIT_TAG := "//g)" - echo "done!" - - # Use `nix-prefetch-git` to fetch `rev`s and `hash`es. - echo "Pre-fetching sources and determining hashes..." - echo -e -n " \e[1;32mXen\e[0m..." - fetchXen=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/xen.git --rev RELEASE-"$version" --quiet) - finalVersion="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)" - hash="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)" - echo "done!" - echo -e -n " \e[1;36mQEMU\e[0m..." - fetchQEMU=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/qemu-xen.git --rev "$qemuVersion" --quiet --fetch-submodules) - finalQEMUVersion="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)" - qemuHash="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)" - echo "done!" - echo -e -n " \e[1;36mSeaBIOS\e[0m..." - fetchSeaBIOS=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/seabios.git --rev "$seaBIOSVersion" --quiet) - finalSeaBIOSVersion="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie rev | sed s/' "rev": "'//g | sed s/'"'//g)" - seaBIOSHash="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie hash | sed s/' "hash": "'//g | sed s/'"'//g)" - echo "done!" - echo -e -n " \e[1;36mOVMF\e[0m..." - ovmfHash="$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/ovmf.git --rev "$ovmfVersion" --quiet --fetch-submodules | grep -ie hash | sed s/' "hash": "'//g | sed s/'",'//g)" - echo "done!" - echo -e -n " \e[1;36miPXE\e[0m..." - ipxeHash="$(nix-prefetch-git --url https://github.com/ipxe/ipxe.git --rev "$ipxeVersion" --quiet | grep -ie hash | sed s/' "hash": "'//g | sed s/'",'//g)" - echo "done!" - - cd "$xenPath" - - echo -e "\nFound the following revisions:\n \e[1;32mXen\e[0m: \e[1;33m$finalVersion\e[0m (\e[1;33m$hash\e[0m)\n \e[1;36mQEMU\e[0m: \e[1;33m$finalQEMUVersion\e[0m (\e[1;33m$qemuHash\e[0m)\n \e[1;36mSeaBIOS\e[0m: \e[1;33m$finalSeaBIOSVersion\e[0m (\e[1;33m$seaBIOSHash\e[0m)\n \e[1;36mOVMF\e[0m: \e[1;33m$ovmfVersion\e[0m (\e[1;33m$ovmfHash\e[0m)\n \e[1;36miPXE\e[0m: \e[1;33m$ipxeVersion\e[0m (\e[1;33m$ipxeHash\e[0m)" - - # Set OCaml Version - read -r -p $'\nEnter the corresponding \e[1;33mOCaml\e[0m version for \e[1;32mXen '"$version"$'\e[0m, or press \e[1;34menter\e[0m for the default value of \e[1;32m4_14\e[0m: ' ocamlVersion - ocamlVersion=${ocamlVersion:-"4_14"} - - mkdir -p "$branch"/ - rm -f "$branch"/default.nix - - # Prepare any .patch files that are called by Nix through a path value. - echo -e "\nPlease add any required patches to version \e[1;32m$branch\e[0m in \e[1;34m$branch/\e[0m, and press \e[1;34menter\e[0m when done." - read -r -p $'Remember to follow the naming specification as defined in \e[1;34m./README.md\e[0m.' - - echo -e "\nDiscovering patches..." - discoveredXenPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-xen-*-$branch.patch" -printf "./%f ")" - discoveredQEMUPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-qemu-*-$branch.patch" -printf "./%f ")" - discoveredSeaBIOSPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-seabios-*-$branch.patch" -printf "./%f ")" - discoveredOVMFPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ovmf-*-$branch.patch" -printf "./%f ")" - discoveredIPXEPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ipxe-*-$branch.patch" -printf "./%f ")" - - discoveredXenPatchesEcho=${discoveredXenPatches:-"\e[1;31mNone found!\e[0m"} - discoveredQEMUPatchesEcho=${discoveredQEMUPatches:-"\e[1;31mNone found!\e[0m"} - discoveredSeaBIOSPatchesEcho=${discoveredSeaBIOSPatches:-"\e[1;31mNone found!\e[0m"} - discoveredOVMFPatchesEcho=${discoveredOVMFPatches:-"\e[1;31mNone found!\e[0m"} - discoveredIPXEPatchesEcho=${discoveredIPXEPatches:-"\e[1;31mNone found!\e[0m"} - - echo -e "Found the following patches:\n \e[1;32mXen\e[0m: \e[1;33m$discoveredXenPatchesEcho\e[0m\n \e[1;36mQEMU\e[0m: \e[1;33m$discoveredQEMUPatchesEcho\e[0m\n \e[1;36mSeaBIOS\e[0m: \e[1;33m$discoveredSeaBIOSPatchesEcho\e[0m\n \e[1;36mOVMF\e[0m: \e[1;33m$discoveredOVMFPatchesEcho\e[0m\n \e[1;36miPXE\e[0m: \e[1;33m$discoveredIPXEPatchesEcho\e[0m" - - # Prepare patches that are called in ./patches.nix. - defaultPatchListInit=("QUBES_REPRODUCIBLE_BUILDS" "XSA_460" "XSA_461" ) - read -r -a defaultPatchList -p $'\nWould you like to override the \e[1;34mupstreamPatches\e[0m list for \e[1;32mXen '"$version"$'\e[0m? If no, press \e[1;34menter\e[0m to use the default patch list: [ \e[1;34m'"${defaultPatchListInit[*]}"$' \e[0m]: ' - defaultPatchList=(${defaultPatchList[@]:-${defaultPatchListInit[@]}}) - upstreamPatches=${defaultPatchList[*]} - - # Write and format default.nix file. - echo -e -n "\nWriting updated \e[1;34mversionDefinition\e[0m..." - cat >"$branch"/default.nix < Date: Sun, 29 Sep 2024 01:54:25 +0000 Subject: [PATCH 06/13] xen: move to by-name Signed-off-by: Fernando Rodrigues Co-authored-by: Yaroslav Bolyukin Co-authored-by: Emily --- .../virtualization/xen/4.18/default.nix | 56 --------------- .../virtualization/xen/4.19/default.nix | 58 --------------- .../virtualization/xen/packages.nix | 71 ------------------- .../xe}/xen/README.md | 65 ++++++----------- pkgs/by-name/xe/xen/package.nix | 11 +++ pkgs/top-level/all-packages.nix | 9 +-- 6 files changed, 33 insertions(+), 237 deletions(-) delete mode 100644 pkgs/applications/virtualization/xen/4.18/default.nix delete mode 100644 pkgs/applications/virtualization/xen/4.19/default.nix delete mode 100644 pkgs/applications/virtualization/xen/packages.nix rename pkgs/{applications/virtualization => by-name/xe}/xen/README.md (65%) create mode 100644 pkgs/by-name/xe/xen/package.nix diff --git a/pkgs/applications/virtualization/xen/4.18/default.nix b/pkgs/applications/virtualization/xen/4.18/default.nix deleted file mode 100644 index 21d6de13f1b03..0000000000000 --- a/pkgs/applications/virtualization/xen/4.18/default.nix +++ /dev/null @@ -1,56 +0,0 @@ -{ - lib, - fetchpatch, - callPackage, - ocaml-ng, - ... -}@genericDefinition: - -let - upstreamPatches = import ../generic/patches.nix { - inherit lib; - inherit fetchpatch; - }; - - upstreamPatchList = lib.lists.flatten ( - with upstreamPatches; - [ - QUBES_REPRODUCIBLE_BUILDS - XSA_462 - ] - ); -in - -callPackage (import ../generic/default.nix { - pname = "xen"; - branch = "4.18"; - version = "4.18.3"; - latest = false; - pkg = { - xen = { - rev = "bd51e573a730efc569646379cd59ccba967cde97"; - hash = "sha256-OFiFdpPCXR+sWjzFHCORtY4DkWyggvxkcsGdgEyO1ts="; - patches = [ ] ++ upstreamPatchList; - }; - qemu = { - rev = "0df9387c8983e1b1e72d8c574356f572342c03e6"; - hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ="; - patches = [ ]; - }; - seaBIOS = { - rev = "ea1b7a0733906b8425d948ae94fba63c32b1d425"; - hash = "sha256-J2FuT+FXn9YoFLSfxDOxyKZvKrys59a6bP1eYvEXVNU="; - patches = [ ]; - }; - ovmf = { - rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16"; - hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s="; - patches = [ ]; - }; - ipxe = { - rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca"; - hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU="; - patches = [ ]; - }; - }; -}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition) diff --git a/pkgs/applications/virtualization/xen/4.19/default.nix b/pkgs/applications/virtualization/xen/4.19/default.nix deleted file mode 100644 index a1b1337042855..0000000000000 --- a/pkgs/applications/virtualization/xen/4.19/default.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - lib, - fetchpatch, - callPackage, - ocaml-ng, - ... -}@genericDefinition: - -let - upstreamPatches = import ../generic/patches.nix { - inherit lib; - inherit fetchpatch; - }; - - upstreamPatchList = lib.lists.flatten ( - with upstreamPatches; - [ - QUBES_REPRODUCIBLE_BUILDS - XSA_460 - XSA_461 - XSA_462 - ] - ); -in - -callPackage (import ../generic/default.nix { - pname = "xen"; - branch = "4.19"; - version = "4.19.0"; - latest = true; - pkg = { - xen = { - rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239"; - hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q="; - patches = [ ] ++ upstreamPatchList; - }; - qemu = { - rev = "0df9387c8983e1b1e72d8c574356f572342c03e6"; - hash = "sha256-BX+LXfNzwdUMALwwI1ZDW12dJ357oynjnrboLHREDGQ="; - patches = [ ]; - }; - seaBIOS = { - rev = "a6ed6b701f0a57db0569ab98b0661c12a6ec3ff8"; - hash = "sha256-hWemj83cxdY8p+Jhkh5GcPvI0Sy5aKYZJCsKDjHTUUk="; - patches = [ ]; - }; - ovmf = { - rev = "ba91d0292e593df8528b66f99c1b0b14fadc8e16"; - hash = "sha256-htOvV43Hw5K05g0SF3po69HncLyma3BtgpqYSdzRG4s="; - patches = [ ]; - }; - ipxe = { - rev = "1d1cf74a5e58811822bee4b3da3cff7282fcdfca"; - hash = "sha256-8pwoPrmkpL6jIM+Y/C0xSvyrBM/Uv0D1GuBwNm+0DHU="; - patches = [ ]; - }; - }; -}) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_14; } // genericDefinition) diff --git a/pkgs/applications/virtualization/xen/packages.nix b/pkgs/applications/virtualization/xen/packages.nix deleted file mode 100644 index fe759709770ff..0000000000000 --- a/pkgs/applications/virtualization/xen/packages.nix +++ /dev/null @@ -1,71 +0,0 @@ -{ - python3Packages, - python311Packages, - callPackage, -}: -let - standard = { - # Broken with python 3.12+ when using internal QEMU due to https://github.com/NixOS/nixpkgs/issues/253751 - python3Packages = python311Packages; - meta = { - description = "Standard"; - longDescription = '' - Standard version of the Xen Project Hypervisor. Uses forks of QEMU, SeaBIOS, - OVMF and iPXE provided by the Xen Project. This provides the vanilla Xen - experience, but wastes space and build time. A typical NixOS setup that runs - lots of VMs will usually need to build two different versions of QEMU when using - this Xen derivation (one fork and upstream). - ''; - }; - }; - slim = { - inherit python3Packages; - meta = { - description = "Without Internal Components"; - longDescription = '' - Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages - as much as possible. Instead of using the Xen Project forks for various internal - components, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These - components may ocasionally get out of sync with the hypervisor itself, but this - builds faster and uses less space than the default derivation. - ''; - }; - }; -in -# TODO: generalise this to automatically generate both Xen variants for each .//default.nix. -rec { - xen_4_19 = callPackage ./4.19/default.nix { - inherit (standard) meta python3Packages; - }; - xen_4_19-slim = xen_4_19.override { - withInternalQEMU = false; - withInternalSeaBIOS = false; - withInternalOVMF = false; - withInternalIPXE = false; - inherit (slim) meta python3Packages; - }; - - xen_4_18 = callPackage ./4.18/default.nix { - inherit (standard) meta python3Packages; - }; - xen_4_18-slim = xen_4_18.override { - withInternalQEMU = false; - withInternalSeaBIOS = false; - withInternalOVMF = false; - withInternalIPXE = false; - inherit (slim) meta python3Packages; - }; - - xen_4_17 = callPackage ./4.17/default.nix { - inherit (standard) meta python3Packages; - }; - xen_4_17-slim = xen_4_17.override { - withInternalQEMU = false; - withInternalSeaBIOS = false; - withInternalOVMF = false; - withInternalIPXE = false; - inherit (slim) meta; - # Broken with python 3.12+ due to distutils missing. - python3Packages = python311Packages; - }; -} diff --git a/pkgs/applications/virtualization/xen/README.md b/pkgs/by-name/xe/xen/README.md similarity index 65% rename from pkgs/applications/virtualization/xen/README.md rename to pkgs/by-name/xe/xen/README.md index 20c45f867dccd..df3b71b3c9565 100644 --- a/pkgs/applications/virtualization/xen/README.md +++ b/pkgs/by-name/xe/xen/README.md @@ -17,7 +17,7 @@ # Xen Project Hypervisor Xen Fu Panda -This directory includes the build recipes for the [Xen Project Hypervisor](https://xenproject.org/). +This directory begins the [Xen Project Hypervisor](https://xenproject.org/) build process. Some other notable packages that compose the Xen Project Ecosystem include: @@ -32,81 +32,56 @@ Some other notable packages that compose the Xen Project Ecosystem include: ### Manually -1. Create one directory per branch. -1. [Update](https://xenbits.xenproject.org/gitweb/) the `default.nix` files for - the branches that already exist and copy a new one to any branches that do - not yet exist in Nixpkgs. - - Do not forget to set the `branch`, `version`, and `latest` attributes for - each of the `default.nix` files. +1. [Update](https://xenbits.xenproject.org/gitweb/) the `package.nix` file for + the latest branch of Xen. + - Do not forget to set the `branch`, `version`, and `latest` attributes. - The revisions are preferably commit hashes, but tag names are acceptable as well. -1. Make sure all branches build. (Both the `standard` and `slim` versions) -1. Use the NixOS module to test if dom0 boots successfully on all new versions. +1. Make sure it builds. +1. Use the NixOS module to test if dom0 boots successfully on the new version. 1. Make sure the `meta` attributes evaluate to something that makes sense. The following one-line command is useful for testing this: ```console - xenToEvaluate=xen; echo -e "\033[1m$(nix eval .#"$xenToEvaluate".meta.description --raw 2> /dev/null)\033[0m\n\n$(nix eval .#"$xenToEvaluate".meta.longDescription --raw 2> /dev/null)" + echo -e "\033[1m$(nix eval .#xen.meta.description --raw 2> /dev/null)\033[0m\n\n$(nix eval .#xen.meta.longDescription --raw 2> /dev/null)" ``` - Change the value of `xenToEvaluate` to evaluate all relevant Xen packages. 1. Run `xtf --all --host` as root when booted into the Xen update, and make - sure no tests fail. + sure no important tests fail. 1. Clean up your changes and commit them, making sure to follow the [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md). 1. Open a PR and await a review from the current maintainers. ## Features -### Pre-fetched Sources +### Generic Builder -On a typical Xen build, the Xen Makefiles will fetch more required sources with -`git` and `wget`. Due to the Nix Sandbox, build-time fetching will fail, so we -pre-fetch the required sources before building.[^1] To accomplish this, we have -a `prefetchedSources` attribute that contains the required derivations, if they -are requested by the main Xen build. +`buildXenPackage` is a helpful utility capable of building Xen when passed +certain attributes. The `package.nix` file on this directory includes all +important attributes for building a Xen package with Nix. Downstreams can +pin their Xen revision or include extra patches if the default Xen package +does not meet their needs. ### EFI Building `xen.efi` requires an `ld` with PE support.[^2] We use a `makeFlag` to override the `$LD` environment variable to point to our -patched `efiBinutils`. For more information, see the comment in `./generic/default.nix`. +patched `efiBinutils`. For more information, see the comment in `pkgs/build-support/xen/default.nix`. > [!TIP] > If you are certain you will not be running Xen in an x86 EFI environment, disable the `withEFI` flag with an [override](https://nixos.org/manual/nixpkgs/stable/#chap-overrides) to save you the need to compile `efiBinutils`. -### Default Overrides - -By default, Xen also builds -[QEMU](https://www.qemu.org/), -[SeaBIOS](https://www.seabios.org/SeaBIOS), -[OVMF](https://github.com/tianocore/tianocore.github.io/wiki/OVMF) and -[iPXE](https://ipxe.org/). - -- QEMU is used for stubdomains and handling devices. -- SeaBIOS is the default legacy BIOS ROM for HVM domains. -- OVMF is the default UEFI ROM for HVM domains. -- iPXE provides a PXE boot environment for HVMs. - -However, those packages are already available on Nixpkgs, and Xen does not -necessarily need to build them into the main hypervisor build. For this reason, -we also have the `withInternal` flags, which enables and disables -building those built-in components. The two most popular Xen configurations will -be the default build, with all built-in components, and a `slim` build, with none -of those components. To simplify this process, the `./packages.nix` file includes -the `xen-slim` package overrides that have all `withInternal` flags -disabled. See the `meta.longDescription` attribute for the `xen-slim` packages -for more information. - ## Security -We aim to support all **security-supported** versions of Xen at any given time. +We aim to support the **latest** version of Xen at any given time. See the [Xen Support Matrix](https://xenbits.xen.org/docs/unstable/support-matrix.html) -for a list of versions. As soon as a version is no longer **security-supported**, -it should be removed from Nixpkgs. +for a list of versions. As soon as a version is no longer the newest, it should +be removed from Nixpkgs (`master`). If you need earlier versions of Xen, consider +building your own Xen by following the instructions in the **Generic Builder** +section. > [!CAUTION] > Pull requests that introduce XSA patches diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix new file mode 100644 index 0000000000000..6f527cda1e7b8 --- /dev/null +++ b/pkgs/by-name/xe/xen/package.nix @@ -0,0 +1,11 @@ +{ + buildXenPackage, + python3Packages, +}: + +buildXenPackage.override { inherit python3Packages; } { + pname = "xen"; + version = "4.19.0"; + rev = "026c9fa29716b0ff0f8b7c687908e71ba29cf239"; + hash = "sha256-Q6x+2fZ4ITBz6sKICI0NHGx773Rc919cl+wzI89UY+Q="; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ba6276ad8dd44..1f9dd0ae13a4a 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -26413,10 +26413,9 @@ with pkgs; glusterfsSupport = lib.meta.availableOn stdenv.hostPlatform glusterfs && lib.meta.availableOn stdenv.hostPlatform libuuid; }); - # See `xenPackages` source for explanations. # Building with `xen` instead of `xen-slim` is possible, but makes no sense. - qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_19-slim; }); - qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xenPackages.xen_4_18-slim; }); + qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xen_4_19-slim; }); + qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xen_4_18-slim; }); qemu_xen = qemu_xen_4_19; qemu_test = lowPrio (qemu.override { hostCpuOnly = true; nixosTestRunner = true; }); @@ -33848,10 +33847,6 @@ with pkgs; xdotool = callPackage ../tools/X11/xdotool { }; - xenPackages = recurseIntoAttrs (callPackage ../applications/virtualization/xen/packages.nix {}); - - xen = xenPackages.xen_4_19; - xen-slim = xenPackages.xen_4_19-slim; buildXenPackage = callPackage ../build-support/xen { }; xkbset = callPackage ../tools/X11/xkbset { }; From b1cb7f4ce8a3b11ab72c4dbb8ad69f9af6984fdc Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 01:49:00 +0000 Subject: [PATCH 07/13] .github/labeler.yml: edit the xen-project label to reflect the new paths. Signed-off-by: Fernando Rodrigues --- .github/labeler.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/labeler.yml b/.github/labeler.yml index eca2a2527037a..485bcce6a8a4d 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -385,9 +385,11 @@ - changed-files: - any-glob-to-any-file: - nixos/modules/virtualisation/xen* - - pkgs/applications/virtualization/xen/** + - pkgs/by-name/xe/xen/* + - pkgs/by-name/qe/qemu_xen/* - pkgs/by-name/xe/xen-guest-agent/* - pkgs/by-name/xt/xtf/* + - pkgs/build-support/xen/* - pkgs/development/ocaml-modules/xen*/* - pkgs/development/ocaml-modules/vchan/* From 3c97ed9d11d9cfe9e3808714d8eae919a228ec48 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 29 Sep 2024 03:02:30 +0000 Subject: [PATCH 08/13] aliases: explain the removals of xen-slim, the versioned attributes and the xenPackages set Signed-off-by: Fernando Rodrigues --- pkgs/top-level/aliases.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 9884796a343ef..d645bdbcf8b92 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1701,6 +1701,12 @@ mapAliases { xcodebuild6 = throw "'xcodebuild6' has been renamed to/replaced by 'xcodebuild'"; # Added 2023-12-10 xdg_utils = xdg-utils; # Added 2021-02-01 xen-light = throw "'xen-light' has been renamed to/replaced by 'xen-slim'"; # Added 2024-06-30 + xen-slim = throw "'xen-slim' has been renamed to 'xen'. The old Xen package with built-in components no longer exists"; # Added 2024-10-05 + xen_4_16 = throw "While Xen 4.16 was still security-supported when it was removed from Nixpkgs, it would have reached its End of Life a couple of days after NixOS 24.11 released. To avoid shipping an insecure version of Xen, the Xen Project Hypervisor Maintenance Team decided to delete the derivation entirely"; # Added 2024-10-05 + xen_4_17 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.17 would have been the 'n-2' version, it was removed"; # Added 2024-10-05 + xen_4_18 = throw "Due to technical challenges involving building older versions of Xen with newer dependencies, the Xen Project Hypervisor Maintenance Team decided to switch to a latest-only support cycle. As Xen 4.18 would have been the 'n-1' version, it was removed"; # Added 2024-10-05 + xen_4_19 = throw "Use 'xen' instead"; # Added 2024-10-05 + xenPackages = throw "The attributes in the xenPackages set have been promoted to the top-level. (xenPackages.xen_4_19 -> xen)"; xineLib = xine-lib; # Added 2021-04-27 xineUI = xine-ui; # Added 2021-04-27 xmlada = gnatPackages.xmlada; # Added 2024-02-25 From f5e6e7ac2acd5a2249d410d8e9a38af9d1f314be Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 30 Sep 2024 22:17:11 +0000 Subject: [PATCH 09/13] qemu_xen: move to by-name Signed-off-by: Fernando Rodrigues --- pkgs/by-name/qe/qemu_xen/package.nix | 1 + pkgs/top-level/all-packages.nix | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-) create mode 100644 pkgs/by-name/qe/qemu_xen/package.nix diff --git a/pkgs/by-name/qe/qemu_xen/package.nix b/pkgs/by-name/qe/qemu_xen/package.nix new file mode 100644 index 0000000000000..0ea5571923e7c --- /dev/null +++ b/pkgs/by-name/qe/qemu_xen/package.nix @@ -0,0 +1 @@ +{ qemu }: qemu.override { xenSupport = true; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1f9dd0ae13a4a..19874f1842c23 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -26413,11 +26413,6 @@ with pkgs; glusterfsSupport = lib.meta.availableOn stdenv.hostPlatform glusterfs && lib.meta.availableOn stdenv.hostPlatform libuuid; }); - # Building with `xen` instead of `xen-slim` is possible, but makes no sense. - qemu_xen_4_19 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xen_4_19-slim; }); - qemu_xen_4_18 = lowPrio (qemu.override { hostCpuTargets = [ "i386-softmmu" ]; xenSupport = true; xen = xen_4_18-slim; }); - qemu_xen = qemu_xen_4_19; - qemu_test = lowPrio (qemu.override { hostCpuOnly = true; nixosTestRunner = true; }); quick-lint-js = callPackage ../development/tools/quick-lint-js { }; From 251dc99c70ac2dbedf5a9942869a5fcfea4e121f Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sat, 5 Oct 2024 21:23:57 +0000 Subject: [PATCH 10/13] nixos/xen: simplify package options Signed-off-by: Fernando Rodrigues --- nixos/modules/virtualisation/xen-dom0.nix | 293 +++++++++++----------- 1 file changed, 147 insertions(+), 146 deletions(-) diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix index 9b6ec543dae59..2911c0c1d97c4 100644 --- a/nixos/modules/virtualisation/xen-dom0.nix +++ b/nixos/modules/virtualisation/xen-dom0.nix @@ -8,6 +8,35 @@ }: let + inherit (builtins) readFile; + inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule mkIf; + inherit (lib.options) + mkOption + mkEnableOption + literalExpression + mkPackageOption + ; + inherit (lib.types) + listOf + str + ints + lines + enum + path + submodule + addCheck + float + bool + int + nullOr + ; + inherit (lib.lists) optional optionals; + inherit (lib.strings) hasSuffix optionalString; + inherit (lib.meta) getExe; + inherit (lib.attrsets) optionalAttrs; + inherit (lib.trivial) boolToString; + inherit (lib.teams.xen) members; + cfg = config.virtualisation.xen; xenBootBuilder = pkgs.writeShellApplication { @@ -22,7 +51,7 @@ let gnused jq ]) - ++ lib.lists.optionals (cfg.efi.bootBuilderVerbosity == "info") ( + ++ optionals (cfg.efi.bootBuilderVerbosity == "info") ( with pkgs; [ bat @@ -36,12 +65,12 @@ let # We disable SC2016 because we don't want to expand the regexes in the sed commands. excludeShellChecks = [ "SC2016" ]; - text = builtins.readFile ./xen-boot-builder.sh; + text = readFile ./xen-boot-builder.sh; }; in { - imports = with lib.modules; [ + imports = [ (mkRemovedOptionModule [ "virtualisation" @@ -123,59 +152,33 @@ in options.virtualisation.xen = { - enable = lib.options.mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect"; + enable = mkEnableOption "the Xen Project Hypervisor, a virtualisation technology defined as a *type-1 hypervisor*, which allows multiple virtual machines, known as *domains*, to run concurrently on the physical machine. NixOS runs as the privileged *Domain 0*. This option requires a reboot into a Xen kernel to take effect"; - debug = lib.options.mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production"; + debug = mkEnableOption "Xen debug features for Domain 0. This option enables some hidden debugging tests and features, and should not be used in production"; - trace = lib.options.mkOption { - type = lib.types.bool; + trace = mkOption { + type = bool; default = cfg.debug; - defaultText = lib.options.literalExpression "false"; + defaultText = literalExpression "false"; example = true; description = "Whether to enable Xen debug tracing and logging for Domain 0."; }; - package = lib.options.mkOption { - type = lib.types.package; - default = pkgs.xen; - defaultText = lib.options.literalExpression "pkgs.xen"; - example = lib.options.literalExpression "pkgs.xen-slim"; - description = '' - The package used for Xen Project Hypervisor. - ''; - relatedPackages = [ - "xen" - "xen-slim" - ]; - }; + package = mkPackageOption pkgs "Xen Hypervisor" { default = [ "xen" ]; }; qemu = { - package = lib.options.mkOption { - type = lib.types.package; - default = pkgs.xen; - defaultText = lib.options.literalExpression "pkgs.xen"; - example = lib.options.literalExpression "pkgs.qemu_xen"; - description = '' - The package with QEMU binaries that runs in Domain 0 - and virtualises the unprivileged domains. - ''; - relatedPackages = [ - "xen" - { - name = "qemu_xen"; - comment = "For use with `pkgs.xen-slim`."; - } - ]; + package = mkPackageOption pkgs "QEMU (with Xen Hypervisor support)" { + default = [ "qemu_xen" ]; }; - pidFile = lib.options.mkOption { - type = lib.types.path; + pidFile = mkOption { + type = path; default = "/run/xen/qemu-dom0.pid"; example = "/var/run/xen/qemu-dom0.pid"; description = "Path to the QEMU PID file."; }; }; - bootParams = lib.options.mkOption { + bootParams = mkOption { default = [ ]; example = '' [ @@ -184,7 +187,7 @@ in "vga=ask" ] ''; - type = lib.types.listOf lib.types.str; + type = listOf str; description = '' Xen Command Line parameters passed to Domain 0 at boot time. Note: these are different from `boot.kernelParams`. See @@ -193,8 +196,8 @@ in }; efi = { - bootBuilderVerbosity = lib.options.mkOption { - type = lib.types.enum [ + bootBuilderVerbosity = mkOption { + type = enum [ "default" "info" "debug" @@ -218,11 +221,11 @@ in ''; }; - path = lib.options.mkOption { - type = lib.types.path; + path = mkOption { + type = path; default = "${cfg.package.boot}/${cfg.package.efi}"; - defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}"; - example = lib.options.literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi"; + defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}"; + example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi"; description = '' Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file on `$boot/boot/xen.efi`, but an unpatched Xen build may install it @@ -234,10 +237,10 @@ in }; dom0Resources = { - maxVCPUs = lib.options.mkOption { + maxVCPUs = mkOption { default = 0; example = 4; - type = lib.types.ints.unsigned; + type = ints.unsigned; description = '' Amount of virtual CPU cores allocated to Domain 0 on boot. If set to 0, all cores are assigned to Domain 0, and @@ -245,10 +248,10 @@ in ''; }; - memory = lib.options.mkOption { + memory = mkOption { default = 0; example = 512; - type = lib.types.ints.unsigned; + type = ints.unsigned; description = '' Amount of memory (in MiB) allocated to Domain 0 on boot. If set to 0, all memory is assigned to Domain 0, and @@ -256,11 +259,11 @@ in ''; }; - maxMemory = lib.options.mkOption { + maxMemory = mkOption { default = cfg.dom0Resources.memory; - defaultText = lib.options.literalExpression "config.virtualisation.xen.dom0Resources.memory"; + defaultText = literalExpression "config.virtualisation.xen.dom0Resources.memory"; example = 1024; - type = lib.types.ints.unsigned; + type = ints.unsigned; description = '' Maximum amount of memory (in MiB) that Domain 0 can dynamically allocate to itself. Does nothing if set @@ -271,8 +274,8 @@ in }; domains = { - extraConfig = lib.options.mkOption { - type = lib.types.lines; + extraConfig = mkOption { + type = lines; default = ""; example = '' XENDOMAINS_SAVE=/persist/xen/save @@ -288,28 +291,28 @@ in }; store = { - path = lib.options.mkOption { - type = lib.types.path; + path = mkOption { + type = path; default = "${cfg.package}/bin/oxenstored"; - defaultText = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored"; - example = lib.options.literalExpression "\${config.virtualisation.xen.package}/bin/xenstored"; + defaultText = literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored"; + example = literalExpression "\${config.virtualisation.xen.package}/bin/xenstored"; description = '' Path to the Xen Store Daemon. This option is useful to switch between the legacy C-based Xen Store Daemon, and the newer OCaml-based Xen Store Daemon, `oxenstored`. ''; }; - type = lib.options.mkOption { - type = lib.types.enum [ + type = mkOption { + type = enum [ "c" "ocaml" ]; - default = if (lib.strings.hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c"; + default = if (hasSuffix "oxenstored" cfg.store.path) then "ocaml" else "c"; internal = true; readOnly = true; description = "Helper internal option that determines the type of the Xen Store Daemon based on cfg.store.path."; }; - settings = lib.options.mkOption { + settings = mkOption { default = { }; example = { enableMerge = false; @@ -324,34 +327,34 @@ in The OCaml-based Xen Store Daemon configuration. This option does nothing with the C-based `xenstored`. ''; - type = lib.types.submodule { + type = submodule { options = { - pidFile = lib.options.mkOption { + pidFile = mkOption { default = "/run/xen/xenstored.pid"; example = "/var/run/xen/xenstored.pid"; - type = lib.types.path; + type = path; description = "Path to the Xen Store Daemon PID file."; }; - testEAGAIN = lib.options.mkOption { + testEAGAIN = mkOption { default = cfg.debug; - defaultText = lib.options.literalExpression "config.virtualisation.xen.debug"; + defaultText = literalExpression "config.virtualisation.xen.debug"; example = true; - type = lib.types.bool; + type = bool; visible = false; description = "Randomly fail a transaction with EAGAIN. This option is used for debugging purposes only."; }; - enableMerge = lib.options.mkOption { + enableMerge = mkOption { default = true; example = false; - type = lib.types.bool; + type = bool; description = "Whether to enable transaction merge support."; }; conflict = { - burstLimit = lib.options.mkOption { + burstLimit = mkOption { default = 5.0; example = 15.0; - type = lib.types.addCheck ( - lib.types.float + type = addCheck ( + float // { name = "nonnegativeFloat"; description = "nonnegative floating point number, meaning >=0"; @@ -369,12 +372,12 @@ in domain's requests are ignored. ''; }; - maxHistorySeconds = lib.options.mkOption { + maxHistorySeconds = mkOption { default = 5.0e-2; example = 1.0; - type = lib.types.addCheck ( - lib.types.float // { description = "nonnegative floating point number, meaning >=0"; } - ) (n: n >= 0); + type = addCheck (float // { description = "nonnegative floating point number, meaning >=0"; }) ( + n: n >= 0 + ); description = '' Limits applied to domains whose writes cause other domains' transaction commits to fail. Must include decimal point. @@ -384,10 +387,10 @@ in is the minimum pause-time during which a domain will be ignored. ''; }; - rateLimitIsAggregate = lib.options.mkOption { + rateLimitIsAggregate = mkOption { default = true; example = false; - type = lib.types.bool; + type = bool; description = '' If the conflict.rateLimitIsAggregate option is `true`, then after each tick one point of conflict-credit is given to just one domain: the @@ -408,16 +411,16 @@ in }; }; perms = { - enable = lib.options.mkOption { + enable = mkOption { default = true; example = false; - type = lib.types.bool; + type = bool; description = "Whether to enable the node permission system."; }; - enableWatch = lib.options.mkOption { + enableWatch = mkOption { default = true; example = false; - type = lib.types.bool; + type = bool; description = '' Whether to enable the watch permission system. @@ -432,144 +435,142 @@ in }; }; quota = { - enable = lib.options.mkOption { + enable = mkOption { default = true; example = false; - type = lib.types.bool; + type = bool; description = "Whether to enable the quota system."; }; - maxEntity = lib.options.mkOption { + maxEntity = mkOption { default = 1000; example = 1024; - type = lib.types.ints.positive; + type = ints.positive; description = "Entity limit for transactions."; }; - maxSize = lib.options.mkOption { + maxSize = mkOption { default = 2048; example = 4096; - type = lib.types.ints.positive; + type = ints.positive; description = "Size limit for transactions."; }; - maxWatch = lib.options.mkOption { + maxWatch = mkOption { default = 100; example = 256; - type = lib.types.ints.positive; + type = ints.positive; description = "Maximum number of watches by the Xenstore Watchdog."; }; - transaction = lib.options.mkOption { + transaction = mkOption { default = 10; example = 50; - type = lib.types.ints.positive; + type = ints.positive; description = "Maximum number of transactions."; }; - maxRequests = lib.options.mkOption { + maxRequests = mkOption { default = 1024; example = 1024; - type = lib.types.ints.positive; + type = ints.positive; description = "Maximum number of requests per transaction."; }; - maxPath = lib.options.mkOption { + maxPath = mkOption { default = 1024; example = 1024; - type = lib.types.ints.positive; + type = ints.positive; description = "Path limit for the quota system."; }; - maxOutstanding = lib.options.mkOption { + maxOutstanding = mkOption { default = 1024; example = 1024; - type = lib.types.ints.positive; + type = ints.positive; description = "Maximum outstanding requests, i.e. in-flight requests / domain."; }; - maxWatchEvents = lib.options.mkOption { + maxWatchEvents = mkOption { default = 1024; example = 2048; - type = lib.types.ints.positive; + type = ints.positive; description = "Maximum number of outstanding watch events per watch."; }; }; - persistent = lib.options.mkOption { + persistent = mkOption { default = false; example = true; - type = lib.types.bool; + type = bool; description = "Whether to activate the filed base backend."; }; xenstored = { log = { - file = lib.options.mkOption { + file = mkOption { default = "/var/log/xen/xenstored.log"; example = "/dev/null"; - type = lib.types.path; + type = path; description = "Path to the Xen Store log file."; }; - level = lib.options.mkOption { + level = mkOption { default = if cfg.trace then "debug" else null; - defaultText = lib.options.literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null"; + defaultText = literalExpression "if (config.virtualisation.xen.trace == true) then \"debug\" else null"; example = "error"; - type = lib.types.nullOr ( - lib.types.enum [ - "debug" - "info" - "warn" - "error" - ] - ); + type = nullOr (enum [ + "debug" + "info" + "warn" + "error" + ]); description = "Logging level for the Xen Store."; }; # The hidden options below have no upstream documentation whatsoever. # The nb* options appear to alter the log rotation behaviour, and # the specialOps option appears to affect the Xenbus logging logic. - nbFiles = lib.options.mkOption { + nbFiles = mkOption { default = 10; example = 16; - type = lib.types.int; + type = int; visible = false; description = "Set `xenstored-log-nb-files`."; }; }; accessLog = { - file = lib.options.mkOption { + file = mkOption { default = "/var/log/xen/xenstored-access.log"; example = "/var/log/security/xenstored-access.log"; - type = lib.types.path; + type = path; description = "Path to the Xen Store access log file."; }; - nbLines = lib.options.mkOption { + nbLines = mkOption { default = 13215; example = 16384; - type = lib.types.int; + type = int; visible = false; description = "Set `access-log-nb-lines`."; }; - nbChars = lib.options.mkOption { + nbChars = mkOption { default = 180; example = 256; - type = lib.types.int; + type = int; visible = false; description = "Set `acesss-log-nb-chars`."; }; - specialOps = lib.options.mkOption { + specialOps = mkOption { default = false; example = true; - type = lib.types.bool; + type = bool; visible = false; description = "Set `access-log-special-ops`."; }; }; xenfs = { - kva = lib.options.mkOption { + kva = mkOption { default = "/proc/xen/xsd_kva"; example = cfg.store.settings.xenstored.xenfs.kva; - type = lib.types.path; + type = path; visible = false; description = '' Path to the Xen Store Daemon KVA location inside the XenFS pseudo-filesystem. While it is possible to alter this value, some drivers may be hardcoded to follow the default paths. ''; }; - port = lib.options.mkOption { + port = mkOption { default = "/proc/xen/xsd_port"; example = cfg.store.settings.xenstored.xenfs.port; - type = lib.types.path; + type = path; visible = false; description = '' Path to the Xen Store Daemon userspace port inside the XenFS pseudo-filesystem. @@ -578,11 +579,11 @@ in }; }; }; - ringScanInterval = lib.options.mkOption { + ringScanInterval = mkOption { default = 20; example = 30; - type = lib.types.addCheck ( - lib.types.int + type = addCheck ( + int // { name = "nonzeroInt"; description = "nonzero signed integer, meaning !=0"; @@ -602,7 +603,7 @@ in ## Implementation ## - config = lib.modules.mkIf cfg.enable { + config = mkIf cfg.enable { assertions = [ { assertion = pkgs.stdenv.hostPlatform.isx86_64; @@ -639,18 +640,18 @@ in ]; virtualisation.xen.bootParams = - lib.lists.optionals cfg.trace [ + optionals cfg.trace [ "loglvl=all" "guest_loglvl=all" ] ++ - lib.lists.optional (cfg.dom0Resources.memory != 0) + optional (cfg.dom0Resources.memory != 0) "dom0_mem=${toString cfg.dom0Resources.memory}M${ - lib.strings.optionalString ( + optionalString ( cfg.dom0Resources.memory != cfg.dom0Resources.maxMemory ) ",max:${toString cfg.dom0Resources.maxMemory}M" }" - ++ lib.lists.optional ( + ++ optional ( cfg.dom0Resources.maxVCPUs != 0 ) "dom0_max_vcpus=${toString cfg.dom0Resources.maxVCPUs}"; @@ -701,7 +702,7 @@ in # See the `xenBootBuilder` script in the main `let...in` statement of this file. loader.systemd-boot.extraInstallCommands = '' - ${lib.meta.getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity} + ${getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity} ''; }; @@ -744,7 +745,7 @@ in XENSTORED="${cfg.store.path}" QEMU_XEN="${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386}" - ${lib.strings.optionalString cfg.trace '' + ${optionalString cfg.trace '' XENSTORED_TRACE=yes XENCONSOLED_TRACE=all ''} @@ -756,10 +757,10 @@ in ''; } # The OCaml-based Xen Store Daemon requires /etc/xen/oxenstored.conf to start. - // lib.attrsets.optionalAttrs (cfg.store.type == "ocaml") { + // optionalAttrs (cfg.store.type == "ocaml") { "xen/oxenstored.conf".text = '' pid-file = ${cfg.store.settings.pidFile} - test-eagain = ${lib.trivial.boolToString cfg.store.settings.testEAGAIN} + test-eagain = ${boolToString cfg.store.settings.testEAGAIN} merge-activate = ${toString cfg.store.settings.enableMerge} conflict-burst-limit = ${toString cfg.store.settings.conflict.burstLimit} conflict-max-history-seconds = ${toString cfg.store.settings.conflict.maxHistorySeconds} @@ -775,7 +776,7 @@ in quota-path-max = ${toString cfg.store.settings.quota.maxPath} quota-maxoutstanding = ${toString cfg.store.settings.quota.maxOutstanding} quota-maxwatchevents = ${toString cfg.store.settings.quota.maxWatchEvents} - persistent = ${lib.trivial.boolToString cfg.store.settings.persistent} + persistent = ${boolToString cfg.store.settings.persistent} xenstored-log-file = ${cfg.store.settings.xenstored.log.file} xenstored-log-level = ${ if isNull cfg.store.settings.xenstored.log.level then @@ -787,7 +788,7 @@ in access-log-file = ${cfg.store.settings.xenstored.accessLog.file} access-log-nb-lines = ${toString cfg.store.settings.xenstored.accessLog.nbLines} acesss-log-nb-chars = ${toString cfg.store.settings.xenstored.accessLog.nbChars} - access-log-special-ops = ${lib.trivial.boolToString cfg.store.settings.xenstored.accessLog.specialOps} + access-log-special-ops = ${boolToString cfg.store.settings.xenstored.accessLog.specialOps} ring-scan-interval = ${toString cfg.store.settings.ringScanInterval} xenstored-kva = ${cfg.store.settings.xenstored.xenfs.kva} xenstored-port = ${cfg.store.settings.xenstored.xenfs.port} @@ -870,5 +871,5 @@ in }; }; }; - meta.maintainers = lib.teams.xen.members; + meta.maintainers = members; } From 1610ee03f11b8cb3955af1771331efd0574e010d Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sat, 5 Oct 2024 21:55:32 +0000 Subject: [PATCH 11/13] treewide: purge remaining calls to xen-slim Signed-off-by: Fernando Rodrigues --- pkgs/by-name/li/libvmi/package.nix | 6 +++--- pkgs/by-name/xe/xen-guest-agent/package.nix | 6 +++--- pkgs/top-level/python-packages.nix | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/li/libvmi/package.nix b/pkgs/by-name/li/libvmi/package.nix index 4eb6f54ba3369..a1f314497b7b1 100644 --- a/pkgs/by-name/li/libvmi/package.nix +++ b/pkgs/by-name/li/libvmi/package.nix @@ -19,7 +19,7 @@ libkvmi, xenSupport ? true, - xen-slim, + xen, }: let @@ -58,7 +58,7 @@ stdenv.mkDerivation { json_c libvirt ] - ++ lib.optionals xenSupport [ xen-slim ] + ++ lib.optionals xenSupport [ xen ] ++ lib.optionals (!legacyKVM) [ libkvmi ] ++ lib.optionals withVMIFS [ fuse ]; @@ -71,7 +71,7 @@ stdenv.mkDerivation { postFixup = lib.optionalString xenSupport '' libvmi="$lib/lib/libvmi.so.${libVersion}" oldrpath=$(patchelf --print-rpath "$libvmi") - patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen-slim ]}" "$libvmi" + patchelf --set-rpath "$oldrpath:${lib.makeLibraryPath [ xen ]}" "$libvmi" ''; passthru = { diff --git a/pkgs/by-name/xe/xen-guest-agent/package.nix b/pkgs/by-name/xe/xen-guest-agent/package.nix index b0223a6311ed2..09c42e5709110 100644 --- a/pkgs/by-name/xe/xen-guest-agent/package.nix +++ b/pkgs/by-name/xe/xen-guest-agent/package.nix @@ -4,7 +4,7 @@ rustPlatform, llvmPackages, pkg-config, - xen-slim, + xen, }: rustPlatform.buildRustPackage rec { pname = "xen-guest-agent"; @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec { pkg-config ]; - buildInputs = [ xen-slim ]; + buildInputs = [ xen ]; postInstall = # Install the sample systemd service. @@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec { postFixup = # Add the Xen libraries in the runpath so the guest agent can find libxenstore. - "patchelf $out/bin/xen-guest-agent --add-rpath ${xen-slim.out}/lib"; + "patchelf $out/bin/xen-guest-agent --add-rpath ${xen}/lib"; meta = { description = "Xen agent running in Linux/BSDs (POSIX) VMs"; diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 7b7ed5e1154f3..f7d6020211ec6 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -17590,7 +17590,7 @@ self: super: with self; { inherit (pkgs) graphviz; }; - xen = toPythonModule (pkgs.xen-slim.override { + xen = toPythonModule (pkgs.xen.override { python3Packages = self; }); From 64cc613a0fd177176e02f9f10f831ef1c2268ce4 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sat, 5 Oct 2024 23:53:11 +0000 Subject: [PATCH 12/13] release-notes: remove mentions to xen-slim or 4.18 They were removed during the great Xen deletion. Signed-off-by: Fernando Rodrigues --- nixos/doc/manual/release-notes/rl-2411.section.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index c122d3425d99f..c0d8701095275 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -54,12 +54,11 @@ was added through the `boot.initrd.systemd.dmVerity` option. - The [Xen Project Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable). - - This release includes Xen [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems. + - This release includes Xen [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes) and support for booting the hypervisor on EFI systems. ::: {.warning} Booting into the Xen Project Hypervisor through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported. ::: - - There are two flavours of Xen available by default: `xen`, which includes all built-in components, and `xen-slim`, which replaces the built-in components with their Nixpkgs equivalents. - - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer available in any of the Xen Project Hypervisor packages. + - The `qemu-xen-traditional` component has been deprecated by the upstream Xen Project, and is no longer included in the Xen build. - The OCaml-based Xen Store can now be configured using [`virtualisation.xen.store.settings`](#opt-virtualisation.xen.store.settings). - The `virtualisation.xen.bridge` options have been deprecated in this release cycle. Users who need network bridges are encouraged to set up their own networking configurations. From ec7ad19010b201221febf0d74eca28bb6ab659f4 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Sun, 6 Oct 2024 15:19:14 +0000 Subject: [PATCH 13/13] qemu: have qemu_xen build for i386-softmmu by default Signed-off-by: Fernando Rodrigues --- pkgs/applications/virtualization/qemu/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix index 3b797c957e83f..619cc9daeba6d 100644 --- a/pkgs/applications/virtualization/qemu/default.nix +++ b/pkgs/applications/virtualization/qemu/default.nix @@ -38,6 +38,8 @@ , hostCpuOnly ? false , hostCpuTargets ? (if toolsOnly then [ ] + else if xenSupport + then [ "i386-softmmu" ] else if hostCpuOnly then (lib.optional stdenv.hostPlatform.isx86_64 "i386-softmmu" ++ ["${stdenv.hostPlatform.qemuArch}-softmmu"]) @@ -50,6 +52,8 @@ , qemu-utils # for tests attribute }: +assert lib.assertMsg (xenSupport -> hostCpuTargets == [ "i386-softmmu" ]) "Xen should not use any other QEMU architecture other than i386."; + let hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;