xen: finish moving to by-name; refactor (#406638)
This commit is contained in:
@@ -1,374 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
autoPatchelfHook,
|
||||
cmake,
|
||||
pkg-config,
|
||||
testers,
|
||||
which,
|
||||
fetchgit,
|
||||
|
||||
# Xen
|
||||
acpica-tools,
|
||||
bison,
|
||||
bzip2,
|
||||
dev86,
|
||||
e2fsprogs,
|
||||
flex,
|
||||
libnl,
|
||||
libuuid,
|
||||
lzo,
|
||||
ncurses,
|
||||
ocamlPackages,
|
||||
perl,
|
||||
python3Packages,
|
||||
systemdMinimal,
|
||||
xz,
|
||||
yajl,
|
||||
zlib,
|
||||
zstd,
|
||||
|
||||
# Optional Components
|
||||
seabios-qemu,
|
||||
systemSeaBIOS ? seabios-qemu,
|
||||
OVMF,
|
||||
ipxe,
|
||||
checkpolicy,
|
||||
binutils-unwrapped-all-targets,
|
||||
|
||||
# Documentation
|
||||
pandoc,
|
||||
|
||||
# Scripts
|
||||
bridge-utils,
|
||||
coreutils,
|
||||
diffutils,
|
||||
gawk,
|
||||
gnugrep,
|
||||
gnused,
|
||||
inetutils,
|
||||
iproute2,
|
||||
iptables,
|
||||
multipath-tools,
|
||||
nbd,
|
||||
openvswitch,
|
||||
util-linux,
|
||||
}:
|
||||
|
||||
{
|
||||
pname,
|
||||
branch ? lib.versions.majorMinor version,
|
||||
version,
|
||||
vendor ? "nixos",
|
||||
upstreamVersion ? version,
|
||||
withFlask ? false,
|
||||
withSeaBIOS ? true,
|
||||
withOVMF ? true,
|
||||
withIPXE ? true,
|
||||
rev,
|
||||
hash,
|
||||
patches ? [ ],
|
||||
meta ? { },
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
enableFeature
|
||||
getExe'
|
||||
licenses
|
||||
makeSearchPathOutput
|
||||
optional
|
||||
optionalString
|
||||
optionals
|
||||
systems
|
||||
teams
|
||||
versionOlder
|
||||
warn
|
||||
;
|
||||
inherit (systems.inspect.patterns) isLinux isAarch64;
|
||||
inherit (licenses)
|
||||
cc-by-40
|
||||
gpl2Only
|
||||
lgpl21Only
|
||||
mit
|
||||
;
|
||||
|
||||
# Mark versions older than minSupportedVersion as EOL.
|
||||
minSupportedVersion = "4.17";
|
||||
|
||||
#TODO: fix paths instead.
|
||||
scriptEnvPath = makeSearchPathOutput "out" "bin" [
|
||||
bridge-utils
|
||||
coreutils
|
||||
diffutils
|
||||
gawk
|
||||
gnugrep
|
||||
gnused
|
||||
inetutils
|
||||
iproute2
|
||||
iptables
|
||||
multipath-tools
|
||||
nbd
|
||||
openvswitch
|
||||
perl
|
||||
util-linux.bin
|
||||
which
|
||||
];
|
||||
in
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
inherit pname version patches;
|
||||
|
||||
outputs = [
|
||||
"out"
|
||||
"man"
|
||||
"doc"
|
||||
"dev"
|
||||
"boot"
|
||||
];
|
||||
|
||||
src = fetchgit {
|
||||
url = "https://xenbits.xenproject.org/git-http/xen.git";
|
||||
inherit rev hash;
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
autoPatchelfHook
|
||||
bison
|
||||
cmake
|
||||
flex
|
||||
pandoc
|
||||
pkg-config
|
||||
python3Packages.setuptools
|
||||
];
|
||||
buildInputs =
|
||||
[
|
||||
# Xen
|
||||
acpica-tools
|
||||
bzip2
|
||||
dev86
|
||||
e2fsprogs.dev
|
||||
libnl
|
||||
libuuid
|
||||
lzo
|
||||
ncurses
|
||||
perl
|
||||
python3Packages.python
|
||||
xz
|
||||
yajl
|
||||
zlib
|
||||
zstd
|
||||
|
||||
# oxenstored
|
||||
ocamlPackages.findlib
|
||||
ocamlPackages.ocaml
|
||||
|
||||
# Python Fixes
|
||||
python3Packages.wrapPython
|
||||
]
|
||||
++ optional withFlask checkpolicy
|
||||
++ optional (versionOlder version "4.19") systemdMinimal;
|
||||
|
||||
configureFlags = [
|
||||
"--enable-systemd"
|
||||
"--disable-qemu-traditional"
|
||||
"--with-system-qemu"
|
||||
(if withSeaBIOS then "--with-system-seabios=${systemSeaBIOS.firmware}" else "--disable-seabios")
|
||||
(if withOVMF then "--with-system-ovmf=${OVMF.mergedFirmware}" else "--disable-ovmf")
|
||||
(if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
|
||||
(enableFeature withFlask "xsmpolicy")
|
||||
];
|
||||
|
||||
makeFlags =
|
||||
[
|
||||
"SUBSYSTEMS=${toString finalAttrs.buildFlags}"
|
||||
|
||||
"PREFIX=$(out)"
|
||||
"BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
|
||||
|
||||
"XEN_WHOAMI=${pname}"
|
||||
"XEN_DOMAIN=${vendor}"
|
||||
|
||||
"GIT=${coreutils}/bin/false"
|
||||
"WGET=${coreutils}/bin/false"
|
||||
"EFI_VENDOR=${vendor}"
|
||||
"INSTALL_EFI_STRIP=1"
|
||||
"LD=${getExe' binutils-unwrapped-all-targets "ld"}"
|
||||
]
|
||||
# These flags set the CONFIG_* options in /boot/xen.config
|
||||
# and define if the default policy file is built. However,
|
||||
# the Flask binaries always get compiled by default.
|
||||
++ optionals withFlask [
|
||||
"XSM_ENABLE=y"
|
||||
"FLASK_ENABLE=y"
|
||||
];
|
||||
|
||||
buildFlags = [
|
||||
"xen"
|
||||
"tools"
|
||||
"docs"
|
||||
];
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = toString [
|
||||
"-Wno-error=maybe-uninitialized"
|
||||
"-Wno-error=array-bounds"
|
||||
];
|
||||
|
||||
dontUseCmakeConfigure = true;
|
||||
|
||||
# Remove in-tree QEMU sources, we don't need them in any circumstance.
|
||||
prePatch = "rm --recursive --force tools/qemu-xen tools/qemu-xen-traditional";
|
||||
|
||||
postPatch =
|
||||
# The following patch forces Xen to install xen.efi on $out/boot
|
||||
# instead of $out/boot/efi/efi/nixos, as the latter directory
|
||||
# would otherwise need to be created manually. This also creates
|
||||
# a more consistent output for downstreams who override the
|
||||
# vendor attribute above.
|
||||
''
|
||||
substituteInPlace xen/Makefile \
|
||||
--replace-fail "\$(D)\$(EFI_MOUNTPOINT)/efi/\$(EFI_VENDOR)/\$(T)-\$(XEN_FULLVERSION).efi" \
|
||||
"\$(D)\$(BOOT_DIR)/\$(T)-\$(XEN_FULLVERSION).efi"
|
||||
''
|
||||
|
||||
# The following patch fixes the call to /bin/mkdir on the
|
||||
# launch_xenstore.sh helper script.
|
||||
+ ''
|
||||
substituteInPlace tools/hotplug/Linux/launch-xenstore.in \
|
||||
--replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
|
||||
''
|
||||
|
||||
# The following expression fixes the paths called by Xen's systemd
|
||||
# units, so we can use them in the NixOS module.
|
||||
+ ''
|
||||
substituteInPlace \
|
||||
tools/hotplug/Linux/systemd/{xen-init-dom0,xen-qemu-dom0-disk-backend,xenconsoled,xendomains,xenstored}.service.in \
|
||||
--replace-fail /bin/grep ${gnugrep}/bin/grep
|
||||
substituteInPlace \
|
||||
tools/hotplug/Linux/systemd/{xen-qemu-dom0-disk-backend,xenconsoled}.service.in \
|
||||
--replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir --parents $out $out/share $boot
|
||||
cp -prvd dist/install/nix/store/*/* $out/
|
||||
cp -prvd dist/install/etc $out
|
||||
cp -prvd dist/install/boot $boot
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
postInstall =
|
||||
# Wrap xencov_split, xenmon and xentrace_format.
|
||||
''
|
||||
wrapPythonPrograms
|
||||
''
|
||||
|
||||
# We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
|
||||
+ ''
|
||||
wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
|
||||
''
|
||||
|
||||
# Fix shebangs in Xen's various scripts.
|
||||
#TODO: Remove any and all usage of `sed` and replace these complicated magic runes with readable code.
|
||||
+ ''
|
||||
shopt -s extglob
|
||||
for i in $out/etc/xen/scripts/!(*.sh); do
|
||||
sed --in-place "2s@^@export PATH=$out/bin:${scriptEnvPath}\n@" $i
|
||||
done
|
||||
'';
|
||||
|
||||
postFixup =
|
||||
''
|
||||
addAutoPatchelfSearchPath $out/lib
|
||||
autoPatchelf $out/libexec/xen/bin
|
||||
''
|
||||
# Flask is particularly hard to disable. Even after
|
||||
# setting the make flags to `n`, it still gets compiled.
|
||||
# If withFlask is disabled, delete the extra binaries.
|
||||
+ optionalString (!withFlask) ''
|
||||
rm -f $out/bin/flask-*
|
||||
'';
|
||||
|
||||
passthru = {
|
||||
efi = "boot/xen-${upstreamVersion}.efi";
|
||||
flaskPolicy =
|
||||
if withFlask then
|
||||
warn "This Xen was compiled with FLASK support, but the FLASK file does not match the Xen version number. Please hardcode the path to the FLASK file instead." "boot/xenpolicy-${version}"
|
||||
else
|
||||
throw "This Xen was compiled without FLASK support.";
|
||||
# This test suite is very simple, as Xen's userspace
|
||||
# utilities require the hypervisor to be booted.
|
||||
tests = {
|
||||
pkg-config = testers.hasPkgConfigModules {
|
||||
package = finalAttrs.finalPackage;
|
||||
moduleNames = [
|
||||
"xencall"
|
||||
"xencontrol"
|
||||
"xendevicemodel"
|
||||
"xenevtchn"
|
||||
"xenforeignmemory"
|
||||
"xengnttab"
|
||||
"xenguest"
|
||||
"xenhypfs"
|
||||
"xenlight"
|
||||
"xenstat"
|
||||
"xenstore"
|
||||
"xentoolcore"
|
||||
"xentoollog"
|
||||
"xenvchan"
|
||||
"xlutil"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta = {
|
||||
inherit branch;
|
||||
|
||||
description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
|
||||
longDescription =
|
||||
''
|
||||
The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
|
||||
hypervisor*, which allows multiple virtual machines, known as domains, to run
|
||||
concurrently with the host on the physical machine. On a typical *type-2
|
||||
hypervisor*, the virtual machines run as applications on top of the
|
||||
host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
|
||||
virtualise **Unprivileged Domains**.
|
||||
|
||||
Use with the `qemu_xen` package.
|
||||
''
|
||||
+ "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${branch}-testing/misc/efi.html), available on the `boot` output of this package."
|
||||
+ optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy-${upstreamVersion}` file is available on the `boot` output of this package."
|
||||
+ optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
|
||||
+ optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
|
||||
+ optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains.";
|
||||
|
||||
homepage = "https://xenproject.org/";
|
||||
downloadPage = "https://downloads.xenproject.org/release/xen/${version}/";
|
||||
changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${branch}_Release_Notes";
|
||||
|
||||
license = [
|
||||
# Documentation.
|
||||
cc-by-40
|
||||
# Most of Xen is licensed under the GPL v2.0.
|
||||
gpl2Only
|
||||
# Xen Libraries and the `xl` command-line utility.
|
||||
lgpl21Only
|
||||
# Development headers in $dev/include.
|
||||
mit
|
||||
];
|
||||
|
||||
teams = [ teams.xen ];
|
||||
knownVulnerabilities = optional (versionOlder version minSupportedVersion) "The Xen Project Hypervisor version ${version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html";
|
||||
|
||||
mainProgram = "xl";
|
||||
|
||||
platforms = [ isLinux ];
|
||||
badPlatforms = [ isAarch64 ];
|
||||
} // meta;
|
||||
})
|
||||
@@ -0,0 +1,35 @@
|
||||
From 7f802ceac03252ad5182ee8c69ebb01da24a307c Mon Sep 17 00:00:00 2001
|
||||
From: Fernando Rodrigues <alpha@sigmasquadron.net>
|
||||
Date: Fri, 4 Jul 2025 18:07:01 +0000
|
||||
Subject: [PATCH 1/2] xen/Makefile: patch .efi output directory
|
||||
|
||||
This is necessary so the build does not fail when Xen tries to install
|
||||
.efi files to $boot/efi/nixos and panics when the directory doesn't
|
||||
exist. It also has the benefit of installing the files in a location
|
||||
that is easier to access.
|
||||
|
||||
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
|
||||
|
||||
diff --git a/xen/Makefile b/xen/Makefile
|
||||
index 6bf0b0ea9e..907cd89f7e 100644
|
||||
--- a/xen/Makefile
|
||||
+++ b/xen/Makefile
|
||||
@@ -527,6 +527,6 @@ _install: $(TARGET)$(CONFIG_XEN_INSTALL_SUFFIX)
|
||||
$(if $(efi-strip-opt), \
|
||||
$(STRIP) $(efi-strip-opt) -p -o $(TARGET).efi.stripped $(TARGET).efi && \
|
||||
- $(INSTALL_DATA) $(TARGET).efi.stripped $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi ||) \
|
||||
- $(INSTALL_DATA) $(TARGET).efi $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
|
||||
+ $(INSTALL_DATA) $(TARGET).efi.stripped $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi ||) \
|
||||
+ $(INSTALL_DATA) $(TARGET).efi $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
|
||||
elif [ "$(D)" = "$(patsubst $(shell cd $(XEN_ROOT) && pwd)/%,%,$(D))" ]; then \
|
||||
echo 'EFI installation only partially done (EFI_VENDOR not set)' >&2; \
|
||||
@@ -560,5 +560,5 @@ _uninstall:
|
||||
rm -f $(D)$(EFI_DIR)/$(T).efi
|
||||
if [ -n '$(EFI_MOUNTPOINT)' -a -n '$(EFI_VENDOR)' ]; then \
|
||||
- rm -f $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
|
||||
+ rm -f $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
|
||||
fi
|
||||
|
||||
--
|
||||
2.49.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,13 +1,191 @@
|
||||
{
|
||||
buildXenPackage,
|
||||
python3Packages,
|
||||
lib,
|
||||
stdenv,
|
||||
testers,
|
||||
fetchgit,
|
||||
fetchpatch,
|
||||
replaceVars,
|
||||
|
||||
# Xen
|
||||
acpica-tools,
|
||||
autoPatchelfHook,
|
||||
binutils-unwrapped-all-targets,
|
||||
bison,
|
||||
bzip2,
|
||||
cmake,
|
||||
dev86,
|
||||
e2fsprogs,
|
||||
flex,
|
||||
libnl,
|
||||
libuuid,
|
||||
lzo,
|
||||
ncurses,
|
||||
ocamlPackages,
|
||||
perl,
|
||||
pkg-config,
|
||||
python3Packages,
|
||||
systemd,
|
||||
xz,
|
||||
yajl,
|
||||
zlib,
|
||||
zstd,
|
||||
|
||||
# Optional Components
|
||||
withFlask ? false,
|
||||
checkpolicy,
|
||||
withIPXE ? true,
|
||||
ipxe,
|
||||
withOVMF ? true,
|
||||
OVMF,
|
||||
withSeaBIOS ? true,
|
||||
seabios-qemu,
|
||||
|
||||
# Documentation
|
||||
pandoc,
|
||||
|
||||
# Scripts
|
||||
bridge-utils,
|
||||
coreutils,
|
||||
diffutils,
|
||||
drbd,
|
||||
gawk,
|
||||
gnugrep,
|
||||
gnused,
|
||||
inetutils,
|
||||
iproute2,
|
||||
iptables,
|
||||
kmod,
|
||||
multipath-tools,
|
||||
nbd,
|
||||
openiscsi,
|
||||
openvswitch,
|
||||
psmisc,
|
||||
util-linux,
|
||||
which,
|
||||
}:
|
||||
|
||||
buildXenPackage.override { inherit python3Packages; } {
|
||||
let
|
||||
inherit (lib)
|
||||
enableFeature
|
||||
genAttrs
|
||||
getExe
|
||||
getExe'
|
||||
licenses
|
||||
optionalString
|
||||
optionals
|
||||
systems
|
||||
teams
|
||||
versionOlder
|
||||
versions
|
||||
warn
|
||||
;
|
||||
inherit (systems.inspect.patterns) isLinux isAarch64;
|
||||
inherit (licenses)
|
||||
cc-by-40
|
||||
gpl2Only
|
||||
lgpl21Only
|
||||
mit
|
||||
;
|
||||
|
||||
# Mark versions older than minSupportedVersion as EOL.
|
||||
minSupportedVersion = "4.17";
|
||||
|
||||
scriptDeps =
|
||||
let
|
||||
mkTools = pkg: tools: genAttrs tools (tool: getExe' pkg tool);
|
||||
in
|
||||
(genAttrs [
|
||||
"CONFIG_DIR"
|
||||
"CONFIG_LEAF_DIR"
|
||||
"LIBEXEC_BIN"
|
||||
"XEN_LOG_DIR"
|
||||
"XEN_RUN_DIR"
|
||||
"XEN_SCRIPT_DIR"
|
||||
"qemu_xen_systemd"
|
||||
"sbindir"
|
||||
] (_: null))
|
||||
// (mkTools coreutils [
|
||||
"basename"
|
||||
"cat"
|
||||
"cp"
|
||||
"cut"
|
||||
"dirname"
|
||||
"head"
|
||||
"ls"
|
||||
"mkdir"
|
||||
"mktemp"
|
||||
"readlink"
|
||||
"rm"
|
||||
"seq"
|
||||
"sleep"
|
||||
"stat"
|
||||
])
|
||||
// (mkTools drbd [
|
||||
"drbdadm"
|
||||
"drbdsetup"
|
||||
])
|
||||
// (mkTools gnugrep [
|
||||
"egrep"
|
||||
"grep"
|
||||
])
|
||||
// (mkTools iproute2 [
|
||||
"bridge"
|
||||
"ip"
|
||||
"tc"
|
||||
])
|
||||
// (mkTools iptables [
|
||||
"arptables"
|
||||
"ip6tables"
|
||||
"iptables"
|
||||
])
|
||||
// (mkTools kmod [
|
||||
"modinfo"
|
||||
"modprobe"
|
||||
"rmmod"
|
||||
])
|
||||
// (mkTools libnl [
|
||||
"nl-qdisc-add"
|
||||
"nl-qdisc-delete"
|
||||
"nl-qdisc-list"
|
||||
])
|
||||
// (mkTools util-linux [
|
||||
"flock"
|
||||
"logger"
|
||||
"losetup"
|
||||
"prlimit"
|
||||
])
|
||||
// {
|
||||
awk = getExe' gawk "awk";
|
||||
brctl = getExe bridge-utils;
|
||||
diff = getExe' diffutils "diff";
|
||||
ifconfig = getExe' inetutils "ifconfig";
|
||||
iscsiadm = getExe' openiscsi "iscsiadm";
|
||||
killall = getExe' psmisc "killall";
|
||||
multipath = getExe' multipath-tools "multipath";
|
||||
nbd-client = getExe' nbd "nbd-client";
|
||||
ovs-vsctl = getExe' openvswitch "ovs-vsctl";
|
||||
sed = getExe gnused;
|
||||
systemd-notify = getExe' systemd "systemd-notify";
|
||||
which = getExe which;
|
||||
};
|
||||
in
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "xen";
|
||||
version = "4.20.0";
|
||||
|
||||
# This attribute can be overriden to correct the file paths in
|
||||
# `passthru` when building an unstable Xen.
|
||||
upstreamVersion = finalAttrs.version;
|
||||
# Useful for further identifying downstream Xen variants. (i.e. Qubes)
|
||||
vendor = "nixos";
|
||||
|
||||
patches = [
|
||||
./0001-makefile-efi-output-directory.patch
|
||||
|
||||
(replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)
|
||||
|
||||
# XSA #469
|
||||
(fetchpatch {
|
||||
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.20-01.patch";
|
||||
hash = "sha256-go743oBhYDuxsK0Xc6nK/WxutQQwc2ERtLKhCU9Dnng=";
|
||||
@@ -36,11 +214,228 @@ buildXenPackage.override { inherit python3Packages; } {
|
||||
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.20-07.patch";
|
||||
hash = "sha256-+BsCJa01R2lrbu7tEluGrYSAqu2jJcrpFNUoLMY466c=";
|
||||
})
|
||||
|
||||
# XSA #470
|
||||
(fetchpatch {
|
||||
url = "https://xenbits.xenproject.org/xsa/xsa470.patch";
|
||||
hash = "sha256-zhMZ6pCZtt0ocgsMFVqthMaof46lMMTaYmlepMXVJqM=";
|
||||
})
|
||||
];
|
||||
rev = "3ad5d648cda5add395f49fc3704b2552aae734f7";
|
||||
hash = "sha256-v2DRJv+1bym8zAgU74lo1HQ/9rUcyK3qc4Eec4RpcEY=";
|
||||
}
|
||||
|
||||
outputs = [
|
||||
"out"
|
||||
"man"
|
||||
"doc"
|
||||
"dev"
|
||||
"boot"
|
||||
];
|
||||
|
||||
src = fetchgit {
|
||||
url = "https://xenbits.xenproject.org/git-http/xen.git";
|
||||
rev = "3ad5d648cda5add395f49fc3704b2552aae734f7";
|
||||
hash = "sha256-v2DRJv+1bym8zAgU74lo1HQ/9rUcyK3qc4Eec4RpcEY=";
|
||||
};
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
nativeBuildInputs =
|
||||
[
|
||||
acpica-tools
|
||||
autoPatchelfHook
|
||||
bison
|
||||
cmake
|
||||
dev86
|
||||
flex
|
||||
pandoc
|
||||
perl
|
||||
pkg-config
|
||||
|
||||
# oxenstored
|
||||
ocamlPackages.findlib
|
||||
ocamlPackages.ocaml
|
||||
]
|
||||
++ (with python3Packages; [
|
||||
python
|
||||
setuptools
|
||||
wrapPython
|
||||
]);
|
||||
|
||||
buildInputs =
|
||||
[
|
||||
bzip2
|
||||
e2fsprogs.dev
|
||||
libnl
|
||||
libuuid
|
||||
lzo
|
||||
ncurses
|
||||
xz
|
||||
yajl
|
||||
zlib
|
||||
zstd
|
||||
]
|
||||
++ optionals withFlask [ checkpolicy ]
|
||||
++ optionals (versionOlder finalAttrs.version "4.19") [ systemd ];
|
||||
|
||||
configureFlags = [
|
||||
"--enable-systemd"
|
||||
"--disable-qemu-traditional"
|
||||
"--with-system-qemu"
|
||||
(if withSeaBIOS then "--with-system-seabios=${seabios-qemu.firmware}" else "--disable-seabios")
|
||||
(if withOVMF then "--with-system-ovmf=${OVMF.mergedFirmware}" else "--disable-ovmf")
|
||||
(if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
|
||||
(enableFeature withFlask "xsmpolicy")
|
||||
];
|
||||
|
||||
makeFlags =
|
||||
[
|
||||
"SUBSYSTEMS=${toString finalAttrs.buildFlags}"
|
||||
|
||||
"PREFIX=$(out)"
|
||||
"BASH_COMPLETION_DIR=$(PREFIX)/share/bash-completion/completions"
|
||||
|
||||
"XEN_WHOAMI=${finalAttrs.pname}"
|
||||
"XEN_DOMAIN=${finalAttrs.vendor}"
|
||||
|
||||
"GIT=${getExe' coreutils "false"}"
|
||||
"WGET=${getExe' coreutils "false"}"
|
||||
"EFI_VENDOR=${finalAttrs.vendor}"
|
||||
"INSTALL_EFI_STRIP=1"
|
||||
"LD=${getExe' binutils-unwrapped-all-targets "ld"}"
|
||||
]
|
||||
# These flags set the CONFIG_* options in /boot/xen.config
|
||||
# and define if the default policy file is built. However,
|
||||
# the Flask binaries always get compiled by default.
|
||||
++ optionals withFlask [
|
||||
"XSM_ENABLE=y"
|
||||
"FLASK_ENABLE=y"
|
||||
];
|
||||
|
||||
buildFlags = [
|
||||
"xen"
|
||||
"tools"
|
||||
"docs"
|
||||
];
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
env.NIX_CFLAGS_COMPILE = toString [
|
||||
"-Wno-error=maybe-uninitialized"
|
||||
"-Wno-error=array-bounds"
|
||||
];
|
||||
|
||||
dontUseCmakeConfigure = true;
|
||||
|
||||
# Remove in-tree QEMU sources, we don't need them in any circumstance.
|
||||
prePatch = "rm -rf tools/qemu-xen tools/qemu-xen-traditional";
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out $out/share $boot
|
||||
cp -prvd dist/install/nix/store/*/* $out/
|
||||
cp -prvd dist/install/etc $out
|
||||
cp -prvd dist/install/boot $boot
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
postInstall =
|
||||
# Wrap xencov_split, xenmon and xentrace_format.
|
||||
# We also need to wrap pygrub, which lies in $out/libexec/xen/bin.
|
||||
''
|
||||
wrapPythonPrograms
|
||||
wrapPythonProgramsIn "$out/libexec/xen/bin" "$out $pythonPath"
|
||||
'';
|
||||
|
||||
postFixup =
|
||||
''
|
||||
addAutoPatchelfSearchPath $out/lib
|
||||
autoPatchelf $out/libexec/xen/bin
|
||||
''
|
||||
# Flask is particularly hard to disable. Even after
|
||||
# setting the make flags to `n`, it still gets compiled.
|
||||
# If withFlask is disabled, delete the extra binaries.
|
||||
+ optionalString (!withFlask) ''
|
||||
rm -f $out/bin/flask-*
|
||||
'';
|
||||
|
||||
passthru = {
|
||||
efi = "boot/xen-${finalAttrs.upstreamVersion}.efi";
|
||||
flaskPolicy =
|
||||
if withFlask then
|
||||
warn "This Xen was compiled with FLASK support, but the FLASK file may not match the Xen version number. Please hardcode the path to the FLASK file instead." "boot/xenpolicy-${finalAttrs.upstreamVersion}"
|
||||
else
|
||||
throw "This Xen was compiled without FLASK support.";
|
||||
# This test suite is very simple, as Xen's userspace
|
||||
# utilities require the hypervisor to be booted.
|
||||
tests = {
|
||||
pkg-config = testers.hasPkgConfigModules {
|
||||
package = finalAttrs.finalPackage;
|
||||
moduleNames = [
|
||||
"xencall"
|
||||
"xencontrol"
|
||||
"xendevicemodel"
|
||||
"xenevtchn"
|
||||
"xenforeignmemory"
|
||||
"xengnttab"
|
||||
"xenguest"
|
||||
"xenhypfs"
|
||||
"xenlight"
|
||||
"xenstat"
|
||||
"xenstore"
|
||||
"xentoolcore"
|
||||
"xentoollog"
|
||||
"xenvchan"
|
||||
"xlutil"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta = {
|
||||
branch = versions.majorMinor finalAttrs.version;
|
||||
|
||||
description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
|
||||
longDescription =
|
||||
''
|
||||
The Xen Project Hypervisor is a virtualisation technology defined as a *type-1
|
||||
hypervisor*, which allows multiple virtual machines, known as domains, to run
|
||||
concurrently with the host on the physical machine. On a typical *type-2
|
||||
hypervisor*, the virtual machines run as applications on top of the
|
||||
host. NixOS runs as the privileged **Domain 0**, and can paravirtualise or fully
|
||||
virtualise **Unprivileged Domains**.
|
||||
|
||||
Use with the `qemu_xen` package.
|
||||
''
|
||||
+ "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${finalAttrs.meta.branch}-testing/misc/efi.html), available on the `boot` output of this package."
|
||||
+ optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy` file is available on the `boot` output of this package."
|
||||
+ optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
|
||||
+ optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."
|
||||
+ optionalString withIPXE "\n* `ipxe`: Support for the iPXE boot firmware on HVM domains.";
|
||||
|
||||
homepage = "https://xenproject.org/";
|
||||
downloadPage = "https://downloads.xenproject.org/release/xen/${finalAttrs.version}/";
|
||||
changelog = "https://wiki.xenproject.org/wiki/Xen_Project_${finalAttrs.meta.branch}_Release_Notes";
|
||||
|
||||
license = [
|
||||
# Documentation.
|
||||
cc-by-40
|
||||
# Most of Xen is licensed under the GPL v2.0.
|
||||
gpl2Only
|
||||
# Xen Libraries and the `xl` command-line utility.
|
||||
lgpl21Only
|
||||
# Development headers in $dev/include.
|
||||
mit
|
||||
];
|
||||
|
||||
teams = [ teams.xen ];
|
||||
knownVulnerabilities = optionals (versionOlder finalAttrs.version minSupportedVersion) [
|
||||
"The Xen Project Hypervisor version ${finalAttrs.version} is no longer supported by the Xen Project Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html"
|
||||
];
|
||||
|
||||
mainProgram = "xl";
|
||||
|
||||
platforms = [ isLinux ];
|
||||
badPlatforms = [ isAarch64 ];
|
||||
};
|
||||
})
|
||||
|
||||
@@ -373,6 +373,7 @@ mapAliases {
|
||||
buildBarebox = throw "buildBarebox has been removed due to lack of interest in maintaining it in nixpkgs"; # Added 2025-04-19
|
||||
buildGo122Module = throw "Go 1.22 is end-of-life, and 'buildGo122Module' has been removed. Please use a newer builder version."; # Added 2025-03-28
|
||||
buildGoPackage = throw "`buildGoPackage` has been deprecated and removed, see the Go section in the nixpkgs manual for details"; # Added 2024-11-18
|
||||
buildXenPackage = throw "'buildXenPackage' has been removed as a custom Xen build can now be achieved by simply overriding 'xen'."; # Added 2025-05-12
|
||||
|
||||
inherit (libsForQt5.mauiPackages) buho; # added 2022-05-17
|
||||
bwidget = tclPackages.bwidget; # Added 2024-10-02
|
||||
|
||||
@@ -14367,8 +14367,6 @@ with pkgs;
|
||||
;
|
||||
};
|
||||
|
||||
buildXenPackage = callPackage ../build-support/xen { };
|
||||
|
||||
gxneur = callPackage ../applications/misc/gxneur {
|
||||
inherit (gnome2) libglade GConf;
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user