xen: 4.20.4 -> 4.22.0 (#471250)

doc/release-notes/rl-2611.section.md

@@ -117,6 +117,8 @@
 
 - `gh-actions-cache` has been removed since its functionality has been integrated directly into `gh` (`gh cache`). See [upstream readme](https://github.com/actions/gh-actions-cache).
 
+- The OCaml-based Xen Store Daemon has been split off the `xen` package, and is now present in the `ocamlPackages.oxenstored` package.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `texlive.combine` is deprecated and scheduled for removal in 27.05. Please migrate to `texliveSmall.withPackages` (see [](#sec-language-texlive-user-guide)).

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -197,6 +197,8 @@
 - `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
   notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
 
+- The Xen Project Hypervisor has been [updated to version 4.22](https://wiki.xenproject.org/wiki/Xen_Project_4.22_Release_Notes), after [version 4.21](https://wiki.xenproject.org/wiki/Xen_Project_4.21_Release_Notes) was skipped in 26.05. The module now has a separate option to customise the OCaml-based Xen Store Daemon package, `virtualisation.xen.store.package`.
+
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
 - NixOS VM tests now prefer to express durations and timeouts as `datetime.timedelta` values instead of bare numbers. Methods such as `machine.wait_until_succeeds`, `machine.sleep`, `retry`, and `polling_condition` now accept a `timedelta` (e.g., `machine.wait_for_unit("sshd.service", timeout=datetime.timedelta(minutes=1))`). Passing an `int`/`float` as seconds still works but now emits a deprecation warning. Argument names that explicitly defined units were preserved but have had `timedelta` equivalents introduced (`timeout_seconds` → `timeout`, `secs` → `duration`, `seconds_interval` → `interval`).

nixos/modules/virtualisation/xen-dom0.nix

@@ -353,8 +353,8 @@ in
     store = {
       path = mkOption {
         type = path;
-        default = "${cfg.package}/bin/oxenstored";
-        defaultText = literalExpression "\${config.virtualisation.xen.package}/bin/oxenstored";
+        default = "${cfg.store.package}/bin/oxenstored";
+        defaultText = literalExpression "\${config.virtualisation.xen.store.package}/bin/oxenstored";
         example = literalExpression "\${config.virtualisation.xen.package}/bin/xenstored";
         description = ''
           Path to the Xen Store Daemon. This option is useful to
@@ -372,6 +372,12 @@ in
         readOnly = true;
         description = "Helper internal option that determines the type of the Xen Store Daemon based on cfg.store.path.";
       };
+      package = mkPackageOption pkgs [ "ocamlPackages" "oxenstored" ] {
+        extraDescription = ''
+          This is only used if the Xen Store Daemon being used is the newer OCaml-based store.
+          The legacy C-based store is always included.
+        '';
+      };
       settings = mkOption {
         default = { };
         example = {
@@ -794,7 +800,8 @@ in
       systemPackages = [
         cfg.package
         (hiPrio cfg.qemu.package)
-      ];
+      ]
+      ++ optional (cfg.store.type == "ocaml") (hiPrio cfg.store.package);
       etc =
         # Set up Xen Domain 0 configuration files.
         {

pkgs/by-name/xe/xen/0001-makefile-efi-output-directory.patch

@@ -1,20 +1,9 @@
-From 7f802ceac03252ad5182ee8c69ebb01da24a307c Mon Sep 17 00:00:00 2001
-From: Fernando Rodrigues <alpha@sigmasquadron.net>
-Date: Fri, 4 Jul 2025 18:07:01 +0000
-Subject: [PATCH 1/2] xen/Makefile: patch .efi output directory
-
-This is necessary so the build does not fail when Xen tries to install
-.efi files to $boot/efi/nixos and panics when the directory doesn't
-exist. It also has the benefit of installing the files in a location
-that is easier to access.
-
-Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
-
 diff --git a/xen/Makefile b/xen/Makefile
-index 6bf0b0ea9e..907cd89f7e 100644
+index 725f220ee6..b73a623b23 100644
 --- a/xen/Makefile
 +++ b/xen/Makefile
-@@ -527,6 +527,6 @@ _install: $(TARGET)$(CONFIG_XEN_INSTALL_SUFFIX)
+@@ -537,8 +537,8 @@
+ 		if [ -n '$(EFI_MOUNTPOINT)' -a -n '$(EFI_VENDOR)' ]; then \
  			$(if $(efi-strip-opt), \
  			     $(STRIP) $(efi-strip-opt) -p -o $(TARGET).efi.stripped $(TARGET).efi && \
 -			     $(INSTALL_DATA) $(TARGET).efi.stripped $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi ||) \
@@ -23,13 +12,13 @@ index 6bf0b0ea9e..907cd89f7e 100644
 +			$(INSTALL_DATA) $(TARGET).efi $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
  		elif [ "$(D)" = "$(patsubst $(shell cd $(XEN_ROOT) && pwd)/%,%,$(D))" ]; then \
  			echo 'EFI installation only partially done (EFI_VENDOR not set)' >&2; \
-@@ -560,5 +560,5 @@ _uninstall:
+ 		fi; \
+@@ -570,7 +570,7 @@
+ 	rm -f $(D)$(EFI_DIR)/$(T)-$(XEN_VERSION).efi
  	rm -f $(D)$(EFI_DIR)/$(T).efi
  	if [ -n '$(EFI_MOUNTPOINT)' -a -n '$(EFI_VENDOR)' ]; then \
 -		rm -f $(D)$(EFI_MOUNTPOINT)/efi/$(EFI_VENDOR)/$(T)-$(XEN_FULLVERSION).efi; \
 +		rm -f $(D)$(BOOT_DIR)/$(T)-$(XEN_FULLVERSION).efi; \
  	fi
-
---
-2.49.0
-
+ 
+ .PHONY: _debug

pkgs/by-name/xe/xen/package.nix

@@ -16,6 +16,7 @@
   dev86,
   e2fsprogs,
   flex,
+  json_c,
   libnl,
   libuuid,
   lzo,
@@ -71,23 +72,38 @@ let
     genAttrs
     getExe
     getExe'
-    licenses
     optionalString
     optionals
-    systems
     teams
+    versionAtLeast
     versionOlder
-    versions
     warn
+    withFeature
+    withFeatureAs
     ;
-  inherit (systems.inspect.patterns) isLinux isAarch64;
-  inherit (licenses)
+  inherit (lib.systems.inspect.patterns) isLinux isAarch64;
+  inherit (lib.versions) majorMinor;
+  inherit (lib.licenses)
     cc-by-40
     gpl2Only
     lgpl21Only
     mit
     ;
 
+  # Xen has a ternary system for enabling and disabling optional firmwares.
+  # - If we want a built-in firmware, then the correct flag to use is
+  #   '--enable-X', or (withXenFeature true "X" null).
+  # - If we want Xen to use a system firmware, then the correct to use is
+  #   '--with-system-X=/path/to/firmware', or (withXenFeature true "X" drv).
+  # - If we do not want Xen to use any firmware, then the correct flag to use is
+  #   '--disable-X', or (withXenFeature false "X" null).
+  withXenFeature =
+    bool: key: value:
+    if (bool && !isNull value) then
+      (withFeatureAs bool "system-${key}" value)
+    else
+      (enableFeature bool key);
+
   # Mark versions older than minSupportedVersion as EOL.
   minSupportedVersion = "4.17";
 
@@ -173,7 +189,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xen";
-  version = "4.20.4";
+  version = "4.22.0";
 
   # This attribute can be overridden to correct the file paths in
   # `passthru` when building an unstable Xen.
@@ -200,13 +216,14 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
     "dev"
     "boot"
+    "ocaml"
   ];
 
   src = fetchFromGitHub {
     owner = "xen-project";
     repo = "xen";
     tag = "RELEASE-${finalAttrs.version}";
-    hash = "sha256-dO9Y7W6NIVbXwWdlnQawpmV6MtemczwgbZdi9gGu190=";
+    hash = "sha256-airf4+QjornWQ9aH+cCpKzgVoLbsNduurXySDAv8clY=";
   };
 
   strictDeps = true;
@@ -221,11 +238,12 @@ stdenv.mkDerivation (finalAttrs: {
     pandoc
     perl
     pkg-config
-
-    # oxenstored
-    ocamlPackages.findlib
-    ocamlPackages.ocaml
   ]
+  ++ (with ocamlPackages; [
+    findlib
+    ocaml
+    ocamlbuild
+  ])
   ++ (with python3Packages; [
     python
     setuptools
@@ -246,15 +264,16 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
   ]
   ++ optionals withFlask [ checkpolicy ]
-  ++ optionals (versionOlder finalAttrs.version "4.19") [ systemd ];
+  ++ optionals (versionOlder finalAttrs.version "4.19") [ systemd ]
+  ++ optionals (versionAtLeast finalAttrs.version "4.21") [ json_c ];
 
   configureFlags = [
-    "--enable-systemd"
-    "--disable-qemu-traditional"
-    "--with-system-qemu"
-    (if withSeaBIOS then "--with-system-seabios=${seabios-qemu.firmware}" else "--disable-seabios")
-    (if withOVMF then "--with-system-ovmf=${OVMF-xen.mergedFirmware}" else "--disable-ovmf")
-    (if withIPXE then "--with-system-ipxe=${ipxe.firmware}" else "--disable-ipxe")
+    (enableFeature true "systemd")
+    (withFeature true "system-qemu")
+    (withFeatureAs true "systemd-sleep" "$out/lib/systemd/system-sleep")
+    (withXenFeature withSeaBIOS "seabios" seabios-qemu.firmware)
+    (withXenFeature withOVMF "ovmf" OVMF-xen.mergedFirmware)
+    (withXenFeature withIPXE "ipxe" ipxe.firmware)
     (enableFeature withFlask "xsmpolicy")
   ];
 
@@ -289,26 +308,45 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=maybe-uninitialized"
-    "-Wno-error=array-bounds"
-  ];
-
   dontUseCmakeConfigure = true;
 
-  # Remove in-tree QEMU sources, we don't need them in any circumstance.
-  prePatch = "rm -rf tools/qemu-xen tools/qemu-xen-traditional";
-
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out $out/share $boot
     cp -prvd dist/install/nix/store/*/* $out/
     cp -prvd dist/install/etc $out
-    # Decompresses the multiboot binary so it's present for bootloaders such as Limine
-    # The find command is used instead of a simple file glob so we skip processing symlinks
+  ''
+  # Decompresses the multiboot binary so it's present for bootloaders such as Limine
+  # The find command is used instead of a simple file glob so we skip processing symlinks
+  + ''
     find dist/install/boot -type f -name '*.gz' -print -exec gunzip -k '{}' ';'
     cp -prvd dist/install/boot $boot
+  ''
+  # Copy the xsd_glue OCaml plugin interface to the ocaml output.
+  # This allows other derivations (namely oxenstored) to depend on the
+  # canonical plugin interface without pulling in the entire xen package,
+  # and avoiding issues that arise when the plugin interface is built twice,
+  # once in this package, and again in the oxenstored package, leading to
+  # a mismatch in hash between the two interfaces and the plugin not being
+  # able to load in oxenstored.
+  + ''
+    mkdir -p $ocaml/lib/ocaml
+    if [ -d $out/lib/ocaml/*/site-lib/xsd_glue ]; then
+      ocamlVersion=$(ls $out/lib/ocaml/)
+      mkdir -p $ocaml/lib/ocaml/$ocamlVersion/site-lib
+      cp -prvd $out/lib/ocaml/$ocamlVersion/site-lib/xsd_glue $ocaml/lib/ocaml/$ocamlVersion/site-lib/
+    fi
+  ''
+  # Also provide the canonical plugin_interface_v1 source files so
+  # downstream packages can build ABI-compatible OCaml modules against
+  # the versions built in the xen derivation. The dependency on the Xen
+  # package in this way also keeps the plugin, interface, oxenstored
+  # and xen packages coupled.
+  + ''
+    mkdir -p $ocaml/share/xen/ocaml/xsd_glue
+    cp -v tools/ocaml/libs/xsd_glue/plugin_interface_v1.ml $ocaml/share/xen/ocaml/xsd_glue/
+    cp -v tools/ocaml/libs/xsd_glue/plugin_interface_v1.mli $ocaml/share/xen/ocaml/xsd_glue/
 
     runHook postInstall
   '';
@@ -355,6 +393,7 @@ stdenv.mkDerivation (finalAttrs: {
           "xenguest"
           "xenhypfs"
           "xenlight"
+          "xenmanage"
           "xenstat"
           "xenstore"
           "xentoolcore"
@@ -367,7 +406,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    branch = versions.majorMinor finalAttrs.version;
+    branch = majorMinor finalAttrs.version;
 
     description = "Type-1 hypervisor intended for embedded and hyperscale use cases";
     longDescription = ''

pkgs/development/ocaml-modules/oxenstored/default.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  replaceVars,
+  dune-site,
+  fmt,
+  xen,
+  alcotest,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "oxenstored";
+  version = "25.3.0";
+
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "xapi-project";
+    repo = "oxenstored";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+JXgVO6m63sPzVTwpq/ztDBx/x/g5vtU1Xbcd+t5ons=";
+  };
+
+  patches = [ (replaceVars ./xen-paths.patch { inherit xen; }) ];
+
+  buildInputs = [
+    dune-site
+    fmt
+    xen
+  ];
+
+  checkInputs = [
+    alcotest
+  ];
+
+  # The xen package builds both plugin_interface_v1 (the xsd_glue library)
+  # and domain_getinfo_v1.cmxs (the plugin) together, ensuring they share
+  # the same .cmi hashes. If we don't use the xen package's interface
+  # and plugin, oxenstored will refuse to dynamically load it, given
+  # the different interface hashes and build environments (make vs dune,
+  # lead to different file hashes), the dynamic load refuses to load the
+  # library from the xen package altogether.
+  # This removes oxenstored's local copy of xsd_glue and instead uses
+  # xen's pre-compiled version found via OCAMLPATH to make sure everything
+  # is consistent and xenstored is built with the same plugin & interface
+  # as the xen package, allowing the plugin to load and interface with
+  # the xen package's libraries.
+  postPatch = ''
+    rm -rf xsd_glue
+  '';
+
+  doCheck = true;
+
+  meta = {
+    description = "OCaml implementation of Xenstore";
+    longDescription = ''
+      Formerly developed in the monolithic Xen repository, `oxenstored` was
+      forked during the development cycle of Xen 4.20 and is now built separately.
+
+      Uses the `xsd_glue` plugin interface from the `xen` package to ensure ABI
+      compatibility with Xen's `domain_getinfo_v1` plugin.
+    '';
+    license = lib.licenses.lgpl21Only;
+    teams = [ lib.teams.xen ];
+    homepage = "https://github.com/xapi-project/oxenstored";
+  };
+})

pkgs/development/ocaml-modules/oxenstored/xen-paths.patch

@@ -0,0 +1,16 @@
+diff --git a/oxenstored/configure.ml b/oxenstored/configure.ml
+index 0b56e90..18069a6 100644
+--- a/oxenstored/configure.ml
++++ b/oxenstored/configure.ml
+@@ -4,9 +4,9 @@
+
+ let xen_log_dir = ref "/var/log/xen/"
+
+-let xen_config_dir = ref "/etc/xen"
++let xen_config_dir = ref "@xen@/etc/xen"
+
+-let libexec = ref "/usr/local/lib/xen"
++let libexec = ref "@xen@/libexec/xen"
+
+ let args =
+   [

pkgs/top-level/ocaml-packages.nix

@@ -1702,6 +1702,8 @@ let
 
         owl-base = callPackage ../development/ocaml-modules/owl-base { };
 
+        oxenstored = callPackage ../development/ocaml-modules/oxenstored { };
+
         ### P ###
 
         pacomb = callPackage ../development/ocaml-modules/pacomb { };