Boot self-tests (also referred to as boot-time tests or power-on
self-tests) are intended to check that Xen has configured the hardware
correctly before bringing up any domains.
Introduce tests to confirm that, using a dedicated SGI (GIC_SGI_TEST):
1. A cpu can send the SGI to itself
2. A cpu can send the SGI to another specific CPU (CPU0)
3. A cpu can send the SGI to all the other CPUs
Each CPU counts the test SGIs it takes. A sender samples those counters
before sending and then waits for the count of every CPU it targeted to
change, which is how it tells that the SGI was really delivered. The
counters are never reset, so comparing against a sample rather than an
absolute value keeps concurrent senders from disturbing each other. The
snapshot is allocated rather than kept on the stack, as NR_CPUS can be
large enough for such an array to overflow it.
A test reports a failure by panic(), so Xen never continues on a
platform where SGI delivery is broken. When the tests pass, Xen carries
on booting normally.
Also introduce a config CONFIG_BOOT_SELFTEST which enables these
tests. It depends on DEBUG and is off unless explicitly enabled.
Also introduce a boolean command line parameter "gic-test", so that a
build with CONFIG_BOOT_SELFTEST enabled can be shipped but the tests
selected at boot. It is documented in
docs/misc/xen-command-line.pandoc.
In order to keep all the boot self-tests together in the binary, a
separate section "initcallboottest" is introduced. Tests are registered
using __initcallboottest() and run once on every CPU by
do_init_boottests(), bracketed by begin/end messages. They run before
any domain is created on the primary core, and before the idle loop is
entered on a secondary core.
Signed-off-by: Ayan Kumar Halder <ayan.kumar.halder@amd.com>
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Julien Grall <julien@xen.org>
This will prevent eclair jobs from been started automatically
everywhere but in the main push repo, but still have the option to
start a jobs manually.
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Some CI testing depends on SHADOW_PAGING. Explicitly enable it when needed.
This is CVE-2026-42493 / XSA-495.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Add new job-level EXTRA_XEN_OPTS variable, in addition to CONSOLE_OPTS.
FRED is not yet enabled by default on Intel systems, but is expected to
function. Explicitly turn it on for added test coverage in the short term.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
For now run similar set of tests as ADL.
Exclude suspend test for now. While firmware claims S3 is supported,
suspend attempt fails (power LED blinks for a few seconds, and
then system reboots). With no messages on the serial console, even with
`sync_console`.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
The configuration uses a mix of dashes and underscores, which is irritating to
develop for. Switch to using the underscore form consistently; it is the more
common form and it has the benefit that it allows splitting on dashes to work
sensibly.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Perform standard syntax cleanup and make it a non-root container. Switch yajl
for json-c given the deprecation of the former. Drop dev86 which is an
x86-only dependency, and QEMU dependencies as we don't build QEMU in this
environment any more.
When updating the job names, also rename some for consistency so the arm64
fragment comes before the compiler.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Perform standard syntax cleanup and make it a non-root container. Switch yajl
for json-c given the deprecation of the former.
Add an x86_64 suffix for naming consistency with everything else.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
This container is tied to gitlab-runner environment in the RPis driving the
test systems, not a specific version of Alpine. Intentionally give it a
generic name so it need not change in the future.
Switch to Alpine 3.24 right away, as it doesn't interact with the 3.18 builds
under test.
The container needs to remain a root container. By no longer using the
arm64v8 build container for dual-purpose, we can finally make the build
containers be non-root.
No practical change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
In order to avoid serialising the testing on both boards, the runner
configuration is being adjusted.
Have the .xilinx-arm64 and .xilinx-x86_64 templates choose the board directly
using a more specific tag.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Victor Lira <victorm.lira@amd.com>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
The container is tied to the runner, not a version of Ubuntu. Intentionally
give it a generic name so it need not change in the future.
Apply standard cleanup to the dockerfile, except that it must continue to be a
root container to drive real hardware. Explicitly install ca-certificates to
compensate for --no-install-recommends.
No practical change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Rename it to have an x86_64 suffix, updating the build job names and scheduled
rebuild task.
Apply standard cleanups. Trim the package list down to what is actually
needed. Archlinux's base-devel contains most libraries, but some of the
listed packages have never been dependenices for Xen, and a lot are QEMU
dependenices which aren't useful owing to the lack of the ninja package.
This shrinks the container from 533MB to 380MB.
No practical change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
The default version of python is 3.13, so drop the 3.11 overrides.
Swap yajl for json-c, given the deprecation of the former. Add lz4.
bin86/dev86 are no longer available.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Swap yajl for json-c, given the deprecation of the former. Add lz4.
Add 26.04 GCC/Clang debug/non-debug jobs. Drop the 24.04 debug jobs to keep
the overall job count down.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
This removes qemu-system-aarch64-6.0.0-*-export and fixes the outstanding
TODOs about efi-virtio.rom, now that the QEMU in use has it's /usr/share/
properly packaged.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Exactly as per the Bookworm container, but additionally with the ipxe-qemu and
qemu-system-aarch64 packages. These will be used to remove the export jobs.
Switch qemu-arm{32,64} test jobs to use this container, and add two new build
tests.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Rework the container to user heredocs for readability, derive from
bookworm-slim and use apt-get --no-install-recommends to keep the size down.
Additionally:
* Make it a non-root container.
* Drop libext2fs-dev which is an x86-only dependency.
* Add libncurses5-dev for xentop and zlib1g-dev which was missing from the
libxenguest decompressors.
* As there's no ninja, the container can no loger build QEMU so drop
libglib2.0-dev and libpixman-1-dev too.
* Swap libyajl-dev for libjson-c-dev given the deprecation of the former.
Rename the job to debian-12-arm64-* to follow the naming scheme of all the
other CI jobs.
This reduces the size of the debian:12-arm64v8 from 2.25GB down to 1.62GB.
Signed-off-by: Javi Merino <javi.merino@cloud.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Rework the container to user heredocs for readability, derive from
bookworm-slim and use apt-get --no-install-recommends to keep the size down.
Convert it to being a non-root container. Add checkpolicy as FLASK is an
available build option for arm32 under Randconfig testing.
Rename the CI jobs to debian-12-arm32-* to follow the naming scheme of all the
other CI jobs.
No functional change.
Signed-off-by: Javi Merino <javi.merino@cloud.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
The binaries/ directory is a composition from the artefacts, and also used as
a working directory for most of the tests. If the very first artefact is from
a root container, then the test must also be a root container to use it as a
working directory.
For arm64, the existing linux-arm64 artefact suffices. For arm32, pull in the
microcode-x86 artefact as it's the smallest available. This bodge can be
removed when all build containers have become non-root.
For the qemu-xtf-dom0less-arm64-*-xen-version jobs, use *arm64-test-needs
ahead of alpine-3.18-gcc-* (as it's a root container), and to deduplicate
the *-export dependency.
This will allow us to change containers to being non-root one at a time,
rather than all in one go.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Build issues may also surface for analysis jobs. Collect intermediate
files (if any) there as well. Include xen/.config too, since it's not
otherwise collected.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
When one of the linking passes fails, additional intermediate files are
still in place. Having them available for analysis of the underlying
problem can be pretty helpful. Collect some into a new intermediates/
directory. (Nothing new will be collected if linking succeeds.)
As the script is run with -e passed to bash, defer exit if the main
"make" (or substituent script thereof) failed. This way more artifacts
are collected, potentially making it easier to analyze the failure.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Rework the container to derive from bookworm-slim, and to build and run
cppcheck as a normal user. User heredocs for readability and use apt-get
--no-install-recommends to keep the size down.
Changed the libpcre3-dev dependency to libpcre3, as the -dev package
is only needed for building, not for running.
Signed-off-by: Javi Merino <javi.merino@cloud.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
With the imminent decommission of CirrusCI we will lose the limited macOS
build testing done there. Introduce two Gitlab macOS build jobs that
reproduce the ones present on CirrusCI.
According to the "Community programs" Gitlab documentation [0] we get
50,000 compute minutes per month. The arm64 job takes ~1m 15s, and the
x86_64 one ~2m. I think it's likely enough given the amount of minutes we
have available. We might need to reconsider if we add more tasks that
consume compute minutes.
[0] https://docs.gitlab.com/subscriptions/community_programs/#gitlab-for-open-source
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
When the variable is set, only build jobs that are used in tests are
scheduled. This saves a lot of time, for example when scheduling a test
pipeline with alternative linux branch.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Allow choosing which artifacts branch and job to use for Linux. This
allows running the same tests for different Linux versions, without
duplicating a lot of yaml sections.
Similarly, make the repo path itself configurable too. The main purpose
is to ensure the test pipeline triggered from any repo will fetch linux
artifact from the right repo. But with a minor change of using that
variable for rootfs and microcode artifacts too, it allows testing
test-artifacts repo changes without needing to modify gitlab-ci.yml in
xen.git at all.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Extend the job by enabling static memory, static shared memory and early
printk features. Given no more regressions for clean rules, mark as
gating.
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
On x86, this is basically everything.
For ARM, CONFIG_MPU and CONFIG_MMU are mutually exclusive (with
CONFIG_STATIC_MEMORY in the mix), as well as CONFIG_NEW_VGIC being mutually
exclusive with the other VGIC infrastructure.
No functional change, but a lot of new Eclair reports (non-blocking).
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Bertrand Marquis <bertrand.marquis@arm.com>
We'd rather have the full spelling in Kconfig. Adjusts every other
reference to the name too.
Not a functional change.
Signed-off-by: Alejandro Vallejo <alejandro.garciavallejo@amd.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
In an attempt to debug/workaround occasional console freeze, switch it
to polling mode. If that helps, it will narrow down the search.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
`docker:stable` tag hasn't been updated in 5 years, and has been
deprecated, according to https://hub.docker.com/_/docker, while
`docker:dind` (image use for the service) is using a recent version of
docker.
Now, `docker info` fails with:
Error response from daemon: client version 1.40 is too old. ...
Switch to a newer tag, and just the "cli" version which contains only
the docker client. With that, both `:dind` and `:cli` should keep
using the same version of version. (`:cli` seems to be the base image
used to build `:dind`.)
Signed-off-by: Anthony PERARD <anthony.perard@vates.tech>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
The selected jobs regex was assumed to be possibly empty in some places
and setting a default value for the regex caused the hardware jobs to
bypass some rules checks.
To fix this, adjust the rules to remove the check for empty and
instead just match the regex.
Fixes: 485ab1b5db
Signed-off-by: Victor Lira <victorm.lira@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
The original yocto config had a hidden default of allow_failure: true for the
manual job while the hidden default for rules is false. This causes the
stages with manual jobs to show as blocked.
Set it explicitly to true to avoid the analyze and build stages being shown as
blocked.
Fixes: 485ab1b5db
Signed-off-by: Victor Lira <victorm.lira@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Filtering jobs using the selected jobs regex is missing for
qemu-export + yocto jobs when running regular pipelines and eclair jobs
when running scheduled pipelines.
First, set a default value for the selected jobs regex to remove the
need to always check if the variable is empty.
Then add the missing rules to filter out those jobs.
Signed-off-by: Victor Lira <victorm.lira@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
It seems unintentional that this job references .eclair-analysis
instead of .eclair-analysis:triggered which does not apply the rules
from that template. One effect is that it runs always instead of
manually in my xen-project/people repo.
Signed-off-by: Victor Lira <victorm.lira@amd.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
All Eclair scanning is for safety purposes, and the *-safety jobs are AMD's
configuration specifically, and other configurations will likely be different.
Rename them to *-amd.
Give the un-suffixed job an *-allcode suffix to make it clearer that they're
looking at all code.
Give the un-suffixed scheduled jobs an *-allrules suffix.
No functional change.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
These jobs should not run in regular scans, but only in xen-project/people
repositories and branches to speed up pipeline execution.
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
The following analysis jobs are performed:
- eclair-{x86_64,ARM64}: analyze Xen using the default configuration for
that architecture; runs on runners tagged `eclair-analysis'.
- eclair-{x86-64,ARM64}-safety: analyze Xen using the configuration for
safety, which is more restricted; runs on runners tagged
`eclair-analysis-safety`.
- eclair-{x86_64,ARM64}-testing: analyze Xen using the default
configuration for the purposes of testing new runner updates; runs on
runners tagged `eclair-analysis-testing`.
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
With the exception of the custom IBT job, copy all Debian 12 jobs making
Debian 13 versions, then trim the Debian 12 ranconfig jobs.
Update the test jobs using Debian 12 to use 13.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Everything works fine with Debian 13. Provide two new build jobs (for a total
of 6), and update the test jobs.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Denis Mukhin <dmukhin@ford.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Everything works fine with Debian 13. Provide two new build jobs, and update
both the randconfig the test jobs.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Introduce new CI job to run x86 XTF argo test under QEMU to smoke test argo
feature functionality in upstream CI.
The new job lead time is ~30s, limit max job duration to 60s.
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Ayan Kumar Halder