xen-project/xen
1
0 Fork 0
mirror of https://github.com/xen-project/xen.git synced 2026-10-28 02:01:24 +01:00
Code Issues Activity
Files
49af80b3e025b6f95cc2e8f9c25f5fa4dce38aff
xen/automation/gitlab-ci/build.yaml
T
Jan Beulich 49af80b3e0 x86: SHADOW_PAGING is deprecated 
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.

Some CI testing depends on SHADOW_PAGING.  Explicitly enable it when needed.

This is CVE-2026-42493 / XSA-495.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
(cherry picked from commit f2cac32029)
2026-07-28 13:07:36 +01:00

797 lines
16 KiB
YAML
Raw Blame History

.build-tmpl: &build
stage: build
image: ${XEN_REGISTRY}/${CONTAINER}
script:
- ./automation/scripts/build 2>&1 | tee build.log
artifacts:
paths:
- binaries/
- xen-config
- xen-cppcheck.txt
- '*.log'
- '*/*.log'
when: always
needs: []
rules:
- if: $SELECTED_JOBS_ONLY && $CI_JOB_NAME =~ $SELECTED_JOBS_ONLY
when: always
- if: $SELECTED_JOBS_ONLY
when: never
- when: on_success
.gcc-tmpl:
variables: &gcc
CC: gcc
CXX: g++
.clang-tmpl:
variables: &clang
CC: clang
CXX: clang++
clang: y
.x86-64-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: x86_64
tags:
- x86_64
.x86-64-build:
extends: .x86-64-build-tmpl
variables:
debug: n
.x86-64-build-debug:
extends: .x86-64-build-tmpl
variables:
debug: y
.x86-32-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: x86_32
tags:
- x86_32
.x86-32-build:
extends: .x86-32-build-tmpl
variables:
debug: n
.x86-32-build-debug:
extends: .x86-32-build-tmpl
variables:
debug: y
.gcc-x86-64-build:
extends: .x86-64-build
variables:
<<: *gcc
.gcc-x86-64-build-debug:
extends: .x86-64-build-debug
variables:
<<: *gcc
.gcc-x86-32-build:
extends: .x86-32-build
variables:
<<: *gcc
.gcc-x86-32-build-debug:
extends: .x86-32-build-debug
variables:
<<: *gcc
.clang-x86-64-build:
extends: .x86-64-build
variables:
<<: *clang
.clang-x86-64-build-debug:
extends: .x86-64-build-debug
variables:
<<: *clang
.clang-x86-32-build:
extends: .x86-32-build
variables:
<<: *clang
.clang-x86-32-build-debug:
extends: .x86-32-build-debug
variables:
<<: *clang
.arm32-cross-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: arm32
tags:
- arm64
.arm32-cross-build:
extends: .arm32-cross-build-tmpl
variables:
debug: n
.arm32-cross-build-debug:
extends: .arm32-cross-build-tmpl
variables:
debug: y
.gcc-arm32-cross-build:
extends: .arm32-cross-build
variables:
<<: *gcc
.gcc-arm32-cross-build-debug:
extends: .arm32-cross-build-debug
variables:
<<: *gcc
.arm64-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: arm64
tags:
- arm64
.arm64-build:
extends: .arm64-build-tmpl
variables:
debug: n
.arm64-build-debug:
extends: .arm64-build-tmpl
variables:
debug: y
.gcc-arm64-build:
extends: .arm64-build
variables:
<<: *gcc
.gcc-arm64-build-debug:
extends: .arm64-build-debug
variables:
<<: *gcc
.riscv64-cross-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: riscv64
tags:
- x86_64
.riscv64-cross-build:
extends: .riscv64-cross-build-tmpl
variables:
debug: n
.riscv64-cross-build-debug:
extends: .riscv64-cross-build-tmpl
variables:
debug: y
.gcc-riscv64-cross-build:
extends: .riscv64-cross-build
variables:
<<: *gcc
.gcc-riscv64-cross-build-debug:
extends: .riscv64-cross-build-debug
variables:
<<: *gcc
.ppc64le-cross-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: ppc64
tags:
- x86_64
.ppc64le-cross-build:
extends: .ppc64le-cross-build-tmpl
variables:
debug: n
.ppc64le-cross-build-debug:
extends: .ppc64le-cross-build-tmpl
variables:
debug: y
.gcc-ppc64le-cross-build:
extends: .ppc64le-cross-build
variables:
<<: *gcc
.gcc-ppc64le-cross-build-debug:
extends: .ppc64le-cross-build-debug
variables:
<<: *gcc
.yocto-test:
stage: build
image: ${XEN_REGISTRY}/${CONTAINER}
script:
- ./automation/build/yocto/build-yocto.sh -v --log-dir=./logs --xen-dir=`pwd` ${YOCTO_BOARD} ${YOCTO_OUTPUT}
variables:
YOCTO_VERSION: scarthgap
CONTAINER: yocto:${YOCTO_VERSION}-${YOCTO_BOARD}${YOCTO_HOST}
artifacts:
paths:
- 'logs/*'
- binaries/
when: always
needs: []
.yocto-test-arm64:
extends: .yocto-test
variables:
YOCTO_HOST: -arm64v8
tags:
- arm64
.yocto-test-x86-64:
extends: .yocto-test
tags:
- x86_64
.x86-64-cross-build-tmpl:
<<: *build
variables:
XEN_TARGET_ARCH: x86_64
tags:
- arm64
.x86-64-cross-build:
extends: .x86-64-cross-build-tmpl
variables:
debug: n
.gcc-x86-64-cross-build:
extends: .x86-64-cross-build
variables:
<<: *gcc
## Test artifacts common
.test-jobs-artifact-common:
stage: build
needs: []
# Arm test artifacts
qemu-system-aarch64-6.0.0-arm64-export:
extends: .test-jobs-artifact-common
image: registry.gitlab.com/xen-project/xen/tests-artifacts/qemu-system-aarch64:6.0.0-arm64v8
script:
- mkdir binaries && cp /qemu-system-aarch64 binaries/qemu-system-aarch64
artifacts:
paths:
- binaries/qemu-system-aarch64
tags:
- arm64
qemu-system-aarch64-6.0.0-arm32-export:
extends: .test-jobs-artifact-common
image: registry.gitlab.com/xen-project/xen/tests-artifacts/qemu-system-aarch64:6.0.0-arm64v8
script:
- mkdir binaries && cp /qemu-system-arm binaries/qemu-system-arm
artifacts:
paths:
- binaries/qemu-system-arm
tags:
- arm64
# Jobs below this line
# Build jobs needed for tests
alpine-3.18-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: alpine:3.18
alpine-3.18-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: alpine:3.18
BUILD_QEMU_XEN: y
EXTRA_XEN_CONFIG: |
CONFIG_EXPERT=y
CONFIG_UNSUPPORTED=y
CONFIG_ARGO=y
CONFIG_UBSAN=y
CONFIG_UBSAN_FATAL=y
CONFIG_UCODE_SCAN_DEFAULT=y
CONFIG_XHCI=y
debian-13-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:13-x86_64
EXTRA_XEN_CONFIG: |
CONFIG_SHADOW_PAGING=y
debian-13-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:13-x86_64
EXTRA_XEN_CONFIG: |
CONFIG_SHADOW_PAGING=y
debian-13-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
variables:
CONTAINER: debian:13-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_UBSAN=y
CONFIG_UBSAN_FATAL=y
debian-13-riscv64-gcc-debug:
extends: .gcc-riscv64-cross-build-debug
variables:
CONTAINER: debian:13-riscv64
KBUILD_DEFCONFIG: tiny64_defconfig
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_UBSAN=y
CONFIG_UBSAN_FATAL=y
# Arm32 cross-build
debian-bookworm-gcc-arm32:
extends: .gcc-arm32-cross-build
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
debian-bookworm-gcc-arm32-debug:
extends: .gcc-arm32-cross-build-debug
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
debian-bookworm-gcc-arm32-randconfig:
extends: .gcc-arm32-cross-build
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
RANDCONFIG: y
debian-bookworm-gcc-arm32-debug-staticmem:
extends: .gcc-arm32-cross-build-debug
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_EXPERT=y
CONFIG_UNSUPPORTED=y
CONFIG_STATIC_MEMORY=y
debian-bookworm-gcc-arm32-debug-earlyprintk:
extends: .gcc-arm32-cross-build-debug
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_EARLY_UART_CHOICE_PL011=y
CONFIG_EARLY_UART_BASE_ADDRESS=0x9000000
debian-bookworm-gcc-arm32-debug-mpu:
extends: .gcc-arm32-cross-build-debug
variables:
CONTAINER: debian:bookworm-arm64v8-arm32-gcc
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_XEN_START_ADDRESS=0x0
CONFIG_MPU=y
CONFIG_UNSUPPORTED=y
# Arm builds
debian-bookworm-gcc-arm64:
extends: .gcc-arm64-build
variables:
CONTAINER: debian:bookworm-arm64v8
debian-bookworm-gcc-debug-arm64:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: debian:bookworm-arm64v8
alpine-3.18-gcc-arm64:
extends: .gcc-arm64-build
variables:
CONTAINER: alpine:3.18-arm64v8
alpine-3.18-gcc-debug-arm64:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
EXTRA_XEN_CONFIG: |
CONFIG_UBSAN=y
CONFIG_UBSAN_FATAL=y
alpine-3.18-gcc-arm64-randconfig:
extends: .gcc-arm64-build
variables:
CONTAINER: alpine:3.18-arm64v8
RANDCONFIG: y
alpine-3.18-gcc-debug-arm64-staticmem:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
EXTRA_XEN_CONFIG: |
CONFIG_EXPERT=y
CONFIG_UNSUPPORTED=y
CONFIG_STATIC_MEMORY=y
alpine-3.18-gcc-debug-arm64-static-shared-mem:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
EXTRA_XEN_CONFIG: |
CONFIG_UNSUPPORTED=y
CONFIG_STATIC_MEMORY=y
CONFIG_STATIC_SHM=y
alpine-3.18-gcc-debug-arm64-boot-cpupools:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
EXTRA_XEN_CONFIG: |
CONFIG_BOOT_TIME_CPUPOOLS=y
alpine-3.18-gcc-debug-arm64-earlyprintk:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
EXTRA_XEN_CONFIG: |
CONFIG_EARLY_UART_CHOICE_PL011=y
CONFIG_EARLY_UART_BASE_ADDRESS=0x9000000
alpine-3.18-gcc-debug-arm64-mpu:
extends: .gcc-arm64-build-debug
variables:
CONTAINER: alpine:3.18-arm64v8
HYPERVISOR_ONLY: y
EXTRA_XEN_CONFIG: |
CONFIG_XEN_START_ADDRESS=0x0
CONFIG_MPU=y
CONFIG_UNSUPPORTED=y
# Yocto test jobs
yocto-qemuarm64:
extends: .yocto-test-arm64
variables:
YOCTO_BOARD: qemuarm64
when: manual
yocto-qemuarm:
extends: .yocto-test-arm64
variables:
YOCTO_BOARD: qemuarm
YOCTO_OUTPUT: --copy-output
when: manual
yocto-qemux86-64:
extends: .yocto-test-x86-64
variables:
YOCTO_BOARD: qemux86-64
when: manual
# Cppcheck analysis jobs
debian-bookworm-gcc-cppcheck:
extends: .gcc-x86-64-cross-build
variables:
CONTAINER: debian:bookworm-cppcheck
CROSS_COMPILE: /usr/bin/x86_64-linux-gnu-
CPPCHECK: y
HYPERVISOR_ONLY: y
debian-bookworm-gcc-arm32-cppcheck:
extends: .gcc-arm32-cross-build
variables:
CONTAINER: debian:bookworm-cppcheck
CROSS_COMPILE: /usr/bin/arm-linux-gnueabihf-
CPPCHECK: y
HYPERVISOR_ONLY: y
debian-bookworm-gcc-arm64-cppcheck:
extends: .gcc-arm64-build
variables:
CONTAINER: debian:bookworm-cppcheck
CPPCHECK: y
HYPERVISOR_ONLY: y
# Build jobs not needed for tests
alpine-3.18-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: alpine:3.18
alpine-3.18-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: alpine:3.18
archlinux-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: archlinux:current
allow_failure: true
archlinux-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: archlinux:current
allow_failure: true
debian-12-x86_64-gcc-ibt:
extends: .gcc-x86-64-build
variables:
CONTAINER: debian:12-x86_64-gcc-ibt
RANDCONFIG: y
EXTRA_FIXED_RANDCONFIG: |
CONFIG_XEN_IBT=y
debian-12-x86_64-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: debian:12-x86_64
debian-12-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: debian:12-x86_64
debian-12-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: debian:12-x86_64
debian-12-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: debian:12-x86_64
debian-12-x86_32-clang-debug:
extends: .clang-x86-32-build-debug
variables:
CONTAINER: debian:12-x86_32
debian-12-x86_32-gcc-debug:
extends: .gcc-x86-32-build-debug
variables:
CONTAINER: debian:12-x86_32
debian-13-x86_64-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: debian:13-x86_64
debian-13-x86_64-clang-randconfig:
extends: .clang-x86-64-build
variables:
CONTAINER: debian:13-x86_64
RANDCONFIG: y
EXTRA_FIXED_RANDCONFIG: |
CONFIG_COVERAGE=n # Disable coverage otherwise build times out.
debian-13-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: debian:13-x86_64
debian-13-x86_64-gcc-randconfig:
extends: .gcc-x86-64-build
variables:
CONTAINER: debian:13-x86_64
RANDCONFIG: y
debian-13-x86_32-clang-debug:
extends: .clang-x86-32-build-debug
variables:
CONTAINER: debian:13-x86_32
debian-13-x86_32-gcc-debug:
extends: .gcc-x86-32-build-debug
variables:
CONTAINER: debian:13-x86_32
fedora-41-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: fedora:41-x86_64
fedora-41-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: fedora:41-x86_64
ubuntu-16.04-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: ubuntu:16.04-x86_64
ubuntu-16.04-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: ubuntu:16.04-x86_64
ubuntu-18.04-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: ubuntu:18.04-x86_64
ubuntu-20.04-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: ubuntu:20.04-x86_64
ubuntu-22.04-x86_64-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: ubuntu:22.04-x86_64
ubuntu-22.04-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: ubuntu:22.04-x86_64
ubuntu-22.04-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: ubuntu:22.04-x86_64
ubuntu-24.04-x86_64-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: ubuntu:24.04-x86_64
ubuntu-24.04-x86_64-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: ubuntu:24.04-x86_64
ubuntu-24.04-x86_64-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: ubuntu:24.04-x86_64
ubuntu-24.04-x86_64-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: ubuntu:24.04-x86_64
opensuse-leap-15.6-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: opensuse:leap-15.6-x86_64
opensuse-leap-15.6-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: opensuse:leap-15.6-x86_64
opensuse-leap-15.6-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: opensuse:leap-15.6-x86_64
opensuse-leap-15.6-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: opensuse:leap-15.6-x86_64
opensuse-tumbleweed-clang:
extends: .clang-x86-64-build
variables:
CONTAINER: opensuse:tumbleweed-x86_64
allow_failure: true
opensuse-tumbleweed-clang-debug:
extends: .clang-x86-64-build-debug
variables:
CONTAINER: opensuse:tumbleweed-x86_64
allow_failure: true
opensuse-tumbleweed-gcc:
extends: .gcc-x86-64-build
variables:
CONTAINER: opensuse:tumbleweed-x86_64
allow_failure: true
opensuse-tumbleweed-gcc-debug:
extends: .gcc-x86-64-build-debug
variables:
CONTAINER: opensuse:tumbleweed-x86_64
allow_failure: true
# PowerPC builds (x86 cross)
debian-11-ppc64le-gcc:
extends: .gcc-ppc64le-cross-build
variables:
CONTAINER: debian:11-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
debian-11-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
variables:
CONTAINER: debian:11-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
debian-12-ppc64le-gcc:
extends: .gcc-ppc64le-cross-build
variables:
CONTAINER: debian:12-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
debian-12-ppc64le-gcc-debug:
extends: .gcc-ppc64le-cross-build-debug
variables:
CONTAINER: debian:12-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
debian-13-ppc64le-gcc:
extends: .gcc-ppc64le-cross-build
variables:
CONTAINER: debian:13-ppc64le
KBUILD_DEFCONFIG: ppc64_defconfig
HYPERVISOR_ONLY: y
# RISC-V 64 cross-build
debian-12-riscv64-gcc:
extends: .gcc-riscv64-cross-build
variables:
CONTAINER: debian:12-riscv64
KBUILD_DEFCONFIG: tiny64_defconfig
HYPERVISOR_ONLY: y
debian-12-riscv64-gcc-debug:
extends: .gcc-riscv64-cross-build-debug
variables:
CONTAINER: debian:12-riscv64
KBUILD_DEFCONFIG: tiny64_defconfig
HYPERVISOR_ONLY: y
debian-13-riscv64-gcc:
extends: .gcc-riscv64-cross-build
variables:
CONTAINER: debian:13-riscv64
KBUILD_DEFCONFIG: tiny64_defconfig
HYPERVISOR_ONLY: y
.riscv-fixed-randconfig:
variables: &riscv-fixed-randconfig
EXTRA_FIXED_RANDCONFIG: |
CONFIG_BOOT_TIME_CPUPOOLS=n
CONFIG_COVERAGE=n
CONFIG_EXPERT=y
CONFIG_GRANT_TABLE=n
CONFIG_LIVEPATCH=n
CONFIG_QEMU_PLATFORM=y
CONFIG_VM_EVENT=n
CONFIG_XSM=n
debian-13-riscv64-gcc-randconfig:
extends: .gcc-riscv64-cross-build
variables:
CONTAINER: debian:13-riscv64
KBUILD_DEFCONFIG: tiny64_defconfig
RANDCONFIG: y
<<: *riscv-fixed-randconfig
Reference in new issue View Git Blame Copy Permalink