[PATCH v4 00/13] Changes for several CI improvements

[PATCH v4 00/13] Changes for several CI improvements

[Marek Marczykowski-Górecki]

- Alpine update
- Debian trixie
- test arbitrary linux branch
- Linux stubdom
- enable SSH access

Green pipeline: https://gitlab.com/xen-project/people/marmarek/test-artifacts/-/pipelines/2498055947

Example Linux test:

Linux-next (20260504):
    https://gitlab.com/xen-project/people/marmarek/test-artifacts/-/pipelines/2496653697

A few genuine failures there:
- kbl-pci-pv-x86_64-gcc-debug:
   domU gets:

   (domU) [    0.449203] pcifront pci-0: xenbus: state reset occurred, reconnecting
   (domU) [    0.449426] pcifront pci-0: 22 freeing event channel 8

   and no PCI device ever appears

- zen3p-pvshim-x86-64-gcc-debug

    [    1.133364] ------------[ cut here ]------------
    [    1.133398] WARNING: arch/x86/xen/multicalls.c:190 at xen_mc_flush+0x198/0x240, CPU#0: swapper/0/1
    [    1.133457] Modules linked in:
    [    1.133488] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.1.0-rc1-next-20260430-gb9303e6bff70 #1 PREEMPT(lazy)
    [    1.133552] RIP: e030:xen_mc_flush+0x198/0x240
    [    1.133588] Code: 48 8b 43 10 48 8b 7b 20 4c 8b 53 38 4c 8b 43 40 e8 9d 85 14 01 48 89 43 18 48 85 c0 0f 89 1b ff ff ff 8b 3b be 01 00 00 00 90 <0f> 0b 90 65 8b 0d 02 9a 94 02 89 fa 48 c7 c7 78 b5 c1 82 e8 10 6e
    [    1.133693] RSP: e02b:ffffc9004000bcc0 EFLAGS: 00010086
    [    1.133730] RAX: ffffffffffffffff RBX: ffff88801da16c40 RCX: ffff88801da17450
    [    1.133778] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
    [    1.133826] RBP: ffff88801da16c40 R08: 0000000000000000 R09: 0000000000000001
    [    1.133874] R10: 0000000000007ff0 R11: ffffc90040015fff R12: ffff888006570280
    [    1.133936] R13: 0000000000000000 R14: ffffc90040016000 R15: 8000000000000073
    [    1.133992] FS:  0000000000000000(0000) GS:ffff888099e14000(0000) knlGS:0000000000000000
    [    1.134040] CS:  e030 DS: 0000 ES: 0000 CR0: 0000000080050033
    [    1.134045] CR2: ffffc9000083f000 CR3: 0000000003034000 CR4: 0000000000050660
    [    1.134045] Call Trace:
    [    1.134045]  <TASK>
    [    1.134045]  ? xen_mc_issue+0x24/0x90
    [    1.134045]  xen_leave_lazy_mmu+0x10/0x50
    [    1.134045]  vmap_range_noflush+0x54d/0x7b0
    [    1.134045]  __ioremap_caller.isra.0+0x174/0x290
    [    1.134045]  ? print_s5_reset_status_mmio+0x1c/0x90
    [    1.134045]  ? __pfx_print_s5_reset_status_mmio+0x10/0x10
    [    1.134045]  print_s5_reset_status_mmio+0x1c/0x90
    [    1.134045]  do_one_initcall+0x58/0x240
    [    1.134045]  kernel_init_freeable+0x1e2/0x240
    [    1.134045]  ? __pfx_kernel_init+0x10/0x10
    [    1.134045]  kernel_init+0x15/0x130
    [    1.134045]  ret_from_fork+0x17e/0x240
    [    1.134045]  ? __pfx_kernel_init+0x10/0x10
    [    1.134045]  ret_from_fork_asm+0x1a/0x30
    [    1.134045]  </TASK>
    [    1.134045] ---[ end trace 0000000000000000 ]---

    Kinda similar to https://lore.kernel.org/xen-devel/aaBH3EAchUwKhrUA@mail-itl/
    (which is still not solved)

- zen3p-smoke-x86-64-dom0pvh-gcc-debug and few other PVH dom0 - dom0 crash without printing panic message

Marek Marczykowski-Górecki (13):
  Add Alpine 3.23 containers
  Switch Linux builds to use Alpine 3.23 container
  Add debian rootfs artifact
  Enable CONFIG_USB_RTL8152 in kernel for hw12 runner
  Include git in the ARM64 build container too
  Support building arbitrary Linux branch/tag/commit
  Add linux-6.12.79-x86_64
  Save Linux config to artifacts too
  Add trigger-test job, to run test on a Linux built from a branch/tag
  Add linux-stubdom dependencies
  Prepare grub for booting x86_64 HVM domU from a disk
  Prepare grub for booting x86_64 HVM domU from a cdrom
  Setup ssh access to test systems

 .gitlab-ci.yml                             |  82 ++++++++++++++++--
 containerize                               |   6 +-
 images/alpine/3.18-arm64-build.dockerfile  |   1 +-
 images/alpine/3.23-arm64-base.dockerfile   |   6 +-
 images/alpine/3.23-arm64-build.dockerfile  |  31 +++++++-
 images/alpine/3.23-x86_64-base.dockerfile  |   6 +-
 images/alpine/3.23-x86_64-build.dockerfile |  43 +++++++++-
 images/debian/13-x86_64-base.dockerfile    |   4 +-
 scripts/alpine-rootfs.sh                   |  24 +++++-
 scripts/build-linux.sh                     |  26 ++++--
 scripts/debian-rootfs.sh                   | 100 ++++++++++++++++++++++-
 11 files changed, 316 insertions(+), 13 deletions(-)
 create mode 100644 images/alpine/3.23-arm64-base.dockerfile
 create mode 100644 images/alpine/3.23-arm64-build.dockerfile
 create mode 100644 images/alpine/3.23-x86_64-base.dockerfile
 create mode 100644 images/alpine/3.23-x86_64-build.dockerfile
 create mode 100644 images/debian/13-x86_64-base.dockerfile
 create mode 100755 scripts/debian-rootfs.sh

base-commit: 76894a5929bc604fb5bdb4aff2f94a6a9df68cdb
-- 
git-series 0.9.1

[PATCH v4 01/13] Add Alpine 3.23 containers

[Marek Marczykowski-Górecki]

Add it in all variants:
- base container
- build container
- initramfs archive

libdw used to be part of libelf in Alpine 3.18, but it's a separate
package in 3.23.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes in v4:
- Update to Alpine 3.23
- Fix alpine-3.22-arm64-rootfs
- Adjust default in containerize script
Changes in v3:
- add comment about libdw
---
 .gitlab-ci.yml                             | 14 +++++++-
 containerize                               |  6 ++-
 images/alpine/3.23-arm64-base.dockerfile   |  6 +++-
 images/alpine/3.23-arm64-build.dockerfile  | 31 +++++++++++++++++-
 images/alpine/3.23-x86_64-base.dockerfile  |  6 +++-
 images/alpine/3.23-x86_64-build.dockerfile | 43 +++++++++++++++++++++++-
 scripts/alpine-rootfs.sh                   |  6 +++-
 7 files changed, 111 insertions(+), 1 deletion(-)
 create mode 100644 images/alpine/3.23-arm64-base.dockerfile
 create mode 100644 images/alpine/3.23-arm64-build.dockerfile
 create mode 100644 images/alpine/3.23-x86_64-base.dockerfile
 create mode 100644 images/alpine/3.23-x86_64-build.dockerfile

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c698612..b86d9aa 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -40,6 +40,13 @@ alpine-3.18-arm64-rootfs:
   variables:
     CONTAINER: alpine:3.18-arm64-base
 
+alpine-3.23-arm64-rootfs:
+  extends: .arm64-artifacts
+  script:
+    - ./scripts/alpine-rootfs.sh
+  variables:
+    CONTAINER: alpine:3.23-arm64-base
+
 linux-6.6.86-arm64:
   extends: .arm64-artifacts
   script: ./scripts/build-linux.sh
@@ -56,6 +63,13 @@ alpine-3.18-x86_64-rootfs:
   variables:
     CONTAINER: alpine:3.18-x86_64-base
 
+alpine-3.23-x86_64-rootfs:
+  extends: .x86_64-artifacts
+  script:
+    - ./scripts/alpine-rootfs.sh
+  variables:
+    CONTAINER: alpine:3.23-x86_64-base
+
 linux-6.6.56-x86_64:
   extends: .x86_64-artifacts
   script: ./scripts/build-linux.sh
diff --git a/containerize b/containerize
index 38a434a..a74ef45 100755
--- a/containerize
+++ b/containerize
@@ -27,7 +27,11 @@ case "_${CONTAINER}" in
     _alpine-3.18-arm64-base) CONTAINER="${BASE}/alpine:3.18-arm64-base" ;;
     _alpine-3.18-arm64-build) CONTAINER="${BASE}/alpine:3.18-arm64-build" ;;
     _alpine-3.18-x86_64-base) CONTAINER="${BASE}/alpine:3.18-x86_64-base" ;;
-    _alpine-3.18-x86_64-build|_) CONTAINER="${BASE}/alpine:3.18-x86_64-build" ;;
+    _alpine-3.18-x86_64-build) CONTAINER="${BASE}/alpine:3.18-x86_64-build" ;;
+    _alpine-3.23-arm64-base) CONTAINER="${BASE}/alpine:3.23-arm64-base" ;;
+    _alpine-3.23-arm64-build) CONTAINER="${BASE}/alpine:3.23-arm64-build" ;;
+    _alpine-3.23-x86_64-base) CONTAINER="${BASE}/alpine:3.23-x86_64-base" ;;
+    _alpine-3.23-x86_64-build|_) CONTAINER="${BASE}/alpine:3.23-x86_64-build" ;;
 esac
 
 # Use this variable to control whether root should be used
diff --git a/images/alpine/3.23-arm64-base.dockerfile b/images/alpine/3.23-arm64-base.dockerfile
new file mode 100644
index 0000000..5899803
--- /dev/null
+++ b/images/alpine/3.23-arm64-base.dockerfile
@@ -0,0 +1,6 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/arm64/v8 alpine:3.23
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
+
+RUN apk --no-cache add bash
diff --git a/images/alpine/3.23-arm64-build.dockerfile b/images/alpine/3.23-arm64-build.dockerfile
new file mode 100644
index 0000000..1e04b3a
--- /dev/null
+++ b/images/alpine/3.23-arm64-build.dockerfile
@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/arm64/v8 alpine:3.23
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
+
+RUN apk --no-cache add bash
+
+RUN <<EOF
+#!/bin/bash
+      set -eu
+
+      adduser -D user --shell /bin/bash
+
+      DEPS=(# Base environment
+            build-base
+            curl
+            git
+
+            # Linux build deps
+            bison
+            findutils
+            flex
+            openssl-dev
+            perl
+      )
+
+      apk add --no-cache "${DEPS[@]}"
+EOF
+
+USER user
+WORKDIR /build
diff --git a/images/alpine/3.23-x86_64-base.dockerfile b/images/alpine/3.23-x86_64-base.dockerfile
new file mode 100644
index 0000000..4c5807f
--- /dev/null
+++ b/images/alpine/3.23-x86_64-base.dockerfile
@@ -0,0 +1,6 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/amd64 alpine:3.23
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
+
+RUN apk --no-cache add bash
diff --git a/images/alpine/3.23-x86_64-build.dockerfile b/images/alpine/3.23-x86_64-build.dockerfile
new file mode 100644
index 0000000..b938d7b
--- /dev/null
+++ b/images/alpine/3.23-x86_64-build.dockerfile
@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/amd64 alpine:3.23
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
+
+RUN apk --no-cache add bash
+
+RUN <<EOF
+#!/bin/bash
+      set -eu
+
+      adduser -D user --shell /bin/bash
+
+      DEPS=(# Base environment
+            build-base
+            curl
+            git
+
+            # Linux build deps
+            bison
+            diffutils
+            elfutils-dev
+            findutils
+            flex
+            gawk
+            linux-headers
+            openssl-dev
+            perl
+
+            # Microcode
+            jq
+
+            # Argo build deps
+            autoconf
+            automake
+            libtool
+      )
+
+      apk add --no-cache "${DEPS[@]}"
+EOF
+
+USER user
+WORKDIR /build
diff --git a/scripts/alpine-rootfs.sh b/scripts/alpine-rootfs.sh
index 6fa1d56..3cd3ab9 100755
--- a/scripts/alpine-rootfs.sh
+++ b/scripts/alpine-rootfs.sh
@@ -40,6 +40,12 @@ case $UNAME in
             # QEMU
             libelf
             )
+        # libdw used to be part of libelf in Alpine 3.18, but it's a separate
+        # package in 3.22.
+        if ! grep -q VERSION_ID=3.18 /etc/os-release; then
+            # QEMU
+            PKGS+=( libdw )
+        fi
         ;;
 
     aarch64)
-- 
git-series 0.9.1

[PATCH v4 02/13] Switch Linux builds to use Alpine 3.23 container

[Marek Marczykowski-Górecki]

Slowly phase out 3.18 one.

But keep Linux 6.6 on Alpine 3.18 containers - it fails to build on
Alpine 3.23 (due to GCC 15 defaulting to -std=c23).

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes in v4:
- Alpine 3.23
- Keep Linux 6.6 on Alpine 3.18
---
 .gitlab-ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b86d9aa..5281c1f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -21,14 +21,14 @@ stages:
   tags:
     - arm64
   variables:
-    CONTAINER: alpine:3.18-arm64-build
+    CONTAINER: alpine:3.23-arm64-build
 
 .x86_64-artifacts:
   extends: .artifacts
   tags:
     - x86_64
   variables:
-    CONTAINER: alpine:3.18-x86_64-build
+    CONTAINER: alpine:3.23-x86_64-build
 
 #
 # ARM64 artifacts
@@ -52,6 +52,7 @@ linux-6.6.86-arm64:
   script: ./scripts/build-linux.sh
   variables:
     LINUX_VERSION: 6.6.86
+    CONTAINER: alpine:3.18-arm64-build
 
 #
 # x86_64 artifacts
@@ -77,6 +78,7 @@ linux-6.6.56-x86_64:
     LINUX_VERSION: 6.6.56
     ARGO_SHA: "cf73819cacc945baca1a7421e5836d1bd481739b"
     ARGOEXEC_SHA: "d900429f6640acc6f68a3d3a4c945d7da60625d8"
+    CONTAINER: alpine:3.18-x86_64-build
 
 microcode-x86:
   extends: .x86_64-artifacts
-- 
git-series 0.9.1

[PATCH v4 03/13] Add debian rootfs artifact

[Marek Marczykowski-Górecki]

Will be used as dom0/domU in some tests.

Install systemd, but set it up to start scripts in /etc/local.d/ too, so
tests don't need different paths for Alpine and Debian.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
---
Changes in v4:
- disable persistent journal via config
Changes in v3:
- fix typo and missing dropbear args
Changes in v2:
- Use systemd
- update to trixie
- disable systemd-journal-catalog-update.service,
  systemd-modules-load.service and persistent journal to save boot time

---
---
 .gitlab-ci.yml                          |   7 ++-
 images/debian/13-x86_64-base.dockerfile |   4 +-
 scripts/debian-rootfs.sh                | 100 +++++++++++++++++++++++++-
 3 files changed, 111 insertions(+)
 create mode 100644 images/debian/13-x86_64-base.dockerfile
 create mode 100755 scripts/debian-rootfs.sh

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5281c1f..4147be5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -71,6 +71,13 @@ alpine-3.23-x86_64-rootfs:
   variables:
     CONTAINER: alpine:3.23-x86_64-base
 
+debian-13-x86_64-rootfs:
+  extends: .x86_64-artifacts
+  script:
+    - ./scripts/debian-rootfs.sh
+  variables:
+    CONTAINER: debian:13-x86_64-base
+
 linux-6.6.56-x86_64:
   extends: .x86_64-artifacts
   script: ./scripts/build-linux.sh
diff --git a/images/debian/13-x86_64-base.dockerfile b/images/debian/13-x86_64-base.dockerfile
new file mode 100644
index 0000000..f98355f
--- /dev/null
+++ b/images/debian/13-x86_64-base.dockerfile
@@ -0,0 +1,4 @@
+# syntax=docker/dockerfile:1
+FROM --platform=linux/amd64 debian:trixie-slim
+LABEL maintainer.name="The Xen Project"
+LABEL maintainer.email="xen-devel@lists.xenproject.org"
diff --git a/scripts/debian-rootfs.sh b/scripts/debian-rootfs.sh
new file mode 100755
index 0000000..1da54a5
--- /dev/null
+++ b/scripts/debian-rootfs.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+set -eu
+
+WORKDIR="${PWD}"
+COPYDIR="${WORKDIR}/binaries"
+UNAME=$(uname -m)
+
+apt-get update
+
+PKGS=(
+    # System
+    bridge-utils
+    dropbear
+    udev
+    systemd-sysv
+    iproute2
+    inetutils-ping
+    util-linux
+    cpio
+
+    # Xen toolstack runtime deps
+    libbz2-1.0
+    libuuid1
+    liblzo2-2
+    liblzma5
+    libyajl2
+
+    # Xen Test Framework
+    python3
+
+    # QEMU
+    libglib2.0-0
+    libaio1t64
+    libpixman-1-0
+    )
+
+case $UNAME in
+    x86_64)
+        PKGS+=(
+            # System
+            pciutils
+
+            # QEMU
+            libelf1
+            )
+        ;;
+
+    aarch64)
+        PKGS+=(
+            # Xen
+            libfdt
+            )
+        ;;
+esac
+
+apt-get -y install "${PKGS[@]}"
+
+# Xen
+cd /
+# Minimal ramdisk environment in case of cpio output
+echo "ttyS0" >> /etc/securetty
+echo "hvc0" >> /etc/securetty
+echo "ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100" >> /etc/inittab
+echo "hvc0::respawn:/sbin/getty -L hvc0 115200 vt100" >> /etc/inittab
+echo "rc_verbose=yes" >> /etc/rc.conf
+echo "DROPBEAR_EXTRA_ARGS=\"-R\"" >> /etc/default/dropbear
+echo > /etc/modules
+# disable unneded services
+rm -f etc/systemd/system/timers.target.wants/apt-daily*.timer
+rm -f etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service
+rm -f usr/lib/systemd/system/sysinit.target.wants/systemd-journal-catalog-update.service
+rm -f usr/lib/systemd/system/sysinit.target.wants/systemd-modules-load.service
+# don't need persistent logging, avoid journal flush service
+mkdir -p etc/systemd/journald.conf.d
+cat >> etc/systemd/journald.conf.d/storage.conf <<EOF
+[Journal]
+Storage=volatile
+EOF
+# Tests install a startup script as /etc/local.d/xen.start
+cat > /etc/rc.local << EOF
+#!/bin/sh
+
+for f in /etc/local.d/*.start; do
+    \$f
+done
+EOF
+chmod +x /etc/rc.local
+passwd -d root
+
+# Create rootfs
+cd /
+{
+    PATHS="bin etc home init lib lib64 mnt opt root sbin srv tmp usr var"
+    find $PATHS -print0
+    echo -ne "dev\0proc\0run\0sys\0"
+} | cpio -0 -H newc -o | gzip > "${COPYDIR}/rootfs.cpio.gz"
+
+# Print the contents for the build log
+zcat "${COPYDIR}/rootfs.cpio.gz" | cpio -tv
-- 
git-series 0.9.1

[PATCH v4 04/13] Enable CONFIG_USB_RTL8152 in kernel for hw12 runner

[Marek Marczykowski-Górecki]

It uses this USB network interface.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
This was posted before at https://lore.kernel.org/xen-devel/20250411203336.585215-1-marmarek@invisiblethingslab.com/
---
 scripts/build-linux.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/build-linux.sh b/scripts/build-linux.sh
index 441b872..cf0e744 100755
--- a/scripts/build-linux.sh
+++ b/scripts/build-linux.sh
@@ -32,6 +32,7 @@ case $UNAME in
             | grep 'XEN' \
             | grep '=m' \
             | sed 's/=m/=y/g' >> .config
+        ./scripts/config --enable USB_RTL8152
         ;;
 
     aarch64)
-- 
git-series 0.9.1

[PATCH v4 05/13] Include git in the ARM64 build container too

[Marek Marczykowski-Górecki]

It will be used for fetching some Linux versions.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
---
 images/alpine/3.18-arm64-build.dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/images/alpine/3.18-arm64-build.dockerfile b/images/alpine/3.18-arm64-build.dockerfile
index 25a8dbd..38464c9 100644
--- a/images/alpine/3.18-arm64-build.dockerfile
+++ b/images/alpine/3.18-arm64-build.dockerfile
@@ -14,6 +14,7 @@ RUN <<EOF
       DEPS=(# Base environment
             build-base
             curl
+            git
 
             # Linux build deps
             bison
-- 
git-series 0.9.1

[PATCH v4 06/13] Support building arbitrary Linux branch/tag/commit

[Marek Marczykowski-Górecki]

Change how kernel version is given to the script - use arguments, to
avoid confusion between pipeline level variables and job level ones.

The build-linux.sh now can take either just the kernel version (used to be
LINUX_VERSION variable), or git branch/tag/commit name + git URL (new feature).
Go with "git init" + "git fetch" instead of "git clone" to support any
of branch/tag/commit.

This also defines optional linux-git-* jobs which will build the thing
if LINUX_GIT_VERSION and LINUX_GIT_URL variables are provided for the
pipeline.

The idea is to define separate CI schedules for the test-artifacts repo
with LINUX_GIT_URL/LINUX_GIT_VERSION pointing at Linux trees to be
tested (for example linux-next), and then trigger matching pipelines in
the xen repo for testing with that version.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes in v4:
- Adjust error message on missing version
- Extract kernel version from job name
Changes in v3:
- pass kernel version via script arguments, not variables
---
 .gitlab-ci.yml         | 29 +++++++++++++++++++++++++----
 scripts/build-linux.sh | 23 +++++++++++++++++------
 2 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4147be5..45006d4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,5 +1,9 @@
 variables:
   REGISTRY: registry.gitlab.com/xen-project/hardware/test-artifacts
+  LINUX_GIT_VERSION:
+    description: "branch/tag/commit for the linux-git jobs"
+  LINUX_GIT_URL:
+    description: "git url for the linux-git jobs"
 
 stages:
   - build
@@ -30,6 +34,13 @@ stages:
   variables:
     CONTAINER: alpine:3.23-x86_64-build
 
+.linux-tpl:
+  script: &linux-script
+  - linux_version="${CI_JOB_NAME}"
+  - linux_version="${linux_version#linux-}"
+  - linux_version="${linux_version%%-*}"
+  - ./scripts/build-linux.sh "${linux_version}"
+
 #
 # ARM64 artifacts
 #
@@ -49,11 +60,16 @@ alpine-3.23-arm64-rootfs:
 
 linux-6.6.86-arm64:
   extends: .arm64-artifacts
-  script: ./scripts/build-linux.sh
+  script: *linux-script
   variables:
-    LINUX_VERSION: 6.6.86
     CONTAINER: alpine:3.18-arm64-build
 
+linux-git-arm64:
+  extends: .arm64-artifacts
+  script: ./scripts/build-linux.sh "$LINUX_GIT_VERSION" "$LINUX_GIT_URL"
+  rules:
+  - if: $LINUX_GIT_VERSION && $LINUX_GIT_URL
+
 #
 # x86_64 artifacts
 #
@@ -80,13 +96,18 @@ debian-13-x86_64-rootfs:
 
 linux-6.6.56-x86_64:
   extends: .x86_64-artifacts
-  script: ./scripts/build-linux.sh
+  script: *linux-script
   variables:
-    LINUX_VERSION: 6.6.56
     ARGO_SHA: "cf73819cacc945baca1a7421e5836d1bd481739b"
     ARGOEXEC_SHA: "d900429f6640acc6f68a3d3a4c945d7da60625d8"
     CONTAINER: alpine:3.18-x86_64-build
 
+linux-git-x86_64:
+  extends: .x86_64-artifacts
+  script: ./scripts/build-linux.sh "$LINUX_GIT_VERSION" "$LINUX_GIT_URL"
+  rules:
+  - if: $LINUX_GIT_VERSION && $LINUX_GIT_URL
+
 microcode-x86:
   extends: .x86_64-artifacts
   script: ./scripts/x86-microcode.sh
diff --git a/scripts/build-linux.sh b/scripts/build-linux.sh
index cf0e744..e01b517 100755
--- a/scripts/build-linux.sh
+++ b/scripts/build-linux.sh
@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 
+LINUX_VERSION="$1"
+LINUX_GIT_URL="$2"
+
 if test -z "${LINUX_VERSION}"
 then
-    >&2 echo "LINUX_VERSION must be set"; exit 1
+    >&2 echo "Version argument missing"; exit 1
 fi
 
 set -ex -o pipefail
@@ -12,11 +15,19 @@ COPYDIR="${WORKDIR}/binaries"
 UNAME=$(uname -m)
 
 # Build Linux
-MAJOR=${LINUX_VERSION%%.*}
-curl -fsSLO \
-    https://cdn.kernel.org/pub/linux/kernel/v"${MAJOR}".x/linux-"${LINUX_VERSION}".tar.xz
-tar xf linux-"${LINUX_VERSION}".tar.xz
-cd linux-"${LINUX_VERSION}"
+if [[ -n "${LINUX_GIT_URL}" ]]; then
+    mkdir linux
+    cd linux
+    git init
+    git fetch --depth=1 "${LINUX_GIT_URL}" "${LINUX_VERSION}"
+    git checkout FETCH_HEAD
+else
+    MAJOR=${LINUX_VERSION%%.*}
+    curl -fsSLO \
+        https://cdn.kernel.org/pub/linux/kernel/v"${MAJOR}".x/linux-"${LINUX_VERSION}".tar.xz
+    tar xf linux-"${LINUX_VERSION}".tar.xz
+    cd linux-"${LINUX_VERSION}"
+fi
 
 make defconfig
 ./scripts/config --enable BRIDGE
-- 
git-series 0.9.1

[PATCH v4 07/13] Add linux-6.12.79-x86_64

[Marek Marczykowski-Górecki]

This is necessary for new Zen4 runner.
Do not include Argo module in this build, as it isn't compatible with
6.12 yet.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
Changes in v2:
- update 6.12.34 to 6.12.60, retaining acks
Changes in v3:
- update 6.12.60 to 6.12.79, retaining acks
---
 .gitlab-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 45006d4..3ba8a31 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -102,6 +102,10 @@ linux-6.6.56-x86_64:
     ARGOEXEC_SHA: "d900429f6640acc6f68a3d3a4c945d7da60625d8"
     CONTAINER: alpine:3.18-x86_64-build
 
+linux-6.12.79-x86_64:
+  extends: .x86_64-artifacts
+  script: *linux-script
+
 linux-git-x86_64:
   extends: .x86_64-artifacts
   script: ./scripts/build-linux.sh "$LINUX_GIT_VERSION" "$LINUX_GIT_URL"
-- 
git-series 0.9.1

[PATCH v4 08/13] Save Linux config to artifacts too

[Marek Marczykowski-Górecki]

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
---
 scripts/build-linux.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/build-linux.sh b/scripts/build-linux.sh
index e01b517..c51e45d 100755
--- a/scripts/build-linux.sh
+++ b/scripts/build-linux.sh
@@ -53,6 +53,8 @@ esac
 
 make olddefconfig
 
+cp .config "${COPYDIR}/linux.config"
+
 case $UNAME in
     x86_64)
         make -j$(nproc) bzImage
-- 
git-series 0.9.1

[PATCH v4 09/13] Add trigger-test job, to run test on a Linux built from a branch/tag

[Marek Marczykowski-Górecki]

When scheduling pipeline in test-artifacts repo, it can get also
TEST_TRIGGER_REPO and TEST_TRIGGER_BRANCH variables, to trigger relevant
pipeline to test just built artifacts.
Pass ARTIFACTS_REPO+ARTIFACTS_BRANCH to the child pipeline to ensure it
fetches artifacts from the right job, but avoid xen test pipeline
inheriting other variables, as they might have unintended consequences
(for example REGISTRY one).
For example, to build linux-next and test Xen staging on it, the
pipeline could be triggered with:

    LINUX_GIT_URL=https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
    LINUX_GIT_VERSION=master
    TEST_TRIGGER_REPO=xen-project/hardware/xen
    TEST_TRIGGER_BRANCH=staging

The triggered xen test pipeline will skip most build jobs.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

---
Changes in v4:
- add inherit:variables:false
---
 .gitlab-ci.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3ba8a31..b3c2b65 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,9 +4,14 @@ variables:
     description: "branch/tag/commit for the linux-git jobs"
   LINUX_GIT_URL:
     description: "git url for the linux-git jobs"
+  TEST_TRIGGER_REPO:
+    description: "gitlab repo on which test just built linux, for example 'xen-project/hardware/xen'"
+  TEST_TRIGGER_BRANCH:
+    description: "branch in TEST_TRIGGER_REPO to test on, for example 'staging'"
 
 stages:
   - build
+  - deploy
 
 .artifacts:
   stage: build
@@ -115,3 +120,20 @@ linux-git-x86_64:
 microcode-x86:
   extends: .x86_64-artifacts
   script: ./scripts/x86-microcode.sh
+
+trigger-test:
+  stage: deploy
+  trigger:
+    project: $TEST_TRIGGER_REPO
+    branch: $TEST_TRIGGER_BRANCH
+    strategy: mirror
+  inherit:
+    variables: false
+  variables:
+    ARTIFACTS_REPO: $CI_PROJECT_PATH
+    ARTIFACTS_BRANCH: $CI_COMMIT_REF_NAME
+    LINUX_JOB_X86_64: linux-git-x86_64
+    LINUX_JOB_ARM64: linux-git-arm64
+    BUILD_FOR_TESTS_ONLY: 1
+  rules:
+  - if: $TEST_TRIGGER_REPO && $TEST_TRIGGER_BRANCH
-- 
git-series 0.9.1

[PATCH v4 10/13] Add linux-stubdom dependencies

[Marek Marczykowski-Górecki]

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
 scripts/alpine-rootfs.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/alpine-rootfs.sh b/scripts/alpine-rootfs.sh
index 3cd3ab9..2671ab5 100755
--- a/scripts/alpine-rootfs.sh
+++ b/scripts/alpine-rootfs.sh
@@ -39,6 +39,10 @@ case $UNAME in
 
             # QEMU
             libelf
+
+            # Stubdomain
+            grub-bios
+            libseccomp
             )
         # libdw used to be part of libelf in Alpine 3.18, but it's a separate
         # package in 3.22.
-- 
git-series 0.9.1

[PATCH v4 11/13] Prepare grub for booting x86_64 HVM domU from a disk

[Marek Marczykowski-Górecki]

The stubdomain test will use it

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
 scripts/alpine-rootfs.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/alpine-rootfs.sh b/scripts/alpine-rootfs.sh
index 2671ab5..18f43e6 100755
--- a/scripts/alpine-rootfs.sh
+++ b/scripts/alpine-rootfs.sh
@@ -96,5 +96,12 @@ cd /
     echo -ne "dev\0proc\0run\0sys\0"
 } | cpio -0 -R 0:0 -H newc -o | gzip > "${COPYDIR}/rootfs.cpio.gz"
 
+if [ "$UNAME" = "x86_64" ]; then
+    # Prepare boot sector for HVM disk
+    grub-mkimage -o ${COPYDIR}/grub-core.img \
+        -O i386-pc -p '(hd0,msdos1)/boot/grub2' \
+        boot part_msdos ext2 linux biosdisk configfile normal
+fi
+
 # Print the contents for the build log
 zcat "${COPYDIR}/rootfs.cpio.gz" | cpio -tv
-- 
git-series 0.9.1

[PATCH v4 12/13] Prepare grub for booting x86_64 HVM domU from a cdrom

[Marek Marczykowski-Górecki]

The stubdomain test will use it.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
 scripts/alpine-rootfs.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/alpine-rootfs.sh b/scripts/alpine-rootfs.sh
index 18f43e6..f649550 100755
--- a/scripts/alpine-rootfs.sh
+++ b/scripts/alpine-rootfs.sh
@@ -101,6 +101,9 @@ if [ "$UNAME" = "x86_64" ]; then
     grub-mkimage -o ${COPYDIR}/grub-core.img \
         -O i386-pc -p '(hd0,msdos1)/boot/grub2' \
         boot part_msdos ext2 linux biosdisk configfile normal
+    grub-mkimage -o ${COPYDIR}/grub-core-eltorito.img \
+        -O i386-pc-eltorito -p '(cd)/boot/grub2' \
+        boot part_msdos ext2 linux biosdisk configfile normal iso9660
 fi
 
 # Print the contents for the build log
-- 
git-series 0.9.1

[PATCH v4 13/13] Setup ssh access to test systems

[Marek Marczykowski-Górecki]

For this add also bridge package, so xenbr0 can be configured with
/etc/network/interfaces.
This allows extracting more logs out of the test system.

Create empty /etc/network/interfaces, so the 'networking' service starts
cleanly even if no interfaces are configured this way. This is
necessary, as dropbear service depends on networking.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
Changes in v4:
- adjust commit message
- drop DROPBEAR_OPTS=\"-R\"
Changes in v2:
- do not allow passwordless login
---
 scripts/alpine-rootfs.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/alpine-rootfs.sh b/scripts/alpine-rootfs.sh
index f649550..c7fee4b 100755
--- a/scripts/alpine-rootfs.sh
+++ b/scripts/alpine-rootfs.sh
@@ -10,6 +10,8 @@ apk --no-cache upgrade
 
 PKGS=(
     # System
+    bridge
+    dropbear
     libgcc
     openrc
     udev
@@ -72,6 +74,7 @@ rc-update add loopback sysinit
 rc-update add bootmisc boot
 rc-update add devfs sysinit
 rc-update add dmesg sysinit
+rc-update add dropbear boot
 rc-update add hostname boot
 rc-update add hwclock boot
 rc-update add hwdrivers sysinit
@@ -85,6 +88,7 @@ echo "hvc0" >> /etc/securetty
 echo "ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100" >> /etc/inittab
 echo "hvc0::respawn:/sbin/getty -L hvc0 115200 vt100" >> /etc/inittab
 echo "rc_verbose=yes" >> /etc/rc.conf
+touch /etc/network/interfaces
 echo > /etc/modules
 passwd -d "root" root
 
-- 
git-series 0.9.1

Re: [PATCH v4 01/13] Add Alpine 3.23 containers

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 536 bytes --]

On Mon, May 04, 2026 at 02:35:40PM +0200, Marek Marczykowski-Górecki wrote:
> Add it in all variants:
> - base container
> - build container
> - initramfs archive
> 
> libdw used to be part of libelf in Alpine 3.18, but it's a separate
> package in 3.23.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 02/13] Switch Linux builds to use Alpine 3.23 container

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 510 bytes --]

On Mon, May 04, 2026 at 02:35:41PM +0200, Marek Marczykowski-Górecki wrote:
> Slowly phase out 3.18 one.
> 
> But keep Linux 6.6 on Alpine 3.18 containers - it fails to build on
> Alpine 3.23 (due to GCC 15 defaulting to -std=c23).
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 06/13] Support building arbitrary Linux branch/tag/commit

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 1193 bytes --]

On Mon, May 04, 2026 at 02:35:45PM +0200, Marek Marczykowski-Górecki wrote:
> Change how kernel version is given to the script - use arguments, to
> avoid confusion between pipeline level variables and job level ones.
> 
> The build-linux.sh now can take either just the kernel version (used to be
> LINUX_VERSION variable), or git branch/tag/commit name + git URL (new feature).
> Go with "git init" + "git fetch" instead of "git clone" to support any
> of branch/tag/commit.
> 
> This also defines optional linux-git-* jobs which will build the thing
> if LINUX_GIT_VERSION and LINUX_GIT_URL variables are provided for the
> pipeline.
> 
> The idea is to define separate CI schedules for the test-artifacts repo
> with LINUX_GIT_URL/LINUX_GIT_VERSION pointing at Linux trees to be
> tested (for example linux-next), and then trigger matching pipelines in
> the xen repo for testing with that version.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 09/13] Add trigger-test job, to run test on a Linux built from a branch/tag

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]

On Mon, May 04, 2026 at 02:35:48PM +0200, Marek Marczykowski-Górecki wrote:
> When scheduling pipeline in test-artifacts repo, it can get also
> TEST_TRIGGER_REPO and TEST_TRIGGER_BRANCH variables, to trigger relevant
> pipeline to test just built artifacts.
> Pass ARTIFACTS_REPO+ARTIFACTS_BRANCH to the child pipeline to ensure it
> fetches artifacts from the right job, but avoid xen test pipeline
> inheriting other variables, as they might have unintended consequences
> (for example REGISTRY one).
> For example, to build linux-next and test Xen staging on it, the
> pipeline could be triggered with:
> 
>     LINUX_GIT_URL=https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
>     LINUX_GIT_VERSION=master
>     TEST_TRIGGER_REPO=xen-project/hardware/xen
>     TEST_TRIGGER_BRANCH=staging
> 
> The triggered xen test pipeline will skip most build jobs.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 13/13] Setup ssh access to test systems

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 711 bytes --]

On Mon, May 04, 2026 at 02:35:52PM +0200, Marek Marczykowski-Górecki wrote:
> For this add also bridge package, so xenbr0 can be configured with
> /etc/network/interfaces.
> This allows extracting more logs out of the test system.
> 
> Create empty /etc/network/interfaces, so the 'networking' service starts
> cleanly even if no interfaces are configured this way. This is
> necessary, as dropbear service depends on networking.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 10/13] Add linux-stubdom dependencies

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 346 bytes --]

On Mon, May 04, 2026 at 02:35:49PM +0200, Marek Marczykowski-Górecki wrote:
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 11/13] Prepare grub for booting x86_64 HVM domU from a disk

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

On Mon, May 04, 2026 at 02:35:50PM +0200, Marek Marczykowski-Górecki wrote:
> The stubdomain test will use it
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 12/13] Prepare grub for booting x86_64 HVM domU from a cdrom

[Anthony PERARD]

[-- Attachment #1: Type: text/plain, Size: 386 bytes --]

On Mon, May 04, 2026 at 02:35:51PM +0200, Marek Marczykowski-Górecki wrote:
> The stubdomain test will use it.
> 
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Thanks,


--
Anthony Perard | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

Re: [PATCH v4 13/13] Setup ssh access to test systems

[Stefano Stabellini]

[-- Attachment #1: Type: text/plain, Size: 759 bytes --]

On Fri, 22 May 2026, Anthony PERARD wrote:
> On Mon, May 04, 2026 at 02:35:52PM +0200, Marek Marczykowski-Górecki wrote:
> > For this add also bridge package, so xenbr0 can be configured with
> > /etc/network/interfaces.
> > This allows extracting more logs out of the test system.
> > 
> > Create empty /etc/network/interfaces, so the 'networking' service starts
> > cleanly even if no interfaces are configured this way. This is
> > necessary, as dropbear service depends on networking.
> > 
> > Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> 
> Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>

Since Anthony has reviewed the entire series, on the whole series:

Acked-by: Stefano Stabellini <sstabellini@kernel.org>

Re: [PATCH test-artifacts v4 13/13] Setup ssh access to test systems

[Marek Marczykowski-Górecki]

[-- Attachment #1: Type: text/plain, Size: 1039 bytes --]

On Tue, May 26, 2026 at 12:02:23PM -0700, Stefano Stabellini wrote:
> On Fri, 22 May 2026, Anthony PERARD wrote:
> > On Mon, May 04, 2026 at 02:35:52PM +0200, Marek Marczykowski-Górecki wrote:
> > > For this add also bridge package, so xenbr0 can be configured with
> > > /etc/network/interfaces.
> > > This allows extracting more logs out of the test system.
> > > 
> > > Create empty /etc/network/interfaces, so the 'networking' service starts
> > > cleanly even if no interfaces are configured this way. This is
> > > necessary, as dropbear service depends on networking.
> > > 
> > > Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> > 
> > Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
> 
> Since Anthony has reviewed the entire series, on the whole series:
> 
> Acked-by: Stefano Stabellini <sstabellini@kernel.org>

Thanks.

I seem to have forgotten the "test-artifacts" subject tag (adding now).

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]