Hi all,

I would like to propose to enable the UBSAN config option in our Gitlab
pipelines. The attached patch (just for testing, do not commit) enables
UBSAN on the Xen build jobs used for most of the ARM and x86 tests. The
pipeline passes.

https://gitlab.com/xen-project/people/sstabellini/xen/-/pipelines/1656001157

Cheers,

Stefano

diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
index bc4a8a5ad2..92790648aa 100644
--- a/automation/gitlab-ci/build.yaml
+++ b/automation/gitlab-ci/build.yaml
@@ -333,6 +333,8 @@ alpine-3.18-gcc-debug:
       CONFIG_EXPERT=y
       CONFIG_UNSUPPORTED=y
       CONFIG_ARGO=y
+      CONFIG_UBSAN=y
+      CONFIG_UBSAN_FATAL=y
 
 debian-12-x86_64-gcc-debug:
   extends: .gcc-x86-64-build-debug
@@ -419,6 +421,11 @@ alpine-3.18-gcc-debug-arm64:
   extends: .gcc-arm64-build-debug
   variables:
     CONTAINER: alpine:3.18-arm64v8
+    EXTRA_XEN_CONFIG: |
+      CONFIG_EXPERT=y
+      CONFIG_UNSUPPORTED=y
+      CONFIG_UBSAN=y
+      CONFIG_UBSAN_FATAL=y
 
 alpine-3.18-gcc-arm64-randconfig:
   extends: .gcc-arm64-build

On Wed Feb 5, 2025 at 12:44 AM GMT, Stefano Stabellini wrote:
> Hi all,
>
> I would like to propose to enable the UBSAN config option in our Gitlab
> pipelines. The attached patch (just for testing, do not commit) enables
> UBSAN on the Xen build jobs used for most of the ARM and x86 tests. The
> pipeline passes.
>
> https://gitlab.com/xen-project/people/sstabellini/xen/-/pipelines/1656001157
>
> Cheers,
>
> Stefano
>
> diff --git a/automation/gitlab-ci/build.yaml b/automation/gitlab-ci/build.yaml
> index bc4a8a5ad2..92790648aa 100644
> --- a/automation/gitlab-ci/build.yaml
> +++ b/automation/gitlab-ci/build.yaml
> @@ -333,6 +333,8 @@ alpine-3.18-gcc-debug:
>        CONFIG_EXPERT=y
>        CONFIG_UNSUPPORTED=y
>        CONFIG_ARGO=y
> +      CONFIG_UBSAN=y
> +      CONFIG_UBSAN_FATAL=y
>  
>  debian-12-x86_64-gcc-debug:
>    extends: .gcc-x86-64-build-debug
> @@ -419,6 +421,11 @@ alpine-3.18-gcc-debug-arm64:
>    extends: .gcc-arm64-build-debug
>    variables:
>      CONTAINER: alpine:3.18-arm64v8
> +    EXTRA_XEN_CONFIG: |
> +      CONFIG_EXPERT=y
> +      CONFIG_UNSUPPORTED=y
> +      CONFIG_UBSAN=y
> +      CONFIG_UBSAN_FATAL=y
>  
>  alpine-3.18-gcc-arm64-randconfig:
>    extends: .gcc-arm64-build

Sounds good to me. Particularly seeing how the pipeline is already clean. We
did some UBSAN checking in XenServer and it did uncovered a number of "oops,
yes that shouldn't quite be like that" sort of issues.

There's already precedent for making debug builds do slightly different things
to exercise different code paths (e.g: forcing map_domain_page() to always use
the mapcache rather than short-circuiting via the directmap).

Cheers,
Alejandro