Skip to content

feat(virtio-linux): further strip out unnecessary kconfigs - #569

Merged
twitchyliquid64 merged 1 commit into
mainfrom
tom/kernel
Aug 5, 2026
Merged

feat(virtio-linux): further strip out unnecessary kconfigs#569
twitchyliquid64 merged 1 commit into
mainfrom
tom/kernel

Conversation

@twitchyliquid64

@twitchyliquid64 twitchyliquid64 commented Aug 5, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Improvements
    • Streamlined the virtio microVM Linux build by disabling hardware features unavailable in virtualized environments.
    • Retained support for essential virtio and 9p functionality.
    • Reduced unnecessary drivers and subsystems for a more focused microVM kernel.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5dd39e82-8b1e-46a7-a748-d5489ec2829b

📥 Commits

Reviewing files that changed from the base of the PR and between b1a1b1b and e2d03e3.

📒 Files selected for processing (1)
  • packages/virtio-linux/build.sh

📝 Walkthrough

Walkthrough

The virtio Linux build disables unsupported hardware drivers and unused kernel features for virtio microVM guests. It retains the broader network-filesystem subsystem and required virtio, 9p, and EFI stub options.

Changes

Virtio guest configuration

Layer / File(s) Summary
Network and USB feature pruning
packages/virtio-linux/build.sh
The build disables Wi-Fi, physical Ethernet, NFS client/root support, and USB support.
Hardware and system feature pruning
packages/virtio-linux/build.sh
The build disables physical IOMMU, PCMCIA, AGP, PCI hotplug, Macintosh, NVRAM, watchdog, DMA, software RAID, hibernation, kexec/crash dump, quota, I2C, and HPET features. It retains EFI stub support.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • gominimal/pkgs#567: Both update the virtio Linux kernel configuration in packages/virtio-linux/build.sh.

Suggested reviewers: bryan-minimal, msample

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the primary change: removing unnecessary kernel configuration options for virtio-linux.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch tom/kernel

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/virtio-linux/build.sh`:
- Around line 327-328: Add KEXEC_FILE to the nope configuration entries in the
build script, alongside KEXEC CRASH_DUMP, and verify the generated published
configuration contains no CONFIG_KEXEC=y, CONFIG_KEXEC_FILE=y, or
CONFIG_KEXEC_CORE=y.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 08296bce-a3d5-4eef-84f2-ba66c6960135

📥 Commits

Reviewing files that changed from the base of the PR and between b1a1b1b and 198e181.

📒 Files selected for processing (1)
  • packages/virtio-linux/build.sh

Comment on lines +327 to +328
nope HIBERNATION
nope KEXEC CRASH_DUMP

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu

config="${OUTPUT_DIR:?}/usr/share/virtio-linux/config"

for sym in KEXEC KEXEC_FILE KEXEC_CORE CRASH_DUMP; do
  if grep -qx "CONFIG_${sym}=y" "$config"; then
    echo "unexpected CONFIG_${sym}=y" >&2
    exit 1
  fi
done

Repository: gominimal/pkgs

Length of output: 204


🏁 Script executed:

#!/bin/sh
set -eu

printf '%s\n' '--- build script structure ---'
ast-grep outline packages/virtio-linux/build.sh 2>/dev/null || true

printf '%s\n' '--- relevant build script sections ---'
sed -n '1,90p' packages/virtio-linux/build.sh
sed -n '280,355p' packages/virtio-linux/build.sh

printf '%s\n' '--- configuration and architecture references ---'
rg -n --no-heading 'nope|defconfig|KEXEC|CRASH_DUMP|KERNEL_ARCH|ARCH|aarch64|arm64|olddefconfig|savedefconfig|config' packages/virtio-linux/build.sh packages/virtio-linux/build.ncl

Repository: gominimal/pkgs

Length of output: 13902


🏁 Script executed:

#!/bin/sh
set -eu

printf '%s\n' '--- nope() and final configuration checks ---'
sed -n '82,112p' packages/virtio-linux/build.sh
sed -n '350,375p' packages/virtio-linux/build.sh

printf '%s\n' '--- repository references ---'
rg -n --no-heading 'FORBIDDEN|CONFIG_KEXEC_FILE|KEXEC_FILE|KEXEC_CORE' .

Repository: gominimal/pkgs

Length of output: 2281


🌐 Web query:

Linux v6.12 Kconfig KEXEC_FILE KEXEC_CORE KEXEC dependency init/Kconfig

💡 Result:

In Linux kernel v6.12, the configuration options related to kexec are consolidated within the kernel/Kconfig.kexec file [1][2]. The dependencies and relationships between KEXEC, KEXEC_FILE, and KEXEC_CORE are structured as follows: KEXEC_CORE This is a hidden boolean configuration symbol that acts as a core dependency for both the traditional kexec and the file-based kexec interfaces [3][1][4]. It does not have user-visible prompt text and is selected by both KEXEC and KEXEC_FILE [3][1]. KEXEC (Enable kexec system call) This option enables the traditional kexec system call [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. KEXEC_FILE (Enable kexec file based system call) This option enables the newer, file-based kexec system call that uses file descriptors for the kernel and initramfs [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC_FILE (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. - Additionally selects: CRYPTO and CRYPTO_LIB_SHA256 (or CRYPTO_SHA256, depending on the specific kernel branch) to support the required cryptographic verification of the kernel image [3][1][4][5]. In summary, KEXEC_CORE is the underlying infrastructure required by both KEXEC and KEXEC_FILE, and both options explicitly select it to ensure it is enabled when either is configured [1][6]. The architecture-specific support is enforced by the ARCH_SUPPORTS_KEXEC and ARCH_SUPPORTS_KEXEC_FILE dependencies, which prevent these features from being enabled on architectures that do not support them [2].

Citations:


Security Misconfiguration (CWE-16)

Reachability: Internal · Exploitability: Difficult

Disable KEXEC_FILE too.

KEXEC_FILE independently selects KEXEC_CORE, so disabling only KEXEC can leave the file-based kexec path enabled. Add KEXEC_FILE to nope and verify that the published configuration contains no CONFIG_KEXEC=y, CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/virtio-linux/build.sh` around lines 327 - 328, Add KEXEC_FILE to the
nope configuration entries in the build script, alongside KEXEC CRASH_DUMP, and
verify the generated published configuration contains no CONFIG_KEXEC=y,
CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@msample msample left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@twitchyliquid64
twitchyliquid64 added this pull request to the merge queue Aug 5, 2026
Merged via the queue into main with commit 28f6ca2 Aug 5, 2026
10 checks passed
@twitchyliquid64
twitchyliquid64 deleted the tom/kernel branch August 5, 2026 16:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants