Skip to content

feat(virtio-linux): further strip out unnecessary kconfigs #569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
twitchyliquid64 merged 1 commit into from
Aug 5, 2026
Merged

feat(virtio-linux): further strip out unnecessary kconfigs #569

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions packages/virtio-linux/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,49 @@ $CFG --enable KVM
$CFG --enable KVM_INTEL
$CFG --enable KVM_AMD

# --- strip defconfig hardware a virtio guest has no bus to find --------------
# Everything above *adds* to x86_64_defconfig, which is a general-purpose
# desktop/server config: it pins a pile of physical-hardware drivers =y that
# this kernel can never reach, on any of the hypervisors we target. They cost
# image size and boot-time probing and buy nothing.
#
# This is deliberately the conservative subset. Plenty of other defconfig
# leftovers (sound, HID/PS2, ATA/SATA, SELinux-without-an-LSM-entry, the debug
# options) are just as unreachable, but each needs its own argument about what
# userland might still poke at, so they stay for now.

# No wifi in a microVM; defconfig carries the whole 802.11 stack =y.
nope CFG80211 MAC80211 RFKILL

# Physical NIC drivers: defconfig pins E1000/E1000E/IGB/R8169/TIGON3/SKY2/
# FORCEDETH/8139TOO/E100/NET_TULIP =y. Only the vendor-driver menu goes —
# NETDEVICES and VIRTIO_NET stay.
nope ETHERNET

# The rootfs arrives over virtiofs or virtio-blk, never NFS. NETWORK_FILESYSTEMS
# itself has to stay: 9P_FS lives under it, and 9p is wanted above.
nope NFS_FS ROOT_NFS SUNRPC

# None of our hypervisors emulate a USB controller, so xhci/ehci/ohci/uhci plus
# usb-storage and usb-hid are unreachable.
nope USB_SUPPORT

# Assorted defconfig hardware with no virtio-guest analogue. Note VIRTIO_IOMMU
# is a different symbol and is still wanted above — what goes here are the
# drivers for real Intel/AMD IOMMUs.
nope INTEL_IOMMU AMD_IOMMU
nope PCCARD YENTA AGP HOTPLUG_PCI
nope MACINTOSH_DRIVERS NVRAM WATCHDOG DMADEVICES
nope BLK_DEV_MD # keep BLK_DEV_DM — wanted above
nope HIBERNATION
nope KEXEC CRASH_DUMP
Comment on lines +327 to +328

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu

config="${OUTPUT_DIR:?}/usr/share/virtio-linux/config"

for sym in KEXEC KEXEC_FILE KEXEC_CORE CRASH_DUMP; do
  if grep -qx "CONFIG_${sym}=y" "$config"; then
    echo "unexpected CONFIG_${sym}=y" >&2
    exit 1
  fi
done

Repository: gominimal/pkgs

Length of output: 204

🏁 Script executed:

#!/bin/sh
set -eu

printf '%s\n' '--- build script structure ---'
ast-grep outline packages/virtio-linux/build.sh 2>/dev/null || true

printf '%s\n' '--- relevant build script sections ---'
sed -n '1,90p' packages/virtio-linux/build.sh
sed -n '280,355p' packages/virtio-linux/build.sh

printf '%s\n' '--- configuration and architecture references ---'
rg -n --no-heading 'nope|defconfig|KEXEC|CRASH_DUMP|KERNEL_ARCH|ARCH|aarch64|arm64|olddefconfig|savedefconfig|config' packages/virtio-linux/build.sh packages/virtio-linux/build.ncl

Repository: gominimal/pkgs

Length of output: 13902

🏁 Script executed:

#!/bin/sh
set -eu

printf '%s\n' '--- nope() and final configuration checks ---'
sed -n '82,112p' packages/virtio-linux/build.sh
sed -n '350,375p' packages/virtio-linux/build.sh

printf '%s\n' '--- repository references ---'
rg -n --no-heading 'FORBIDDEN|CONFIG_KEXEC_FILE|KEXEC_FILE|KEXEC_CORE' .

Repository: gominimal/pkgs

Length of output: 2281

🌐 Web query:

Linux v6.12 Kconfig KEXEC_FILE KEXEC_CORE KEXEC dependency init/Kconfig

💡 Result:

In Linux kernel v6.12, the configuration options related to kexec are consolidated within the kernel/Kconfig.kexec file [1][2]. The dependencies and relationships between KEXEC, KEXEC_FILE, and KEXEC_CORE are structured as follows: KEXEC_CORE This is a hidden boolean configuration symbol that acts as a core dependency for both the traditional kexec and the file-based kexec interfaces [3][1][4]. It does not have user-visible prompt text and is selected by both KEXEC and KEXEC_FILE [3][1]. KEXEC (Enable kexec system call) This option enables the traditional kexec system call [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. KEXEC_FILE (Enable kexec file based system call) This option enables the newer, file-based kexec system call that uses file descriptors for the kernel and initramfs [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC_FILE (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. - Additionally selects: CRYPTO and CRYPTO_LIB_SHA256 (or CRYPTO_SHA256, depending on the specific kernel branch) to support the required cryptographic verification of the kernel image [3][1][4][5]. In summary, KEXEC_CORE is the underlying infrastructure required by both KEXEC and KEXEC_FILE, and both options explicitly select it to ensure it is enabled when either is configured [1][6]. The architecture-specific support is enforced by the ARCH_SUPPORTS_KEXEC and ARCH_SUPPORTS_KEXEC_FILE dependencies, which prevent these features from being enabled on architectures that do not support them [2].

Citations:

Security Misconfiguration (CWE-16)

Reachability: Internal · Exploitability: Difficult

Disable KEXEC_FILE too.

KEXEC_FILE independently selects KEXEC_CORE, so disabling only KEXEC can leave the file-based kexec path enabled. Add KEXEC_FILE to nope and verify that the published configuration contains no CONFIG_KEXEC=y, CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/virtio-linux/build.sh` around lines 327 - 328, Add KEXEC_FILE to the
nope configuration entries in the build script, alongside KEXEC CRASH_DUMP, and
verify the generated published configuration contains no CONFIG_KEXEC=y,
CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.

nope QUOTA
nope I2C HPET
# Not in that list: EFI_STUB. On x86 it's a promptable symbol and --disable
# works, but on arm64 it's a bare `bool` that CONFIG_EFI selects, so the only
# way to drop it there is to turn off UEFI support entirely — a much bigger
# call on arm64 than the handful of KiB it saves.

# Resolve any new dependencies / silently drop options renamed upstream.
make olddefconfig

Expand Down