From 7c7ba9dd722f341d876e6aa016fe0c276f1c29f2 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Tue, 13 Oct 2026 09:28:13 +0000 Subject: [PATCH 1/2] chore: Add license Signed-off-by: Charalampos Mainas --- LICENSE | 202 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 13 +++- 2 files changed, 214 insertions(+), 1 deletion(-) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md index 26ba712..db33c1c 100644 --- a/README.md +++ b/README.md @@ -1 +1,12 @@ -# unikernel-build \ No newline at end of file +# unikernel-build + +## License + +The files in this repository are licensed under the [Apache License 2.0](LICENSE). + +That license does not extend to: + +- The submodules (`mirage-skeleton`, `unikernel-httpreply`, `unikernel-redis`), which keep their own licenses. +- The software inside the published images: + - The Linux kernels are licensed under `GPL-2.0-only WITH Linux-syscall-note`. Each is built from an unmodified [kernel.org](https://kernel.org) release, using the defconfig under `kernel/` and `.github/workflows/kernels.yml`. Each `linux-kernel` image ships the license and the expanded `.config` under `/.boot/`. Its labels name the exact source tarball and its SHA-256 (`com.urunc.kernel.tarball`, `com.urunc.kernel.tarball.sha256`) and the defconfig it was built from (`com.urunc.kernel.defconfig`). + - The unikernel frameworks, applications and root filesystems in the images are under their own licenses. From 988bcb39a4e02733c42769c765531fda5279c308 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Tue, 13 Oct 2026 12:44:07 +0000 Subject: [PATCH 2/2] feat(linux): Add workflow to build and publish linux kernels Add a workflow that builds each kernel under linux_kernel// and publishes it as a signed multi-arch image, ghcr.io//linux-kernel:, with the kernel at /.boot/kernel. Bunnyfiles can then reference a kernel by digest instead of copying a binary into their build context. A generic kernel for amd64 and arm64 is included. Kernels are described by one defconfig per arch, which keeps the configuration small and reviewable. A `# KVER=` line pins the kernel version; otherwise the latest LTS release is used. The build fails if a symbol set to =y does not end up built in, since drivers the guest needs to mount its root cannot be loaded as modules. To keep builds trustworthy and reproducible, the source tarball must carry a valid kernel.org release signature, and it is compiled in a digest-pinned gcc image with fixed build metadata. Each image ships the kernel license and the full .config, and its labels record the source tarball, its checksum and the defconfig used, so the GPL source of every published kernel is identifiable. Pull requests build the changed kernels and get a comment linking the artifacts; pushes to main publish them. Signed-off-by: Charalampos Mainas --- .github/workflows/build-kernel.yml | 168 ------- .github/workflows/build-linux-kernels.yml | 511 ++++++++++++++++++++++ .github/workflows/oci.yml | 15 - README.md | 133 +++++- linux_kernel/generic/defconfig-amd64 | 375 ++++++++++++++++ linux_kernel/generic/defconfig-arm64 | 367 ++++++++++++++++ 6 files changed, 1385 insertions(+), 184 deletions(-) delete mode 100644 .github/workflows/build-kernel.yml create mode 100644 .github/workflows/build-linux-kernels.yml create mode 100644 linux_kernel/generic/defconfig-amd64 create mode 100644 linux_kernel/generic/defconfig-arm64 diff --git a/.github/workflows/build-kernel.yml b/.github/workflows/build-kernel.yml deleted file mode 100644 index 852a7e7..0000000 --- a/.github/workflows/build-kernel.yml +++ /dev/null @@ -1,168 +0,0 @@ -name: Build or Retrieve Linux Kernel - -on: - workflow_call: - inputs: - kernel_version: - description: 'Linux Kernel version to build' - required: true - type: string - defconfig_file: - description: 'Path to defconfig JSON' - required: true - type: string - registry: - default: 'ghcr.io' - required: false - type: string - arch: - type: string - required: true - default: '["amd64", "arm64"]' - runner-arch-map: - type: string - default: '{"amd64":"ubuntu-22.04", "arm64":"ubuntu-22.04-arm"}' - # default: '[{"amd64":"base-dind-2204-amd64", "arm64":"base-dind-2204-arm64"}]' - secrets: - GIT_CLONE_PAT: - required: false - # harbor_user: - # required: false - # harbor_secret: - # required: false - - # workflow_dispatch: - # inputs: - # kernel_version: - # description: 'Linux Kernel version to build' - # required: true - # type: string - # defconfig_file: - # description: 'Path to defconfig JSON' - # required: true - # type: string - # registry: - # default: 'ghcr.io' - # required: false - # type: string - # arch: - # type: string - # required: true - # default: '["amd64", "arm64"]' - # runner-arch-map: - # type: string - # # default: '[{"amd64":"ubuntu-22.04", "arm64":"ubuntu-22.04-arm"}]' - # default: '[{"amd64":"base-dind-2204-amd64", "arm64":"base-dind-2204-arm64"}]' - # secrets: - # GIT_CLONE_PAT: - # required: false - # harbor_user: - # required: false - # harbor_secret: - # required: false - -env: - REGISTRY: ${{ github.event.inputs.registry || 'ghcr.io' }} - # NOTE: We assume that a project named after the repo owner exists in the - # registry. The image will be uploaded as under the - # project. - REGISTRY_IMAGE: ${{ github.repository }} - -jobs: - check-artifact: - runs-on: ${{ fromJSON(inputs.runner-arch-map)[inputs.arch] }} - steps: - - uses: actions/checkout@v4 - - - name: Load defconfig JSON - id: defconfig - run: | - DEFCONFIG=$(jq -c . "${{ inputs.defconfig_file }}") - echo "defconfig=$DEFCONFIG" >> $GITHUB_OUTPUT - - - name: Check if Kernel Artifact Exists - id: check - run: | - echo "Checking for existing artifacts..." - - # Compute the hash of the defconfig contents - CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1) - echo "Config hash: $CONFIG_HASH" - - # Build the artifact name based on kernel_version and defconfig hash - EXPECTED_ARTIFACT="linux-kernel-${{ inputs.kernel_version }}-${CONFIG_HASH}" - echo "Expected artifact name: $EXPECTED_ARTIFACT" - - # List artifacts from previous successful runs of the 'Build Linux Kernel' workflow - ARTIFACTS=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/vnd.github.v3+json" \ - "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=completed&workflow=Build%20Linux%20Kernel" \ - | jq -r '.workflow_runs[].artifacts_url' | xargs -I {} curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/vnd.github.v3+json" \ - {} \ - | jq -r '.artifacts[].name') - - if echo "$ARTIFACTS" | grep -q "$EXPECTED_ARTIFACT"; then - echo "Kernel artifact already exists! Skipping build." - echo "exists=true" >> $GITHUB_OUTPUT - else - echo "No matching artifact found. Proceeding with build." - echo "exists=false" >> $GITHUB_OUTPUT - fi - - - name: Check if Kernel Artifact Exists - id: check-fc - run: | - echo "Checking for existing artifacts..." - - # Compute the hash of the defconfig contents - CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1) - echo "Config hash: $CONFIG_HASH" - - # Build the artifact name based on kernel_version and defconfig hash - EXPECTED_ARTIFACT="linux-kernel-fc-${{ inputs.kernel_version }}-${CONFIG_HASH}" - echo "Expected artifact name: $EXPECTED_ARTIFACT" - - # List artifacts from previous successful runs of the 'Build Linux Kernel' workflow - ARTIFACTS=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/vnd.github.v3+json" \ - "https://api.github.com/repos/${{ github.repository }}/actions/runs?status=completed&workflow=Build%20Linux%20Kernel" \ - | jq -r '.workflow_runs[].artifacts_url' | xargs -I {} curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/vnd.github.v3+json" \ - {} \ - | jq -r '.artifacts[].name') - - if echo "$ARTIFACTS" | grep -q "$EXPECTED_ARTIFACT"; then - echo "Kernel artifact already exists! Skipping build." - echo "exists=true" >> $GITHUB_OUTPUT - else - echo "No matching artifact found. Proceeding with build." - echo "exists=false" >> $GITHUB_OUTPUT - fi - - - name: Build Linux Kernel - if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }} - run: | - git clone --depth 1 --branch v${{ inputs.kernel_version }} https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-source - cd linux-source - sudo apt-get update - sudo apt-get install -y build-essential flex bison libssl-dev libelf-dev bc - echo "${{ inputs.defconfig }}" > .config - make olddefconfig - make -j$(nproc) - CONFIG_HASH=$(echo -n "${{ steps.defconfig.outputs.defconfig }}" | md5sum | cut -d ' ' -f 1) - echo "config_hash=${CONFIG_HASH}" >> $GITHUB_ENV - - - name: Archive Kernel Artifact - if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }} - uses: actions/upload-artifact@v4 - with: - name: linux-kernel-${{ inputs.kernel_version }}-${{ env.config_hash }} - path: linux-source/arch/x86/boot/bzImage - - - name: Archive Kernel Artifact FC - if: ${{ steps.check.outputs.exists == 'false' || steps.check-fc.outputs.exists == 'false' }} - uses: actions/upload-artifact@v4 - with: - name: linux-kernel-fc-${{ inputs.kernel_version }}-${{ env.config_hash }} - path: linux-source/vmlinux diff --git a/.github/workflows/build-linux-kernels.yml b/.github/workflows/build-linux-kernels.yml new file mode 100644 index 0000000..5f4a4f9 --- /dev/null +++ b/.github/workflows/build-linux-kernels.yml @@ -0,0 +1,511 @@ +name: Build kernels + +# Builds the Linux guest kernels laid out as linux_kernel//defconfig- +# and publishes each directory as two signed multi-arch images, one with the +# uncompressed and one with the compressed kernel, each at /.boot/kernel: +# +# linux_kernel//defconfig- -> ghcr.io//linux-kernel: +# ghcr.io//linux-kernel:-compressed +# +# As in Kata Containers, the GPL source is the unmodified kernel.org release +# named in the image labels plus the defconfig and this workflow; the image +# also carries the kernel license and the expanded .config. +# +# A defconfig pins its kernel version with a `# KVER=x.y.z` line; without one +# it gets the latest longterm release, resolved once per run. All defconfigs +# in a directory must end up on the same version. On push and pull_request +# only the changed directories are built; pull requests build without pushing +# and get a comment linking the built kernels. +# Kernels are reproducible: the source is verified against the kernel.org +# release keys, the compiler is pinned by digest and build metadata is fixed. + +on: + push: + branches: + - main + paths: + - 'linux_kernel/**' + - '.github/workflows/build-linux-kernels.yml' + pull_request: + branches: + - main + paths: + - 'linux_kernel/**' + - '.github/workflows/build-linux-kernels.yml' + workflow_dispatch: + inputs: + filter: + description: "Only build this kernel (generic or linux_kernel/generic); empty builds all" + type: string + default: '' + +permissions: + contents: read + +# A new push to a pull request cancels its previous run. Pushes and manual +# runs each get their own group so they always finish: a run only builds the +# kernels its push changed, so a cancelled or replaced run would never publish +# them, and a cancel mid-publish could leave images pushed but unsigned. +concurrency: + group: >- + ${{ github.event_name == 'pull_request' + && format('{0}-{1}', github.workflow, github.event.pull_request.number) + || github.run_id }} + cancel-in-progress: true + +env: + REGISTRY: ghcr.io + REGISTRY_IMAGE: ghcr.io/${{ github.repository }}/linux-kernel + GCC_IMAGE: gcc:15.2.0@sha256:3ae15afe768b06d0c0fe088d822ba5f8045c26630bdacc8d8e7713cf5d8e7289 + +jobs: + discover: + name: Discover kernels to build + runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: read # paths-filter lists PR files through the API + outputs: + builds: ${{ steps.scan.outputs.builds }} + images: ${{ steps.scan.outputs.images }} + steps: + - name: Checkout code + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + + # Lists the changed files on push and pull_request. Manual runs build + # every kernel, or only the one named in the filter input, so they skip it. + - name: Find changed kernels + id: changes + if: ${{ github.event_name != 'workflow_dispatch' }} + uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 + with: + list-files: json + filters: | + kernels: + - 'linux_kernel/**' + workflow: + - '.github/workflows/build-linux-kernels.yml' + + # Emits one build per defconfig and one image per directory, e.g. + # builds: [{"name":"generic","arch":"amd64","kver":"6.18.57"}, ...] + # images: [{"name":"generic","kver":"6.18.57","arches":["amd64","arm64"]}] + # On push and pull_request only the linux_kernel// directories with + # changed files are built, unless this workflow changed, which builds + # every kernel. + - name: Discover kernels + id: scan + env: + MODE: >- + ${{ (github.event_name == 'workflow_dispatch' || steps.changes.outputs.workflow == 'true') + && 'all' || 'changed' }} + CHANGED_FILES: ${{ steps.changes.outputs.kernels_files }} + FILTER: ${{ inputs.filter }} + run: | + set -euo pipefail + + CHANGED_DIRS=null + if [ "$MODE" = changed ]; then + CHANGED_DIRS=$(jq -c 'map(split("/")[0:2] | join("/")) | unique' <<< "${CHANGED_FILES:-[]}") + fi + + # Accept the filter as a name (generic) or a path (linux_kernel/generic/). + FILTER=${FILTER#linux_kernel/} + FILTER=${FILTER%/} + + LTS=$(curl -sSf https://www.kernel.org/releases.json | jq -r ' + [.releases[] | select(.moniker == "longterm") | .version] + | max_by(split(".") | map(tonumber))') + echo "Latest longterm release: $LTS" + + ENTRIES=$(find linux_kernel -mindepth 2 -maxdepth 2 -type f -name 'defconfig-*' | sort \ + | while read -r f; do + kver=$(sed -n 's/^#[[:space:]]*KVER=\([0-9.]*\)[[:space:]]*$/\1/p' "$f" | head -n1) + echo "$(cut -d/ -f2 <<< "$f") ${f##*/defconfig-} ${kver:-$LTS}" + done) + + BUILDS=$(jq -R -s -c --argjson changed "$CHANGED_DIRS" --arg filter "$FILTER" ' + split("\n") + | map(select(length > 0) | split(" ") | {name: .[0], arch: .[1], kver: .[2]}) + | map(select(($changed == null) or (("linux_kernel/" + .name) as $d | any($changed[]; . == $d)))) + | map(select(($filter == "") or .name == $filter)) + ' <<< "$ENTRIES") + + if [ -n "$FILTER" ] && [ "$BUILDS" = "[]" ]; then + echo "::error::No kernel named '${FILTER}': expected linux_kernel/${FILTER}/defconfig-" + exit 1 + fi + + UNKNOWN=$(jq -r 'map(select(.arch != "amd64" and .arch != "arm64") + | "linux_kernel/\(.name)/defconfig-\(.arch)") | join(" ")' <<< "$BUILDS") + if [ -n "$UNKNOWN" ]; then + echo "::error::Unsupported architecture (use defconfig-amd64 or defconfig-arm64): ${UNKNOWN}" + exit 1 + fi + + MIXED=$(jq -r 'group_by(.name)[] | select(map(.kver) | unique | length > 1) + | "\(.[0].name): \(map("\(.arch)=\(.kver)") | join(", "))"' <<< "$BUILDS") + if [ -n "$MIXED" ]; then + echo "::error::Defconfigs in one directory must use the same kernel version: $MIXED" + exit 1 + fi + + IMAGES=$(jq -c 'group_by(.name) | map({name: .[0].name, kver: .[0].kver, arches: map(.arch)})' <<< "$BUILDS") + + echo "Kernels to build: $BUILDS" + echo "builds=$BUILDS" >> "$GITHUB_OUTPUT" + echo "images=$IMAGES" >> "$GITHUB_OUTPUT" + + build: + name: build ${{ matrix.name }}/${{ matrix.arch }} + needs: discover + if: ${{ needs.discover.outputs.builds != '[]' }} + runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }} + strategy: + fail-fast: false + matrix: + include: ${{ fromJSON(needs.discover.outputs.builds) }} + steps: + - name: Checkout code + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + + # Releases are signed over the uncompressed tarball: x.y by Linus Torvalds, + # stable x.y.z by Greg Kroah-Hartman. Their keys are fetched over WKD, but + # only a signature by one of the pinned primary keys below is accepted. + - name: Fetch and verify kernel source + env: + KVER: ${{ matrix.kver }} + run: | + set -euo pipefail + URL="https://cdn.kernel.org/pub/linux/kernel/v${KVER%%.*}.x/linux-${KVER}" + curl -sSfLO "${URL}.tar.xz" + curl -sSfLO "${URL}.tar.sign" + + GNUPGHOME=$(mktemp -d) + export GNUPGHOME + gpg --batch --auto-key-locate clear,wkd --locate-keys torvalds@kernel.org gregkh@kernel.org + # gpg explains a failure (bad signature, missing key) on stderr, and + # the || true lets it reach the error below instead of exiting here. + SIGNER=$(xz -dc "linux-${KVER}.tar.xz" \ + | gpg --batch --status-fd 1 --verify "linux-${KVER}.tar.sign" - \ + | awk '$2 == "VALIDSIG" { print $NF }') || true + case "$SIGNER" in + ABAF11C65A2970B130ABE3C479BE3E4300411886) echo "Signed by Linus Torvalds" ;; + 647F28654894E3BD457199BE38DBBDC86092693E) echo "Signed by Greg Kroah-Hartman" ;; + *) echo "::error::linux-${KVER}.tar.xz is not signed by a trusted key"; exit 1 ;; + esac + + tar -xf "linux-${KVER}.tar.xz" + + # Expands the defconfig, fails if any =y symbol lost its dependencies (a + # missing built-in would leave the guest unable to mount its root), and + # builds the kernel both uncompressed (vmlinux on x86, booted via PVH; + # Image on arm64) and compressed (bzImage; Image.gz), since monitors + # differ in which they boot. The compressed target depends on the + # uncompressed one, so one make builds both. The build runs in the pinned + # compiler image at a fixed path with fixed KBUILD metadata so it is + # reproducible; bc, bison, flex and libelf only build host tools and do + # not end up in the kernel. + - name: Build kernel + env: + NAME: ${{ matrix.name }} + ARCH: ${{ matrix.arch }} + KVER: ${{ matrix.kver }} + run: | + set -euo pipefail + case "$ARCH" in + amd64) KARCH=x86_64 SRCARCH=x86 TARGET=bzImage IMG=vmlinux ZIMG=arch/x86/boot/bzImage ;; + arm64) KARCH=arm64 SRCARCH=arm64 TARGET=Image.gz IMG=arch/arm64/boot/Image ZIMG=arch/arm64/boot/Image.gz ;; + *) echo "::error::Unsupported architecture $ARCH"; exit 1 ;; + esac + + mkdir -p out/uncompressed out/compressed + docker run --rm \ + -v "$PWD/linux-${KVER}:/build/linux" \ + -v "$PWD/linux_kernel/${NAME}/defconfig-${ARCH}:/defconfig:ro" \ + -v "$PWD/out:/out" \ + -w /build/linux \ + -e KARCH="$KARCH" -e SRCARCH="$SRCARCH" -e TARGET="$TARGET" -e IMG="$IMG" -e ZIMG="$ZIMG" \ + -e OWNER="$(id -u):$(id -g)" \ + -e KBUILD_BUILD_TIMESTAMP='Thu Jan 1 00:00:00 UTC 1970' \ + -e KBUILD_BUILD_USER=urunc \ + -e KBUILD_BUILD_HOST=unikernel-build \ + -e KBUILD_BUILD_VERSION=1 \ + "$GCC_IMAGE" bash -euo pipefail -c ' + apt-get update -qq + apt-get install -y -qq --no-install-recommends bc bison flex libelf-dev > /dev/null + + cp /defconfig "arch/${SRCARCH}/configs/urunc_defconfig" + make ARCH="$KARCH" urunc_defconfig + MISSING=$(grep -E "^CONFIG_[A-Z0-9_]+=y$" /defconfig | grep -vxFf .config || true) + if [ -n "$MISSING" ]; then + echo "::error::Symbols not built in after expanding the defconfig:" $MISSING + exit 1 + fi + + make ARCH="$KARCH" -j"$(nproc)" "$TARGET" + cp "$IMG" /out/uncompressed/kernel + cp "$ZIMG" /out/compressed/kernel + cp .config /out/uncompressed/config + cp .config /out/compressed/config + chown -R "$OWNER" /out + ' + echo "Built linux ${KVER} for ${ARCH}: $(du -h out/uncompressed/kernel | cut -f1) uncompressed, $(du -h out/compressed/kernel | cut -f1) compressed" + + # Each format gets its own artifact holding exactly what its image + # ships: the kernel, the config and the license, since the GPL travels + # with the binary. source.sha256 records which tarball it was built + # from, and size/ the unzipped size for the pull request comment, as + # the artifacts API only reports the zipped one. + SUM=$(sha256sum "linux-${KVER}.tar.xz" | cut -d' ' -f1) + mkdir -p size + for variant in uncompressed compressed; do + dir="out/${variant}" + mkdir -p "${dir}/LICENSES/preferred" "${dir}/LICENSES/exceptions" + cp "linux-${KVER}/COPYING" "${dir}/" + cp "linux-${KVER}/LICENSES/preferred/GPL-2.0" "${dir}/LICENSES/preferred/" + cp "linux-${KVER}/LICENSES/exceptions/Linux-syscall-note" "${dir}/LICENSES/exceptions/" + echo "$SUM" > "${dir}/source.sha256" + find "$dir" -type f -printf '%s\n' | awk '{ total += $1 } END { print total }' > "size/${variant}" + done + + - name: Upload uncompressed kernel + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: kernel-${{ matrix.name }}-${{ matrix.arch }}-uncompressed + path: out/uncompressed/ + + - name: Upload compressed kernel + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: kernel-${{ matrix.name }}-${{ matrix.arch }}-compressed + path: out/compressed/ + + - name: Upload kernel sizes + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: size-kernel-${{ matrix.name }}-${{ matrix.arch }} + path: size/ + + # Pull requests from this repository get one comment, updated on every push, + # linking the kernels each build produced. Pull requests from forks only + # get a read-only token, so they are skipped. + comment: + name: Comment on pull request + needs: [discover, build] + if: >- + ${{ !cancelled() && github.event_name == 'pull_request' + && github.event.pull_request.head.repo.full_name == github.repository + && needs.discover.result == 'success' && needs.discover.outputs.builds != '[]' }} + runs-on: ubuntu-22.04 + permissions: + actions: read + pull-requests: write + steps: + # Fails when no build succeeded; the comment then reports every build as + # failed instead of not being posted. + - name: Download kernel sizes + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + continue-on-error: true + with: + pattern: size-kernel-* + path: sizes + + - name: Comment with the built kernels + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 + env: + BUILDS: ${{ needs.discover.outputs.builds }} + with: + script: | + const fs = require('fs'); + const mib = bytes => `${(bytes / 2 ** 20).toFixed(1)} MiB`; + const builds = JSON.parse(process.env.BUILDS); + const { owner, repo } = context.repo; + const issue_number = context.issue.number; + const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`; + const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, + { owner, repo, run_id: context.runId }); + + // One cell per format: a link to its artifact with both sizes. + const cell = (b, variant) => { + const name = `kernel-${b.name}-${b.arch}-${variant}`; + const a = artifacts.find(a => a.name === name); + if (!a) return 'build failed'; + const sizeFile = `sizes/size-kernel-${b.name}-${b.arch}/${variant}`; + const unzipped = fs.existsSync(sizeFile) + ? `, ${mib(Number(fs.readFileSync(sizeFile, 'utf8')))} unzipped` : ''; + return `[${name}](${runUrl}/artifacts/${a.id}) (${mib(a.size_in_bytes)} zipped${unzipped})`; + }; + const rows = builds.map(b => + `| \`${b.name}\` | ${b.arch} | ${b.kver} | ${cell(b, 'uncompressed')} | ${cell(b, 'compressed')} |`); + const names = [...new Set(builds.map(b => b.name))]; + const marker = ''; + const body = [ + marker, + '### Kernel builds', + '', + '| Kernel | Arch | Linux | Uncompressed | Compressed |', + '| --- | --- | --- | --- | --- |', + ...rows, + '', + `On merge: ${names.flatMap(n => [n, `${n}-compressed`]) + .map(t => `\`${process.env.REGISTRY_IMAGE}:${t}\``).join(', ')}`, + '', + `[Workflow run](${runUrl})`, + ].join('\n'); + + const comments = await github.paginate(github.rest.issues.listComments, + { owner, repo, issue_number }); + const existing = comments.find(c => c.body?.includes(marker)); + if (existing) { + await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body }); + } else { + await github.rest.issues.createComment({ owner, repo, issue_number, body }); + } + + # One image per directory, published only if every arch of it built, so a + # failed build elsewhere does not hold back unrelated kernels. + publish: + name: publish ${{ matrix.name }} + needs: [discover, build] + if: >- + ${{ !cancelled() && github.event_name != 'pull_request' + && needs.discover.result == 'success' && needs.discover.outputs.images != '[]' }} + runs-on: ubuntu-22.04 + permissions: + contents: read + id-token: write # for signing the images + packages: write + strategy: + fail-fast: false + matrix: + include: ${{ fromJSON(needs.discover.outputs.images) }} + steps: + # Full history, to check whether a newer commit changed this kernel. + - name: Checkout code + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + fetch-depth: 0 + + - name: Download kernels + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + pattern: kernel-${{ matrix.name }}-* + path: dist + + # Pin the buildkit daemon: different buildkit versions produce different + # layers from the same inputs, which would break reproducible images. + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + with: + driver-opts: image=moby/buildkit:v0.34.0 + + - name: Install Cosign + uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0 + + - name: Log into registry ${{ env.REGISTRY }} + uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # As in Kata Containers, the kernel's GPL source is the unmodified + # kernel.org release plus this repository: each image ships the license + # and the expanded .config next to the kernel, and its labels name the + # exact tarball and defconfig it was built from. The commit is carried by + # the -- tag and the signature rather than a label, so an + # unchanged kernel keeps its digest. The kernel version is part of that + # tag because an unpinned defconfig follows the latest LTS: re-running a + # commit after a new release then gets a new tag instead of moving the + # old one. The uncompressed and the compressed kernel are separate images, + # each at /.boot/kernel, so a pull fetches only the format the monitor + # boots: and -compressed, each also tagged - and + # --. Per-arch images are pushed by digest only and combined + # into a signed index; bunnyfiles should pin the per-arch digest. + - name: Publish ${{ env.REGISTRY_IMAGE }}:${{ matrix.name }} + env: + NAME: ${{ matrix.name }} + KVER: ${{ matrix.kver }} + ARCHES: ${{ toJSON(matrix.arches) }} + SHA: ${{ github.sha }} + DEFAULT_BRANCH: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} + MAIN: ${{ github.event.repository.default_branch }} + run: | + set -euo pipefail + TARBALL="https://cdn.kernel.org/pub/linux/kernel/v${KVER%%.*}.x/linux-${KVER}.tar.xz" + for arch in $(jq -r '.[]' <<< "$ARCHES"); do + for variant in uncompressed compressed; do + if [ ! -f "dist/kernel-${NAME}-${arch}-${variant}/kernel" ]; then + echo "::error::No ${variant} ${arch} kernel was built for ${NAME}" + exit 1 + fi + done + done + + # Runs on the default branch never cancel each other, so an older run + # can finish after a newer one. Only move the shared and + # - tags if no newer commit changed this kernel or this + # workflow; otherwise leave them to the newer run. + LATEST=false + if [ "$DEFAULT_BRANCH" = true ]; then + git fetch --quiet origin "$MAIN" + NEWER=$(git log --format=%h "${SHA}..FETCH_HEAD" -- \ + "linux_kernel/${NAME}" .github/workflows/build-linux-kernels.yml) + if [ -z "$NEWER" ]; then + LATEST=true + else + echo "::notice::Newer commits change ${NAME} (${NEWER//$'\n'/, }); only tagging ${NAME}-${KVER}-${SHA}" + fi + fi + + for variant in uncompressed compressed; do + TAG="${NAME}" + if [ "$variant" = compressed ]; then + TAG="${NAME}-compressed" + fi + + KERNELS=() + for arch in $(jq -r '.[]' <<< "$ARCHES"); do + CTX="dist/kernel-${NAME}-${arch}-${variant}" + # FROM scratch + COPY needs no emulation for the foreign arch. + # Clamp every timestamp to the epoch so identical kernels produce + # identical image digests. + printf 'FROM scratch\nCOPY kernel config COPYING /.boot/\nCOPY LICENSES /.boot/LICENSES\n' \ + | docker buildx build \ + --platform "linux/${arch}" \ + --file - \ + --build-arg SOURCE_DATE_EPOCH=0 \ + --label "org.opencontainers.image.version=${KVER}" \ + --label "org.opencontainers.image.licenses=GPL-2.0-only WITH Linux-syscall-note" \ + --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \ + --label "com.urunc.kernel.format=${variant}" \ + --label "com.urunc.kernel.tarball=${TARBALL}" \ + --label "com.urunc.kernel.tarball.sha256=$(cat "${CTX}/source.sha256")" \ + --label "com.urunc.kernel.defconfig=linux_kernel/${NAME}/defconfig-${arch}" \ + --provenance=false \ + --output "type=image,name=${REGISTRY_IMAGE},push-by-digest=true,name-canonical=true,push=true,rewrite-timestamp=true" \ + --metadata-file "meta-${variant}-${arch}.json" \ + "$CTX" + KERNEL="${REGISTRY_IMAGE}@$(jq -r '."containerimage.digest"' "meta-${variant}-${arch}.json")" + echo "${variant} ${arch}: ${KERNEL}" + KERNELS+=("$KERNEL") + done + + TAGS=(-t "${REGISTRY_IMAGE}:${TAG}-${KVER}-${SHA}") + if [ "$LATEST" = true ]; then + TAGS+=(-t "${REGISTRY_IMAGE}:${TAG}" -t "${REGISTRY_IMAGE}:${TAG}-${KVER}") + fi + docker buildx imagetools create "${TAGS[@]}" "${KERNELS[@]}" + DIGEST=$(docker buildx imagetools inspect "${REGISTRY_IMAGE}:${TAG}-${KVER}-${SHA}" --format '{{json .Manifest}}' | jq -r .digest) + echo "${variant} index: ${REGISTRY_IMAGE}@${DIGEST}" + + # --recursive also signs each per-arch image, which is what + # bunnyfiles pin and what cosign verify gets pointed at. + cosign sign --yes --recursive "${REGISTRY_IMAGE}@${DIGEST}" \ + -a "repo=${GITHUB_REPOSITORY}" \ + -a "workflow=${GITHUB_WORKFLOW}" \ + -a "ref=${SHA}" \ + -a "kernel=${KVER}" \ + -a "format=${variant}" \ + -a "author=Nubificus LTD" + done diff --git a/.github/workflows/oci.yml b/.github/workflows/oci.yml index ac9e9fb..9e1cd22 100644 --- a/.github/workflows/oci.yml +++ b/.github/workflows/oci.yml @@ -130,22 +130,7 @@ jobs: postfix: ${{ matrix.postfix }} secrets: inherit - # build-linux-kernel: - # strategy: - # fail-fast: false - # matrix: - # archconfig: [ amd64, arm64 ] - # uses: ./.github/workflows/build-kernel.yml - # with: - # kernel_version: "6.14" - # # unikernel: ${{ matrix.unikernel }} - # # hypervisor: ${{ matrix.hypervisor }} - # defconfig_file: "configs/defconfig.json" - # arch: ${{ matrix.archconfig }} - # secrets: inherit - build-linux-unikernels: - # needs: build-linux-kernel strategy: matrix: unikernel: [ nginx, redis ] diff --git a/README.md b/README.md index db33c1c..a364c99 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,136 @@ # unikernel-build +## Linux kernels + +The guest kernels used by the Linux images are built from defconfigs in +`linux_kernel//defconfig-`, where `` is `amd64` or `arm64`. +A directory can hold one or both. Each directory is one kernel, published as +two images signed with cosign: one with the uncompressed kernel and one with +the compressed kernel, so each guest pulls only the format its monitor boots. +Each image has an entry for every `defconfig-` file in the directory: + +``` +linux_kernel//defconfig- -> ghcr.io/urunc-dev/unikernel-build/linux-kernel: + ghcr.io/urunc-dev/unikernel-build/linux-kernel:-compressed +``` + +### Kernel version + +Pin the kernel version with a `# KVER=x.y.z` line in the defconfig: + +``` +# KVER=6.12.113 +CONFIG_LOCALVERSION="-urunc" +... +``` + +Without that line the kernel is built from the latest +[longterm release](https://www.kernel.org/category/releases.html) at build +time. All defconfigs in one directory must end up on the same version. +`make savedefconfig` drops comments, so re-add the `# KVER=` line after +regenerating a defconfig. + +### Adding or changing a kernel + +1. Start from an existing defconfig in a kernel tree of the version you want, + change the configuration, and save it back as a defconfig. For example, + for amd64: + + ```sh + cp linux_kernel/generic/defconfig-amd64 linux-/arch/x86/configs/urunc_defconfig + cd linux- + make ARCH=x86_64 urunc_defconfig + make ARCH=x86_64 menuconfig + make ARCH=x86_64 savedefconfig # writes ./defconfig + ``` + + For arm64 use `arch/arm64/configs/` and `ARCH=arm64`. +2. Save the result as `linux_kernel//defconfig-`, one file for + each architecture you need (one or both), and add the `# KVER=` line if you + want a pinned version. +3. Open a pull request. CI builds every changed directory and comments on the + pull request with links to the built kernels. Nothing is published. +4. When the pull request is merged, the kernels are published. + +### What CI checks + +- The kernel.org tarball must carry a valid signature from Linus Torvalds or + Greg Kroah-Hartman. +- Every symbol the defconfig sets to `=y` must still be `=y` after the + defconfig is expanded. A symbol whose dependencies are missing fails the + build, rather than shipping a kernel that cannot mount its root. +- Builds are designed to be reproducible: they run in a compiler image pinned + by digest with fixed build metadata, and image timestamps are clamped, so + the same defconfig and kernel version should produce the same image digest. + +### Published images + +| Tag | Points to | +| --- | --- | +| `` | The latest build from `main` | +| `-` | The latest build of that kernel version from `main` | +| `--` | That kernel version built from that commit | + +The compressed images use the same tags with `-compressed` after the name: +`-compressed`, `-compressed-` and +`-compressed--`. + +A defconfig without a `# KVER=` line follows the latest LTS, so building the +same commit again after a new release produces a newer kernel. It gets its own +`--` tag instead of replacing the earlier one. + +| Image | `/.boot/kernel` on amd64 | `/.boot/kernel` on arm64 | +| --- | --- | --- | +| `` | `vmlinux` (uncompressed ELF) | `Image` | +| `-compressed` | `bzImage` | `Image.gz` | + +Both images also contain: + +| Path | Contents | +| --- | --- | +| `/.boot/config` | The full expanded `.config` | +| `/.boot/COPYING`, `/.boot/LICENSES/` | The kernel license | + +The image labels record the kernel version, whether the kernel is compressed +(`com.urunc.kernel.format`), the source tarball URL and its SHA-256, and the +defconfig it was built from. + +### Using a kernel in a bunnyfile + +Pick the uncompressed or compressed image depending on what the monitor +boots, and reference it by the digest of the image for that architecture, +not by tag or by the multi-arch index: + +```sh +docker buildx imagetools inspect ghcr.io/urunc-dev/unikernel-build/linux-kernel:generic +``` + +```yaml +kernel: + from: ghcr.io/urunc-dev/unikernel-build/linux-kernel@sha256: + path: /.boot/kernel +``` + +### Building a kernel locally + +Build on a host of the target architecture, so no cross-compiler is needed: + +```sh +KVER=6.18.57 +curl -LO https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${KVER}.tar.xz +tar -xf linux-${KVER}.tar.xz +cp linux_kernel/generic/defconfig-amd64 linux-${KVER}/arch/x86/configs/urunc_defconfig +cd linux-${KVER} +make ARCH=x86_64 urunc_defconfig +make ARCH=x86_64 -j"$(nproc)" bzImage # also builds vmlinux +``` + +This produces `vmlinux` and `arch/x86/boot/bzImage`. On arm64 use +`arch/arm64/configs/`, `ARCH=arm64` and the `Image.gz` target, which produces +`arch/arm64/boot/Image` and `arch/arm64/boot/Image.gz`. A local build is not bit-for-bit identical +to the CI one. For that, use the pinned compiler image and the `KBUILD_BUILD_*` +settings from the "Build kernel" step in `.github/workflows/build-linux-kernels.yml`. + ## License The files in this repository are licensed under the [Apache License 2.0](LICENSE). @@ -8,5 +139,5 @@ That license does not extend to: - The submodules (`mirage-skeleton`, `unikernel-httpreply`, `unikernel-redis`), which keep their own licenses. - The software inside the published images: - - The Linux kernels are licensed under `GPL-2.0-only WITH Linux-syscall-note`. Each is built from an unmodified [kernel.org](https://kernel.org) release, using the defconfig under `kernel/` and `.github/workflows/kernels.yml`. Each `linux-kernel` image ships the license and the expanded `.config` under `/.boot/`. Its labels name the exact source tarball and its SHA-256 (`com.urunc.kernel.tarball`, `com.urunc.kernel.tarball.sha256`) and the defconfig it was built from (`com.urunc.kernel.defconfig`). + - The Linux kernels are licensed under `GPL-2.0-only WITH Linux-syscall-note`. Each is built from an unmodified [kernel.org](https://kernel.org) release, using the defconfig under `linux_kernel/` and `.github/workflows/build-linux-kernels.yml`. Each `linux-kernel` image ships the license and the expanded `.config` under `/.boot/`. Its labels name the exact source tarball and its SHA-256 (`com.urunc.kernel.tarball`, `com.urunc.kernel.tarball.sha256`) and the defconfig it was built from (`com.urunc.kernel.defconfig`). - The unikernel frameworks, applications and root filesystems in the images are under their own licenses. diff --git a/linux_kernel/generic/defconfig-amd64 b/linux_kernel/generic/defconfig-amd64 new file mode 100644 index 0000000..f94e003 --- /dev/null +++ b/linux_kernel/generic/defconfig-amd64 @@ -0,0 +1,375 @@ +# KVER=6.18.57 +CONFIG_LOCALVERSION="-urunc" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_SYSVIPC=y +CONFIG_POSIX_MQUEUE=y +# CONFIG_CROSS_MEMORY_ATTACH is not set +CONFIG_NO_HZ_FULL=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y +CONFIG_BPF_SYSCALL=y +# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set +# CONFIG_PREEMPT_DYNAMIC is not set +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TASK_XACCT=y +CONFIG_TASK_IO_ACCOUNTING=y +CONFIG_PSI=y +CONFIG_PSI_DEFAULT_DISABLED=y +CONFIG_CGROUPS=y +CONFIG_MEMCG=y +CONFIG_BLK_CGROUP=y +CONFIG_CGROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_BPF=y +# CONFIG_TIME_NS is not set +CONFIG_USER_NS=y +CONFIG_BLK_DEV_INITRD=y +# CONFIG_RD_GZIP is not set +# CONFIG_RD_BZIP2 is not set +# CONFIG_RD_LZMA is not set +# CONFIG_RD_XZ is not set +# CONFIG_RD_LZO is not set +# CONFIG_RD_LZ4 is not set +# CONFIG_RD_ZSTD is not set +# CONFIG_INITRAMFS_PRESERVE_MTIME is not set +CONFIG_SYSFS_SYSCALL=y +CONFIG_SMP=y +CONFIG_X86_FRED=y +# CONFIG_X86_EXTENDED_PLATFORM is not set +# CONFIG_SCHED_OMIT_FRAME_POINTER is not set +CONFIG_HYPERVISOR_GUEST=y +CONFIG_PARAVIRT=y +CONFIG_PVH=y +CONFIG_NR_CPUS=240 +# CONFIG_X86_MCE is not set +# CONFIG_PERF_EVENTS_INTEL_UNCORE is not set +# CONFIG_PERF_EVENTS_INTEL_RAPL is not set +# CONFIG_PERF_EVENTS_INTEL_CSTATE is not set +# CONFIG_PERF_EVENTS_AMD_UNCORE is not set +# CONFIG_X86_IOPL_IOPERM is not set +CONFIG_X86_MSR=y +CONFIG_X86_CPUID=y +CONFIG_NUMA=y +# CONFIG_AMD_NUMA is not set +# CONFIG_X86_64_ACPI_NUMA is not set +# CONFIG_MTRR_SANITIZER is not set +# CONFIG_X86_KERNEL_IBT is not set +# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set +# CONFIG_RANDOMIZE_MEMORY is not set +CONFIG_LEGACY_VSYSCALL_NONE=y +# CONFIG_MITIGATION_RETHUNK is not set +# CONFIG_MITIGATION_IBPB_ENTRY is not set +# CONFIG_MITIGATION_IBRS_ENTRY is not set +# CONFIG_MITIGATION_GDS is not set +# CONFIG_MITIGATION_RFDS is not set +# CONFIG_MITIGATION_SPECTRE_BHI is not set +# CONFIG_MITIGATION_MDS is not set +# CONFIG_MITIGATION_TAA is not set +# CONFIG_MITIGATION_MMIO_STALE_DATA is not set +# CONFIG_MITIGATION_L1TF is not set +# CONFIG_MITIGATION_SPECTRE_V1 is not set +# CONFIG_MITIGATION_SPECTRE_V2 is not set +# CONFIG_MITIGATION_SRBDS is not set +# CONFIG_MITIGATION_SSB is not set +# CONFIG_SUSPEND is not set +# CONFIG_ACPI_SPCR_TABLE is not set +# CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set +# CONFIG_ACPI_AC is not set +# CONFIG_ACPI_BATTERY is not set +# CONFIG_ACPI_BUTTON is not set +# CONFIG_ACPI_FAN is not set +# CONFIG_ACPI_THERMAL is not set +# CONFIG_ACPI_DEBUG is not set +CONFIG_ACPI_PCI_SLOT=y +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y +CONFIG_X86_INTEL_PSTATE=y +# CONFIG_HALTPOLL_CPUIDLE is not set +# CONFIG_VIRTUALIZATION is not set +# CONFIG_SCHED_CLUSTER is not set +# CONFIG_SCHED_MC is not set +# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set +CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_DEBUG_FS is not set +# CONFIG_MQ_IOSCHED_DEADLINE is not set +# CONFIG_MQ_IOSCHED_KYBER is not set +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +CONFIG_BINFMT_MISC=y +# CONFIG_SLAB_MERGE_DEFAULT is not set +# CONFIG_SLUB_CPU_PARTIAL is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_PAGE_REPORTING=y +CONFIG_LRU_GEN=y +CONFIG_NET=y +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_UNIX=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_INET=y +CONFIG_IP_MULTICAST=y +CONFIG_IP_PNP=y +CONFIG_IP_PNP_DHCP=y +# CONFIG_INET_DIAG is not set +CONFIG_TCP_CONG_ADVANCED=y +# CONFIG_TCP_CONG_BIC is not set +# CONFIG_TCP_CONG_CUBIC is not set +# CONFIG_TCP_CONG_WESTWOOD is not set +# CONFIG_TCP_CONG_HTCP is not set +CONFIG_TCP_CONG_BBR=y +CONFIG_TCP_MD5SIG=y +# CONFIG_IPV6_SIT is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_NETWORK_SECMARK=y +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_EGRESS is not set +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_AMANDA=y +CONFIG_NF_CONNTRACK_FTP=y +CONFIG_NF_CONNTRACK_H323=y +CONFIG_NF_CONNTRACK_IRC=y +CONFIG_NF_CONNTRACK_NETBIOS_NS=y +CONFIG_NF_CONNTRACK_SNMP=y +CONFIG_NF_CONNTRACK_PPTP=y +CONFIG_NF_CONNTRACK_SANE=y +CONFIG_NF_CONNTRACK_SIP=y +CONFIG_NF_CONNTRACK_TFTP=y +CONFIG_NF_CT_NETLINK=y +CONFIG_NF_CT_NETLINK_TIMEOUT=y +CONFIG_NF_CT_NETLINK_HELPER=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NF_NAT=y +CONFIG_NETFILTER_XT_SET=y +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_HMARK=y +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_NAT=y +CONFIG_NETFILTER_XT_TARGET_NETMAP=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_REDIRECT=y +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y +CONFIG_NETFILTER_XT_TARGET_TEE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_BPF=y +CONFIG_NETFILTER_XT_MATCH_CGROUP=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +CONFIG_NETFILTER_XT_MATCH_CPU=y +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_IPCOMP=y +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y +CONFIG_NETFILTER_XT_MATCH_IPVS=y +CONFIG_NETFILTER_XT_MATCH_L2TP=y +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +CONFIG_NETFILTER_XT_MATCH_NFACCT=y +CONFIG_NETFILTER_XT_MATCH_OSF=y +CONFIG_NETFILTER_XT_MATCH_OWNER=y +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +CONFIG_NETFILTER_XT_MATCH_RATEEST=y +CONFIG_NETFILTER_XT_MATCH_REALM=y +CONFIG_NETFILTER_XT_MATCH_RECENT=y +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_TIME=y +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPMARK=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_MAC=y +CONFIG_IP_SET_HASH_NETPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETNET=y +CONFIG_IP_SET_HASH_NETPORT=y +CONFIG_IP_SET_HASH_NETIFACE=y +CONFIG_IP_SET_LIST_SET=y +CONFIG_IP_VS=y +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_SCTP=y +CONFIG_IP_VS_RR=y +CONFIG_IP_VS_WRR=y +CONFIG_IP_VS_LC=y +CONFIG_IP_VS_WLC=y +CONFIG_IP_VS_FO=y +CONFIG_IP_VS_OVF=y +CONFIG_IP_VS_LBLC=y +CONFIG_IP_VS_LBLCR=y +CONFIG_IP_VS_DH=y +CONFIG_IP_VS_SH=y +CONFIG_IP_VS_SED=y +CONFIG_IP_VS_NQ=y +CONFIG_IP_VS_FTP=y +CONFIG_IP_VS_PE_SIP=y +CONFIG_NF_TPROXY_IPV4=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_REJECT_IPV4=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_TARGET_SYNPROXY=y +CONFIG_NF_DUP_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_BRIDGE=y +CONFIG_NET_SCHED=y +CONFIG_NET_SCH_MULTIQ=y +CONFIG_NET_SCH_FQ_CODEL=y +CONFIG_NET_SCH_FQ=y +CONFIG_NET_CLS_CGROUP=y +CONFIG_NET_EMATCH=y +CONFIG_VSOCKETS=y +# CONFIG_VSOCKETS_DIAG is not set +# CONFIG_VSOCKETS_LOOPBACK is not set +CONFIG_VIRTIO_VSOCKETS=y +# CONFIG_PCPU_DEV_REFCNT is not set +CONFIG_CGROUP_NET_PRIO=y +# CONFIG_WIRELESS is not set +CONFIG_NET_9P=y +# CONFIG_NET_9P_FD is not set +CONFIG_NET_9P_VIRTIO=y +# CONFIG_ETHTOOL_NETLINK is not set +CONFIG_PCI=y +CONFIG_PCIEPORTBUS=y +CONFIG_PCI_MSI=y +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +CONFIG_DEVTMPFS_SAFE=y +# CONFIG_STANDALONE is not set +# CONFIG_PREVENT_FIRMWARE_BUILD is not set +# CONFIG_DMIID is not set +# CONFIG_PNP_DEBUG_MESSAGES is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_RAM=y +CONFIG_VIRTIO_BLK=y +# CONFIG_INTEL_MEI is not set +CONFIG_NETDEVICES=y +CONFIG_TUN=y +CONFIG_VETH=y +CONFIG_VIRTIO_NET=y +# CONFIG_ETHERNET is not set +# CONFIG_WLAN is not set +# CONFIG_INPUT_KEYBOARD is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_SERIO is not set +# CONFIG_LEGACY_PTYS is not set +# CONFIG_LEGACY_TIOCSTI is not set +# CONFIG_LDISC_AUTOLOAD is not set +CONFIG_SERIAL_8250=y +# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set +CONFIG_SERIAL_8250_CONSOLE=y +# CONFIG_SERIAL_8250_EXAR is not set +# CONFIG_SERIAL_8250_LPSS is not set +# CONFIG_SERIAL_8250_MID is not set +# CONFIG_SERIAL_8250_PERICOM is not set +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_HW_RANDOM_INTEL is not set +# CONFIG_HW_RANDOM_AMD is not set +# CONFIG_HW_RANDOM_VIA is not set +CONFIG_HW_RANDOM_VIRTIO=y +# CONFIG_DEVMEM is not set +# CONFIG_DEVPORT is not set +CONFIG_PTP_1588_CLOCK=y +# CONFIG_HWMON is not set +# CONFIG_X86_PKG_TEMP_THERMAL is not set +# CONFIG_HID_SUPPORT is not set +# CONFIG_USB_SUPPORT is not set +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +# CONFIG_VHOST_MENU is not set +# CONFIG_SURFACE_PLATFORMS is not set +# CONFIG_X86_PLATFORM_DEVICES is not set +CONFIG_INTEL_IOMMU=y +# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set +# CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON is not set +# CONFIG_INTEL_IOMMU_PERF_EVENTS is not set +CONFIG_IRQ_REMAP=y +CONFIG_VIRTIO_IOMMU=y +CONFIG_EXT4_FS=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_EXPORTFS_BLOCK_OPS=y +CONFIG_FANOTIFY=y +CONFIG_AUTOFS_FS=y +CONFIG_FUSE_FS=y +CONFIG_VIRTIO_FS=y +# CONFIG_FUSE_PASSTHROUGH is not set +CONFIG_OVERLAY_FS=y +# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set +CONFIG_OVERLAY_FS_INDEX=y +CONFIG_OVERLAY_FS_XINO_AUTO=y +CONFIG_OVERLAY_FS_METACOPY=y +CONFIG_TMPFS=y +CONFIG_TMPFS_XATTR=y +CONFIG_HUGETLBFS=y +CONFIG_EROFS_FS=y +# CONFIG_EROFS_FS_POSIX_ACL is not set +# CONFIG_EROFS_FS_BACKED_BY_FILE is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y +CONFIG_KEYS=y +CONFIG_SECURITY=y +CONFIG_SECURITY_NETWORK=y +# CONFIG_INTEGRITY is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf" +CONFIG_INIT_STACK_NONE=y +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_CRC32C=y +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ANSI_CPRNG=y +CONFIG_CRYPTO_USER_API_HASH=y +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set +CONFIG_CRYPTO_AES_NI_INTEL=y +# CONFIG_CRYPTO_HW is not set +CONFIG_XZ_DEC=y +CONFIG_PRINTK_TIME=y +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=4 +# CONFIG_SYMBOLIC_ERRNAME is not set +CONFIG_DEBUG_FS=y +# CONFIG_RUNTIME_TESTING_MENU is not set diff --git a/linux_kernel/generic/defconfig-arm64 b/linux_kernel/generic/defconfig-arm64 new file mode 100644 index 0000000..33bde95 --- /dev/null +++ b/linux_kernel/generic/defconfig-arm64 @@ -0,0 +1,367 @@ +# KVER=6.18.57 +CONFIG_LOCALVERSION="-urunc" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_SYSVIPC=y +CONFIG_POSIX_MQUEUE=y +# CONFIG_CROSS_MEMORY_ATTACH is not set +CONFIG_NO_HZ_FULL=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y +CONFIG_BPF_SYSCALL=y +# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TASK_XACCT=y +CONFIG_TASK_IO_ACCOUNTING=y +CONFIG_PSI=y +CONFIG_PSI_DEFAULT_DISABLED=y +CONFIG_CGROUPS=y +CONFIG_MEMCG=y +CONFIG_BLK_CGROUP=y +CONFIG_CGROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_BPF=y +CONFIG_NAMESPACES=y +CONFIG_USER_NS=y +CONFIG_BLK_DEV_INITRD=y +# CONFIG_RD_GZIP is not set +# CONFIG_RD_BZIP2 is not set +# CONFIG_RD_LZMA is not set +# CONFIG_RD_XZ is not set +# CONFIG_RD_LZO is not set +# CONFIG_RD_LZ4 is not set +# CONFIG_RD_ZSTD is not set +# CONFIG_INITRAMFS_PRESERVE_MTIME is not set +CONFIG_SYSFS_SYSCALL=y +CONFIG_EXPERT=y +# CONFIG_AMPERE_ERRATUM_AC03_CPU_38 is not set +# CONFIG_ARM64_ERRATUM_1319367 is not set +# CONFIG_ARM64_ERRATUM_1530923 is not set +CONFIG_ARM64_ERRATUM_1286807=y +# CONFIG_ARM64_ERRATUM_1508412 is not set +# CONFIG_ARM64_ERRATUM_2051678 is not set +# CONFIG_ARM64_ERRATUM_2077057 is not set +# CONFIG_ARM64_ERRATUM_2658417 is not set +# CONFIG_ARM64_ERRATUM_2054223 is not set +# CONFIG_ARM64_ERRATUM_2067961 is not set +# CONFIG_ARM64_ERRATUM_2645198 is not set +# CONFIG_ARM64_ERRATUM_2966298 is not set +# CONFIG_ARM64_ERRATUM_3117295 is not set +# CONFIG_ARM64_ERRATUM_3194386 is not set +# CONFIG_CAVIUM_ERRATUM_22375 is not set +# CONFIG_CAVIUM_ERRATUM_23154 is not set +# CONFIG_CAVIUM_ERRATUM_27456 is not set +# CONFIG_CAVIUM_ERRATUM_30115 is not set +# CONFIG_CAVIUM_TX2_ERRATUM_219 is not set +# CONFIG_FUJITSU_ERRATUM_010001 is not set +# CONFIG_HISILICON_ERRATUM_161600802 is not set +# CONFIG_HISILICON_ERRATUM_162100801 is not set +# CONFIG_QCOM_FALKOR_ERRATUM_1003 is not set +# CONFIG_QCOM_FALKOR_ERRATUM_1009 is not set +# CONFIG_QCOM_QDF2400_ERRATUM_0065 is not set +# CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set +# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set +# CONFIG_ROCKCHIP_ERRATUM_3588001 is not set +# CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set +CONFIG_ARM64_VA_BITS_48=y +CONFIG_NR_CPUS=255 +CONFIG_PARAVIRT=y +# CONFIG_ARM64_TAGGED_ADDR_ABI is not set +# CONFIG_ARM64_USE_LSE_ATOMICS is not set +# CONFIG_ARM64_PTR_AUTH is not set +# CONFIG_ARM64_AMU_EXTN is not set +# CONFIG_ARM64_TLB_RANGE is not set +# CONFIG_ARM64_BTI is not set +# CONFIG_ARM64_E0PD is not set +# CONFIG_ARM64_EPAN is not set +# CONFIG_ARM64_POE is not set +CONFIG_ARM64_PSEUDO_NMI=y +CONFIG_RANDOMIZE_BASE=y +# CONFIG_RANDOMIZE_MODULE_REGION_FULL is not set +# CONFIG_EFI is not set +# CONFIG_SUSPEND is not set +CONFIG_CPU_IDLE=y +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y +# CONFIG_SCHED_CLUSTER is not set +# CONFIG_BLOCK_LEGACY_AUTOLOAD is not set +CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_DEBUG_FS is not set +# CONFIG_MQ_IOSCHED_DEADLINE is not set +# CONFIG_MQ_IOSCHED_KYBER is not set +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +# CONFIG_SLAB_MERGE_DEFAULT is not set +# CONFIG_SLUB_CPU_PARTIAL is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_PAGE_REPORTING=y +CONFIG_LRU_GEN=y +CONFIG_NET=y +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_UNIX=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_INET=y +CONFIG_IP_MULTICAST=y +CONFIG_IP_PNP=y +CONFIG_IP_PNP_DHCP=y +# CONFIG_INET_DIAG is not set +CONFIG_TCP_CONG_ADVANCED=y +# CONFIG_TCP_CONG_BIC is not set +# CONFIG_TCP_CONG_CUBIC is not set +# CONFIG_TCP_CONG_WESTWOOD is not set +# CONFIG_TCP_CONG_HTCP is not set +CONFIG_TCP_CONG_BBR=y +CONFIG_TCP_MD5SIG=y +# CONFIG_IPV6_SIT is not set +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_NETWORK_SECMARK=y +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_EGRESS is not set +CONFIG_NF_CONNTRACK=y +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_AMANDA=y +CONFIG_NF_CONNTRACK_FTP=y +CONFIG_NF_CONNTRACK_H323=y +CONFIG_NF_CONNTRACK_IRC=y +CONFIG_NF_CONNTRACK_NETBIOS_NS=y +CONFIG_NF_CONNTRACK_SNMP=y +CONFIG_NF_CONNTRACK_PPTP=y +CONFIG_NF_CONNTRACK_SANE=y +CONFIG_NF_CONNTRACK_SIP=y +CONFIG_NF_CONNTRACK_TFTP=y +CONFIG_NF_CT_NETLINK=y +CONFIG_NF_CT_NETLINK_TIMEOUT=y +CONFIG_NF_CT_NETLINK_HELPER=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NF_NAT=y +CONFIG_NETFILTER_XT_SET=y +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_HMARK=y +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_NAT=y +CONFIG_NETFILTER_XT_TARGET_NETMAP=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_REDIRECT=y +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y +CONFIG_NETFILTER_XT_TARGET_TEE=y +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_BPF=y +CONFIG_NETFILTER_XT_MATCH_CGROUP=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +CONFIG_NETFILTER_XT_MATCH_CPU=y +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_IPCOMP=y +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y +CONFIG_NETFILTER_XT_MATCH_IPVS=y +CONFIG_NETFILTER_XT_MATCH_L2TP=y +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +CONFIG_NETFILTER_XT_MATCH_NFACCT=y +CONFIG_NETFILTER_XT_MATCH_OSF=y +CONFIG_NETFILTER_XT_MATCH_OWNER=y +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +CONFIG_NETFILTER_XT_MATCH_RATEEST=y +CONFIG_NETFILTER_XT_MATCH_REALM=y +CONFIG_NETFILTER_XT_MATCH_RECENT=y +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_TIME=y +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +CONFIG_IP_SET_HASH_IPMARK=y +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +CONFIG_IP_SET_HASH_MAC=y +CONFIG_IP_SET_HASH_NETPORTNET=y +CONFIG_IP_SET_HASH_NET=y +CONFIG_IP_SET_HASH_NETNET=y +CONFIG_IP_SET_HASH_NETPORT=y +CONFIG_IP_SET_HASH_NETIFACE=y +CONFIG_IP_SET_LIST_SET=y +CONFIG_IP_VS=y +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_SCTP=y +CONFIG_IP_VS_RR=y +CONFIG_IP_VS_WRR=y +CONFIG_IP_VS_LC=y +CONFIG_IP_VS_WLC=y +CONFIG_IP_VS_FO=y +CONFIG_IP_VS_OVF=y +CONFIG_IP_VS_LBLC=y +CONFIG_IP_VS_LBLCR=y +CONFIG_IP_VS_DH=y +CONFIG_IP_VS_SH=y +CONFIG_IP_VS_SED=y +CONFIG_IP_VS_NQ=y +CONFIG_IP_VS_FTP=y +CONFIG_IP_VS_PE_SIP=y +CONFIG_NF_TPROXY_IPV4=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_REJECT_IPV4=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_TARGET_SYNPROXY=y +CONFIG_NF_DUP_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_NET_SCHED=y +CONFIG_NET_SCH_MULTIQ=y +CONFIG_NET_SCH_FQ_CODEL=y +CONFIG_NET_SCH_FQ=y +CONFIG_NET_CLS_CGROUP=y +CONFIG_NET_EMATCH=y +CONFIG_VSOCKETS=y +# CONFIG_VSOCKETS_DIAG is not set +# CONFIG_VSOCKETS_LOOPBACK is not set +CONFIG_VIRTIO_VSOCKETS=y +# CONFIG_PCPU_DEV_REFCNT is not set +CONFIG_CGROUP_NET_PRIO=y +# CONFIG_WIRELESS is not set +CONFIG_NET_9P=y +# CONFIG_NET_9P_FD is not set +CONFIG_NET_9P_VIRTIO=y +# CONFIG_ETHTOOL_NETLINK is not set +CONFIG_PCI=y +CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI=y +CONFIG_PCI_HOST_GENERIC=y +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_STANDALONE is not set +# CONFIG_PREVENT_FIRMWARE_BUILD is not set +# CONFIG_ARM_SMCCC_SOC_ID is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_RAM=y +CONFIG_VIRTIO_BLK=y +CONFIG_NETDEVICES=y +CONFIG_TUN=y +CONFIG_VETH=y +CONFIG_VIRTIO_NET=y +# CONFIG_ETHERNET is not set +# CONFIG_WLAN is not set +# CONFIG_INPUT_KEYBOARD is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_SERIO is not set +# CONFIG_LEGACY_PTYS is not set +# CONFIG_LEGACY_TIOCSTI is not set +# CONFIG_LDISC_AUTOLOAD is not set +CONFIG_SERIAL_8250=y +# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set +# CONFIG_SERIAL_8250_16550A_VARIANTS is not set +CONFIG_SERIAL_8250_CONSOLE=y +# CONFIG_SERIAL_8250_EXAR is not set +# CONFIG_SERIAL_8250_PERICOM is not set +CONFIG_SERIAL_OF_PLATFORM=y +CONFIG_SERIAL_AMBA_PL011=y +CONFIG_SERIAL_AMBA_PL011_CONSOLE=y +CONFIG_VIRTIO_CONSOLE=y +CONFIG_HW_RANDOM_VIRTIO=y +# CONFIG_HW_RANDOM_ARM_SMCCC_TRNG is not set +# CONFIG_DEVMEM is not set +# CONFIG_DEVPORT is not set +# CONFIG_HWMON is not set +# CONFIG_HID_SUPPORT is not set +# CONFIG_USB_SUPPORT is not set +CONFIG_RTC_CLASS=y +# CONFIG_RTC_NVMEM is not set +CONFIG_RTC_DRV_PL031=y +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +# CONFIG_VHOST_MENU is not set +# CONFIG_SURFACE_PLATFORMS is not set +# CONFIG_ARM64_PLATFORM_DEVICES is not set +# CONFIG_ARM_ARCH_TIMER_EVTSTREAM is not set +# CONFIG_FSL_ERRATUM_A008585 is not set +# CONFIG_HISILICON_ERRATUM_161010101 is not set +# CONFIG_ARM64_ERRATUM_858921 is not set +# CONFIG_IOMMU_SUPPORT is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_EXPORTFS_BLOCK_OPS=y +CONFIG_AUTOFS_FS=y +CONFIG_FUSE_FS=y +CONFIG_VIRTIO_FS=y +# CONFIG_FUSE_PASSTHROUGH is not set +CONFIG_OVERLAY_FS=y +# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set +CONFIG_OVERLAY_FS_INDEX=y +CONFIG_OVERLAY_FS_XINO_AUTO=y +CONFIG_OVERLAY_FS_METACOPY=y +CONFIG_TMPFS=y +CONFIG_TMPFS_XATTR=y +CONFIG_HUGETLBFS=y +CONFIG_EROFS_FS=y +# CONFIG_EROFS_FS_POSIX_ACL is not set +# CONFIG_EROFS_FS_BACKED_BY_FILE is not set +CONFIG_9P_FS=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y +CONFIG_KEYS=y +CONFIG_SECURITY=y +CONFIG_SECURITY_NETWORK=y +# CONFIG_INTEGRITY is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf" +CONFIG_INIT_STACK_NONE=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_CRC32C=y +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_ANSI_CPRNG=y +CONFIG_CRYPTO_USER_API_HASH=y +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set +CONFIG_CRYPTO_AES_ARM64=y +CONFIG_CRYPTO_AES_ARM64_CE=y +# CONFIG_CRYPTO_HW is not set +CONFIG_PRINTK_TIME=y +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=4 +# CONFIG_SYMBOLIC_ERRNAME is not set +# CONFIG_DEBUG_BUGVERBOSE is not set +# CONFIG_DEBUG_MISC is not set +CONFIG_DEBUG_FS=y +# CONFIG_RCU_TRACE is not set +# CONFIG_FTRACE is not set +# CONFIG_RUNTIME_TESTING_MENU is not set