board configs: disable unprivileged BPF #9082
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
neheb
requested review from
AGM1968,
ColorfulRhino,
HeyMeco,
JohnTheCoolingFan,
PanderMusubi,
SuperKali,
TheSnowfield,
Tonymac32,
ahoneybun,
amazingfate,
brentr,
catalinii,
chainsx,
chraac,
efectn,
ginkage,
igorpecovnik,
janprunk,
joekhoobyar,
krachlatte,
lanefu,
leggewie,
paolosabatino,
prahal,
pyavitz,
rpardini,
schwar3kat,
sgjava,
teknoid and
vidplace7
as code owners
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (4)
config/kernel/linux-sunxi-current.config (1)
8-11: Sunxi: BPF_UNPRIV_DEFAULT_OFF addition matches the cross‑family policyEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=yis consistent with the other defconfigs in this PR and with the stated objective to have unprivileged eBPF off by default on ARM32 as well.Process/automation considerations for these config changes are already covered in the comment on
linux-mvebu64-current.config.config/kernel/linux-odroidxu4-current.config (1)
7-11: Odroid XU4: consistent BPF_UNPRIV_DEFAULT_OFF enablementThis mirrors the other families by pairing
CONFIG_BPF_SYSCALL=y/CONFIG_BPF_JIT=ywithCONFIG_BPF_UNPRIV_DEFAULT_OFF=y, so the unprivileged eBPF default is uniform on this SoC too.Automation vs manual‑edit guidance for kernel configs is already noted in the first file’s comment.
config/kernel/linux-mvebu-edge.config (1)
8-12: mvebu edge: align edge/current with BPF_UNPRIV_DEFAULT_OFF=ySetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere keeps the edge mvebu kernel in sync with the current variant and with the repository‑wide policy established in this PR.The note about generating these config deltas via the standard rewrite tooling instead of manual edits is already given on
linux-mvebu64-current.config.config/kernel/linux-rockchip-current.config (1)
11-11: Manual config edit is redundant (same issue as other config files).This manual addition follows the same pattern as the other config files in this PR. As explained in the PR comments, the proper approach is to rely on the
armbian-kernel.shchange and regenerate configs automatically viarewrite-kernel-config, rather than manually editing config files with sed.Based on learnings about Armbian's automated kernel config generation process.
🧹 Nitpick comments (1)
config/kernel/linux-virtual-current.config (1)
90-103: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y matches the PR goal; just ensure it’s driven via the central config machineryEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the intent to have unprivileged eBPF disabled by default while keeping BPF/JIT available for privileged users, and should help avoid the misleading Spectre v2 “Unprivileged eBPF enabled” status on this kernel.Given these
.configfiles are auto-generated overlays, please double‑check that:
lib/functions/compilation/armbian-kernel.sh(e.g.armbian_kernel_config__600_enable_ebpf_and_btf_info) is also settingBPF_UNPRIV_DEFAULT_OFF, andrewrite-kernel-confighas been run so this file reflects the scripted change rather than a one‑off manual edit.That keeps this setting stable across future config rewrites and avoids drift.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (21)
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-imx6-legacy.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-imx6-edge.config
- config/kernel/linux-mvebu-legacy.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-bcm2711-legacy.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-sunxi-legacy.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-thead-legacy.config
🧰 Additional context used
🧠 Learnings (20)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-22T21:59:36.334Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:200-200
Timestamp: 2025-09-22T21:59:36.334Z
Learning: Functions named with the pattern `armbian_kernel_config__*` in lib/functions/compilation/armbian-kernel.sh are automatically discovered and invoked by Armbian's extension system via metaprogramming using `compgen -A function`, without requiring explicit registration or calls.
Applied to files:
lib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rk322x-current.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rockchip-current.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-rockchip-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-virtual-current.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-current.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-meson64-edge.config
🔇 Additional comments (6)
config/kernel/linux-mvebu64-current.config (1)
9-12: CONFIG_BPF_UNPRIV_DEFAULT_OFF placement is correctThis aligns with the PR goal of disabling unprivileged eBPF by default while keeping BPF enabled for privileged use. The change is consistently applied across all 37 kernel config families in the codebase, confirming it came from the automated
rewrite-kernel-configworkflow rather than manual editing.config/kernel/linux-meson64-current.config (1)
10-10: LGTM! Security configuration correctly applied.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly disables unprivileged BPF by default, which resolves the incorrect CPU vulnerability output mentioned in the PR description. The placement alongside other BPF-related options (afterCONFIG_BPF_JIT=y) is logical and consistent.Based on the PR comments and AI summary, this PR follows the recommended approach of updating both
lib/functions/compilation/armbian-kernel.sh(for future config generation) and existing config files (for immediate deployment), which ensures consistency across all platforms.config/kernel/linux-sunxi64-current.config (1)
9-9: LGTM! Consistent security configuration.The
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ysetting is correctly applied, consistent with other platform configurations in this PR. This ensures unprivileged BPF is disabled by default on sunxi64 platforms.config/kernel/linux-rk322x-current.config (1)
95-107: BPF_UNPRIV_DEFAULT_OFF correctly enabled for rk322xSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent withCONFIG_BPF=yandCONFIG_BPF_JIT=y, and achieves the PR’s goal of default‑disabling unprivileged BPF on this kernel family. No conflicts or regressions are apparent.config/kernel/linux-mvebu-current.config (1)
6-15: Unprivileged BPF default‑off enabled for mvebu as intendedAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ybesideCONFIG_BPF_JIT=ycleanly applies the “unprivileged eBPF disabled by default” policy to the mvebu defconfig and is consistent with the rest of the networking/BPF setup.lib/functions/compilation/armbian-kernel.sh (1)
123-123: LGTM! This is the correct approach.Adding
BPF_UNPRIV_DEFAULT_OFFto the opts_y array in the eBPF/BTF configuration function is the proper way to enable this option across all Armbian kernel configs. This change will automatically apply the setting when kernel configs are regenerated through the automated process.The placement alongside other BPF-related options is appropriate, and this single change should eliminate the need for manual edits to individual config files.
Based on learnings about Armbian's kernel config automation and the PR discussion recommendation.
Collaborator
looks reasonable, but again have you tried running |
Contributor
Author
|
looks to be from 5.16. So it looks like these configs are holdovers from before then. |
Collaborator
|
We run a massive |
Contributor
Author
|
After some configuration (my repo was still on master), I started https://github.com/neheb/build/actions/runs/20253971351 |
Contributor
Author
|
Rebased. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
lib/functions/compilation/armbian-kernel.sh (1)
100-127: Consider enabling BPF_UNPRIV_DEFAULT_OFF unconditionally for consistent security posture.
BPF_UNPRIV_DEFAULT_OFFis currently only enabled whenKERNEL_BTF != "no"(line 123). However, this is a security hardening option independent of BTF debug information:
- BPF_UNPRIV_DEFAULT_OFF: Controls whether unprivileged users can create BPF programs (security)
- KERNEL_BTF: Controls debug information for eBPF programs (debugging/observability)
When users set
KERNEL_BTF=no(e.g., on low-memory systems per lines 111-116), the security hardening is skipped, leaving unprivileged BPF enabled by default. This inconsistency means the Spectre v2 vulnerability fix mentioned in the PR description won't apply universally.🔎 Consider this approach to apply the security hardening unconditionally:
function armbian_kernel_config__600_enable_ebpf_and_btf_info() { + # Always disable unprivileged BPF for security hardening (independent of BTF) + opts_y+=("BPF_UNPRIV_DEFAULT_OFF") + if [[ "${KERNEL_BTF}" == "no" ]]; then # If user is explicit by passing "KERNEL_BTF=no", then actually disable all debug info. display_alert "Disabling eBPF and BTF info for kernel" "as requested by KERNEL_BTF=no" "info" opts_y+=("DEBUG_INFO_NONE") # Enable the "none" option opts_n+=("DEBUG_INFO" "DEBUG_INFO_DWARF5" "DEBUG_INFO_BTF" "DEBUG_INFO_BTF_MODULES") # BTF & CO-RE == off # We don't disable the eBPF options, as eBPF itself doesn't require BTF (debug info) and doesnt' consume as much memory during build as BTF debug info does. else declare -i available_physical_memory_mib available_physical_memory_mib=$(($(awk '/MemAvailable/ {print $2}' /proc/meminfo) / 1024)) # MiB display_alert "Considering available RAM for BTF build" "${available_physical_memory_mib} MiB" "info" if [[ ${available_physical_memory_mib} -lt 6451 ]]; then # If less than 6451 MiB of RAM is available, then exit with an error, telling the user to avoid pain and set KERNEL_BTF=no ... if [[ "${KERNEL_BTF}" == "yes" ]]; then # ... except if the user knows better, and has set KERNEL_BTF=yes, then we'll just warn. display_alert "Not enough RAM available (${available_physical_memory_mib}Mib) for BTF build" "but KERNEL_BTF=yes is set; enabling BTF" "warn" else exit_with_error "Not enough RAM available (${available_physical_memory_mib}Mib) for BTF build. Please set 'KERNEL_BTF=no' to avoid running out of memory during the kernel LD/BTF build step; or ignore this check by setting 'KERNEL_BTF=yes' -- that might put a lot of load on your swap disk, if any." fi fi display_alert "Enabling eBPF and BTF info" "for fully BTF & CO-RE enabled kernel" "info" opts_n+=("DEBUG_INFO_NONE") # Make sure the "none" option is disabled opts_y+=( "BPF_JIT" "BPF_JIT_DEFAULT_ON" "FTRACE_SYSCALLS" "PROBE_EVENTS_BTF_ARGS" "BPF_KPROBE_OVERRIDE" # eBPF == on - "BPF_UNPRIV_DEFAULT_OFF" "DEBUG_INFO" "DEBUG_INFO_DWARF5" "DEBUG_INFO_BTF" "DEBUG_INFO_BTF_MODULES" # BTF & CO-RE == off ) fi }This ensures the security fix applies consistently regardless of memory constraints or BTF settings.
🧹 Nitpick comments (3)
config/kernel/linux-odroidxu4-current.config (1)
9-9: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here is semantically correct and aligns with the PR goalThis pairs correctly with existing
CONFIG_BPF_SYSCALL/CONFIG_BPF_JITand will default‑disable unprivileged eBPF on odroidxu4. If this PR also wiresBPF_UNPRIV_DEFAULT_OFFintoarmbian-kernel.sh(as discussed in the thread), futurerewrite-kernel-configruns should regenerate the same line, so this explicit edit is fine but somewhat redundant; relying on the scripted helper plus rewrite to touch all configs would keep churn lower.config/kernel/linux-bcm2711-legacy.config (1)
10-10: Consistent enablement of CONFIG_BPF_UNPRIV_DEFAULT_OFF for bcm2711 legacySetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere matches the other bcm2711 variants and correctly default‑disables unprivileged eBPF. Given the automated Armbian flow (armbian-kernel.sh → rewrite-kernel-config), you can optionally rely on the helper function alone and let the rewrite job regenerate this line, to avoid having to touch each family config manually next time.config/kernel/linux-imx6-current.config (1)
12-12: Correctly default‑disables unprivileged eBPF for imx6-current
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yfits with the existing BPF JIT settings and aligns this family with the PR’s cross‑arch policy. Assuming the option is also driven viaarmbian-kernel.sh, futurerewrite-kernel-configruns should keep this line stable; using the script as the primary source and letting the rewrite workflow update configs will help avoid manual per‑file edits next time.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (25)
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-sunxi-current.config
- config/kernel/linux-mvebu-edge.config
- config/kernel/linux-mvebu64-current.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-imx6-legacy.config
- config/kernel/linux-imx6-edge.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-rk322x-current.config
- config/kernel/linux-sunxi-legacy.config
- config/kernel/linux-mvebu-current.config
- config/kernel/linux-sunxi64-current.config
- config/kernel/linux-thead-legacy.config
- config/kernel/linux-meson64-edge.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-sunxi-edge.config
🧰 Additional context used
🧠 Learnings (22)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:01.143Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.274Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-imx6-current.configconfig/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-edge.configlib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu64-edge.configconfig/kernel/linux-rk35xx-vendor.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-edge.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rockchip-rk3588-edge.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-08-11T22:00:13.411Z
Learnt from: rafayahmed317
Repo: armbian/build PR: 8484
File: config/kernel/linux-rk35xx-vendor.config:904-906
Timestamp: 2025-08-11T22:00:13.411Z
Learning: In the linux-rk35xx-vendor kernel, the LTE driver options (CONFIG_LTE, CONFIG_LTE_RM310, CONFIG_LTE_EM05) are defined as boolean in drivers/net/lte/Kconfig and cannot be built as modules - they must be either built-in (=y) or disabled.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-14T06:29:18.958Z
Learnt from: amazingfate
Repo: armbian/build PR: 8619
File: config/sources/families/rockchip.conf:64-70
Timestamp: 2025-09-14T06:29:18.958Z
Learning: In the Armbian build system, vendor branch configurations in family files are designed to be shared across multiple SoCs within the same family that use the same vendor kernel tree. For example, rk35xx and rockchip-rk3588 families both use identical vendor branch settings (same KERNELSOURCE, KERNELBRANCH, and KERNELPATCHDIR), demonstrating that vendor branches are intentionally generic rather than SoC-specific.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu-legacy.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-mvebu-legacy.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-odroidxu4-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu-legacy.configlib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-10-26T10:41:35.118Z
Learnt from: HackingGate
Repo: armbian/build PR: 8665
File: config/boards/photonicat2.csc:4-4
Timestamp: 2025-10-26T10:41:35.118Z
Learning: In the Armbian build system, rk3576 boards consistently use BOARDFAMILY="rk35xx" for both vendor and edge kernel targets. The rk35xx family configuration sources rockchip64_common.inc, which provides edge and current kernel branch definitions, making these branches available even though they're not defined directly in rk35xx.conf.
Applied to files:
config/kernel/linux-rockchip-rk3588-edge.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-22T21:59:36.334Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:200-200
Timestamp: 2025-09-22T21:59:36.334Z
Learning: Functions named with the pattern `armbian_kernel_config__*` in lib/functions/compilation/armbian-kernel.sh are automatically discovered and invoked by Armbian's extension system via metaprogramming using `compgen -A function`, without requiring explicit registration or calls.
Applied to files:
lib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-odroidxu4-current.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
lib/functions/compilation/armbian-kernel.sh
🔇 Additional comments (4)
config/kernel/linux-rockchip-rk3588-edge.config (1)
92-106: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFhere is correct and aligned with the PR goalThis makes unprivileged eBPF disabled by default on rk3588-edge while keeping BPF/JIT available for privileged users, and aligns this defconfig with the rest of the arches updated in the PR. I don’t see conflicts in the surrounding BPF settings; assuming the
armbian-kernel.shhelper was updated as discussed so rewrite-kernel-config reproduces this, this change looks good to keep.If you haven’t already, it’s worth running the kernel-config rewrite workflow (or
./lib/tools/rewrite-kernel-config) once to confirm this line is preserved/generated rather than being a one-off manual edit.config/kernel/linux-mvebu64-edge.config (1)
8-12: Enable unprivileged BPF default‑off on mvebu64 edge is appropriatePlacing
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF_SYSCALL/CONFIG_BPF_JITcleanly enforces “no unprivileged BPF by default” while preserving privileged BPF functionality, which matches the PR’s stated goal and Armbian’s overlay-config workflow. Based on learnings, this looks correct and low‑risk.config/kernel/linux-mvebu-legacy.config (1)
94-105: Consistent unprivileged BPF default‑off across mvebu legacy configAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere mirrors the 64‑bit edge/current configs and ensures legacy mvebu kernels also default to unprivileged BPF disabled, aligning with the vulnerability-mitigation intent without introducing conflicting options. Based on learnings, this is a sensible, consistent configuration.config/kernel/linux-rk35xx-vendor.config (1)
10-10: LGTM! Config file correctly reflects the script change.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yaligns with the PR objective to disable unprivileged BPF and fix the Spectre v2 vulnerability output. Based on learnings, this config file appears to be properly auto-generated after modifyinglib/functions/compilation/armbian-kernel.sh.
Contributor
Author
|
@EvilOlaf not sure I follow. if will override the changes here, how would it be fixed? |
Member
|
Why should this override? |
Collaborator
|
My original question here was whether the automated machinery would elide the changed line altogether, as, being an overlay, if it would already by =y then it would be evaluated as redundant by savedefconfig.
|
Contributor
Author
|
https://github.com/neheb/build/actions/runs/20403772655 refuses to run |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
config/kernel/linux-mvebu-legacy.config (1)
94-105: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here is correct and aligned with the PR’s goalPlacing
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yalongsideCONFIG_BPF=y/CONFIG_BPF_SYSCALL=ycleanly enforces “unprivileged eBPF default-off” on this legacy mvebu kernel, which is exactly what the spectre_v2 reporting logic expects. No conflicting BPF options are present in this block, so the change is safe and behaviorally clear.If you later regenerate this autogen
.configviarewrite-kernel-config, just ensure the armbian-kernel.sh hook also sets this symbol so the change persists and you don’t see churn in this file. Based on learnings, these configs are overlays on top of arch defconfig and are periodically rewritten.config/kernel/linux-mvebu-current.config (1)
6-12: Defconfig overlay use of CONFIG_BPF_UNPRIV_DEFAULT_OFF=y looks goodSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yin this Armbian mvebu “current” defconfig cleanly enforces unprivileged-BPF default-off (while keepingCONFIG_BPF_JIT=yand privileged BPF intact), matching the PR’s objective and the legacy config behavior. As an overlay, this is the appropriate place to override the kernel’s default for this family; any future rewrite of defconfigs will either preserve or drop it as redundant without functional risk.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (22)
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-imx6-legacy.config
- lib/functions/compilation/armbian-kernel.sh
- config/kernel/linux-imx6-current.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-meson64-edge.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-mvebu64-current.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-sunxi-current.config
- config/kernel/linux-sunxi64-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
🧰 Additional context used
🧠 Learnings (20)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-imx6-edge.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
config/kernel/linux-rk322x-current.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-rk322x-current.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu-edge.configconfig/kernel/linux-mvebu64-legacy.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-odroidxu4-edge.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-08-11T22:00:13.411Z
Learnt from: rafayahmed317
Repo: armbian/build PR: 8484
File: config/kernel/linux-rk35xx-vendor.config:904-906
Timestamp: 2025-08-11T22:00:13.411Z
Learning: In the linux-rk35xx-vendor kernel, the LTE driver options (CONFIG_LTE, CONFIG_LTE_RM310, CONFIG_LTE_EM05) are defined as boolean in drivers/net/lte/Kconfig and cannot be built as modules - they must be either built-in (=y) or disabled.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
📚 Learning: 2025-11-08T06:39:24.527Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8886
File: patch/kernel/rk35xx-vendor-6.1/dt/rk3528-nanopi-rev01.dts:9-9
Timestamp: 2025-11-08T06:39:24.527Z
Learning: In Armbian's Rockchip vendor kernel branches (rk35xx-vendor), device tree files may not require the same headers as mainline Linux. For example, input key definitions like KEY_BACK and KEY_VOLUMEUP may be handled differently in BSP kernels and don't necessarily need explicit includes like <dt-bindings/input/input.h> that would be required in mainline kernel device trees.
Applied to files:
config/kernel/linux-rk35xx-vendor.config
🔇 Additional comments (8)
config/kernel/linux-mvebu64-legacy.config (1)
10-10: Verify implementation approach: config file edits may not persist.Based on the PR discussion and learnings about the Armbian build system, kernel configuration files in
config/kernel/are autogenerated overlays that are periodically rewritten by automated processes. Direct edits to these files may be overwritten during futurerewrite-kernel-configruns.Per the PR discussion (comments from tabrisnet and coderabbitai), the recommended approach is to add
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in thearmbian_kernel_config__600_enable_ebpf_and_btf_infofunction inlib/functions/compilation/armbian-kernel.sh. This ensures the configuration persists through the automated kernel config generation workflow: previous config → armbian-kernel.sh changes → make oldconfig → Armbian processing.Please confirm:
- Are changes to
lib/functions/compilation/armbian-kernel.shalso included in this PR but not visible in the current review files?- If only config file edits are being made, have you verified these changes will persist through the next automated rewrite?
Based on learnings about the Armbian build system's kernel configuration workflow.
config/kernel/linux-imx6-edge.config (1)
12-12: Config option correctly enabled; see implementation approach concern.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis correct and addresses the vulnerability warning issue described in the PR objectives. The placement is appropriate alongside other BPF-related configuration options.However, the same persistence concern raised for
linux-mvebu64-legacy.configapplies here regarding the automated kernel config generation workflow. Please ensure the implementation approach will maintain these changes across future automated rewrites.config/kernel/linux-thead-legacy.config (1)
182-182: Verification complete: armbian-kernel.sh properly updated.The concern about manual config file edits being overwritten is addressed. The PR correctly adds
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in thearmbian_kernel_config__600_enable_ebpf_and_btf_info()function (line 123 oflib/functions/compilation/armbian-kernel.sh), which is the proper approach. The config file entry will be auto-generated from this function during automated config regeneration, so the manual edit is consistent with Armbian's build system architecture.config/kernel/linux-rk322x-current.config (1)
95-107: CONFIG_BPF_UNPRIV_DEFAULT_OFF=y here correctly enforces unprivileged BPF off by defaultWith
CONFIG_BPF,CONFIG_BPF_SYSCALL, andCONFIG_BPF_JITalready enabled, settingCONFIG_BPF_UNPRIV_DEFAULT_OFF=yis the right way to make unprivileged eBPF default‑off on this RK322x kernel and aligns with the PR’s spectre_v2 mitigation goal. Note that this file is an autogenerated Armbian overlay; the canonical behavior should come from the updatedarmbian-kernel.sh, and futurerewrite-kernel-configruns may drop this explicit line if it becomes redundant. Based on learnings, Armbian kernel overlays are periodically regenerated.config/kernel/linux-mvebu-edge.config (1)
6-12: mvebu-edge: enabling CONFIG_BPF_UNPRIV_DEFAULT_OFF=y is consistent and desirableAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext toCONFIG_BPF_JIT=ygives mvebu-edge the same “unprivileged BPF default‑off” behavior as other families, matching the PR’s objective. Since this is an autogenerated Armbian defconfig overlay, ensure the correspondingarmbian-kernel.shlogic is treated as the canonical source and check after runningrewrite-kernel-configthat this setting is preserved (or made redundant) as expected. Based on learnings, these overlays are periodically regenerated.config/kernel/linux-bcm2711-legacy.config (1)
10-10: Configuration change is consistent across files.The change matches the pattern applied to other kernel configs in this PR. The placement after
CONFIG_BPF_JIT=yis appropriate and consistent with the BPF configuration grouping.Please see the verification request in the review of
linux-sunxi-legacy.configregarding the persistence of manual config file changes versus implementing this inarmbian-kernel.sh.config/kernel/linux-odroidxu4-edge.config (1)
9-9: Configuration change is consistent across kernel variants.The change is correctly placed in the BPF configuration section and follows the same pattern as other kernel configs in this PR. The syntax is correct and aligns with the security objective to disable unprivileged BPF by default.
Please refer to the verification request and discussion in the review of
linux-sunxi-legacy.configregarding the optimal approach for ensuring this change persists through Armbian's automated kernel configuration regeneration process.config/kernel/linux-sunxi-legacy.config (1)
9-9: Remove manual CONFIG_BPF_UNPRIV_DEFAULT_OFF additions from config files.
CONFIG_BPF_UNPRIV_DEFAULT_OFFis already being set vialib/functions/compilation/armbian-kernel.shin thearmbian_kernel_config__600_enable_ebpf_and_btf_info()function (line 123, within theopts_yarray). Manual additions of this option to kernel config files are redundant and will be overwritten during Armbian's automated config regeneration process.Remove
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yfrom all config files affected by this PR. The setting is already properly enforced through the automated tooling.⛔ Skipped due to learnings
Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-199 Timestamp: 2025-09-25T18:37:00.330Z Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-199 Timestamp: 2025-09-25T18:37:00.330Z Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.Learnt from: EvilOlaf Repo: armbian/build PR: 8428 File: config/boards/lckfb-taishanpi.csc:5-9 Timestamp: 2025-07-25T03:51:50.830Z Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.Learnt from: libiunc Repo: armbian/build PR: 8033 File: config/kernel/linux-starfive2-vendor.config:43-43 Timestamp: 2025-03-31T12:57:13.880Z Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.Learnt from: EvilOlaf Repo: armbian/build PR: 8428 File: config/boards/lckfb-taishanpi.csc:5-9 Timestamp: 2025-07-25T03:51:50.830Z Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.Learnt from: igorpecovnik Repo: armbian/build PR: 8849 File: config/boards/radxa-e54c.csc:14-28 Timestamp: 2025-11-02T20:49:56.719Z Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.Learnt from: tabrisnet Repo: armbian/build PR: 8678 File: config/kernel/linux-sunxi64-current.config:94-94 Timestamp: 2025-09-27T21:50:15.915Z Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.Learnt from: EvilOlaf Repo: armbian/build PR: 0 File: :0-0 Timestamp: 2025-12-19T13:56:45.124Z Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-201 Timestamp: 2025-09-22T21:52:01.225Z Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.Learnt from: tabrisnet Repo: armbian/build PR: 8661 File: lib/functions/compilation/armbian-kernel.sh:194-201 Timestamp: 2025-09-22T21:52:01.225Z Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.Learnt from: lanefu Repo: armbian/build PR: 8377 File: config/kernel/linux-uefi-arm64-cloud.config:165-170 Timestamp: 2025-07-19T00:03:42.995Z Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.Learnt from: pyavitz Repo: armbian/build PR: 8421 File: config/kernel/linux-sunxi64-edge.config:438-439 Timestamp: 2025-07-27T15:56:34.414Z Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.Learnt from: tabrisnet Repo: armbian/build PR: 0 File: :0-0 Timestamp: 2025-08-30T06:56:33.372Z Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
config/kernel/linux-mvebu64-current.config (1)
11-11: Consider centralizing this change in armbian-kernel.sh instead of editing config files directly.The change itself is correct and addresses the security posture issue. However, based on the PR discussion and Armbian's kernel config generation workflow, modifying
lib/functions/compilation/armbian-kernel.sh(functionarmbian_kernel_config__600_enable_ebpf_and_btf_info) would be the preferred approach:
- Config files in
config/kernel/are autogenerated overlays that can be overwritten by periodicrewrite-kernel-configjobs- Adding
BPF_UNPRIV_DEFAULT_OFFto theopts_yarray in the script ensures the change propagates to all generated configs- This reduces file churn and avoids potential conflicts during config regeneration
Based on learnings, Armbian kernel configuration files are overlays maintained through generation scripts, and manual edits may not persist.
Example implementation in armbian-kernel.sh
In
lib/functions/compilation/armbian-kernel.sh, within thearmbian_kernel_config__600_enable_ebpf_and_btf_infofunction, add:opts_y+=( "BPF_SYSCALL" # eBPF "BPF_JIT" + "BPF_UNPRIV_DEFAULT_OFF" # Disable unprivileged eBPF by default # ... other options )Then run
rewrite-kernel-configto regenerate all config files with this change applied consistently.lib/functions/compilation/armbian-kernel.sh (1)
119-125: Good: centralizingBPF_UNPRIV_DEFAULT_OFFin the eBPF/BTF helper.Adding
"BPF_UNPRIV_DEFAULT_OFF"toopts_yhere makes the unprivileged‑BPF default‑off behavior part of the scripted kernel config pipeline, so rewrite‑kernel‑config will preserve it. If you ever want this enforced even whenKERNEL_BTF="no", you could set it outside the BTF RAM check, but that’s an optional follow‑up rather than a blocker.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (33)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)lib/functions/compilation/armbian-kernel.sh(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (20)
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-sunxi64-legacy.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-mvebu-current.config
- config/kernel/linux-sunxi-legacy.config
- config/kernel/linux-mvebu64-edge.config
- config/kernel/linux-thead-legacy.config
- config/kernel/linux-imx6-legacy.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-mvebu-legacy.config
🧰 Additional context used
🧠 Learnings (33)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:48:09.091Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the user prefers flexible grep patterns over anchored ones for BTRFS configuration checks, but agrees to use quiet grep (-q) to avoid polluting build logs.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-rockchip64-current.configconfig/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-mvebu-edge.configlib/functions/compilation/armbian-kernel.sh
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-mvebu-edge.configconfig/kernel/linux-rockchip-edge.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-rk322x-current.configconfig/kernel/linux-bcm2711-legacy.config
📚 Learning: 2025-12-19T13:56:45.124Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-meson64-edge.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-legacy.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-sunxi64-current.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-sunxi64-current.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-sunxi-current.configconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-sunxi64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-edge.configconfig/kernel/linux-rockchip-edge.configlib/functions/compilation/armbian-kernel.shconfig/kernel/linux-bcm2711-legacy.configconfig/kernel/linux-imx6-edge.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi64-current.config
📚 Learning: 2025-11-20T18:20:11.985Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-03T11:42:46.660Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-04T17:59:19.369Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-01T02:34:37.451Z
Learnt from: tabrisnet
Repo: armbian/build PR: 9000
File: config/desktop/questing/environments/xfce/debian/postinst:17-18
Timestamp: 2025-12-01T02:34:37.451Z
Learning: In the Armbian build system shell scripts, the sed pattern with -i flag placed after the script argument (e.g., `sed "s/.../.../" -i file`) is intentional and correct. While non-POSIX, this GNU sed extension is used throughout the codebase and works correctly in the Armbian build environment. This pattern should not be flagged as incorrect.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-06-24T10:08:40.313Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T05:09:02.306Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-16T13:40:07.649Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T15:46:22.709Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 9096
File: patch/kernel/archive/sunxi-6.18/patches.armbian/arm64-dts-sun50i-h616-add-overlays.patch:4-5
Timestamp: 2025-12-17T15:46:22.709Z
Learning: In Armbian kernel patches, when patches are renamed or reorganized, the old Subject line may be intentionally preserved in the patch header (as a second Subject line) for archival/historical purposes to document the previous patch name. This is an Armbian-specific practice for tracking patch evolution and should not be flagged as an error when the maintainer has intentionally included it for documentation.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T22:20:48.475Z
Learnt from: rpardini
Repo: armbian/build PR: 8044
File: patch/u-boot/v2025.04/cmd-fileenv-read-string-from-file-into-env.patch:76-86
Timestamp: 2025-03-31T22:20:48.475Z
Learning: For the Armbian build project, maintaining consistency with existing patches across U-Boot versions (such as between 2025.01 and 2025.04) is prioritized over refactoring individual patches for code improvements.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-11-11T20:56:20.303Z
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi64-edge.configconfig/kernel/linux-sunxi-current.config
📚 Learning: 2025-10-26T10:41:35.118Z
Learnt from: HackingGate
Repo: armbian/build PR: 8665
File: config/boards/photonicat2.csc:4-4
Timestamp: 2025-10-26T10:41:35.118Z
Learning: In the Armbian build system, rk3576 boards consistently use BOARDFAMILY="rk35xx" for both vendor and edge kernel targets. The rk35xx family configuration sources rockchip64_common.inc, which provides edge and current kernel branch definitions, making these branches available even though they're not defined directly in rk35xx.conf.
Applied to files:
config/kernel/linux-rockchip-edge.config
📚 Learning: 2025-10-26T12:56:29.185Z
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Applied to files:
lib/functions/compilation/armbian-kernel.shconfig/kernel/linux-rk322x-current.config
📚 Learning: 2025-12-18T23:40:41.627Z
Learnt from: rpardini
Repo: armbian/build PR: 9101
File: lib/functions/image/compress-checksum.sh:44-48
Timestamp: 2025-12-18T23:40:41.627Z
Learning: In the Armbian build framework, scripts run with set -e, so a non-zero exit status will abort the script. During reviews, assume failures will stop execution unless explicitly handled. Verify that commands that must fail are checked, errors are propagated, and any critical steps have proper error handling (e.g., using pipefail where appropriate, checking exit codes, and not masking failures).
Applied to files:
lib/functions/compilation/armbian-kernel.sh
🔇 Additional comments (8)
config/kernel/linux-sunxi-current.config (1)
9-9: Remove manual config edit; BPF_UNPRIV_DEFAULT_OFF is already handled centrally.The security improvement is correct, but the manual config file edit is redundant. The
armbian_kernel_config__600_enable_ebpf_and_btf_infofunction already setsBPF_UNPRIV_DEFAULT_OFFin itsopts_yarray (line 123 of lib/functions/compilation/armbian-kernel.sh). This setting is applied automatically during kernel compilation, making the manual edit to the config file unnecessary.Remove this change from the config file and rely on the existing central function to apply the setting consistently across all configurations.
Likely an incorrect or invalid review comment.
config/kernel/linux-mvebu-edge.config (1)
9-12: Unprivileged BPF default-off correctly enabled for mvebuSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the existing BPF enablement and matches the PR goal of disabling unprivileged eBPF by default while preserving privileged BPF use. No conflicts apparent in this defconfig overlay.config/kernel/linux-rockchip64-current.config (1)
9-13: Rockchip64: BPF_UNPRIV_DEFAULT_OFF aligns with existing BPF stackWith
CONFIG_BPF_SYSCALL=y,CONFIG_BPF_JIT=yandCONFIG_BPF_LSM=yalready enabled, addingCONFIG_BPF_UNPRIV_DEFAULT_OFF=ygives the intended “BPF available but unprivileged disabled by default” behavior and should clean up the Spectre v2 vulnerability reporting. Looks coherent for this family.config/kernel/linux-imx6-edge.config (1)
10-14: i.MX6 edge: consistent unprivileged BPF default-offAdding
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ynext to the existing BPF JIT options consistently applies the “unprivileged BPF disabled by default” policy here as well, matching the other families and the PR’s security objective.config/kernel/linux-rk322x-current.config (1)
95-106: EnableCONFIG_BPF_UNPRIV_DEFAULT_OFFfor correct unprivileged eBPF stateSetting
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is consistent with the existing BPF settings and with the PR goal of having unprivileged eBPF disabled by default and properly reflected in the Spectre v2 vulnerability output. No issues spotted.config/kernel/linux-rockchip-edge.config (1)
8-12: Rockchip edge: unprivileged eBPF default‑off is correctly enabled
CONFIG_BPF_UNPRIV_DEFAULT_OFF=ycomplementsCONFIG_BPF_SYSCALL/CONFIG_BPF_JITand aligns this defconfig with the intended “unprivileged eBPF disabled by default” behavior and reporting. Looks good.config/kernel/linux-meson64-edge.config (1)
7-11: EnablingCONFIG_BPF_UNPRIV_DEFAULT_OFFhere is correct and consistent.Placed alongside the other BPF options, this ensures unprivileged BPF is default‑off for meson64 edge and matches the central armbian‑kernel.sh logic.
config/kernel/linux-sunxi64-edge.config (1)
7-9: Sunxi64 edge config correctly enablesCONFIG_BPF_UNPRIV_DEFAULT_OFF.The new line sits with the other BPF knobs and matches the intended “unprivileged BPF default‑off” behavior across ARM64 kernels.
Collaborator
|
Have you looked into running [a few sample jobs] manually on your machine?Each individual run shouldn't take more than a few minutes.
basically ./compile.sh rewrite-kernel-config BOARD=foo BRANCH=current
That's what the workflow does, but once for every board family.
The goal would, roughly, be to run for a sunxi64 board, a meson64 board & a rockchip64 board. See the results.
Did it elide the line?
Sent from myPhone.
|
Collaborator
|
I fetched/cherry-picked your commit de1f9ee, then did a rewrite for As I expected [ignore |
Contributor
|
Tip For best results, initiate chat on the files or code changes. @tabrisnet: Thank you for testing this! Your results confirm the overlay config behavior and reveal an important insight. What the test results mean: The fact that The original problem: The configs had explicit What this means for the PR: The current PR has two types of changes:
Recommended next steps: Since the
This approach:
@neheb: Would you like to run the full rewrite-kernel-config workflow, or should the maintainers handle that separately? The key fix (armbian-kernel.sh change) is already in place. 🧠 Learnings used |
Collaborator
|
Unlike the 🐰 suggestion, I'd say either revert the |
Contributor
Author
|
Deleted the line. |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
config/kernel/linux-sunxi64-current.config (1)
7-9: Align with generator workflow: remove explicitCONFIG_BPF_UNPRIV_DEFAULT_OFFfrom this overlayThis line achieves the desired mitigation, but
config/kernel/linux-sunxi64-current.configis a generated overlay. The agreed approach in this PR is to setCONFIG_BPF_UNPRIV_DEFAULT_OFFinarmbian-kernel.shand letrewrite-kernel-configregenerate overlays; leaving the explicit=yhere is redundant and will be dropped or rewritten later. Please rely on the central generator and keep this overlay minimal. Based on learnings, manual edits in these files tend not to persist.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
🧹 Nitpick comments (5)
config/kernel/linux-imx6-legacy.config (1)
98-111: Avoid persisting manual edits in autogenerated kernel configs
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis a valid choice here (it makes unprivileged eBPF disabled by default and matches the PR’s security goal), but this file is tagged “Automatically generated; DO NOT EDIT” and Armbian’s workflow rewrites these overlays from defconfig +armbian-kernel.sh. That rewrite will likely drop this line again if it matches the kernel default, causing pointless churn across many.configfiles.Prefer enforcing
BPF_UNPRIV_DEFAULT_OFFin the central kernel-config machinery (e.g.armbian_kernel_config__600_enable_ebpf_and_btf_infoinlib/functions/compilation/armbian-kernel.sh) and letrewrite-kernel-configregenerate overlays, rather than carrying this explicit=yin each overlay file. Once the central change is in place, this line can be safely removed and left to the rewrite job.
Based on learnings, manual edits to autogenerated overlays are discouraged and non-persistent.config/kernel/linux-sunxi64-legacy.config (1)
7-9: Avoid hard‑codingCONFIG_BPF_UNPRIV_DEFAULT_OFFin this autogenerated overlayThese
config/kernel/*.configfiles are generated overlays; explicit defaults likeCONFIG_BPF_UNPRIV_DEFAULT_OFF=ywill be elided byrewrite-kernel-configand cause churn. With the option handled centrally inlib/functions/compilation/armbian-kernel.sh, this line is redundant here and can be dropped so the overlay only captures deviations from the base defconfig. Based on learnings, Armbian prefers generator‑driven changes over manual edits in these files.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=yconfig/kernel/linux-mvebu-current.config (1)
9-10: Keep unprivileged BPF default‑off, but drive it fromarmbian-kernel.sh, not this overlayThe value
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yis correct for security, but this file is an autogenerated overlay. Per the Armbian workflow and previous discussion on this PR, the persistent source of truth should belib/functions/compilation/armbian-kernel.shplusrewrite-kernel-config; keeping the explicit line here is redundant and will be stripped or rewritten later. Consider dropping it and relying on the generator’s BPF section instead. Based on learnings, autogenerated overlays should stay minimal.Proposed cleanup
-CONFIG_BPF_UNPRIV_DEFAULT_OFF=yconfig/kernel/linux-mvebu-legacy.config (1)
94-105: Correct option, but prefer setting it viaarmbian-kernel.shinstead of this generated configEnabling
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere does achieve the desired security behavior (disabling unprivileged eBPF by default), but this file is an auto‑generated kernel config overlay and is subject torewrite-kernel-config. As discussed in the PR and past learnings, the preferred pattern is:
- Add
BPF_UNPRIV_DEFAULT_OFFto the appropriateopts_y+=()inlib/functions/compilation/armbian-kernel.sh(e.g. inarmbian_kernel_config__600_enable_ebpf_and_btf_info), and- Let the rewrite workflow regenerate overlays, omitting redundant lines if the option matches the kernel default.
Once the central script change is in place, this explicit line in the overlay can be dropped to avoid churn when rewrite-kernel-config runs. Based on learnings, Armbian kernel overlays should not be manually maintained where the generator can express the intent.
config/kernel/linux-sunxi-legacy.config (1)
8-12: Functionally good, but should rely on the central kernel-config generator rather than this overlay
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yhere is the correct knob to turn off unprivileged eBPF by default and addresses the reported vuln output. However, thislinux-sunxi-legacy.configfile is an autogenerated Armbian overlay; per the agreed PR direction and existing workflow, this option should be set vialib/functions/compilation/armbian-kernel.shand then propagated byrewrite-kernel-config, not by hand in the overlay.Once the generator is updated, consider removing this explicit line from the overlay so that future rewrite runs don’t drop it as redundant or reformat it, avoiding unnecessary config churn. Based on learnings, overlay configs should remain as thin deltas over the base defconfig.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (32)
config/kernel/linux-bcm2711-current.config(1 hunks)config/kernel/linux-bcm2711-edge.config(1 hunks)config/kernel/linux-bcm2711-legacy.config(1 hunks)config/kernel/linux-imx6-current.config(1 hunks)config/kernel/linux-imx6-edge.config(1 hunks)config/kernel/linux-imx6-legacy.config(1 hunks)config/kernel/linux-meson64-current.config(1 hunks)config/kernel/linux-meson64-edge.config(1 hunks)config/kernel/linux-mvebu-current.config(1 hunks)config/kernel/linux-mvebu-edge.config(1 hunks)config/kernel/linux-mvebu-legacy.config(1 hunks)config/kernel/linux-mvebu64-current.config(1 hunks)config/kernel/linux-mvebu64-edge.config(1 hunks)config/kernel/linux-mvebu64-legacy.config(1 hunks)config/kernel/linux-odroidxu4-current.config(1 hunks)config/kernel/linux-odroidxu4-edge.config(1 hunks)config/kernel/linux-rk322x-current.config(1 hunks)config/kernel/linux-rk322x-edge.config(1 hunks)config/kernel/linux-rk35xx-vendor.config(1 hunks)config/kernel/linux-rockchip-current.config(1 hunks)config/kernel/linux-rockchip-edge.config(1 hunks)config/kernel/linux-rockchip-rk3588-edge.config(1 hunks)config/kernel/linux-rockchip64-current.config(1 hunks)config/kernel/linux-rockchip64-edge.config(1 hunks)config/kernel/linux-sunxi-current.config(1 hunks)config/kernel/linux-sunxi-edge.config(1 hunks)config/kernel/linux-sunxi-legacy.config(1 hunks)config/kernel/linux-sunxi64-current.config(1 hunks)config/kernel/linux-sunxi64-edge.config(1 hunks)config/kernel/linux-sunxi64-legacy.config(1 hunks)config/kernel/linux-thead-legacy.config(1 hunks)config/kernel/linux-virtual-current.config(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (22)
- config/kernel/linux-rockchip-current.config
- config/kernel/linux-sunxi-edge.config
- config/kernel/linux-sunxi-current.config
- config/kernel/linux-rockchip64-edge.config
- config/kernel/linux-imx6-current.config
- config/kernel/linux-sunxi64-edge.config
- config/kernel/linux-bcm2711-edge.config
- config/kernel/linux-rockchip64-current.config
- config/kernel/linux-rockchip-rk3588-edge.config
- config/kernel/linux-odroidxu4-edge.config
- config/kernel/linux-bcm2711-current.config
- config/kernel/linux-mvebu64-legacy.config
- config/kernel/linux-rk322x-current.config
- config/kernel/linux-meson64-current.config
- config/kernel/linux-rk322x-edge.config
- config/kernel/linux-bcm2711-legacy.config
- config/kernel/linux-rockchip-edge.config
- config/kernel/linux-rk35xx-vendor.config
- config/kernel/linux-odroidxu4-current.config
- config/kernel/linux-virtual-current.config
- config/kernel/linux-mvebu-edge.config
- config/kernel/linux-mvebu64-edge.config
🧰 Additional context used
🧠 Learnings (32)
📓 Common learnings
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Learnt from: rpardini
Repo: armbian/build PR: 8820
File: config/sources/families/include/meson64_common.inc:51-53
Timestamp: 2025-10-26T12:56:29.185Z
Learning: In the Armbian build framework, scripts/config correctly handles kernel configuration option names both with and without the CONFIG_ prefix, so opts_m+=("CONFIG_RTL8822CS") and opts_m+=("RTL8822CS") are both valid and will work correctly.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
📚 Learning: 2025-08-30T04:13:16.457Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T04:13:16.457Z
Learning: Armbian kernel configuration files like linux-filogic-current.config are autogenerated overlays on top of arch defconfig. Comments added manually will be lost during future updates by maintainers, and explicit "CONFIG_OPTION is not set" statements aren't needed for mutually exclusive options since these are overlay configs that only specify changes from the base configuration.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-11-02T20:49:56.719Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8849
File: config/boards/radxa-e54c.csc:14-28
Timestamp: 2025-11-02T20:49:56.719Z
Learning: In Armbian board configuration files (config/boards/*.conf, *.csc, etc.), do not use kernel_config_set, kernel_config_set_m, kernel_config_set_y, or custom_kernel_config__* functions to modify kernel configuration. Kernel configuration is associated with LINUXFAMILY/BOARDFAMILY, not individual BOARD. Board-specific kernel modifications cause inconsistency in kernel packages published to the apt repository because boards within a family share the same kernel packages. Kernel configuration changes must be made in the appropriate kernel config file (e.g., config/kernel/linux-*-*.config) or in family configuration files (config/sources/families/*.conf, *.inc) instead.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:47:58.020Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-bcm2711-edge.config:859-861
Timestamp: 2025-09-27T21:47:58.020Z
Learning: In the Armbian build system, kernel configuration files in config/kernel/ are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: In lib/functions/compilation/armbian-kernel.sh, the kernel_config_modifying_hashes array is not universally required for all kernel configuration functions - some functions like armbian_kernel_config__netkit() operate without it, and adding entries with '=m' would be incorrect when the actual result might be '=y' for options already built-in.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-27T21:49:55.796Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-current.config:78-80
Timestamp: 2025-09-27T21:49:55.796Z
Learning: In the Armbian build system, kernel configuration files are generated through an automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-25T18:37:00.330Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:50:04.845Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sm8250-edge.config:80-82
Timestamp: 2025-09-27T21:50:04.845Z
Learning: In the Armbian build system, kernel configuration files are generated through this automated process: taking previous config → applying scripted changes from armbian-kernel.sh → running kernel's `make oldconfig` → processing by Armbian machinery back into config files. This automated process properly handles kernel configuration dependencies and reduces the likelihood of manual configuration errors.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T21:52:01.225Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-201
Timestamp: 2025-09-22T21:52:01.225Z
Learning: The kernel_config_set_m function in lib/functions/compilation/armbian-kernel.sh preserves existing 'y' (built-in) settings and only sets options to 'm' (module) when they are not already built-in, achieving "prefer modules but allow built-ins" behavior.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-10-22T07:56:19.424Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8789
File: config/kernel/linux-sunxi64-edge.config:839-839
Timestamp: 2025-10-22T07:56:19.424Z
Learning: In Linux kernel configuration, some `=y` (builtin) options are infrastructure or feature flags that enable subsystems or features for modular drivers, rather than directly compiling code into the kernel. For example, in Armbian wireless configs, options like CONFIG_SPARD_WLAN_SUPPORT=y, CONFIG_SC23XX=y, CONFIG_WCN_BSP_DRIVER_BUILDIN=y, CONFIG_UNISOC_WIFI_PS=y are module infrastructure/feature enablers, while the actual drivers (CONFIG_WLAN_UWE5621=m, CONFIG_WLAN_UWE5622=m) remain as loadable modules. These infrastructure options don't cause kernel bloat.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-27T15:56:34.414Z
Learnt from: pyavitz
Repo: armbian/build PR: 8421
File: config/kernel/linux-sunxi64-edge.config:438-439
Timestamp: 2025-07-27T15:56:34.414Z
Learning: CONFIG_NET_SCH_DEFAULT is a boolean kernel configuration option (=y or =n) that enables/disables the ability to override the default network queueing discipline at runtime. When set to 'y', it allows setting the actual qdisc name via /proc/sys/net/core/default_qdisc at runtime, not in the kernel config file itself.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi64-legacy.config
📚 Learning: 2025-08-30T06:56:33.372Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-30T06:56:33.372Z
Learning: In Armbian kernel configuration, the BTRFS configuration logic preserves existing settings (whether built-in 'y' or module 'm') and only sets BTRFS_FS to module when it was previously disabled or not set, achieving "allow but not require" flexibility while maintaining backward compatibility.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-thead-legacy.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-07-19T00:03:42.995Z
Learnt from: lanefu
Repo: armbian/build PR: 8377
File: config/kernel/linux-uefi-arm64-cloud.config:165-170
Timestamp: 2025-07-19T00:03:42.995Z
Learning: CONFIG_NETKIT was introduced in Linux kernel 4.14.330 (November 2023) and enables BPF-programmable network devices that can operate in Layer 3 or Layer 2 mode. It's a valid configuration option in modern kernels including 6.12.
Applied to files:
config/kernel/linux-mvebu64-current.configconfig/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-imx6-legacy.configconfig/kernel/linux-sunxi64-legacy.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-03-31T12:57:13.880Z
Learnt from: libiunc
Repo: armbian/build PR: 8033
File: config/kernel/linux-starfive2-vendor.config:43-43
Timestamp: 2025-03-31T12:57:13.880Z
Learning: For StarFive2 platform kernel configurations, maintain alignment with vendor-provided configurations rather than modifying security settings like SECCOMP. This ensures hardware compatibility as intended by the manufacturer.
Applied to files:
config/kernel/linux-thead-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-imx6-edge.configconfig/kernel/linux-mvebu-legacy.config
📚 Learning: 2025-09-27T21:50:15.915Z
Learnt from: tabrisnet
Repo: armbian/build PR: 8678
File: config/kernel/linux-sunxi64-current.config:94-94
Timestamp: 2025-09-27T21:50:15.915Z
Learning: When kernel config files are generated through Armbian's automated process (previous config → armbian-kernel.sh changes → make oldconfig → Armbian machinery processing), manual config file edits are not appropriate since they would be overwritten. Deprecated option handling should be implemented in the automated tooling instead.
Applied to files:
config/kernel/linux-mvebu-current.configconfig/kernel/linux-sunxi-legacy.configconfig/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.configconfig/kernel/linux-sunxi64-legacy.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the KERNEL_CONFIGURE=yes switch is deprecated. The recommended approach for kernel configuration is now to use the `kernel-config` build command, which provides a more structured way to configure kernel options.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-07-15T21:09:23.252Z
Learnt from: pyavitz
Repo: armbian/build PR: 8383
File: config/kernel/linux-sunxi64-edge.config:57-64
Timestamp: 2025-07-15T21:09:23.252Z
Learning: In Linux kernel configuration, when CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y is set, the ondemand governor is implicitly enabled by default, making the explicit CONFIG_CPU_FREQ_GOV_ONDEMAND=y line redundant. The make menuconfig tool automatically removes such redundant lines. This behavior applies to CPU frequency governor configurations in general - setting a default governor automatically enables that governor.
Applied to files:
config/kernel/linux-sunxi-legacy.config
📚 Learning: 2025-11-20T18:20:11.985Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-03T11:42:46.660Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:96-169
Timestamp: 2025-10-03T11:42:46.660Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), deletion of kernel config files does not need to be handled. The workflow intentionally only captures ACMR (added/copied/modified/renamed) changes and does not need to propagate deletions to the aggregator.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-10-04T17:59:19.369Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 8705
File: .github/workflows/rewrite-kernel-configs.yml:217-220
Timestamp: 2025-10-04T17:59:19.369Z
Learning: In the Armbian build repository's kernel config rewrite workflow (.github/workflows/rewrite-kernel-configs.yml), the workflow is designed to rewrite existing kernel configs only. New/untracked files can be safely ignored, so using `git diff --quiet` (which ignores untracked files) is the correct approach for detecting changes rather than `git status --porcelain`.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-01T02:34:37.451Z
Learnt from: tabrisnet
Repo: armbian/build PR: 9000
File: config/desktop/questing/environments/xfce/debian/postinst:17-18
Timestamp: 2025-12-01T02:34:37.451Z
Learning: In the Armbian build system shell scripts, the sed pattern with -i flag placed after the script argument (e.g., `sed "s/.../.../" -i file`) is intentional and correct. While non-POSIX, this GNU sed extension is used throughout the codebase and works correctly in the Armbian build environment. This pattern should not be flagged as incorrect.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-06-24T10:08:40.313Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8328
File: lib/functions/compilation/patch/drivers_network.sh:542-545
Timestamp: 2025-06-24T10:08:40.313Z
Learning: In the Armbian build system, when a PR removes build support for a specific kernel version, version check issues for that removed version become practically irrelevant even if they appear incorrect in isolation. Context about which kernel versions are being deprecated/removed is important for understanding the impact of version-related code changes.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-19T13:56:45.124Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.
Applied to files:
config/kernel/linux-meson64-edge.configconfig/kernel/linux-sunxi64-current.config
📚 Learning: 2025-12-17T05:09:02.306Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-17T05:09:02.306Z
Learning: In the Armbian build system, kernel patches (e.g., in patch/kernel/archive/sunxi-6.18/patches.armbian/) contain device tree overlays and other code that have existed for years and are maintained/ported across kernel versions. When reviewing PRs that modify these patch files, focus on the actual changes being made (e.g., Makefile fixes, new additions) rather than reviewing the entire existing content within the patch as if it were new code. The patch file contents are existing, stable code unless explicitly modified in the PR diff.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-07-25T03:51:50.830Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-16T13:40:07.649Z
Learnt from: igorpecovnik
Repo: armbian/build PR: 9087
File: .github/workflows/pr-check-pictures.yml:138-146
Timestamp: 2025-12-16T13:40:07.649Z
Learning: In the Armbian build repository, when introducing new requirements or checks (like the board assets verification workflow), the project prefers an initial educational-only period where violations post helpful PR comments and warnings but don't block merges. This allows contributors to become familiar with new requirements before enforcement is enabled (typically after ~6 months).
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-12-17T15:46:22.709Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 9096
File: patch/kernel/archive/sunxi-6.18/patches.armbian/arm64-dts-sun50i-h616-add-overlays.patch:4-5
Timestamp: 2025-12-17T15:46:22.709Z
Learning: In Armbian kernel patches, when patches are renamed or reorganized, the old Subject line may be intentionally preserved in the patch header (as a second Subject line) for archival/historical purposes to document the previous patch name. This is an Armbian-specific practice for tracking patch evolution and should not be flagged as an error when the maintainer has intentionally included it for documentation.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-03-31T22:20:48.475Z
Learnt from: rpardini
Repo: armbian/build PR: 8044
File: patch/u-boot/v2025.04/cmd-fileenv-read-string-from-file-into-env.patch:76-86
Timestamp: 2025-03-31T22:20:48.475Z
Learning: For the Armbian build project, maintaining consistency with existing patches across U-Boot versions (such as between 2025.01 and 2025.04) is prioritized over refactoring individual patches for code improvements.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-11-11T20:56:20.303Z
Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.
Applied to files:
config/kernel/linux-meson64-edge.config
📚 Learning: 2025-08-02T05:46:10.664Z
Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-08-02T05:46:10.664Z
Learning: In the Armbian build system, the modern recommended approach for kernel configuration is to use the kernel-config command via "./compile.sh BOARD=boardname BRANCH=branchname kernel-config" instead of the deprecated KERNEL_CONFIGURE=yes flag. This provides a two-step workflow: configure using menuconfig, then build, with better transparency and control over configuration changes.
Applied to files:
config/kernel/linux-sunxi64-current.config
📚 Learning: 2025-09-22T22:08:54.273Z
Learnt from: tabrisnet
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-09-22T22:08:54.273Z
Learning: When extracting comments from Linux Kconfig files, def_bool and def_tristate entries use their parameter as a dependency/default condition, not as a feature description. Comments should be generated differently for these entry types to avoid misleading inline documentation.
Applied to files:
config/kernel/linux-sunxi64-legacy.config
🔇 Additional comments (1)
config/kernel/linux-meson64-edge.config (1)
10-10: Technical change is correct.The addition of
CONFIG_BPF_UNPRIV_DEFAULT_OFF=yproperly addresses the PR objective to disable unprivileged BPF and fix the CPU vulnerability warning. The setting is placed logically within the BPF configuration group.As discussed in previous review comments, the workflow approach (manual config edits + armbian-kernel.sh change) has been accepted by the maintainer for immediate availability, despite being non-standard.
Collaborator
I didn't mean to remove it from |
github-actions
bot
added
size/small
Collaborator
|
ok, and bring back the |
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable:
Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the
warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' \;
Signed-off-by: Rosen Penev <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes wrong CPU vulnerability output:
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation:Vulnerable: Unprivileged eBPF enabled
It's enabled but CONFIG_BPF_UNPRIV_DEFAULT_OFF being unset causes the warning.
This warning happens on ARM32 and ARM64 devices.
Edited with:
find -name "*.config" -exec sed -i 's/# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set/CONFIG_BPF_UNPRIV_DEFAULT_OFF=y/g' '{}' ;
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.